4268453953a85263980bd0426b12754351a14214fc0a86ffd0840293ca449576

General

Target
www.mxh4h.com_sample.bin
Size 2.8MB
Sample261024-eammtsfv91
SHA256 4268453953a85263980bd0426b12754351a14214fc0a86ffd0840293ca449576
MD5 cf9685b15bcc3b58682222ecf6c9f239
SHA1 fef20d983f6ef52937916c72d09482a9ee294d0c
SHA512 595d730af05be0093e7b41d3f9caf2cc8623f5260caba23f9b8bc71c586d28e5c564d4dc09ca732aa0e738afbab5de2a53708521c5989fda7ae349bef224c54f
SSDEEP 49152:AyuU3b+sFqMZuuu6Wfvdq90G4ABrNu1lZIGNdKK0PQ0PgEx2TXixHJQkdebbi:sUjFqquuu6f9Aau1lZIUH0PgExyDbbi
TLSH
T1BCD5331FE1DB0D84F9F42173718C2686FF016E8AFAD550ACF4B10926E7B7A1A5B84970
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.07.exe
- Size 30.5MB
- SHA256 9650f2986bc20f2c88884ef8b687bc59d1f1fb107fca51db7b2287ea32a856c5
- MD5 5a3ada70201344cac66a756960dd9ddf
- SHA1 c40768b02da76122a2ca95a40900e914bf08b135
- SHA512 a3cd1cdaa25712a13421e764e46b54b50049dc0574b9d5e7393b3e1bed82844746d6b3fd619f67bd582dc6a686fd8c3b2594aa8b967f76b7f98d3ab54ce7971b
- SSDEEP 196608:TZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYD:4C/p+HuPOc4+
- TLSH
  T17567181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2