Extracted

• • Target
    OpenIVSetup.exe
  • Size 24.9MB
  • SHA256 bb476bef066592e17b65ac5d12306ee55fc33065402bd3be3591cf5f04cdf6e6
  • MD5 2de8b986e82b6d5885f61b54f22a2d79
  • SHA1 19f6a7428964c7577e01b88a57498d26dd1a2d76
  • SHA512 de5bd5e7c4f416161359630597ff9568060e46aaefbf36a4123c36388af1308c978354d286af96d62cb4bd3248a9046cc46a49bd81067608b4a77656a42a0d30
  • SSDEEP 786432:tBpY3afltG5vPqVBz+XHHzmYgKSXu/a9MRKyOPVd:tRlt4vSV1+XHCzKSXu/j2
  • TLSH
    T19A471213F348A53AC07B1D3A487BD754583FBA316E22CC1B6BF4494C8F7A6405A3A65B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverypersistenceprivilege_escalationransomwaretrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral1behavioral2