Overview

overview

10

Static

static

10

source_prepared.exe

windows11-21h2-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    source_prepared.exe

  • Size

    80.6MB

  • Sample

    240630-sq76cstbjj

  • MD5

    5c92a72875b245378a6f4f8a9af7e2a1

  • SHA1

    a9a0cae4a0bcc9817d771b1c926ffb3175ec30db

  • SHA256

    cf8b0038277f80f6ccae1d3b253b2eaef42d592cf986536bd43ad4022bbabba6

  • SHA512

    7a4f4fa9e07bf7568d6f5ffd327950e1d027832a3d913228e9f56bf9c4732c84be8230d50bc2c365bcea7af4730807ed40808a1ed84959c366e412ebafb9a684

  • SSDEEP

    1572864:OvNBYQglX2XaSk8IpG7V+VPhqb+TnE7Ulg8iYgj+h58sMw5IlWj95qgcJX0:OvNBYxRtSkB05awb+Tfe25FSK95K0

Score
10/10
pysilonevasionexecutionpersistencepyinstallerupx

Malware Config

Targets

    • Target

      source_prepared.exe

    • Size

      80.6MB

    • MD5

      5c92a72875b245378a6f4f8a9af7e2a1

    • SHA1

      a9a0cae4a0bcc9817d771b1c926ffb3175ec30db

    • SHA256

      cf8b0038277f80f6ccae1d3b253b2eaef42d592cf986536bd43ad4022bbabba6

    • SHA512

      7a4f4fa9e07bf7568d6f5ffd327950e1d027832a3d913228e9f56bf9c4732c84be8230d50bc2c365bcea7af4730807ed40808a1ed84959c366e412ebafb9a684

    • SSDEEP

      1572864:OvNBYQglX2XaSk8IpG7V+VPhqb+TnE7Ulg8iYgj+h58sMw5IlWj95qgcJX0:OvNBYxRtSkB05awb+Tfe25FSK95K0

    Score
    8/10
    evasionexecutionpersistenceupx

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks