Overview

overview

10

Static

static

10

source_prepared.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    source_prepared.exe

  • Size

    76.7MB

  • Sample

    241110-pt8phszmgj

  • MD5

    c2a1298d327ff7908698cb2dc521b1fe

  • SHA1

    d5d238493096b73387d7ea8dcecfc6c467e11b53

  • SHA256

    7c0e4eb84043047e3dc3bb3fcee195566240dec959104ebc2abc351b28b9610c

  • SHA512

    1e8ae25de5a6aeb431f6f87a5503b0020948206ed582bbcad9a1e0f8b8ebb258d074aae03fa59a7f2bb2123d3955f5bedfe9b09e4f958b8fb946d9178e3226ff

  • SSDEEP

    1572864:r1l9W50hSk8IpG7V+VPhqYdfzE7ElhTRiYweyJulZUdg1hW/xNA3Ii3hO:r1HRSkB05awcfHLapuxhO04

Score
10/10
pysilonevasionexecutionpersistencepyinstallerupx

Malware Config

Targets

    • Target

      source_prepared.exe

    • Size

      76.7MB

    • MD5

      c2a1298d327ff7908698cb2dc521b1fe

    • SHA1

      d5d238493096b73387d7ea8dcecfc6c467e11b53

    • SHA256

      7c0e4eb84043047e3dc3bb3fcee195566240dec959104ebc2abc351b28b9610c

    • SHA512

      1e8ae25de5a6aeb431f6f87a5503b0020948206ed582bbcad9a1e0f8b8ebb258d074aae03fa59a7f2bb2123d3955f5bedfe9b09e4f958b8fb946d9178e3226ff

    • SSDEEP

      1572864:r1l9W50hSk8IpG7V+VPhqYdfzE7ElhTRiYweyJulZUdg1hW/xNA3Ii3hO:r1HRSkB05awcfHLapuxhO04

    Score
    10/10
    evasionexecutionpersistenceupx

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks