b400c6a613ac58fa7c25be50de4491c3961483ae38dfcacc47c10ab383441012

General

Target
www.mxh4h.com_sample.bin
Size 2.8MB
Sample261024-m2x7msbs9q
SHA256 b400c6a613ac58fa7c25be50de4491c3961483ae38dfcacc47c10ab383441012
MD5 cb2c1056617b59af844168e7a9058dd6
SHA1 3fb1f0905b557fa9710cd0c8ac4c8091c693662e
SHA512 419a8ca1be47e569332f9a0ed25b8e5190d79d673656ea9cc542098781d509b085295d42abced5b91a145f4e1f2610b869a643498a9d025a86d855b49ca43543
SSDEEP 49152:tyuU3b+sFqMZuuu6Wfvdq90G4ABrNu1lZIGNdKK0PQ0PgEx2TXixHJQkdebb6:TUjFqquuu6f9Aau1lZIUH0PgExyDbb6
TLSH
T12DD5331FE1DB0D94F9F42173718C2686FF016E8AFAD550ACF4B10926E7B3A1A5B84970
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.03.exe
- Size 30.5MB
- SHA256 52398cdcb3353edc5f25656fec0050c20ad95a2ac1990b1dca197a65ae10d683
- MD5 4f7c8282d716a6d4743be00cf779e949
- SHA1 6f71ff95bc82070a3976f9aa9f00f13efd89f3e1
- SHA512 a1895556585e4ba163a591f8de33a7d16939f8ad3f7e7516679c43e72c58d72f51378d6f46b092ac7e56bbae4cd820f4a157a70a08c0500d9f874bb4a6498d12
- SSDEEP 196608:zZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYe:YC/p+HuPOc4j
- TLSH
  T1D267181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2