General
-
Target
source_prepared.exe
-
Size
80.2MB
-
Sample
240708-anw17swaqc
-
MD5
9ebf09185e4a1e4a0a55d41edba444d3
-
SHA1
2d903a8225013efaec3291c3c6c6b44a27000f0b
-
SHA256
61eac8558107ad07e319c442c607f625422390dd1372ab07273573cec3eb6438
-
SHA512
9d113de190eedf53b6a38f1bfb9adb60d6562a46cf739d01f90e3566495d84a8567e58d5927d7c82ef6e5b3b2d43f73d1b535441b2d7d0ef3db66d3bc01f2a06
-
SSDEEP
1572864:0vxZQgl5bSk8IpG7V+VPhqxDE75lgwOiYgj+h58sMwpW698+zcJz6:0vxZxXSkB05awxEeww5NF98R6
Behavioral task
behavioral1
Sample
source_prepared.exe
Resource
win10v2004-20240508-en
Malware Config
Targets
-
-
Target
source_prepared.exe
-
Size
80.2MB
-
MD5
9ebf09185e4a1e4a0a55d41edba444d3
-
SHA1
2d903a8225013efaec3291c3c6c6b44a27000f0b
-
SHA256
61eac8558107ad07e319c442c607f625422390dd1372ab07273573cec3eb6438
-
SHA512
9d113de190eedf53b6a38f1bfb9adb60d6562a46cf739d01f90e3566495d84a8567e58d5927d7c82ef6e5b3b2d43f73d1b535441b2d7d0ef3db66d3bc01f2a06
-
SSDEEP
1572864:0vxZQgl5bSk8IpG7V+VPhqxDE75lgwOiYgj+h58sMwpW698+zcJz6:0vxZxXSkB05awxEeww5NF98R6
Score9/10-
Enumerates VirtualBox DLL files
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Virtualization/Sandbox Evasion
1Hide Artifacts
2Hidden Files and Directories
2Modify Registry
1