89d8db1f567622012ca6d2285ae6d69a23e3d230ef59ca8370d748126a338011

General

Target
www.mxh4h.com_sample.bin
Size 2.8MB
Sample261024-n5s8jatzay
SHA256 89d8db1f567622012ca6d2285ae6d69a23e3d230ef59ca8370d748126a338011
MD5 07eaa469ef557aaa42f75b35650305a2
SHA1 b2f86ce7f4979a003de58657c7de3d308ee47002
SHA512 20a2ea53b53179c434fb5e37928f6a11e6f6f6edf55a06599f83c2cd5a7e3ecd3ae200cce1e2b269c04321eef5205c597a788fd3bd631b9243dcfe8eecb05050
SSDEEP 49152:3/8gA+fqXIBLq3+mX0BKKVmKsBLaJ8K1KtQ+BvrH3GPALKze:tA+fqGO3+mXOKBrB5tNB7GPA7
TLSH
T1E2D5331099E9C396F5379AB6B7B00589FB09F98B658E3210C7B5670A4B2307F73B049D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.05.exe
- Size 30.5MB
- SHA256 6ff0a279ee2a9d51e30c720ba8973825e9c320d76b6b1fdf52d800593595749a
- MD5 b008f30a8ef599d4068db571406566b8
- SHA1 315c446a0b77ea7cf3311d6d46adee0c7d4d87b5
- SHA512 7b00a7288a188c21aa4d2349dbb776577fabcaa71a35c7611bd546b4b8fb52a6072622537e162a847208d595ed790b36eee6b5c20877e6da2360318153392f45
- SSDEEP 196608:GZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYK:FC/p+HuPOc4z
- TLSH
  T11F67181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2