General
- Target www.mxh4h.com_sample.bin
- Size 2.8MB
- Sample261024-mkfw2ayv5l
- SHA256 50d5cb712b5fc8684088b8aedb1c74e0455fcecf1b32a547782f97abe1526f06
Malware Config
Targets
-
- Target install.2.0.03.exe
- Size 30.5MB
- SHA256 4ccb4f9f1c2a01fea067b8059da7f9a37b8f46f6ad597ab45c2fd5ec298b181f
Score10/10UAC bypass
Windows security bypass
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Drops file in Drivers directory
Modifies RDP port number used by Windows
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Modifies file permissions
Adds Run key to start application
Indicator Removal: Clear Persistence
Clear artifacts associated with previously established persistence like scheduletasks on a host.
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Screensaver
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Screensaver
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1File and Directory Permissions Modification
1Impair Defenses
2Disable or Modify Tools
2Indicator Removal
1Clear Persistence
1Modify Registry
4