General
-
Target
source_prepared.exe
-
Size
80.3MB
-
Sample
240825-3xfpsssemd
-
MD5
52102f70cfd61a716325833666b0180e
-
SHA1
625ccc40c919e34554bd178279b02268a6c6fcfe
-
SHA256
44adad36384d5fe063fec38dd156b6d923968eb05e1ebb4fad7b55fea983eee4
-
SHA512
dd6df976430a3d828ce14c05b8158f181a50e1722bced4c224d09ae98fb3171d03d55babca6a591f8d5c39795f17f789dda4336324e8c40d0d3529e5345ef457
-
SSDEEP
1572864:70bZQglGWLo7vPSk8IpG7V+VPhq+EE74lgbiYgj+h58sMwL9ZC2cJzU:70bZxkHLSkB05aw+yeV5n9ZaU
Behavioral task
behavioral1
Sample
source_prepared.exe
Resource
win10-20240404-en
Malware Config
Targets
-
-
Target
source_prepared.exe
-
Size
80.3MB
-
MD5
52102f70cfd61a716325833666b0180e
-
SHA1
625ccc40c919e34554bd178279b02268a6c6fcfe
-
SHA256
44adad36384d5fe063fec38dd156b6d923968eb05e1ebb4fad7b55fea983eee4
-
SHA512
dd6df976430a3d828ce14c05b8158f181a50e1722bced4c224d09ae98fb3171d03d55babca6a591f8d5c39795f17f789dda4336324e8c40d0d3529e5345ef457
-
SSDEEP
1572864:70bZQglGWLo7vPSk8IpG7V+VPhq+EE74lgbiYgj+h58sMwL9ZC2cJzU:70bZxkHLSkB05aw+yeV5n9ZaU
-
Enumerates VirtualBox DLL files
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
1Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Virtualization/Sandbox Evasion
1