Overview

overview

10

Static

static

.NET Frame...10.exe

windows7-x64

10

.NET Frame...10.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    .NET Framework FIX WIN10.exe

  • Size

    4.6MB

  • Sample

    221209-1ned9see24

  • MD5

    91182cc38b2dcadf8bbbaca3319d6c55

  • SHA1

    ef9065fe80b54f2af060347995e584dc35b5f3b6

  • SHA256

    07d6b71653fafd84f5228e391ced68aa4a0a04405b20361033fcd119a3639d22

  • SHA512

    9b5eeb07a17a169f08c5de8789cc2c810af0dde579cb65739b8ac2c723348fe044e4d803ade4097ba510073c27c9b92d6e3a08a574c777a923ea9ef527fd30e5

  • SSDEEP

    98304:ZMheos0UFj5H5ekbAa3CKz3pqR6fW+971MOIkCOW+FIpzFzKQ:ZyXM15nbAjKNqRT+dG6FW+khzL

Score
10/10
discoveryevasionexploit

Malware Config

Targets

    • Target

      .NET Framework FIX WIN10.exe

    • Size

      4.6MB

    • MD5

      91182cc38b2dcadf8bbbaca3319d6c55

    • SHA1

      ef9065fe80b54f2af060347995e584dc35b5f3b6

    • SHA256

      07d6b71653fafd84f5228e391ced68aa4a0a04405b20361033fcd119a3639d22

    • SHA512

      9b5eeb07a17a169f08c5de8789cc2c810af0dde579cb65739b8ac2c723348fe044e4d803ade4097ba510073c27c9b92d6e3a08a574c777a923ea9ef527fd30e5

    • SSDEEP

      98304:ZMheos0UFj5H5ekbAa3CKz3pqR6fW+971MOIkCOW+FIpzFzKQ:ZyXM15nbAjKNqRT+dG6FW+khzL

    Score
    10/10
    discoveryevasionexploit

    • Modifies security service

      evasion

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Possible privilege escalation attempt

      exploit

    • Stops running service(s)

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Modifies file permissions

      discovery

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks