Resubmissions
07-07-2024 16:37
240707-t5azvaxfne 10General
-
Target
source_prepared.exe
-
Size
80.6MB
-
Sample
240707-t5azvaxfne
-
MD5
c15c3f15dc3d4c29fcbca3c94fcf5975
-
SHA1
f1198dc55c7073e503ea912ae3df104065bb1440
-
SHA256
a671eec44a452dbfa969ced8f5a410c65fa2dda8a9218ee51dd1e500dfc736c2
-
SHA512
8aedf535907650152c1448db074019ba3050735ec3b9a22bbe87699c00204f52764800b14b6d18e4dec26e7ac289e61e006844ee6e44e5b054b66917583fa970
-
SSDEEP
1572864:fvxZQglX2OSk8IpG7V+VPhqb+TnE7Ulg8iYgj+h58sMw5IlWb9wqScJX0:fvxZxRBSkB05awb+Tfe25FSq9wA0
Behavioral task
behavioral1
Sample
source_prepared.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
source_prepared.exe
Resource
win10v2004-20240704-en
Malware Config
Targets
-
-
Target
source_prepared.exe
-
Size
80.6MB
-
MD5
c15c3f15dc3d4c29fcbca3c94fcf5975
-
SHA1
f1198dc55c7073e503ea912ae3df104065bb1440
-
SHA256
a671eec44a452dbfa969ced8f5a410c65fa2dda8a9218ee51dd1e500dfc736c2
-
SHA512
8aedf535907650152c1448db074019ba3050735ec3b9a22bbe87699c00204f52764800b14b6d18e4dec26e7ac289e61e006844ee6e44e5b054b66917583fa970
-
SSDEEP
1572864:fvxZQglX2OSk8IpG7V+VPhqb+TnE7Ulg8iYgj+h58sMw5IlWb9wqScJX0:fvxZxRBSkB05awb+Tfe25FSq9wA0
Score9/10-
Enumerates VirtualBox DLL files
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Virtualization/Sandbox Evasion
1Hide Artifacts
2Hidden Files and Directories
2Modify Registry
1