676ae7524d8d2be55f0b0d91fce0ad0f7118f548b049741d60c6c8dee8f9aad4

General

Target
www.mxh4h.com_sample.bin
Size 3.1MB
Sample261025-kznjbaex91
SHA256 676ae7524d8d2be55f0b0d91fce0ad0f7118f548b049741d60c6c8dee8f9aad4
MD5 36dbc45ae4ada2d774253ba326863e0f
SHA1 66141a0efcbfa69508aa32b7fc3686815d3f092c
SHA512 d8bae862e9790f2bd540ffbc32e60b526eaa8b68a770b86c80230fe3252c338223d15ad54f1e2409a941bb6ebd99921f82ce1235af7d8f17e705171f99935ebb
SSDEEP 98304:XnBWlxqDvceNzobSkAVrpNRBekx0ocDLzd3radCJcOP:34/qoeRy2V9NR9x0BDd7aGl
TLSH
T126E5338C98BD6BD5F21D0A3A51837D109E8D4273CF9632F8ADACB4A6DBC7DE0AC44414
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.3.1.12.exe
- Size 32.4MB
- SHA256 dfcf4e73b39f1c9ff7abd818a1f551fd366206a6e4078decd46a31fdadc7d9db
- MD5 43a8af5b7fb0910db871d8e06845d279
- SHA1 a7fc61f9802a8fa7da7fbceaa7fc96affe9fed61
- SHA512 3e59d7028c32d73961acc1950cf0446d9156eb4a79604605b9fa7a3a51f736267ffab9462e3a9d7af429fb456e8f5ad9fcc7f3d845fdadc7c5f30cd1a15e95c7
- SSDEEP 196608:mqEfM3r4vGOgAVAiZfFK0SBqtiEPFNPTM:W6qpw
- TLSH
  T131770646FA414DD2F85846F588ABB7A023FEBD7582D1C30721D87325AFAF29C0E93195
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2