General
-
Target
source_prepared.exe
-
Size
78.6MB
-
Sample
240803-ffbm7aycne
-
MD5
38eb61249112add0ec3b309b833b6a81
-
SHA1
d955d6d746f4258c0f245b4435ef23fc703a1739
-
SHA256
9c09cefd985f22f9691a4acada5354281fb825acacdef30394287b652d1ba29b
-
SHA512
5f70dbd16c9809f79b97c7739c4de3a303b2ca3d0a5cfdc1a706ee479de0c8d88eeaec504ad35deebe5e1078a09f78456a219ecf761d812839248eb628dfbe28
-
SSDEEP
1572864:rvHcRlqoh7vXSk8IpG7V+VPhqWdfME7FFlHFziYweyJulZUdgAdW42kj5uxa/Z95:rvHcR1hTSkB05awqfhdCpukdR/Ms9U
Behavioral task
behavioral1
Sample
source_prepared.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
source_prepared.exe
Resource
win10v2004-20240802-en
Malware Config
Targets
-
-
Target
source_prepared.exe
-
Size
78.6MB
-
MD5
38eb61249112add0ec3b309b833b6a81
-
SHA1
d955d6d746f4258c0f245b4435ef23fc703a1739
-
SHA256
9c09cefd985f22f9691a4acada5354281fb825acacdef30394287b652d1ba29b
-
SHA512
5f70dbd16c9809f79b97c7739c4de3a303b2ca3d0a5cfdc1a706ee479de0c8d88eeaec504ad35deebe5e1078a09f78456a219ecf761d812839248eb628dfbe28
-
SSDEEP
1572864:rvHcRlqoh7vXSk8IpG7V+VPhqWdfME7FFlHFziYweyJulZUdgAdW42kj5uxa/Z95:rvHcR1hTSkB05awqfhdCpukdR/Ms9U
Score9/10-
Enumerates VirtualBox DLL files
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
1Virtualization/Sandbox Evasion
1