Overview

overview

10

Static

static

10

source_prepared.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    source_prepared.exe

  • Size

    77.6MB

  • Sample

    240630-vyak6s1ekc

  • MD5

    127e99c610cef16fc3ab09de26a5c4b6

  • SHA1

    91d11fbb7b878b97a7ed4dbdde6d9ef3e3407782

  • SHA256

    81fb88560e1d8ed53a9ab97c2a12bff393b213c9e2b03ad1d8acdcd6e6c2e734

  • SHA512

    e796c9afba42053cff390a8a3b0858a71eebf48d58afe1b98f9e654816a4ee71fa6072bca99b87cfcf078f6fc94408c44d813410d4f8d246c8f48f20b7b6145e

  • SSDEEP

    1572864:TviEaVKM6Sk8IpG7V+VPhqQduXE7SVNO3iYweyJulZUdgyXWncrUFZvkOI:TvZal6SkB05awkuRbjpueXmjkOI

Score
10/10
pysilonevasionexecutionpersistencepyinstallerupx

Malware Config

Targets

    • Target

      source_prepared.exe

    • Size

      77.6MB

    • MD5

      127e99c610cef16fc3ab09de26a5c4b6

    • SHA1

      91d11fbb7b878b97a7ed4dbdde6d9ef3e3407782

    • SHA256

      81fb88560e1d8ed53a9ab97c2a12bff393b213c9e2b03ad1d8acdcd6e6c2e734

    • SHA512

      e796c9afba42053cff390a8a3b0858a71eebf48d58afe1b98f9e654816a4ee71fa6072bca99b87cfcf078f6fc94408c44d813410d4f8d246c8f48f20b7b6145e

    • SSDEEP

      1572864:TviEaVKM6Sk8IpG7V+VPhqQduXE7SVNO3iYweyJulZUdgyXWncrUFZvkOI:TvZal6SkB05awkuRbjpueXmjkOI

    Score
    8/10
    evasionexecutionpersistenceupx

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks