0027603590c7a4ae576bfc2ffcd730b3ded34066b0f8793196912d111304abb9

General

Target
www.mxh4h.com_sample.bin
Size 2.8MB
Sample261024-nbhjyahv21
SHA256 0027603590c7a4ae576bfc2ffcd730b3ded34066b0f8793196912d111304abb9
MD5 887c59cf60841e07cb563986db921329
SHA1 395e5fdf08d181bb873b3fc051a367ed9fddfc42
SHA512 54675fda950b9b444b735dc9e52e9b390456f346d49d057fd39f80012507525007ed343693f165d5ea8b81f6afbc9e33aea402a89c729110ddc0f9226f8952fb
SSDEEP 49152:4Qdk+gL00Zawjix/KqRzlKgWLbf3P3JVOup7BbpdrfC5izGAr8DhGqvPmHWcs:4Qu32Ky/KqjKRLz3hVV79pdrdGAqUA+A
TLSH
T137D53397CAA71794FB3490F85F1AEB50FF36918E502A90485CA603C1887704E9F79AF7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.04.exe
- Size 30.5MB
- SHA256 84507804e46e614735420d04d73f60ec881a7459fefe12bc43159c454a43c4c5
- MD5 0c81da8c68eecc481fde884e50839cec
- SHA1 2720bb2a045e766a146b0f2a3ba7a97d032cf8cd
- SHA512 66d80e90663cc214b5d6ed51bb84b903c4b72df050ee03776de24389f72acdadf8931d87d6f28c56612c48e5e26fba8ef019fc5f79568cc40a5e705635b94488
- SSDEEP 196608:sZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYi:TC/p+HuPOc4b
- TLSH
  T1B567181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2