56008380140649ae690db7681e1607fd484eedb04a2f9d13b252c2a98e3f571d

General

Target
www.mxh4h.com_sample.bin
Size 2.8MB
Sample261024-etclzafx2v
SHA256 56008380140649ae690db7681e1607fd484eedb04a2f9d13b252c2a98e3f571d
MD5 2c3598469c41b091f768263f846b5f7e
SHA1 16f7cd8896a773b31b6cdebc4167399e2a14a945
SHA512 b3fb7f5a5efb9fc7c5e4d30d9f6337436aa2b031ccb9c9c782559e8765857ce9a293dc84c8ad3aca7aca1b74c608a0b38a09c7d414fa1b0fcaecbbe8616a0a96
SSDEEP 49152:zyuU3b+sFqMZuuu6Wfvdq90G4ABrNu1lZIGNdKK0PQ0PgEx2TXixHJQkdebbX:RUjFqquuu6f9Aau1lZIUH0PgExyDbbX
TLSH
T126D5331FE1DB0D84F9F42173718C2686FF016E8AFAD550ACF4B10966E7B3A1A5B84970
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.07.exe
- Size 30.5MB
- SHA256 16b73eb0e2e1ed199069d74d63524cc59aeb7eeb395e0f434d7b6938c41c1b4e
- MD5 81ae5fbe947c9d5e4e4ac8e37762ed16
- SHA1 c71060463378dedca41413d04dd91e20405d70f1
- SHA512 61dfd965750f393fa35825875594465f02c39ee2fb5bf0eae77d22001fc82531fed16d6e04876cd4509b4b4d225d526c44a64a26cad90a21b281b684d916638f
- SSDEEP 196608:TZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYB:4C/p+HuPOc48
- TLSH
  T1C167181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation trojan exploit
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2