Overview

overview

10

Static

static

10

source_prepared.exe

windows11-21h2-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    source_prepared.exe

  • Size

    80.7MB

  • Sample

    241231-17wsnavlbn

  • MD5

    f715947035f31ed7388e4be6e7796f0e

  • SHA1

    b3f75beaa98cd1104ff8c3476c46ce136edcba09

  • SHA256

    fc6ec5c84949cabc06748119d43228cac188c235e2723c82cf8a32cfd8817a77

  • SHA512

    a31e6f9d555b0941a1f6fcdfa902920c624f8bdded1c63b8338ad2f2c107443af4576203bd8446bc8baf3664ed11a95176ed4674c23e4b84b0922b53acf9ff5b

  • SSDEEP

    1572864:5GKlDWjysmwSk8IpG7V+VPhqFiE7BbliEoiYgj+h58sMw/DBZB:QK51smwSkB05awFVwE65Dt

Score
10/10
pysilonevasionexecutionpersistencepyinstallerupx

Malware Config

Targets

    • Target

      source_prepared.exe

    • Size

      80.7MB

    • MD5

      f715947035f31ed7388e4be6e7796f0e

    • SHA1

      b3f75beaa98cd1104ff8c3476c46ce136edcba09

    • SHA256

      fc6ec5c84949cabc06748119d43228cac188c235e2723c82cf8a32cfd8817a77

    • SHA512

      a31e6f9d555b0941a1f6fcdfa902920c624f8bdded1c63b8338ad2f2c107443af4576203bd8446bc8baf3664ed11a95176ed4674c23e4b84b0922b53acf9ff5b

    • SSDEEP

      1572864:5GKlDWjysmwSk8IpG7V+VPhqFiE7BbliEoiYgj+h58sMw/DBZB:QK51smwSkB05awFVwE65Dt

    Score
    9/10
    evasionexecutionpersistenceupx

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks