Overview

overview

10

Static

static

10

unity hub ...on.exe

windows11-21h2-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    unity hub test verison.exe

  • Size

    106.7MB

  • Sample

    240701-bthlfasblh

  • MD5

    c25d7735f6c17adbb7f5ad2718807c39

  • SHA1

    5839b3df416f7ba9ee59fc745c1e174ae659308a

  • SHA256

    8091b6fb70d5687cb1aea31bbafb642e8dd31e7a0dacd73424d08499401e5ff4

  • SHA512

    76bfe6fe50546c4fb163a2b25ed3532c26a377a5819f87937b0d7a0219cf5d3f86557162596008a5d77c6038231aa1b94512c88f02172601981dcab006b4698a

  • SSDEEP

    3145728:qcT7paiS6xjKcBa6R2qHO5izBVnG0iWMstB2Ox0pT3:pVjSWNa6HHCittieBm

Score
10/10
pysilonevasionexecutionpersistencepyinstaller

Malware Config

Targets

    • Target

      unity hub test verison.exe

    • Size

      106.7MB

    • MD5

      c25d7735f6c17adbb7f5ad2718807c39

    • SHA1

      5839b3df416f7ba9ee59fc745c1e174ae659308a

    • SHA256

      8091b6fb70d5687cb1aea31bbafb642e8dd31e7a0dacd73424d08499401e5ff4

    • SHA512

      76bfe6fe50546c4fb163a2b25ed3532c26a377a5819f87937b0d7a0219cf5d3f86557162596008a5d77c6038231aa1b94512c88f02172601981dcab006b4698a

    • SSDEEP

      3145728:qcT7paiS6xjKcBa6R2qHO5izBVnG0iWMstB2Ox0pT3:pVjSWNa6HHCittieBm

    Score
    9/10
    evasionexecutionpersistencepyinstaller

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Modify Registry

1
T1112

Credential Access

Discovery

File and Directory Discovery

1
T1083

Virtualization/Sandbox Evasion

1
T1497

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks