Overview

overview

10

Static

static

10

MidnightFN.exe

windows10-ltsc 2021-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    MidnightFN.exe

  • Size

    6.9MB

  • Sample

    250210-xvn1haspgq

  • MD5

    130b390a8015eba60c8b8ecf9ebdccb2

  • SHA1

    cfd387b4d3179b74dd3b0294383c8b25649897ae

  • SHA256

    8786a888ec8146386563a0ce071e851ac3c7ac517bf6636bf884e3d1f2c45fc7

  • SHA512

    a93d2dc201bd0c9a914c2fca73b2e48ad4af59b624a6491fa57bf37a7a34cdec70fe8b1fcc8bfb84c0a4e21c44958898cb63eedcaf0246ec9179df5d8c2ef1c6

  • SSDEEP

    98304:+WmDjWM8JE7bylccsamaHl3Ne4i3Tf2PkOpfW9hZMMoVmkzhxIdfXeRiYRJJcGhd:+Wm02yneNTfm/pf+xk4dWRimrbW3jmyc

Score
10/10
blankgrabberdefense_evasiondiscoveryexecutionupx

Malware Config

Targets

    • Target

      MidnightFN.exe

    • Size

      6.9MB

    • MD5

      130b390a8015eba60c8b8ecf9ebdccb2

    • SHA1

      cfd387b4d3179b74dd3b0294383c8b25649897ae

    • SHA256

      8786a888ec8146386563a0ce071e851ac3c7ac517bf6636bf884e3d1f2c45fc7

    • SHA512

      a93d2dc201bd0c9a914c2fca73b2e48ad4af59b624a6491fa57bf37a7a34cdec70fe8b1fcc8bfb84c0a4e21c44958898cb63eedcaf0246ec9179df5d8c2ef1c6

    • SSDEEP

      98304:+WmDjWM8JE7bylccsamaHl3Ne4i3Tf2PkOpfW9hZMMoVmkzhxIdfXeRiYRJJcGhd:+Wm02yneNTfm/pf+xk4dWRimrbW3jmyc

    Score
    10/10
    defense_evasiondiscoveryexecutionupx

    • Deletes Windows Defender Definitions

      Uses mpcmdrun utility to delete all AV definitions.

      defense_evasion

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Enumerates processes with tasklist

      discovery

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks