Overview

overview

10

Static

static

10

pin cracker.exe

windows7-x64

7

pin cracker.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    pin cracker.exe

  • Size

    77.4MB

  • Sample

    241030-pjba9stcqp

  • MD5

    67cb9f48d7235af1b79ffb29d1bdc46f

  • SHA1

    881033e32d9f56b8b0376a587906a2f9667a20fa

  • SHA256

    cf8da575530bbc737a5047d8e5c8efdb3295ab72c208f1da969c5f6c080d9856

  • SHA512

    304d12b1fcb27c707b6b50767eb942420a68229fd3eb17cdf2cb0dbec292aff947ad6e8d812ad1117b1180e27d6bf6dacf930b359eda9151c85bf62a0d86a111

  • SSDEEP

    1572864:ScRl3WzmSk8IpG7V+VPhqYdfzE7slhTEiYweyJulZUdg1hqrR9E3V37U:ScR5gmSkB05awcf5LppuxhqrTKo

Score
10/10
pysilonevasionexecutionpersistencepyinstallerupx

Malware Config

Targets

    • Target

      pin cracker.exe

    • Size

      77.4MB

    • MD5

      67cb9f48d7235af1b79ffb29d1bdc46f

    • SHA1

      881033e32d9f56b8b0376a587906a2f9667a20fa

    • SHA256

      cf8da575530bbc737a5047d8e5c8efdb3295ab72c208f1da969c5f6c080d9856

    • SHA512

      304d12b1fcb27c707b6b50767eb942420a68229fd3eb17cdf2cb0dbec292aff947ad6e8d812ad1117b1180e27d6bf6dacf930b359eda9151c85bf62a0d86a111

    • SSDEEP

      1572864:ScRl3WzmSk8IpG7V+VPhqYdfzE7slhTEiYweyJulZUdg1hqrR9E3V37U:ScR5gmSkB05awcf5LppuxhqrTKo

    Score
    9/10
    upxevasionexecutionpersistence

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks