Overview

overview

10

Static

static

10

source_prepared.exe

windows10-ltsc 2021-x64

9

source_prepared.exe

windows11-21h2-x64

9

Resubmissions

13-11-2024 16:44

241113-t8xb9avhnd 10

13-11-2024 16:40

241113-t6xv1ayner 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    source_prepared.exe

  • Size

    101.0MB

  • Sample

    241113-t6xv1ayner

  • MD5

    ccfe18db286115bf03843f64a1a0a9b0

  • SHA1

    2391d35c3a13c7c2a8f783db16357208fd78254c

  • SHA256

    7669d3b509150c0040490c325e0a971b3762e1296406996ff4c404e0a9ca2b8b

  • SHA512

    d94df5f48dc4a2120c8154a89460f91e4a34822214cdb2eb4a6047d906d023dc49c485ae8a617ca79c5eafd7eba9ff3bf83abb4615bf31e87575b03a7e2a73a9

  • SSDEEP

    3145728:Dv455r7fS6xjKcBa32qHO5ie6apnGr/hjLtsA0qyNUH7Ql1IMW/:05pDSWNaVHCixXP0qy3Pw

Score
10/10
pysilondiscoveryevasionexecutionpersistencepyinstaller

Malware Config

Targets

    • Target

      source_prepared.exe

    • Size

      101.0MB

    • MD5

      ccfe18db286115bf03843f64a1a0a9b0

    • SHA1

      2391d35c3a13c7c2a8f783db16357208fd78254c

    • SHA256

      7669d3b509150c0040490c325e0a971b3762e1296406996ff4c404e0a9ca2b8b

    • SHA512

      d94df5f48dc4a2120c8154a89460f91e4a34822214cdb2eb4a6047d906d023dc49c485ae8a617ca79c5eafd7eba9ff3bf83abb4615bf31e87575b03a7e2a73a9

    • SSDEEP

      3145728:Dv455r7fS6xjKcBa32qHO5ie6apnGr/hjLtsA0qyNUH7Ql1IMW/:05pDSWNaVHCixXP0qy3Pw

    Score
    9/10
    evasionexecutionpersistencediscovery

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks