15125a1433a812d4fac85f194285b0984198b0eec54fd87a03ae0ab50513c4a3

General

Target
www.mxh4h.com_sample.bin
Size 2.8MB
Sample261025-fe7z1afx2p
SHA256 15125a1433a812d4fac85f194285b0984198b0eec54fd87a03ae0ab50513c4a3
MD5 8f4c87d0b2b6ba6d1cb32333eaca6ca0
SHA1 95b5459331a82da7f9edfe55ef22578b4cd89e41
SHA512 3cd3350a56f06330d8b1c17fd16f8519447f3ad58d0eaa8e5f320dcd530c90caa5785ce4a31393033aa0b425cebcc6afbed3165c2785f69613295241f09156d7
SSDEEP 49152:byuU3b+sFqMZuuu6Wfvdq90G4ABrNu1lZIGNdKK0PQ0PgEx2TXixHJQkdebb5:JUjFqquuu6f9Aau1lZIUH0PgExyDbb5
TLSH
T1BED5331FE1DB0D94F9F42172718C2686FF016E8AFAD550ACF4B10926E7B3A1A5B84970
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.07.exe
- Size 30.5MB
- SHA256 ef2dc0d41458def586f0e5627991da39beafd9108e0e7c4badec5242785c8c60
- MD5 6f7c21724bfdd06cc8665fec296b49c5
- SHA1 6c2d4ccf6be5c90cc1372a501164b79bb08b8998
- SHA512 1ddfeb3312115b1bdab660039f8eb4e2596b0847f7c2cea784391d03d952c67a4bce01f2c712618f2efdc68acc93ffc99bd7f2686777635092279f78b59d1db5
- SSDEEP 196608:TZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYQ:4C/p+HuPOc4t
- TLSH
  T19167181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2