0926bc301c8c94c691517f1390b5c5b9d9d68a2ae85a22e088923fd18665fd67

General

Target
www.mxh4h.com_sample.bin
Size 2.8MB
Sample261024-exmakssvaz
SHA256 0926bc301c8c94c691517f1390b5c5b9d9d68a2ae85a22e088923fd18665fd67
MD5 35acd734d70139d48c62ca4c2f0b0bdf
SHA1 1796623d029a7bfbad12999e1c589eb8abfd225b
SHA512 471e8cdd0c87020e1dea15ac8403f1b7e2bebc10ff7c615ddffd31b04d44b53294f1056f547ba9f18441b4e1265df17cbd0303340b98e6fb6463c9e9f49862e1
SSDEEP 49152:YyuU3b+sFqMZuuu6Wfvdq90G4ABrNu1lZIGNdKK0PQ0PgEx2TXixHJQkdebb5:UUjFqquuu6f9Aau1lZIUH0PgExyDbb5
TLSH
T1B0D5335FD1EB0D94F9B82172718C1A86FF012E8AF6C5509CF4F10966E7B3A1A6BC4970
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.08.exe
- Size 30.5MB
- SHA256 498fd4bdbf4abf7595b1dff63524c21df2fa0ab3c72564f36e9c117095f97227
- MD5 fe2e7ca088025d5d74862f2527d06761
- SHA1 ee324736e81727bd0c19c0611a3aa84e23c85e18
- SHA512 6e3538d3e81044b074e7060087bdfcca2b11175ad874a0bd934691d0a8856f89e5b51ee31d3fd603c17b33e0b46946c60f1e83f2afbcf385208538e9b6b1c512
- SSDEEP 196608:8ZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYw:DC/p+HuPOc4N
- TLSH
  T15B67181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2