31eef4beda8ca669d55e667b2905a304b322b3d2f4dfbe2c8bc7ef3eab85c9f8

General

Target
www.mxh4h.com_sample.bin
Size 3.1MB
Sample261022-sjs3vsvv8n
SHA256 31eef4beda8ca669d55e667b2905a304b322b3d2f4dfbe2c8bc7ef3eab85c9f8
MD5 94170e890623bd1201c82806d62d4849
SHA1 225e2a4024dc325c3bb35c1e862bcd027a27e7db
SHA512 7372234827e3aaf33b8ff9d3cba844d3fc7f4f8cf93b773cbe001eb28bd4c4f887ebd4315210ec67e7f88a84952d4533df2fdb5e1c7874091dbca0c6902c4424
SSDEEP 49152:jS7Crkei40pGjr0+ltjUm34wgQCMcLHSPxblCaFlmSiHk1PPQCd5qg:jvrkG4G3Im34wnCMcrSfHzmSiQPYG5qg
TLSH
T1D5E5338DEC64B84BAC1D851D8372058B6B35817BCF8A1DF824E416AE5BC3FEDB05D44A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.10.exe
- Size 34.6MB
- SHA256 5832c497a6cc3872ed466145ad1637eea8c68959cc1627143fd856e3d893fe04
- MD5 758b45fc1bc6661199ed5bb5a222bde3
- SHA1 20d0fe204f582186e201bf9390348f0d6b74fe03
- SHA512 21038df0b6eae3aa804ccf0b364a51e871969f5a3c2f75ff2038a336d3d61ac712fd23a9358b5e9c600de69bc3da393152f0c0c0fa393612ba7c830935a28c21
- SSDEEP 98304:g6ukQmHTpksa7ffG6slKxMzfM3nJ76KVfMYrvjgAl:bukQmH0HmKxofM3nl6UfMYrLgAl
- TLSH
  T144876F22B6428CD2F00285F45897BBA427FEFCB18AD1C71336E95B1E6FAE18C8D57055
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2