7259909543d184bcad0eca1f050c244d5aa77df0eeb81e8b4a37625f4be8c974

General

Target
www.mxh4h.com_sample.bin
Size 2.8MB
Sample261024-jkpx6axy4p
SHA256 7259909543d184bcad0eca1f050c244d5aa77df0eeb81e8b4a37625f4be8c974
MD5 f42331a1502bd3848eb744b712203d3e
SHA1 fb5f97201d89c7933ce33747c62d9eb4f1729def
SHA512 3e7bc00d9eaa15a9fc8029455d18d246aaa3cbcb8acd5075371d3ac61694a944f0f3d769aaff81168d272ee3897c4988feec4cdaf86db220913576eb47a1e7c7
SSDEEP 49152:SdcB+zKw8pG3d9mY/RJDXe86hd/u8/4RDiaHwxl8sBQL5tzuRB30gS2fdw+Ml:SCBEv8pUdUa3Xe86hd/GDuxl8sBccRVe
TLSH
T11AD53390CA0FD61AF3199075062B30A7FBB962843C7765C84C7C129748A2CDD5FA9DB9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.13.exe
- Size 30.5MB
- SHA256 6399ec6ba1e498c7697f92c37236fb5a6d2f4df61553efd792f94504165a3871
- MD5 73762f1628d0c4641d2fb3f4d4d8d925
- SHA1 1c868e57d303ee7421ad894fa00ce2ac0bfa2e62
- SHA512 fa1cf95e604a32535c081e1ee719f1291be1453d4f70b274be56cdc5b9a56e0d83972fe8bd37cb990cbe6f5c447939ed873ef81a6771b3b33bd62fe68f39dc23
- SSDEEP 196608:CZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYl:ZC/p+HuPOc4Y
- TLSH
  T14367181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2