Overview

overview

10

Static

static

10

Generator-Tool.exe

windows10-2004-x64

9

Resubmissions

25-09-2024 00:17

240925-ak6fgawgme 10

25-09-2024 00:15

240925-ajv84swfqd 10

23-09-2024 20:00

240923-yrgyfszbnl 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Generator-Tool.exe

  • Size

    56.1MB

  • Sample

    240925-ak6fgawgme

  • MD5

    86480d87daa6bdcc81fc5fa224ae47a4

  • SHA1

    86685b537b073b4fa43503b64ce9dbdd402d3033

  • SHA256

    02ab5eaa36cd584cb56f5f384d9a3c6e1cb19620c8e23e72d72097c023c93372

  • SHA512

    ec0743f111dc144023a7f3e6bb01123144c5a81601ae31fab6765edcf6f08a9b1c5ff58887408943097381fd826129bed6d2ed49dc29c0dd558220bc3b808b88

  • SSDEEP

    1572864:AvxZQglHWE7vaSk8IpG7V+VPhqQdSiE70lg7SDPz:AvxZxF3eSkB05awkSge7gb

Score
10/10
pysilondefense_evasiondiscoveryevasionexecutionpersistenceprivilege_escalationpyinstallerupx

Malware Config

Targets

    • Target

      Generator-Tool.exe

    • Size

      56.1MB

    • MD5

      86480d87daa6bdcc81fc5fa224ae47a4

    • SHA1

      86685b537b073b4fa43503b64ce9dbdd402d3033

    • SHA256

      02ab5eaa36cd584cb56f5f384d9a3c6e1cb19620c8e23e72d72097c023c93372

    • SHA512

      ec0743f111dc144023a7f3e6bb01123144c5a81601ae31fab6765edcf6f08a9b1c5ff58887408943097381fd826129bed6d2ed49dc29c0dd558220bc3b808b88

    • SSDEEP

      1572864:AvxZQglHWE7vaSk8IpG7V+VPhqQdSiE70lg7SDPz:AvxZxF3eSkB05awkSge7gb

    Score
    9/10
    defense_evasiondiscoveryevasionexecutionpersistenceprivilege_escalationupx

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Downloads MZ/PE file

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Blocklisted process makes network request

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Component Object Model Hijacking

1
T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Component Object Model Hijacking

1
T1546.015

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Modify Registry

2
T1112

Subvert Trust Controls

2
T1553

Install Root Certificate

1
T1553.004

SIP and Trust Provider Hijacking

1
T1553.003

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Browser Information Discovery

1
T1217

File and Directory Discovery

1
T1083

Peripheral Device Discovery

1
T1120

Query Registry

5
T1012

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Virtualization/Sandbox Evasion

1
T1497

Lateral Movement

Collection

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks