b80f12f7f48234bb0d54dc22720942db3cd4ce80630e005aa99fd2bcfc1d2744

General

Target
www.mxh4h.com_sample.bin
Size 2.8MB
Sample261025-b3s4jadt8x
SHA256 b80f12f7f48234bb0d54dc22720942db3cd4ce80630e005aa99fd2bcfc1d2744
MD5 72b26501f8e13abfc5a2147bc8c9c627
SHA1 70a20b46795ea44b16c8576c31fd7cc508addd07
SHA512 910b98f7934f208a8cd598658ce7fbee6731e2858aabbb1b1d1d9757e1fe56e151033bf437bb27c9fef2553f34a9d19da1374ee94e6c380b3ee75be2daa68c11
SSDEEP 49152:/yuU3b+sFqMZuuu6Wfvdq90G4ABrNu1lZIGNdKK0PQ0PgEx2TXixHJQkdebb+:FUjFqquuu6f9Aau1lZIUH0PgExyDbb+
TLSH
T1B5D5331FE1DB0D94F9F42173718C2686FF016E8AFAD550ACF4B10926E7B3A1A5B84970
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.03.exe
- Size 30.5MB
- SHA256 b9f9e310a96720eea0e9369f97e3bf52d0f82777121582beb931cc3fc0219c21
- MD5 aac5f52c8233d661eec9752e1bdfb83e
- SHA1 3562f1ec1a36438b2c77a4b35775de04ff26d66b
- SHA512 1f4593c9364c09df83a8c7ed5bb925e503a6fb1d6e9a5788cd701a3057cf154b692dda404ffb55e785f85be704a6778f14721cd8a2a4c61022189d196b26cd36
- SSDEEP 196608:zZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYC:YC/p+HuPOc4b
- TLSH
  T1E067181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2