General
- Target Installer-1.0.9.exe
- Size 9.8MB
- Sample260814-ysmkbsbg28
- SHA256 6c1bfdb571e85b8a1e0566f008f9eef8dab6baa4088a48d3b9c7ea9c7e9bfd9a
Score
10/10
Malware Config
Targets
-
- Target Installer-1.0.9.exe
- Size 9.8MB
- SHA256 6c1bfdb571e85b8a1e0566f008f9eef8dab6baa4088a48d3b9c7ea9c7e9bfd9a
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks whether UAC is enabled
-
Drops desktop.ini file(s)
-
Network Share Discovery
Attempt to gather information on host network.
-
Drops file in System32 directory