79634196f85e6c0a68881e59ce50b02c087096ae3dc8e3d1d05f07500de45d3b

General

Target
www.mxh4h.com_sample.bin
Size 2.8MB
Sample261023-pppqvady8n
SHA256 79634196f85e6c0a68881e59ce50b02c087096ae3dc8e3d1d05f07500de45d3b
MD5 87b9f0f7e3a329ac8873af053b4097d3
SHA1 5b1b4bb14df5089d222ae8d6cc1fb5a327a05936
SHA512 0d6ba93111c091655bdf65e56e87c522121e2f6a9c96acc40a711aebbc59cade52c79311cbdce3c4dc391f0e2eb51078b42ccf5dd37e55c7e4a3714bc5329370
SSDEEP 49152:syuU3b+sFqMZuuu6Wfvdq90G4ABrNu1lZIGNdKK0PQ0PgEx2TXixHJQkdebbl:gUjFqquuu6f9Aau1lZIUH0PgExyDbbl
TLSH
T170D5331FE1DB0D84F9F42172718C2686FF016E8AFAD550ACF4F10926E7B3A1A5B84970
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.08.exe
- Size 30.5MB
- SHA256 78efeaedf5bdd63b65c0c88950bae227b35e0c97bdf172336c39508d2b5ebb64
- MD5 e38bfa624a75ba5dc042988d2b972336
- SHA1 cb099bc3515aef5d8fcbaf0d37e338be0c55965c
- SHA512 c9f4df96944357a750cb277bca6e496fdec0653f5b87233cc36cbcf41c2ddc9787682812078a6a51e5871d20d320ef10efd170f1db5747b9914b2ee4f2f441d7
- SSDEEP 196608:8ZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYn:DC/p+HuPOc4W
- TLSH
  T1B967181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2