a921c33c5998b4b19f342303b4b9024b34c83e408aca7b3929fdd81fe5031b01

General

Target
www.mxh4h.com_sample.bin
Size 2.8MB
Sample261024-mfqwfaa17n
SHA256 a921c33c5998b4b19f342303b4b9024b34c83e408aca7b3929fdd81fe5031b01
MD5 0e3dd68701268e2a161ee9b509870145
SHA1 06a74045f763b21f68dd59ad760dffffc3264425
SHA512 0834c2a2cbac6889662cd728f6d3b4a0bbf138dca71a486176a414324ac75930c2bf9dc472b89d18bfbf8ea4da24b4d962e4a8755a221dcb65c3f4a25c6b0a25
SSDEEP 49152:TyuU3b+sFqMZuuu6Wfvdq90G4ABrNu1lZIGNdKK0PQ0PgEx2TXixHJQkdebbX:xUjFqquuu6f9Aau1lZIUH0PgExyDbbX
TLSH
T1C9D5331FE1DB0D84F9F42173718C2686FF016E8AFAD550ACF4B10926E7B3A1A5B84970
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.03.exe
- Size 30.5MB
- SHA256 96807bb3de0a770cd115f3c401eba54da35bd61fcd198bc7608961956900c61b
- MD5 946f0755bc450604f50f3ca55d978316
- SHA1 2fe5803cf76720aedd4263471be2d9adcb0a10f6
- SHA512 b62ba70899f64683367e9cbe33063a4af8e3cf36088cb3559ccdde2aae961353968647694c2cea9a6f85b8055b9ac985681a925bbeef28b44416ef74f4221afc
- SSDEEP 196608:zZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYa:YC/p+HuPOc4n
- TLSH
  T19B67181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2