General
-
Target
source_prepared.exe
-
Size
103.4MB
-
Sample
240701-ssm8za1gqr
-
MD5
c4e4cd81904945564cac70677fdd3ecc
-
SHA1
b56d9f337d85b5ba5c2c769de54f85ce98fbe32b
-
SHA256
87ff0ad475eb22984d975275d45ccfae4e094a931bbd8bd076174297a6768104
-
SHA512
d9193d1728c8c7f67ee82b91907f77201bfe6ee5355a6d854ccb331f0085902c368c103527855661a1329b06f2efa28b8e2960d6c25110a90e018e77aa2ff4ba
-
SSDEEP
3145728:xR7pa8S6xjKcBa6c2qHO5iVY2nGQbRe0zJcBWhDX9U:vVBSWNa6sHCiH1XcBW5
Behavioral task
behavioral1
Sample
source_prepared.exe
Resource
win11-20240508-en
Malware Config
Targets
-
-
Target
source_prepared.exe
-
Size
103.4MB
-
MD5
c4e4cd81904945564cac70677fdd3ecc
-
SHA1
b56d9f337d85b5ba5c2c769de54f85ce98fbe32b
-
SHA256
87ff0ad475eb22984d975275d45ccfae4e094a931bbd8bd076174297a6768104
-
SHA512
d9193d1728c8c7f67ee82b91907f77201bfe6ee5355a6d854ccb331f0085902c368c103527855661a1329b06f2efa28b8e2960d6c25110a90e018e77aa2ff4ba
-
SSDEEP
3145728:xR7pa8S6xjKcBa6c2qHO5iVY2nGQbRe0zJcBWhDX9U:vVBSWNa6sHCiH1XcBW5
Score9/10-
Enumerates VirtualBox DLL files
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Virtualization/Sandbox Evasion
1Hide Artifacts
2Hidden Files and Directories
2Modify Registry
1