General
- Target RealSetup_a828e50b04035340a6b22f9aa0bcf2f5991f2ab820c46a1969046cd6fee19a7f.exe
- Size 16.3MB
- Sample260719-ysymlaaz2q
- SHA256 8f1c661b542a5c7c1b69fe2900a97e0d82bb2ef75322c2470e21986e6a438d17
Score
9/10
Malware Config
Targets
-
- Target RealSetup_a828e50b04035340a6b22f9aa0bcf2f5991f2ab820c46a1969046cd6fee19a7f.exe
- Size 16.3MB
- SHA256 8f1c661b542a5c7c1b69fe2900a97e0d82bb2ef75322c2470e21986e6a438d17
Score9/10Identifies VirtualBox via ACPI registry values (likely anti-VM)
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
Executes dropped EXE
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Checks whether UAC is enabled
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
Network Share Discovery
Attempt to gather information on host network.
Suspicious use of NtSetInformationThreadHideFromDebugger
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1