15deaeb8897cb82f96b6c3a1135cf11a78adee610cf7e2048babddeb533f8d4f

General

Target
www.mxh4h.com_sample.bin
Size 2.8MB
Sample261024-f75qcaxt7n
SHA256 15deaeb8897cb82f96b6c3a1135cf11a78adee610cf7e2048babddeb533f8d4f
MD5 4945bc8997c7ebf59ec043460d19a9f8
SHA1 7cac296389525baa0c60e816cd9f8a38d6399382
SHA512 cf4802da79ac03fcc9426d639b273cfb54d865ca2d7d473f1abad5b1ab038580334adf125383829e75a850857fb0a009f8c4ac55e969b135afde3ffb4f5b1207
SSDEEP 49152:5ELdccyp/n/GYj0OOHhYNEJI5XvilQyqo/S9z/+Qxt/7klWaax9wvyDPcF:KicypfByHqEJI5fixqBN7k0aa/waDPS
TLSH
T147D5334B80ABE3C1DA768D370F206035B6A45EB478982DDCB5CA66C58931E7C48D7CDB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.10.exe
- Size 30.5MB
- SHA256 4c4c7db105e726c00f28b4b4e1adfdaa7d6d9fc3d6823dce03d0464dafded739
- MD5 cfece4f1b124c69c1e2bfba23321931c
- SHA1 00524f7c378659420129419516ce5577c32f0823
- SHA512 8ef5f6ce213d1c2c1a7e2ae4fd9165ce2bd34fb02a5c53815e76b58b323530c1c778131533a2de3e28769fc229f0791e14da41bd7916f0124938ee335b46467e
- SSDEEP 196608:NZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYs:qC/p+HuPOc4R
- TLSH
  T19A67181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2