ed862ebd5a8cb9431afaf4123ea060544beabeff0957bb1ecd438409240e0b8b

General

Target
www.mxh4h.com_sample.bin
Size 3.1MB
Sample261023-e6zbhahw7w
SHA256 ed862ebd5a8cb9431afaf4123ea060544beabeff0957bb1ecd438409240e0b8b
MD5 cd1cc0998d12063eee401a66cd5e1c46
SHA1 bd6a40bbd1ffb60905cdae97a8acf798a75e1f29
SHA512 e247b9223a621d86cb516710b34e786f32adfbaf7cc5f31d6f838f8376fc8895bd1e9db07aebb88a8b13fb26208cdcbcdfd4866da4cce45f37899f27819f631c
SSDEEP 98304:vlKGExswz9I2lyPhSM+HCrJB6xmBtXLb5Ww2B+Dj+:vlUV970hSM+HCrsmfXLN9j+
TLSH
T1D7E533E6E1ECD0C06CBEE065C79637DE9B2F82A8647B380DDCF692A159477700194E9C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.09.exe
- Size 34.6MB
- SHA256 4b84810e8a2eaee1cc049efea0db08fbd3e460d85fee038307e16a162a811b37
- MD5 e12c09d4b6ae8d52401cf8b2b3467e8c
- SHA1 6f53bbc1c3a5a93198b9001052eda65a28736f0d
- SHA512 8b27ef05aef2ba9fa605e2a6cb3c3a17cf7a93d200dd5cddcf8bd147d8279524665f4bb39f721e8ec9b7b67a4ac61aac1d31323b7f60818ce1fd1d5657d57c20
- SSDEEP 98304:x6ukQmHTpksa7ffG6slKxMzfM3nJ76KVfMYrvjgAP:wukQmH0HmKxofM3nl6UfMYrLgAP
- TLSH
  T10D876F22B6428CD2F00285F45897BBA427FEFCB18AD1C71336E95B1E6FAE18C8D57055
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2