98179afd98d2bce064c5bbe1dd0a68b6e87c721665b456cede81daea081b13a1

General

Target
www.mxh4h.com_sample.bin
Size 2.8MB
Sample261024-e35dcafx5y
SHA256 98179afd98d2bce064c5bbe1dd0a68b6e87c721665b456cede81daea081b13a1
MD5 b0cf026599317da764b3938b1c6263e7
SHA1 beb549bf68013400593227f268bf977d0c63db13
SHA512 01ebfa263550ef753b172e7c9f043e93cece933426f9de46bca79c1bd78e3358f32b5d1eeb1577c35ee9319eab33b10f7bad284721cd260344e795e464bbbbb7
SSDEEP 49152:PyuU3b+sFqMZuuu6Wfvdq90G4ABrNu1lZIGNdKK0PQ0PgEx2TXixHJQkdebbc:VUjFqquuu6f9Aau1lZIUH0PgExyDbbc
TLSH
T1CAD5331FE1DB0D84F9F42172718C2686FF016E8AFAD550ACF4F10966E7B3A1A5B84970
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.08.exe
- Size 30.5MB
- SHA256 215c17875ae238dc66581773ef533b0b7110c62f1e88063957b7b3c18b06db85
- MD5 6f30c3eb0276e8cd71c40c0d8a44a08a
- SHA1 052df4cf859e6ff6c5f702c3ea26def83b6a3af8
- SHA512 9ca6a24ef591a2fe893cdbf560860596474b195a7be405fdfa275ceadb5a505d1b92d6b1e811cdccdd263a7285e71183010c15c40417e0bfade80fd0322076dc
- SSDEEP 196608:8ZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYe:DC/p+HuPOc4j
- TLSH
  T10467181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2