Overview

overview

10

Static

static

10

fnchairs.exe

windows11-21h2-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fnchairs.exe

  • Size

    6.0MB

  • Sample

    240727-sbwtsaxgnd

  • MD5

    6e823f2578eec36a631b0bac4fa443d8

  • SHA1

    84f211243adf27bde83c69a12ac78e2e82f2cc60

  • SHA256

    d1c30ab1c6b22995d37b0a504cf0b85765a47cdaa5f35bfcab3de5cabd0d01a6

  • SHA512

    90ea6d2d828f9fc2d35b441980d720f8006bd8faff79d9044f5d0b0fd3c59ddc11a6c304328f45755253b5b8612be62b16c3d6cb3c4ed4ad271ebd65b3411dcf

  • SSDEEP

    98304:R3oIXqkqM8YL4afkhk9Y+YNwh1SMCJbzRnPJ8iE/56YSZDJ1n6hBnLnzO1:f4YL4ack9Y7m7SMYNPKB8n6hVvg

Score
10/10
blankgrabberdiscoveryexecutionupx

Malware Config

Targets

    • Target

      fnchairs.exe

    • Size

      6.0MB

    • MD5

      6e823f2578eec36a631b0bac4fa443d8

    • SHA1

      84f211243adf27bde83c69a12ac78e2e82f2cc60

    • SHA256

      d1c30ab1c6b22995d37b0a504cf0b85765a47cdaa5f35bfcab3de5cabd0d01a6

    • SHA512

      90ea6d2d828f9fc2d35b441980d720f8006bd8faff79d9044f5d0b0fd3c59ddc11a6c304328f45755253b5b8612be62b16c3d6cb3c4ed4ad271ebd65b3411dcf

    • SSDEEP

      98304:R3oIXqkqM8YL4afkhk9Y+YNwh1SMCJbzRnPJ8iE/56YSZDJ1n6hBnLnzO1:f4YL4ack9Y7m7SMYNPKB8n6hVvg

    Score
    8/10
    discoveryexecutionupx

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Enumerates processes with tasklist

      discovery
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks