Overview

overview

7

Static

static

1

NFs_080_9.msi

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ba2e05d0d12645958d6212007.zip

  • Size

    3.5MB

  • Sample

    240509-yr43zseh67

  • MD5

    cc4821e352446da3ce8dd93e61cac98a

  • SHA1

    df9ff19b18096e6d50758edc95fd1fa509eae25e

  • SHA256

    3a04bc537fc44fd04657a316c838bf0f47575a69854350ee873446ef3d8fe058

  • SHA512

    56ca0857310832eec461a3cd0f95cecd8fd444b9c451781142975c93d697c1ad4055bf8913af1da233d5460a6c9147d48d010481e86a6fe6d008cff488ef11cb

  • SSDEEP

    98304:8ZVOnyfR2wCETD2YPMqBnOpyeFt7PkN8jNT6YImC:8Hf6Ef7ZVOD7HhT6PmC

Score
7/10
persistence

Malware Config

Targets

    • Target

      NFs_080_9.msi

    • Size

      4.4MB

    • MD5

      103b8eaccb9689b767dbf221a9936cf5

    • SHA1

      dfd79a7641a8c3f83d198db8138e5f3ae6bd02a4

    • SHA256

      2825f330548a1a0e1297d1196f9ec582e2c0afb57186d926bf35c39629972a67

    • SHA512

      7fa5b9d625f5f250d2e81349864bc23a76cb2482435a1e5317fc5d8961dfb640a4d27942a9f5577b5895017d0983633737d146ab48f2c2e50d3f987190dd9bf9

    • SSDEEP

      98304:FyclEycl/Y5A8c4Ly6BjspUkjVHpCZ0PN3YSwqR:FyIEyIKDJZsBHv13YnqR

    Score
    7/10
    persistence

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Adds Run key to start application

      persistence

    • Blocklisted process makes network request

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks