7a04efed6cecf9edf468f31e9fe064bc31f5918f465da00338e4c1fb7fe65866

General

Target
www.mxh4h.com_sample.bin
Size 2.8MB
Sample261024-mt1mssbs6l
SHA256 7a04efed6cecf9edf468f31e9fe064bc31f5918f465da00338e4c1fb7fe65866
MD5 4f786b58856e265f1dc0c6496f634878
SHA1 425bf7b23417cde33b0c50aa6e828fd3d1a34cf0
SHA512 4e7766c423ef079d7e9c0a7de37f7b83d877910281da567e5564e194d4c66779d6ad8d1086ad7b56945952f55a581aeef98fbc20d981ccf1314731d6a04dddfd
SSDEEP 49152:vyuU3b+sFqMZuuu6Wfvdq90G4ABrNu1lZIGNdKK0PQ0PgEx2TXixHJQkdebbB:1UjFqquuu6f9Aau1lZIUH0PgExyDbbB
TLSH
T101D5331FE1DB0D84F9F42173718C2686FF016E8AFAD550ACF4B10926E7B3A1A5B84970
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.03.exe
- Size 30.5MB
- SHA256 c9c411b2d066cc14d9c57e0f6d9be2918c3c59bde056b63ff9f5808aa307fb10
- MD5 013326781f326ea21a7ac0d666411efb
- SHA1 1af4c1f02501d10428597058b792a1a46a05fa63
- SHA512 8c627b3bc56b2b36e3144c95be90c44b6cce76dafb480908eaef79604138dcb5a7c46b4daa5a3a410b1a3761c6d10adb8750ffe61fa2f3c96603c566a0122a65
- SSDEEP 196608:zZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYp:YC/p+HuPOc4U
- TLSH
  T1EC67181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2