General
-
Target
source_prepared.exe
-
Size
80.7MB
-
Sample
240703-qx6vrsyhng
-
MD5
151d7708e147957fb7d0fb4dd9cadd6f
-
SHA1
60b73ba56f2b502aebd183806c64e40081db4dc0
-
SHA256
b11384a3db715c4ed6c9dda48c0a07543f1eddc98031d6329b41269564545e91
-
SHA512
e7c20767ec74791bf6c3edec77c89404e9e72601f74104c7509d0ffdde4bcc446ab654e6278baf3ea89538ce92d5fab6327b4f743d5d88477cf0c5d0a4d63d3e
-
SSDEEP
1572864:EvxZQglKSk8IpG7V+VPhqYdfCE70lgLiYgj+h58sMwFWuWDxNwJk:EvxZxwSkB05awcfAeF55HM3
Behavioral task
behavioral1
Sample
source_prepared.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
source_prepared.exe
Resource
win10v2004-20240508-en
Malware Config
Targets
-
-
Target
source_prepared.exe
-
Size
80.7MB
-
MD5
151d7708e147957fb7d0fb4dd9cadd6f
-
SHA1
60b73ba56f2b502aebd183806c64e40081db4dc0
-
SHA256
b11384a3db715c4ed6c9dda48c0a07543f1eddc98031d6329b41269564545e91
-
SHA512
e7c20767ec74791bf6c3edec77c89404e9e72601f74104c7509d0ffdde4bcc446ab654e6278baf3ea89538ce92d5fab6327b4f743d5d88477cf0c5d0a4d63d3e
-
SSDEEP
1572864:EvxZQglKSk8IpG7V+VPhqYdfCE70lgLiYgj+h58sMwFWuWDxNwJk:EvxZxwSkB05awcfAeF55HM3
Score9/10-
Enumerates VirtualBox DLL files
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Virtualization/Sandbox Evasion
1Hide Artifacts
2Hidden Files and Directories
2Modify Registry
1