524d27be59efd29564fd6ba9194162499fe5e200b262dd43f3466071ec1b8855

General

Target
www.mxh4h.com_sample.bin
Size 3.1MB
Sample261022-ytwvdstxev
SHA256 524d27be59efd29564fd6ba9194162499fe5e200b262dd43f3466071ec1b8855
MD5 ca3237748e734383b797e0861d0c1201
SHA1 821968ac1cb1bb588060c5dfc54aae4039978365
SHA512 308108ff5f2aa04da86867bf855d62e4ee5203e7be83c92cce939f879f25b3c61973e7ad01f517a7d437e6bf0dc089eb4d177d011e0d64f47121287726f36817
SSDEEP 49152:oXssrDqmCxbmylFyHoA00u9UPFyeNj0CcwjTC1NJ9T1HDVCiketNKdfDBCwD:gsdZm2ABuSPMeZ0fwjmDXTHZ1odfUm
TLSH
T143E53394A0AED5C952BF9416816039DE070EDB2D7EB1312B5CFBC397248B7DE618D88C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.02.exe
- Size 34.6MB
- SHA256 801c8ed51f6b2bcb58e04f694a5771d95b2db06813d0776be19d06a3f7689745
- MD5 f1a42c64016a163a94521368a1ff925f
- SHA1 7edeef8b9a6ab52034cd1bbf123824bd8549c2e8
- SHA512 5a5e0fcd8120a735da2e7d450beb1b2068f070627e273e1c3b4dba38f0d2c5d383cc725cb4f54882cd581a08dc99b7f7820b74400fbe6fc133d2263bb78859b7
- SSDEEP 98304:n6ukQmHTpksa7ffG6slKxMzfM3nJ76KVfMYrvjgAH:6ukQmH0HmKxofM3nl6UfMYrLgAH
- TLSH
  T134876F22B6428CD2F00285F45897BBA427FEFCB18AD1C71336E95B1E6FAE18C8D57055
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2