008b0bbd6602f84aa97ff8fd06ce03c9132e2b5a7e6457c8c88b5dbf77a78078

General

Target
www.mxh4h.com_sample.bin
Size 3.1MB
Sample261022-wss11aah77
SHA256 008b0bbd6602f84aa97ff8fd06ce03c9132e2b5a7e6457c8c88b5dbf77a78078
MD5 59d15261efcacff1a5be6cebada9d300
SHA1 78b7efa935781892ff7471fe38859f44ef9ead69
SHA512 d947c292e2427bcc1ef773e87989fe7e0a4e3c2545ba413d6d46ce7892366d89a383a76b9935f2e3596f90cb72527807a550fa383fd1c526c0ca05ac2e985849
SSDEEP 49152:VXssrDqmCxbmylFyHoA00u9UPFyeNj0CcwjTC1NJ9T1HDVCiketNKdfDBCwJ:psdZm2ABuSPMeZ0fwjmDXTHZ1odfU0
TLSH
T108E53394A0AED5C952BF9416816039DE070EDB2D7EB1312B5CFBC397248B7DE618D88C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.02.exe
- Size 34.6MB
- SHA256 cfdf9dfe52da7ab8a66a3d0d3a2e69bb1f30728beee4c522860c90ae5600dda4
- MD5 2034f51807b02723dbc89a84e3bea361
- SHA1 7cd6b5ba691d5f5248f0dafcfd0a736581bd56af
- SHA512 6a672abaf4e970d9abf01fd0f31afd6222fe33e395372eeb3983c7d9e89251d95bc3c00bf29e36471ae52fef26d9d3a1565102a27e580c3f0d7fea07a2247acd
- SSDEEP 98304:n6ukQmHTpksa7ffG6slKxMzfM3nJ76KVfMYrvjgAW:6ukQmH0HmKxofM3nl6UfMYrLgAW
- TLSH
  T1D9876F22B6428CD2F00285F45897BBA427FEFCB18AD1C71336E95B1E6FAE18C8D57055
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2