8f7b8d119ab44b4a29c9a141ce90e171f63033496333f541f90ddd4fa5db4e00

General

Target
www.mxh4h.com_sample.bin
Size 2.8MB
Sample261024-ml8cnsbs2p
SHA256 8f7b8d119ab44b4a29c9a141ce90e171f63033496333f541f90ddd4fa5db4e00
MD5 d4c85580cd989d820f418ee3f0107906
SHA1 d4f7af843cea2d37d92bad2a2ffc437250ab89a3
SHA512 5ec02e12d97b83f7ee4357b5e02accc0117c7a8eb7a3a6622c401816f2c99865c533fc73238ae995a4f8cd102ad3ed3f2eb40dcf948980d0c6376af06d5706b3
SSDEEP 49152:FyuU3b+sFqMZuuu6Wfvdq90G4ABrNu1lZIGNdKK0PQ0PgEx2TXixHJQkdebbP:bUjFqquuu6f9Aau1lZIUH0PgExyDbbP
TLSH
T1B6D5331FE1DB0D84F9F42173718C2686FF016E8AFAD550ACF4B10966E7B3A1A5B84970
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.03.exe
- Size 30.5MB
- SHA256 c7d4120e5c8fb0ecb226b071be766630f1a285cc137ae8fd7c9a8a14bbf68594
- MD5 922f6448de4a8e72b13c82109c9dd7f2
- SHA1 079f6a1580eabc5873d2a1064c1bb6358d4aa88b
- SHA512 47c11a37f003c0ccc27dbd1528658fb85bcdecb042331325367e1f55043a9eaf79fcb968170f63c31f9ea124a1584bd68bc9635b8a980a4841547b5f3d08f81d
- SSDEEP 196608:zZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYw:YC/p+HuPOc4N
- TLSH
  T1DF67181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2