Overview

overview

10

Static

static

10

DisableServices.exe

windows7-x64

7

DisableServices.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    DisableServices.bat

  • Size

    81.0MB

  • Sample

    241018-h23pxatfrb

  • MD5

    dc0010cbf16f536baee7f9ca3b6ab271

  • SHA1

    0e203f83150264f325e5831ce8189d41356f77a5

  • SHA256

    78322c682362b296b97f945d7e416bae3e37d6ad92c0fa5a5813da378ee409fc

  • SHA512

    a69fc5048f8775de5164d5189d8e0d028afc48ecb00cf6bd2246816a604cab2cf5c97f49441d264c78bf0035dc39aa9ffd0857255b1dd143bb5404630d6f1202

  • SSDEEP

    1572864:JvxZQgl02Sk8IpG7V+VPhqcPE7hlgkiYgj+h58sMwVWS9eSFcJz7:JvxZxPSkB05awcSeu5BZ9e17

Score
10/10
pysilonevasionexecutionpersistencepyinstallerupx

Malware Config

Targets

    • Target

      DisableServices.bat

    • Size

      81.0MB

    • MD5

      dc0010cbf16f536baee7f9ca3b6ab271

    • SHA1

      0e203f83150264f325e5831ce8189d41356f77a5

    • SHA256

      78322c682362b296b97f945d7e416bae3e37d6ad92c0fa5a5813da378ee409fc

    • SHA512

      a69fc5048f8775de5164d5189d8e0d028afc48ecb00cf6bd2246816a604cab2cf5c97f49441d264c78bf0035dc39aa9ffd0857255b1dd143bb5404630d6f1202

    • SSDEEP

      1572864:JvxZQgl02Sk8IpG7V+VPhqcPE7hlgkiYgj+h58sMwVWS9eSFcJz7:JvxZxPSkB05awcSeu5BZ9e17

    Score
    9/10
    upxevasionexecutionpersistence

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks