7fc09d78d3b2886bfed56223f76b8a71abe016c7a1f6eda8a27e35319bf3a422

General

Target
www.mxh4h.com_sample.bin
Size 2.8MB
Sample261025-d6cbasdy5z
SHA256 7fc09d78d3b2886bfed56223f76b8a71abe016c7a1f6eda8a27e35319bf3a422
MD5 1452f9aaeeb95785c0615fbf5682edc8
SHA1 6c74c09f0d916e52a88b7c93a12c607604117d94
SHA512 8a31139f852c3e3a69f0c303de5a50dd656c4c31be55fb513d5dde0531e7937635d9f538006752dca67afb799aeb2ed84305892844bf9f8bc87c6983292e9a97
SSDEEP 49152:tdccyp/n/GYj0OOHhYNEJI5XvilQyqo/S9z/+Qxt/7klWaax9wvyDPcC:McypfByHqEJI5fixqBN7k0aa/waDPZ
TLSH
T131D5330A50ABE3C1EA365D370F206035B6A86DB438942DDCB5CAA5C58934E7C48E7DDF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.06.exe
- Size 30.5MB
- SHA256 5e3508e83fd0c03b3b42f04879cff4989b640473cd3b82016f3194a99f00ede6
- MD5 d462e346b0caa4e61ca9f30405019c7b
- SHA1 33445911f92842e7363218f211d5fd9976ab1beb
- SHA512 4791bc97c6226cfa509f6329b5d1afa8ccf24f23f62114cfe32b1c164943265d398a05bf472f807bec422bb9ac7e26ff03c5923a6d2fd67dd1c2f048df3f6e40
- SSDEEP 196608:zZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYy:YC/p+HuPOc4P
- TLSH
  T1E267181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2