General
-
Target
source_prepared.exe
-
Size
76.7MB
-
Sample
240704-1peres1brj
-
MD5
a81fca6de5462d0ffb70eb6f7d963d83
-
SHA1
a4f153c02a967d8ed2dea3facfe8929908fef0ad
-
SHA256
e9bf19c453137ac594f19fc208cd25db49831c63f40d5818a3f01f451cbe6a14
-
SHA512
428fe696a1f9379be38806f070aabd4010121cfaf845492cc190070bea74be33304fda7d76a49dc727fe16d04fc38ab5709077f37c01d9065fda22e768c2fd61
-
SSDEEP
1572864:kvHcRl9WSk8IpG7V+VPhqb+TTE73lHt7fETiYweyJulZUdg1I6MWhfBcmDta9:kvHcRySkB05awb+TMdeMpuJvMg1ta9
Behavioral task
behavioral1
Sample
source_prepared.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
source_prepared.exe
Resource
win10v2004-20240704-en
Malware Config
Targets
-
-
Target
source_prepared.exe
-
Size
76.7MB
-
MD5
a81fca6de5462d0ffb70eb6f7d963d83
-
SHA1
a4f153c02a967d8ed2dea3facfe8929908fef0ad
-
SHA256
e9bf19c453137ac594f19fc208cd25db49831c63f40d5818a3f01f451cbe6a14
-
SHA512
428fe696a1f9379be38806f070aabd4010121cfaf845492cc190070bea74be33304fda7d76a49dc727fe16d04fc38ab5709077f37c01d9065fda22e768c2fd61
-
SSDEEP
1572864:kvHcRl9WSk8IpG7V+VPhqb+TTE73lHt7fETiYweyJulZUdg1I6MWhfBcmDta9:kvHcRySkB05awb+TMdeMpuJvMg1ta9
Score9/10-
Enumerates VirtualBox DLL files
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Virtualization/Sandbox Evasion
1Hide Artifacts
2Hidden Files and Directories
2Modify Registry
1