60262d98b5fe74f3e8e9ee815d0e20894d43b7f38b27af490acf75e03785f80e

General

Target
www.mxh4h.com_sample.bin
Size 2.8MB
Sample261024-m7fvjsbt4n
SHA256 60262d98b5fe74f3e8e9ee815d0e20894d43b7f38b27af490acf75e03785f80e
MD5 31504d25dc73cc2c0778ad4f77ad3f6c
SHA1 9b92916f79b0eea93c47eab13427e4b620b8b2ed
SHA512 69d76fac9d0b7ff5687fdf9df8dc57182410b7c7d60122ac5eb4cd815e6d9c7630943bf10211c73849d5461c92be98de990820fdd9bd67a290f3dac566f9ce29
SSDEEP 49152:eQdk+gL00Zawjix/KqRzlKgWLbf3P3JVOup7BbpdrfC5izGAr8DhGqvPmHWch:eQu32Ky/KqjKRLz3hVV79pdrdGAqUA+d
TLSH
T11ED53397CA671794FB3490F85F1AEB50FF36918E502A90485CA603C1887704E9F79AF7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.04.exe
- Size 30.5MB
- SHA256 5775a02a5bf2e150f808a0179045136a3e03085289f05da3ba8ebc77f3fd1080
- MD5 8a74c738a949f6f3269b3c9a544646f4
- SHA1 10e1181463409ca6a900ff8bffed2b5b8f90d84a
- SHA512 872ea17c073d8f4fc7703dc463e78dd11dd6f70f53f7bb32de36a9cdb00b399bad194a45e2b762ee275ed6d0c0afe0421d3072be47591b0e6ebd962346c039f6
- SSDEEP 196608:sZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYH:TC/p+HuPOc4+
- TLSH
  T1D767181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2