Overview

overview

10

Static

static

10

SSCOSMETICS.exe

windows7-x64

1

SSCOSMETICS.exe

windows10-2004-x64

9

Resubmissions

13-09-2024 22:39

240913-2k2aassgrj 10

13-09-2024 22:21

240913-19nj3asgra 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SSCOSMETICS.exe

  • Size

    102.9MB

  • Sample

    240913-2k2aassgrj

  • MD5

    a06ccc09faef64a85a921426d9e60f12

  • SHA1

    9a2f19c0730bc8312b4301e9454cccad3107f4e6

  • SHA256

    b2fd41b241aef3c5400bff943206a710c6971e8b80c27cc8504a3a6b8fa7e7db

  • SHA512

    7e6778ff098bdbd7c9f764551c64c89fb652a01a89f540c2fccb4df72a80fcbb04bfda2f57ffee2c20ad86f0c5362bbeec6ae2585fcca4ba43f4f55cf5fef9cb

  • SSDEEP

    3145728:eiWL88S6xjKcBanL2qHO5iVjdqlnGQbRe0zJcBq3gvgO3p:e7HSWNaBHCi651XcBq3G3

Score
10/10
pysilondiscoveryevasionexecutionpersistencepyinstaller

Malware Config

Targets

    • Target

      SSCOSMETICS.exe

    • Size

      102.9MB

    • MD5

      a06ccc09faef64a85a921426d9e60f12

    • SHA1

      9a2f19c0730bc8312b4301e9454cccad3107f4e6

    • SHA256

      b2fd41b241aef3c5400bff943206a710c6971e8b80c27cc8504a3a6b8fa7e7db

    • SHA512

      7e6778ff098bdbd7c9f764551c64c89fb652a01a89f540c2fccb4df72a80fcbb04bfda2f57ffee2c20ad86f0c5362bbeec6ae2585fcca4ba43f4f55cf5fef9cb

    • SSDEEP

      3145728:eiWL88S6xjKcBanL2qHO5iVjdqlnGQbRe0zJcBq3gvgO3p:e7HSWNaBHCi651XcBq3G3

    Score
    9/10
    discoveryevasionexecutionpersistence

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks