a6dc751ceb6cf009d9474fb194ce28d1ebd6473e3069b7975bfced0c096d7a41

General

Target
www.mxh4h.com_sample.bin
Size 3.1MB
Sample261023-e7w8jazw3q
SHA256 a6dc751ceb6cf009d9474fb194ce28d1ebd6473e3069b7975bfced0c096d7a41
MD5 938f59066d2b066e042f1a159aa2e9d5
SHA1 3e27288b39ecdf89dc6621156cef8841d19c853d
SHA512 42ce7f72803bce9978c2afd4d542cfc79fa4171fcc1b196b666f8ace692d1b99fbdb04771a63f7f0e2af2720d5acb26c76317762a70ff2ccc470898fc3178d1b
SSDEEP 98304:ElKGExswz9I2lyPhSM+HCrJB6xmBtXLb5Ww2B+Djb:ElUV970hSM+HCrsmfXLN9jb
TLSH
T1C4E533E6E1ECD0C06CBEE065C79637DE9B2F82A8647B380DDCF692A159477700194E9C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.09.exe
- Size 34.6MB
- SHA256 9e4e051aaa1b18ea370210c438d77d5b324868ad8558f61f5ba3ac93a1ce8045
- MD5 2fa3738efc12050d1d87c41ac3d067d5
- SHA1 192bbd710a045cec87c2edc2f6518222036fe086
- SHA512 36fe0ff5391aee22393d66bfac6473d950c42262f728a4b68ca51c712559fbc6a02d6a414091c1542463708f636f0d152244dde1a026cfeb4a1d0a349a82fd36
- SSDEEP 98304:x6ukQmHTpksa7ffG6slKxMzfM3nJ76KVfMYrvjgAX:wukQmH0HmKxofM3nl6UfMYrLgAX
- TLSH
  T115876F22B6428CD2F00285F45897BBA427FEFCB18AD1C71336E95B1E6FAE18C8D57055
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2