c367912c3a9d32e8baf8b375eda0d5739dabf52fc61aeb689abb181c0bf59331

General

Target
www.mxh4h.com_sample.bin
Size 3.1MB
Sample261022-x8h2eae12w
SHA256 c367912c3a9d32e8baf8b375eda0d5739dabf52fc61aeb689abb181c0bf59331
MD5 4515e0219d9324404ed4fe7f6441cfd6
SHA1 ffd3f7085535b2bb6a8ccd02566851f3e03f1abc
SHA512 cbf92976c4d09ef3baf9c30aa21c0de6e8023c0e0533cda300e7546f330f0a6bb1deebf01b89ba16bfde422537c3cc46ad74b5780bb09771c3b16949f2786b83
SSDEEP 49152:gXssrDqmCxbmylFyHoA00u9UPFyeNj0CcwjTC1NJ9T1HDVCiketNKdfDBCwX:IsdZm2ABuSPMeZ0fwjmDXTHZ1odfUy
TLSH
T11DE53394A0AED5C952BF9416816039DE070EDB2D7EB1312B5CFBC397248B7DE618D88C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.02.exe
- Size 34.6MB
- SHA256 32605013ffa40c145d85b2cdafa449f941f4ca1d63d41dc456c3bc6276bbcd6e
- MD5 8890b34f6d47535b72d32c049bdc7957
- SHA1 ee556c2bff8857c35156fcfbefeae918877016dd
- SHA512 8969fb7f4b8d80f2988ad330c2cc4577a6147e3260967abf5df6625dec69f04d7241430e817b425101255e1ecfc228a2b990a9e6af6b677ded5b67a1a9302932
- SSDEEP 98304:n6ukQmHTpksa7ffG6slKxMzfM3nJ76KVfMYrvjgAN:6ukQmH0HmKxofM3nl6UfMYrLgAN
- TLSH
  T146876F22B6428CD2F00285F45897BBA427FEFCB18AD1C71336E95B1E6FAE18C8D57055
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2