Overview

overview

10

Static

static

10

sourceprepared.exe

windows7-x64

7

sourceprepared.exe

windows10-2004-x64

9

Resubmissions

27-09-2024 19:54

240927-yms5xswgpk 10

27-09-2024 18:31

240927-w5564atfjj 10

27-09-2024 16:42

240927-t7rels1hrj 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    sourceprepared.exe

  • Size

    77.0MB

  • Sample

    240927-t7rels1hrj

  • MD5

    998e8ab823ff8144c84b9757746da918

  • SHA1

    8354d5b0ec36a744442075f81bff57fa2df130a9

  • SHA256

    abdceb052f30a79f342ec2077c884401d2ada4c54fc05121456c4d876b1181d9

  • SHA512

    d31f4f82db55048b9eaaa74f08edede3d75643fcb4e31eaa3358069ea20675d5655578944c4863492455c165cb27fb50fe05bfeced310b663cad72179a951ced

  • SSDEEP

    1572864:LvHcRlnWXmSk8IpG7V+VPhqFxE7ulHQBBPiYweyJulZUdgD72JxyyOlqH1O3:LvHcRVkmSkB05awFjdQnApu/72Jg3cO3

Score
10/10
pysilonevasionexecutionpersistencepyinstallerupx

Malware Config

Targets

    • Target

      sourceprepared.exe

    • Size

      77.0MB

    • MD5

      998e8ab823ff8144c84b9757746da918

    • SHA1

      8354d5b0ec36a744442075f81bff57fa2df130a9

    • SHA256

      abdceb052f30a79f342ec2077c884401d2ada4c54fc05121456c4d876b1181d9

    • SHA512

      d31f4f82db55048b9eaaa74f08edede3d75643fcb4e31eaa3358069ea20675d5655578944c4863492455c165cb27fb50fe05bfeced310b663cad72179a951ced

    • SSDEEP

      1572864:LvHcRlnWXmSk8IpG7V+VPhqFxE7ulHQBBPiYweyJulZUdgD72JxyyOlqH1O3:LvHcRVkmSkB05awFjdQnApu/72Jg3cO3

    Score
    9/10
    upxevasionexecutionpersistence

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks