37e1fe4006103a5e175884e7570af7da6388cc98438a96b5b5513561455da0c8

General

Target
www.mxh4h.com_sample.bin
Size 2.8MB
Sample261024-md4drayv2r
SHA256 37e1fe4006103a5e175884e7570af7da6388cc98438a96b5b5513561455da0c8
MD5 80fb161f73306ad1fcd04c91bc9b0401
SHA1 38f14341e06a21e3c8efc0b9b4c8527807dde746
SHA512 92d874f94ed67099e2260563966425e1d583c7c0319c6aa2d19114437ca4811f447014b33397c7598dd62f40e953f2456330a9f87903664b5be351ccfd53ed82
SSDEEP 49152:YyuU3b+sFqMZuuu6Wfvdq90G4ABrNu1lZIGNdKK0PQ0PgEx2TXixHJQkdebby:UUjFqquuu6f9Aau1lZIUH0PgExyDbby
TLSH
T1C0D5331FE1DB0D84F9F42173718C2686FF016E8AFAD550ACF4B10966E7B3A1A5B84970
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.03.exe
- Size 30.5MB
- SHA256 0f45eee7a56759b3e735bd9478a2de9f62de02b8c302b48dea03f466c7828df2
- MD5 2bde57238e944c2595cbef35890b43b5
- SHA1 26681238d5229d8c2809795610b7c26792db6204
- SHA512 b3f1363d103edb1670bd54a774f6914207f9c9d0c496b15e5a9b73796f3165b83747d83d0349dbee17bf8b76be33ab6f09c6cab2ffb18224e6ff85c7af718691
- SSDEEP 196608:zZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYF:YC/p+HuPOc44
- TLSH
  T10B67181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2