Overview

overview

6

Static

static

3

clrhost.dll

windows10-ltsc_2021-x64

1

nfregdrv.exe

windows10-ltsc_2021-x64

6

run.bat

windows10-ltsc_2021-x64

6

Sharing

Copy URL Twitter E-mail

General

  • Target
    run.zip
  • Size 11.8MB
  • Sample260803-cvlj6aah92
  • SHA256 1dd83ec6cf24dbcedf63ca09a42633f79cc06414802dec6c2d177e5665be2ff0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
defense_evasiondiscoveryexecutionpersistence

Malware Config

Targets

    • Target
      clrhost.dll
    • Size 8.6MB
    • SHA256 a6a4dccc4efe71ae5cb3af4ccb3a99faa246334148a8b02d8662e8241ad6bd0a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral1
    • Target
      nfregdrv.exe
    • Size 3.6MB
    • SHA256 01a9ccff60dbdf2dce2a6304f01c51ab32b03029fb4648394fb715bc1dc2ce5b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    persistence

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral2
    • Target
      run.bat
    • Size 212B
    • SHA256 1f936a782f1f68606d715ca6bc14c86f67a1188a6f4598bf5dd264d16adb47f4
    • MD5 SHA1 SHA512 TLSH
    Score
    6/10
    defense_evasiondiscoveryexecutionpersistence

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral3

MITRE ATT&CK Enterprise v16

Tasks