General
-
Target
source_prepared.exe
-
Size
80.2MB
-
Sample
240701-qwkwxaxhmq
-
MD5
4529ed6390a3ce8f8de34bf1b06ccacd
-
SHA1
090606efd741cb335bf50a5767b2dfc530804b7c
-
SHA256
34d10d9f569187e67e9c7d994bfb372ddd4775aa6da7b83189832bf1d2ac72c9
-
SHA512
15e7f520b66806f73ab71cd7cae91b577a245131319b8a6ced8204edce4de4d1345a0dc9a31d68f9abc041f31946f092b211818a35aa07f44cabb9729580d1f7
-
SSDEEP
1572864:uvxZQgl8mSk8IpG7V+VPhqHDE7jblgA7iYgj+h58sMw8W2nId3RR:uvxZxXSkB05awHaeA15wS
Behavioral task
behavioral1
Sample
source_prepared.exe
Resource
win10-20240404-en
Malware Config
Targets
-
-
Target
source_prepared.exe
-
Size
80.2MB
-
MD5
4529ed6390a3ce8f8de34bf1b06ccacd
-
SHA1
090606efd741cb335bf50a5767b2dfc530804b7c
-
SHA256
34d10d9f569187e67e9c7d994bfb372ddd4775aa6da7b83189832bf1d2ac72c9
-
SHA512
15e7f520b66806f73ab71cd7cae91b577a245131319b8a6ced8204edce4de4d1345a0dc9a31d68f9abc041f31946f092b211818a35aa07f44cabb9729580d1f7
-
SSDEEP
1572864:uvxZQgl8mSk8IpG7V+VPhqHDE7jblgA7iYgj+h58sMw8W2nId3RR:uvxZxXSkB05awHaeA15wS
Score9/10-
Enumerates VirtualBox DLL files
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Virtualization/Sandbox Evasion
1Hide Artifacts
2Hidden Files and Directories
2Modify Registry
1