Overview

overview

10

Static

static

10

TriggerFinder.exe

windows11-21h2-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    TriggerFinder.exe

  • Size

    76.6MB

  • Sample

    250101-d44mrstjhv

  • MD5

    e63a8cb540b649742e86f6ac1655d487

  • SHA1

    552f95291c8031def5e100e21f61fd3a85bab397

  • SHA256

    d960b2484911a1013062e2f636243942a77a0ec8c83aecfdc4d275f6aacfd40a

  • SHA512

    7783ae9037c6db31f1d8f20ad1338e006f02b2dd85a3b59d061483639e99023b7bb72927e5c914adeef5b9eb07782f736a0702896c29d4fbc3622ec2b5c13763

  • SSDEEP

    1572864:p1l7WdXmUSk8IpG7V+VPhqFxE7glSWiYweyJulZUdg6zfziu3d72:p1Z0XmUSkB05awF18LpuqbPZ2

Score
10/10
pysilonevasionexecutionpersistencepyinstallerupx

Malware Config

Targets

    • Target

      TriggerFinder.exe

    • Size

      76.6MB

    • MD5

      e63a8cb540b649742e86f6ac1655d487

    • SHA1

      552f95291c8031def5e100e21f61fd3a85bab397

    • SHA256

      d960b2484911a1013062e2f636243942a77a0ec8c83aecfdc4d275f6aacfd40a

    • SHA512

      7783ae9037c6db31f1d8f20ad1338e006f02b2dd85a3b59d061483639e99023b7bb72927e5c914adeef5b9eb07782f736a0702896c29d4fbc3622ec2b5c13763

    • SSDEEP

      1572864:p1l7WdXmUSk8IpG7V+VPhqFxE7glSWiYweyJulZUdg6zfziu3d72:p1Z0XmUSkB05awF18LpuqbPZ2

    Score
    9/10
    evasionexecutionpersistenceupx

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks