1d78817d9ded855ad45da13a2e1700c5fad82f6a5d459c1cfaf86e0f899c6f77

General

Target
www.mxh4h.com_sample.bin
Size 3.1MB
Sample261022-t7ee2sdx5w
SHA256 1d78817d9ded855ad45da13a2e1700c5fad82f6a5d459c1cfaf86e0f899c6f77
MD5 a15a7a4d7ac6448fd50504289050cc27
SHA1 383e83ffad50466833017435776c6a1be0500f62
SHA512 55b5492ed15ae8b80894d6c7681fe13fd69fd24c8c04d1402594ff14027b6db45751d92c59f6aa47cbdbb55f3e10ebe37353e7f21b0b198202497da865a1c47e
SSDEEP 49152:xXssrDqmCxbmylFyHoA00u9UPFyeNj0CcwjTC1NJ9T1HDVCiketNKdfDBCwTzU:1sdZm2ABuSPMeZ0fwjmDXTHZ1odfUizU
TLSH
T121E533D4A0AED5CA52BF5416816139DF070ECB197EB1712B5CFBC38A248B7DE618D88C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.02.exe
- Size 34.6MB
- SHA256 edc9f715ad974b7589ef18e876f7df24c17822a33aabb7289e2baee541d95913
- MD5 3c65a8103f4f70e0b70c5b8cad66c39a
- SHA1 ec2c507133f48278bd90d72ea669cbccfa834547
- SHA512 94da2e5634ee25dd5ff3dfa256f67942edf6f655c8db470ab19946e98cf533efc0e5525036db655a642e0c0bc0fe8d57372d990074b2984f35bdcf01f427d66e
- SSDEEP 98304:n6ukQmHTpksa7ffG6slKxMzfM3nJ76KVfMYrvjgA7:6ukQmH0HmKxofM3nl6UfMYrLgA7
- TLSH
  T1FC876F22B6428CD2F00285F45897BBA427FEFCB18AD1C71336E95B1E6FAE18C8D57055
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2