General
-
Target
windows_update_check.exe
-
Size
75.6MB
-
Sample
240703-qzy8pszblc
-
MD5
c849691f1fa5e179ccc8b58a8b257646
-
SHA1
97bd7ebb876134305071b8b136bc9fe0ef3b0510
-
SHA256
c5132e605f9e2b8e644dd4480b64120f7fa75c4333ae7222fa4298702150ae69
-
SHA512
f9a520611aa91e9c0a0fc1bb69c60e6919c7e2947706877fba75d900f4e82d3ddd3fc6960377e08cccfdce43034d56ac1ddca633f8275ab73318e5917d5b3d4e
-
SSDEEP
1572864:zhQ6l2bSk8IpG7V+VPhqIbE7WjlPIkiY4MHHLeqPNLtDgWcZ4HlWC:zh1WSkB05awIxj5IfMHVLtUrQJ
Behavioral task
behavioral1
Sample
windows_update_check.exe
Resource
win10-20240404-en
Malware Config
Targets
-
-
Target
windows_update_check.exe
-
Size
75.6MB
-
MD5
c849691f1fa5e179ccc8b58a8b257646
-
SHA1
97bd7ebb876134305071b8b136bc9fe0ef3b0510
-
SHA256
c5132e605f9e2b8e644dd4480b64120f7fa75c4333ae7222fa4298702150ae69
-
SHA512
f9a520611aa91e9c0a0fc1bb69c60e6919c7e2947706877fba75d900f4e82d3ddd3fc6960377e08cccfdce43034d56ac1ddca633f8275ab73318e5917d5b3d4e
-
SSDEEP
1572864:zhQ6l2bSk8IpG7V+VPhqIbE7WjlPIkiY4MHHLeqPNLtDgWcZ4HlWC:zh1WSkB05awIxj5IfMHVLtUrQJ
Score9/10-
Enumerates VirtualBox DLL files
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-