ba7df0b0d233fe1225e2ad8ef1ecd462d7c9eaf98bdcf9edcfc85a028d51aea8

General

Target
www.mxh4h.com_sample.bin
Size 3.1MB
Sample261023-ftwwaacc33
SHA256 ba7df0b0d233fe1225e2ad8ef1ecd462d7c9eaf98bdcf9edcfc85a028d51aea8
MD5 b4e11fd90220b1887b4d602d3906cac4
SHA1 70b74865ec300af117f394d395283264f9100a03
SHA512 7c29f4a5b509b369f9722e58a90a391c8252cd2cf9b7395a8123b39b46b0429eda2d7642935614c2380815f5fb09231fb14df6c0150e827dbbd83bf1fcd593b7
SSDEEP 49152:GS7Crkei40pGjr0+ltjUm34wgQCMcLHSPxblCaFlmSiHk1PPQCd5qy:GvrkG4G3Im34wnCMcrSfHzmSiQPYG5qy
TLSH
T102E5338DEC64B84BAC1D851D8372058F6B35817BCF8A1DF824E416AE9B83FED705D44A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.10.exe
- Size 34.6MB
- SHA256 af9252551de728af82071ebc62ceb819f20413b1943c069618385e68c0d4a404
- MD5 c1846a70037944acb65d314b5cb7c7c3
- SHA1 7e5ab3c0f8e1fbb00161fcff88ce0780ae44f342
- SHA512 ebe6822d4b5d8c02bc37336d8875dfd00264b4d577e751f3c00b42708b4c1fda893e4c2cfb29ae4b0ffa34ef665257b0cf78067ddfee4a2d6c844472487c0078
- SSDEEP 98304:g6ukQmHTpksa7ffG6slKxMzfM3nJ76KVfMYrvjgAW:bukQmH0HmKxofM3nl6UfMYrLgAW
- TLSH
  T124876F22B6428CD2F00285F45897BBA427FEFCB18AD1C71336E95B1E6FAE18C8D57055
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2