4d1ce46bf7794426ae29173cbd8787552f9bd57dbece850ecc0195d5fe391da0

General

Target
www.mxh4h.com_sample.bin
Size 2.8MB
Sample261024-s87mjsax61
SHA256 4d1ce46bf7794426ae29173cbd8787552f9bd57dbece850ecc0195d5fe391da0
MD5 91db78cf5a89cd7371136613c3d07d30
SHA1 1e2ad31c74abd79406d2ac4ab1aa04c9c826c326
SHA512 5a1560630beeec43cd82f000c01b570939993a15386e956998b0fc71600664907c96ce01683bb60a08cbeb58c2c4cc49537b91af9fcf56acb88bee752031e57d
SSDEEP 49152:8yuU3b+sFqMZuuu6Wfvdq90G4ABrNu1lZIGNdKK0PQ0PgEx2TXixHJQkdebbu:wUjFqquuu6f9Aau1lZIUH0PgExyDbbu
TLSH
T133D5331FE1DB0D84F9F42172718C2686FF016E8AFAD550ACF4F10966E7B3A1A5B84970
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.07.exe
- Size 30.5MB
- SHA256 d7c5a430b7cdd0f4f068d537082bf63e8d1da374e6de607677617e240dcd89e5
- MD5 a8ee7ca0b8f5abdbabbc22d7838260ca
- SHA1 e261c29817829bef65916c6b6ed47742532b3ff5
- SHA512 284fe69cf0e0ffe76742de4112be66c98c4d62a8ec86b456b043b7da07a55a3f07573f02806bae56b0d0baaacfbce7814ebf3cd1b8ad3944856edb0c4e714b8c
- SSDEEP 196608:TZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYD:4C/p+HuPOc4+
- TLSH
  T1ED67181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2