29fc0ca68e1591f6aae3b3185be0b02dd913f5712287c7d4e26d003a0e18ade8

General

Target
www.mxh4h.com_sample.bin
Size 2.8MB
Sample261024-g96absed75
SHA256 29fc0ca68e1591f6aae3b3185be0b02dd913f5712287c7d4e26d003a0e18ade8
MD5 986e00823e1475261509d2ab4ecd5642
SHA1 4577d59642dbe09b7ee223dcec38eaf2eee6d2b5
SHA512 87bb760a547491182e8887007424fb9e4c8fdf58ac0024156e64a24be6cdf907394ea188b367bb3239a14d8702ecad28703caf25a53f7cb0d09f34dcd4228ec9
SSDEEP 49152:xyuU3b+sFqMZuuu6Wfvdq90G4ABrNu1lZIGNdKK0PQ0PgEx2TXixHJQkdebbo:vUjFqquuu6f9Aau1lZIUH0PgExyDbbo
TLSH
T150D5331FE1DB0D84F9F42172718C1686FF016E8AFAD550ACF4F10966E7B3A1A5B84970
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.11.exe
- Size 30.5MB
- SHA256 a678183d12aaab769501ebdbb1c5c4f06097510988e42b11f258d0ba057ee581
- MD5 6c7c7a55899aa2d5ad049169cd951e0b
- SHA1 1a4576976ecd90878f979f72f234d17795f8cec3
- SHA512 e8076b5ddd9cc58c9940c9445e9685cd365e67efa62fb29a76bfca1fbb7ea929a50b18a204a922da2150dd54831a9b373e151c2d175c7ee4fe7db38d49e7721e
- SSDEEP 196608:hZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYk:WC/p+HuPOc4Z
- TLSH
  T1CA67181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2