e96bbbfe7fbfe577b62d84bde24d5134b79a26316249f3cb184997bb9311072e

General

Target
www.mxh4h.com_sample.bin
Size 2.8MB
Sample261024-d88saastby
SHA256 e96bbbfe7fbfe577b62d84bde24d5134b79a26316249f3cb184997bb9311072e
MD5 19e9cffef47fa87a866b4667124c0b85
SHA1 8b4f6229e85ae2aadbccad4682db63a625f12e1d
SHA512 4eb412f4303d60354397ef8cd4878b567309fe7611b4a0e64c9a266cbc073b7a383c33daae7e81e5dd564ab07192d305bb8735e01fb21edd0fe57ee67ddb6f90
SSDEEP 49152:EyuU3b+sFqMZuuu6Wfvdq90G4ABrNu1lZIGNdKK0PQ0PgEx2TXixHJQkdebbV:IUjFqquuu6f9Aau1lZIUH0PgExyDbbV
TLSH
T117D5331FE1DB0D84F9F42172718C2686FF016E8AFAD550ACF4F10966E7B3A1A5B84970
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.07.exe
- Size 30.5MB
- SHA256 b81555006070d87335717d6827e19c08450c7c1f73289cfa596e1d503c4a0803
- MD5 e838ab90373b5df2d6ac41b17b7ec4c9
- SHA1 c325f70168093382e754da8b984d49de99d69a11
- SHA512 c0ae7f7808252d562f292bd4566f0f81298de6a7ff19690833a5fa8197c18d4daf95aa10d40ed68f3c3700d97efebf1741913728c9ad54fa695711b32fcc9b63
- SSDEEP 196608:TZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCY7:4C/p+HuPOc4G
- TLSH
  T1F167181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2