General

  • Target

    Ware.exe

  • Size

    76.8MB

  • Sample

    240814-vner5sybkp

  • MD5

    ddb000f158f9a0fbe813f27766392378

  • SHA1

    d2e5efe45015d6f86bb26aa85afb1cc2b9988cc4

  • SHA256

    18ee170db33fe7dddc61a3ea81cd0f842142aea908ced0483cdb8930f8f775e2

  • SHA512

    40c9161fa72b85745acfa54f26e962c49cc5be0cd567f306d8aae383ba83e1ed1d06fa9bcf7ee04179ba92089432e256574fc5eedcd2e7f7d4a9c4981a6c024c

  • SSDEEP

    1572864:svHcRlDWeh7vXSk8IpG7V+VPhqb+TTE7HlHTdiYweyJulZUdglXenXZvkON1b:svHcR9rhTSkB05awb+T0dmpuJXgkOj

Malware Config

Targets

    • Target

      Ware.exe

    • Size

      76.8MB

    • MD5

      ddb000f158f9a0fbe813f27766392378

    • SHA1

      d2e5efe45015d6f86bb26aa85afb1cc2b9988cc4

    • SHA256

      18ee170db33fe7dddc61a3ea81cd0f842142aea908ced0483cdb8930f8f775e2

    • SHA512

      40c9161fa72b85745acfa54f26e962c49cc5be0cd567f306d8aae383ba83e1ed1d06fa9bcf7ee04179ba92089432e256574fc5eedcd2e7f7d4a9c4981a6c024c

    • SSDEEP

      1572864:svHcRlDWeh7vXSk8IpG7V+VPhqb+TTE7HlHTdiYweyJulZUdglXenXZvkON1b:svHcR9rhTSkB05awb+T0dmpuJXgkOj

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks