1e506b975b7fcab3db1a780b4f97fe20258839d9b902ba1f31f5d582c5662625

General

Target
www.mxh4h.com_sample.bin
Size 2.8MB
Sample261024-hth1jaee22
SHA256 1e506b975b7fcab3db1a780b4f97fe20258839d9b902ba1f31f5d582c5662625
MD5 2f84fbe5b37d86e38962ad7703bf039a
SHA1 d3f9eabd8a3f50da220e348d0d83b528f7708451
SHA512 d69827176cfb47ae4963fd0d8fd39a928059ff0c7c6326509344059b7f9659c86e947b337cadfdb0d0eb8c4b184f7b9be8e307452c188265900f6f234953f49a
SSDEEP 49152:fdcB+zKw8pG3d9mY/RJDXe86hd/u8/4RDiaHwxl8sBQL5tzuRB30gS2fdw+Ml:fCBEv8pUdUa3Xe86hd/GDuxl8sBccRVG
TLSH
T1CAD53390CA0FD61AF3199075062B30ABFBB962843C7765C84C7C129748A2CDD5FE9DB9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.12.exe
- Size 30.5MB
- SHA256 0f3377f853208eadc667788f350101e1132bbe49efa6167a73ef57d53149d1ee
- MD5 163d2cebf1df3759c7d0bc2996d9b226
- SHA1 c924e85b542ddf7bd1528ebfa4e61d670899fa63
- SHA512 6f83559b33b3c85de10220dc35d9f12a1647dceac7ffa8f908205c09a59bf4b9720824c78485ab90c20c6d5abc4d4bebfbd3fcb0ddbf46de4039014bba8d650d
- SSDEEP 196608:PZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYY:8C/p+HuPOc4l
- TLSH
  T12967181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2