General
- Target yeni.exe
- Size 8.6MB
- Sample261102-2t67xaxvcs
- SHA256 45c48d9eb5e4833cc34f3a3ead7640a017dbc36df2da8aac44ab4635a96914bd
Score
10/10
Malware Config
Targets
-
- Target yeni.exe
- Size 8.6MB
- SHA256 45c48d9eb5e4833cc34f3a3ead7640a017dbc36df2da8aac44ab4635a96914bd
Score10/10UAC bypass
Enumerates VirtualBox registry keys
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Disables taskbar notifications via registry modification
Looks for VMWare Tools registry key
Executes a file named after a Windows system binary
The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
Loads dropped DLL
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
Hide Artifacts: Hidden Files and Directories
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
1Disable or Modify Tools
1Masquerading
1Match Legitimate Name or Location
1Modify Registry
1Virtualization/Sandbox Evasion
3