Resubmissions

25-07-2024 21:35

240725-1fq34awdnn 10

General

  • Target

    setup.exe

  • Size

    81.6MB

  • Sample

    240725-1fq34awdnn

  • MD5

    c9d6e390aa33b6f852000b30d695f295

  • SHA1

    1013c7e9c9503106cdf0fd15cb3330240e5f423c

  • SHA256

    dbe1fccb35465c9bf863620b99119542a19a3bb2c89aaec50c7f98330dd1c751

  • SHA512

    9d30d231b95bca865ee994968a1510f309f8c0e0d57ab299f3b97d5ef637d5698c2065407384c52678d145676d66f40204eb108167ec7dd9ac9819b58af7183a

  • SSDEEP

    1572864:IvxZQglq3z7vaSk8IpG7V+VPhqCMNE7TlgHtqiYgj+h58sMw4Wd9C8mcJzR:IvxZxEjeSkB05awCMkeNE5UY9CYR

Malware Config

Targets

    • Target

      setup.exe

    • Size

      81.6MB

    • MD5

      c9d6e390aa33b6f852000b30d695f295

    • SHA1

      1013c7e9c9503106cdf0fd15cb3330240e5f423c

    • SHA256

      dbe1fccb35465c9bf863620b99119542a19a3bb2c89aaec50c7f98330dd1c751

    • SHA512

      9d30d231b95bca865ee994968a1510f309f8c0e0d57ab299f3b97d5ef637d5698c2065407384c52678d145676d66f40204eb108167ec7dd9ac9819b58af7183a

    • SSDEEP

      1572864:IvxZQglq3z7vaSk8IpG7V+VPhqCMNE7TlgHtqiYgj+h58sMw4Wd9C8mcJzR:IvxZxEjeSkB05awCMkeNE5UY9CYR

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks