f4536ec7d3bf49cfec5fe41ba6eaaaf5f7ce23af1636a297e65ecc2890748742

General

Target
www.mxh4h.com_sample.bin
Size 2.8MB
Sample261024-e2977sw15l
SHA256 f4536ec7d3bf49cfec5fe41ba6eaaaf5f7ce23af1636a297e65ecc2890748742
MD5 2e143afb6b55554d838e2a2d30bcfe1e
SHA1 9ddeef9b00ed4037a628692963a71a1daed0ecbe
SHA512 980c218a554f88cc7b3009bc26db74ee09ef2f3c9f675586d951d434bf004331be2e37d24c213e66910982a4ad8a97b5b3d18a6d54ff70b73c3afbf09c95a2c5
SSDEEP 49152:RyuU3b+sFqMZuuu6Wfvdq90G4ABrNu1lZIGNdKK0PQ0PgEx2TXixHJQkdebb7:PUjFqquuu6f9Aau1lZIUH0PgExyDbb7
TLSH
T151D5331FE1DB0D84F9F42172718C2686FF016E8AFAD550ACF4B10966E7B3A1A5B84970
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.08.exe
- Size 30.5MB
- SHA256 0f58fbe5020606c5a1fdedf4f579c978305a853ac771d77c85d40aca44a03966
- MD5 bb7629e6e847530211a001ed305cd66d
- SHA1 a90d923c605d2675b2f96b5d6361e5c68ebb3361
- SHA512 9dbe7a8ccac1e02aefd19fcaadb70d1396e242f42ab4cc791f84d2135e351f71d93a13233c20a5611aaef1b6fc6e6fab3a7a4f04b39f21b32708fb9883b5147e
- SSDEEP 196608:8ZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYQ:DC/p+HuPOc4t
- TLSH
  T1A867181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2