General

  • Target

    Built.exe

  • Size

    6.9MB

  • Sample

    241111-ymdegaveqm

  • MD5

    8131e5e145cfbb6f3f6ddd413afb82b1

  • SHA1

    1527a3113b47050bf5c4b3e3f603da45f723ba70

  • SHA256

    2526bb6ec72af0a4b8d6a087844adc9de70b37691593c4625ea93c114b4f2514

  • SHA512

    8b8206749661445f1800bcd497548804da07dea8a6fbb48954ed383999767015b122a8131bd41aa954e53fde7beca273048b95153fa539470e2a19b29f5977b2

  • SSDEEP

    98304:WkDjWM8JEE1FuamaHl3Ne4i3Tf2PkOpfW9hZMMoVmkzhxIdfXeRpYRJJcGhEIFWi:Wk0ReNTfm/pf+xk4dWRpmrbW3jmrr

Malware Config

Targets

    • Target

      Built.exe

    • Size

      6.9MB

    • MD5

      8131e5e145cfbb6f3f6ddd413afb82b1

    • SHA1

      1527a3113b47050bf5c4b3e3f603da45f723ba70

    • SHA256

      2526bb6ec72af0a4b8d6a087844adc9de70b37691593c4625ea93c114b4f2514

    • SHA512

      8b8206749661445f1800bcd497548804da07dea8a6fbb48954ed383999767015b122a8131bd41aa954e53fde7beca273048b95153fa539470e2a19b29f5977b2

    • SSDEEP

      98304:WkDjWM8JEE1FuamaHl3Ne4i3Tf2PkOpfW9hZMMoVmkzhxIdfXeRpYRJJcGhEIFWi:Wk0ReNTfm/pf+xk4dWRpmrbW3jmrr

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Clipboard Data

      Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    • Loads dropped DLL

    • Obfuscated Files or Information: Command Obfuscation

      Adversaries may obfuscate content during command execution to impede detection.

    • Enumerates processes with tasklist

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks