8d0028b62ca80e242571c5b2032f8b426522d3b2159b5583e206f0abd7ed6827

General

Target
www.mxh4h.com_sample.bin
Size 2.8MB
Sample261024-eelakawz5j
SHA256 8d0028b62ca80e242571c5b2032f8b426522d3b2159b5583e206f0abd7ed6827
MD5 4c37aa685b19a822814b2d663568ed3e
SHA1 1d1234ddd75a753d4f617df464b16fe84c2de18e
SHA512 7c88a6d1be2c5ac0b2a184d1649acfab640df0bdec820e122988d3cfa6695d76dc848d44832a58991a389ec923dddf9050bf803b3027cd4b7963fcb2ccf587ff
SSDEEP 49152:wyuU3b+sFqMZuuu6Wfvdq90G4ABrNu1lZIGNdKK0PQ0PgEx2TXixHJQkdebbC:cUjFqquuu6f9Aau1lZIUH0PgExyDbbC
TLSH
T15ED5331FE1DB0D84F9F42173718C2686FF016E8AFAD550ACF4B10966E7B3A1A5B84970
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.07.exe
- Size 30.5MB
- SHA256 cf1e26314ded6b60f71572efd0f1292b45d71209c04d85540c60392643b93f28
- MD5 45e38e96a8427963501a3896a5828f30
- SHA1 95a6d553f537ed0395fd84eb07623cad21cfc5cc
- SHA512 04a46e105ecc4dc53478c2af92e0327f15113dd4a78f5fa6c03916edbaab240b659304907bbe2e3560d45fb401898cad8a9fc6bd451702cee27d01fc15f7d7c0
- SSDEEP 196608:TZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYg:4C/p+HuPOc4d
- TLSH
  T1B367181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2