2138a5d9f3eb5ae33da6615bd4e951c42138082f404b958740e5a0d8b82421ee

General

Target
www.mxh4h.com_sample.bin
Size 2.8MB
Sample261024-jp24aaxy6m
SHA256 2138a5d9f3eb5ae33da6615bd4e951c42138082f404b958740e5a0d8b82421ee
MD5 43673b7b944894efc56ac9d7b36843a5
SHA1 fbb2e092f74a9e95f61736a36b93105ab32cf20d
SHA512 fde0c7a480b31d05c3a190e0e692e62248635666eb20b8e7c6c28c3ab54b56a3999151e31292c4d0f5f6ebe548ff962d00acf85020092d530dbfa43f15ff7f71
SSDEEP 49152:7yuU3b+sFqMZuuu6Wfvdq90G4ABrNu1lZIGNdKK0PQ0PgEx2TXixHJQkdebbP:pUjFqquuu6f9Aau1lZIUH0PgExyDbbP
TLSH
T132D5331FE1DB0D84F9F42172718C2686FF016E8AFAD550ACF4B10966E7B3A1A5B84970
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.14.exe
- Size 30.5MB
- SHA256 ee0b41ddc74f9dd5f02e465977d7f4d9fe42457b5f5e02146b08d4c39b140521
- MD5 618ff9fe82ea906a1128763ada88fb63
- SHA1 9f6d4fc72ed4a3dfed3e06293a166904a2da1cdb
- SHA512 25a319ba26b2fe6b087fcfc13199eb73e5c03bbf8d20d4a4ee3856833fdedb5176840d6bd339304ddd8d3a82c1722c8255a379a485f3b5801aa1054d3ec8ebe2
- SSDEEP 196608:iZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYb:5C/p+HuPOc4q
- TLSH
  T19767181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2