General
-
Target
source_prepared.exe
-
Size
77.6MB
-
Sample
240731-1ep5eavakl
-
MD5
988ac06553e576c14a480d66a87eeb09
-
SHA1
8d5007a74403c703ccc2e34f32ccd54b61c2f494
-
SHA256
3baea76d784713cb246927d15a0bd19a73ffb64996d6a0f38163c9011fa4b126
-
SHA512
3dbe807df16d1a81fd096e0ab09d0f0b5ee822d405ac2a46dcc7d92fca5493aeaa7648bc5efecf31f87219eafd0abe238977bcec170838a0fb16911ef5c7a081
-
SSDEEP
1572864:avHcRlq9h7vXSk8IpG7V+VPhqWdfME7FFlHFziYweyJulZUdgAdW4sZuxa/Z9UN/:avHcRahTSkB05awqfhdCpukdR/s9U
Behavioral task
behavioral1
Sample
source_prepared.exe
Resource
win10v2004-20240730-en
Malware Config
Targets
-
-
Target
source_prepared.exe
-
Size
77.6MB
-
MD5
988ac06553e576c14a480d66a87eeb09
-
SHA1
8d5007a74403c703ccc2e34f32ccd54b61c2f494
-
SHA256
3baea76d784713cb246927d15a0bd19a73ffb64996d6a0f38163c9011fa4b126
-
SHA512
3dbe807df16d1a81fd096e0ab09d0f0b5ee822d405ac2a46dcc7d92fca5493aeaa7648bc5efecf31f87219eafd0abe238977bcec170838a0fb16911ef5c7a081
-
SSDEEP
1572864:avHcRlq9h7vXSk8IpG7V+VPhqWdfME7FFlHFziYweyJulZUdgAdW4sZuxa/Z9UN/:avHcRahTSkB05awqfhdCpukdR/s9U
Score9/10-
Enumerates VirtualBox DLL files
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
1Virtualization/Sandbox Evasion
1