Overview

overview

10

Static

static

10

source_prepared.exe

windows11-21h2-x64

9

Resubmissions

27-10-2024 14:39

241027-r1h4jswmcr 10

20-10-2024 16:53

241020-vef9lsyfnb 10

20-10-2024 16:52

241020-vdsw1s1cqk 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    source_prepared.exe

  • Size

    102.7MB

  • Sample

    241020-vef9lsyfnb

  • MD5

    c1c5dadb542b478a86d0055515ab14ff

  • SHA1

    5e17fb64d722d7488cfc1d6e5aa28900addc0e0f

  • SHA256

    10dc063071132d3be140f064aa0c9292eccd00954018505090d89ae445e552cf

  • SHA512

    a8f43633e8275fa3ca116061b43cc6544e502d86aa14c665fdfbf16877755369aa3ac1aa2d3f93c2c4f9f132925e1e8b055415d2241829bcaf9ed329232e4163

  • SSDEEP

    3145728:pnG9r78S6xjKcBanL2qHO5iVAunGQbRe0zJcBtfZ2:M1ASWNaBHCin1XcBS

Score
10/10
pysilonevasionexecutionpersistencepyinstaller

Malware Config

Targets

    • Target

      source_prepared.exe

    • Size

      102.7MB

    • MD5

      c1c5dadb542b478a86d0055515ab14ff

    • SHA1

      5e17fb64d722d7488cfc1d6e5aa28900addc0e0f

    • SHA256

      10dc063071132d3be140f064aa0c9292eccd00954018505090d89ae445e552cf

    • SHA512

      a8f43633e8275fa3ca116061b43cc6544e502d86aa14c665fdfbf16877755369aa3ac1aa2d3f93c2c4f9f132925e1e8b055415d2241829bcaf9ed329232e4163

    • SSDEEP

      3145728:pnG9r78S6xjKcBanL2qHO5iVAunGQbRe0zJcBtfZ2:M1ASWNaBHCin1XcBS

    Score
    9/10
    evasionexecutionpersistence

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks