22c15a3c928faf5f211d1c65fca5056a292e9ba3a6d970329b2c1adcc13a9cfd

General

Target
www.mxh4h.com_sample.bin
Size 2.8MB
Sample261024-mexbtshs71
SHA256 22c15a3c928faf5f211d1c65fca5056a292e9ba3a6d970329b2c1adcc13a9cfd
MD5 66afb8f75b348a6e66eaecbbed92d679
SHA1 a2e23af5fe0db60b4cbc9d06b33aa8ca63829996
SHA512 52f0b3eb01e8240c659d8a77a204e1d9522227002d46e484b4f3ea52a4acda579026488b763bd508d4e8e85552528e1b9857626ab9ede67ceb66e640285934c8
SSDEEP 49152:byuU3b+sFqMZuuu6Wfvdq90G4ABrNu1lZIGNdKK0PQ0PgEx2TXixHJQkdebbf:JUjFqquuu6f9Aau1lZIUH0PgExyDbbf
TLSH
T161D5331FE1DB0D84F9F42173718C2686FF016E8AFAD550ACF4B10966E7B3A1A5B84970
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.03.exe
- Size 30.5MB
- SHA256 14c46c90102f2ef4429a84494961b4f37c6b1119d861ac0e36685ca16648539f
- MD5 c7bf032782cfe13c953557dfa4547c62
- SHA1 d8654c45147f1df73746d6df1e28aa488d03bb4b
- SHA512 b02f88f5ba6926d7653eea9933c38018f7eb0541a5982bb1779fc4339cddbdfb65f30e427402ff78fc5e5529d0868f5ca8ee367509b9fd1330f3e1e21d94085d
- SSDEEP 196608:zZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYC:YC/p+HuPOc4/
- TLSH
  T1F967181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2