96fb71a920316778be2a90697015af815a3c140cfa55002b4a16c90f17527262

General

Target
www.mxh4h.com_sample.bin
Size 3.1MB
Sample261022-vs627agv7j
SHA256 96fb71a920316778be2a90697015af815a3c140cfa55002b4a16c90f17527262
MD5 e08bfaad24a6eafef052512d129c8dc4
SHA1 53c9fb933c3f1fbf87b79ca7934cc18188732529
SHA512 f2da524521874f0d2b3906bdea4ba806b7f939cebd7e1c96868a11caafed98a076c0324bf840b87d73e060b05c42340f68912dac40dc5cee0c8fe75dfaac4988
SSDEEP 49152:KXssrDqmCxbmylFyHoA00u9UPFyeNj0CcwjTC1NJ9T1HDVCiketNKdfDBCwT:+sdZm2ABuSPMeZ0fwjmDXTHZ1odfUG
TLSH
T19AE53394A0AED5C952BF9416816039DE070EDB2D7EB1312B5CFBC397248B7DE618D88C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.02.exe
- Size 34.6MB
- SHA256 95f8a3015d645553ff25e34528fcd9674734e04e4bda7a839130b0548ac5a2b6
- MD5 de1e6532bd00d0c42c2851e1f49f0ae4
- SHA1 9c1740a2e651b73ce00499ed1864e1aa122c7d63
- SHA512 c2182b10276133262ad751d85bd7b5561b8c9dbf62047993cb047f04fca9649fdf741811ab430e6d83ea1a24c0d20d143b37ab86c03aadfb1ba6cc656c75c72b
- SSDEEP 98304:n6ukQmHTpksa7ffG6slKxMzfM3nJ76KVfMYrvjgA4:6ukQmH0HmKxofM3nl6UfMYrLgA4
- TLSH
  T1D8876F22B6428CD2F00285F45897BBA427FEFCB18AD1C71336E95B1E6FAE18C8D57055
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2