General
-
Target
source_prepared.exe
-
Size
52.0MB
-
Sample
240806-m1lgfs1eqf
-
MD5
89f978ed4b1ee844338baa49a8b8df56
-
SHA1
7c0ab0a736b0653d2d7dbf334fc8c103b1640c43
-
SHA256
e243a523691b3e6f42688b64368bb630573346f8c8cb640af0d88312d0c317bd
-
SHA512
cd828304a94a80a918c7cc035d92a947331b34a11f35f02bee4feabce4acbed657d0b02bcaff1f7197651f4f099c98030c26b2679740dc6210ae4dac09fdad34
-
SSDEEP
1572864:VhQ6l2C7vDSk8IpG7V+VPhqIbE7WjlbIEWIdZDmH:Vh1JPSkB05awIxjhIEFdc
Behavioral task
behavioral1
Sample
source_prepared.exe
Resource
win10v2004-20240802-en
Malware Config
Targets
-
-
Target
source_prepared.exe
-
Size
52.0MB
-
MD5
89f978ed4b1ee844338baa49a8b8df56
-
SHA1
7c0ab0a736b0653d2d7dbf334fc8c103b1640c43
-
SHA256
e243a523691b3e6f42688b64368bb630573346f8c8cb640af0d88312d0c317bd
-
SHA512
cd828304a94a80a918c7cc035d92a947331b34a11f35f02bee4feabce4acbed657d0b02bcaff1f7197651f4f099c98030c26b2679740dc6210ae4dac09fdad34
-
SSDEEP
1572864:VhQ6l2C7vDSk8IpG7V+VPhqIbE7WjlbIEWIdZDmH:Vh1JPSkB05awIxjhIEFdc
Score9/10-
Enumerates VirtualBox DLL files
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
1Virtualization/Sandbox Evasion
1