d1e2cd72f529b711750e1bbe135194d4b6de895809ac235d64b244117f0ad353

Sharing

Copy URL Twitter E-mail

General

Target
FrameGlass.zip
Size 5.7MB
Sample261017-am7rbatsdv
SHA256 d1e2cd72f529b711750e1bbe135194d4b6de895809ac235d64b244117f0ad353
MD5 a9a036688523aa048b7255acd4f3d113
SHA1 366ea05298a37360b9573b971683008ea70e9a7d
SHA512 907b866141afdbe05ba5287a52abea75df992a2af4b3e16de254c8c5fd684935f8cfe9481f656f704a10104f9bed41264bf9b62af307eb4be782dbe16e97ea40
SSDEEP 98304:uJ6Op4VncwmZIBZnpGwkwOpQerIEAz57bpKwmZHfrlg2xvUms70iTrvzwFoWhns:uJBwmZIBfKwU8rdKDlpWmmTrvzQ5s
TLSH
T106563374DAE5883A0E47693A64F38BEC99505876023CDBB5FC6CCC100F96B55AB4C9CE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  FrameGlass/Dia2Lib.dll
- Size 57KB
- SHA256 6c4cac68010fe032218efe5e9fcf46eef9f77bfaa5f3bd33f03c5ff77d5a8fac
- MD5 be6474b726207994decdc22e84936a3c
- SHA1 ea1d16f16de16b29a576a1b5cc4baa31bc5db9bb
- SHA512 d204240213a0b509101ae3c9b691e9f6a141946cf3284244f56314183c84d24c1cdaa28661444fb8e1dc018e24f8aae4505c35f9994e368032a9913c9de8ff59
- SSDEEP 768:MQMT4Q3O9ymyKJcy3Xs3y4rV50sds8SzUwHhvoVi+CLr0:dQCye14oGs8SNhgVVAA
- TLSH
  T154431827761CF40DC5A26ABE91CDDEA22770D7417B03CF02499CB36A9F437496B62239
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  FrameGlass/FrameGlass.dll
- Size 105KB
- SHA256 85f04c7d200128ef572e010ebca73137ef726b0529bc86d0df53a5f814437b5e
- MD5 6164019cb214a5cddbb1c3b12d16b325
- SHA1 a06265ecc5f9dfc6e7c32e186bbe5d5a210694a4
- SHA512 1e93aef56ac26a9a604ac159456c35a46880dd690a954c67e8f56d22a943147421cbe8526e986f08e4a812bf412b0ab3cce0f6ac4027a547f4d7a178a449c303
- SSDEEP 3072:rb9kdLiFQoIbco5lQ/UQVNNjpZ4TLWZYV:0LisbcM6MWNjAeW
- TLSH
  T1CFB34B8173FC4725F6FF6F3624F111910736BAA6A632D78D098935EC1972BC05A21BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  FrameGlass/FrameGlass.exe
- Size 182KB
- SHA256 10ca070c4671dc671be0ab04eb80d3215b4d724485dff07f2a97cc091cdd8114
- MD5 728df867a87ec8b1a0dd1bb5b23d297d
- SHA1 23f1cbd9307d88513525d2dfe9c8377ded23a5c3
- SHA512 735e1ca6d742d178377723b86257958fbd36024786a905934fc5184fa74773b270588ba02c49cf0718e1955c89c0316af92c1e76eabad7e5202d14d403e79e1f
- SSDEEP 3072:XVDxk88wN1BL+x7dL1Z9QnlX97E3swmozzaAT52ntp7WTLYZYX:Fhax7F1nQnJcBiFntowW
- TLSH
  T1A7045D13A76811BEE1B3D678C9924941FB7278598B71A7CF07504EBA0F76BD09E39302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence ransomware
- Downloads MZ/PE file
behavioral5 behavioral6
- Target
  FrameGlass/Microsoft.Diagnostics.FastSerialization.dll
- Size 74KB
- SHA256 a216b032692e6b0effc7adac7b7591ed2c754e2c6764bb7127464b808d8bdfd5
- MD5 6295352702dfbaa24c02b94fae77bf33
- SHA1 dce10f2ecfb00dae6fad6ab9278bf3e55e462075
- SHA512 1f40ab85450527342d86c8fe8098b75d8085a5efe1bff1b9d9c623d9b7b7f80e4a02a7452d42c48c2386da385247851ad15a31989fd63a02c482d7728b371797
- SSDEEP 1536:lWjWJwH/lOtwQYi/IV/jG2/khuc+8gC/2QPZ2lcpHikiAcm0zQ11h0awb1l2byLp:lWaJGctwni/IV/jTlAcQ11qawb1losp
- TLSH
  T135734B1477EC8B63EEFF1BFBB4B081110B70BEA66536E78E5584A1A84C53B508E91317
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  FrameGlass/Microsoft.Diagnostics.NETCore.Client.dll
- Size 142KB
- SHA256 baed2d25ca5bc53a3447c237d5572c92eac1fd842807b3e72602a711749b1b22
- MD5 ae909868c35d7a0cfd75e0fb6b03cfb7
- SHA1 b48aad85eb1a67c160bf26ee2ea8822eeded3652
- SHA512 c1390e002de92feb3da884cb0996ae7d19dd867b63420975fd4e381a90418bdaf7ff283f6d5095ef34f82377e2a60e4a71a25f88c372e0da516b171d83cd764b
- SSDEEP 3072:MmQktakR06vEO14/o7q3hnQhYbbmiLg+RjUjbQ1DsSjNmsWsocB12EJo:1QkRHvH14/o7q3hnPRjUjbQ1Dskzb17q
- TLSH
  T1E8E33C50A3E88F66FADF6F78B4749260CB79A607A96BF74E444CA1FD18027E04D41723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  FrameGlass/Microsoft.Diagnostics.Tracing.TraceEvent.dll
- Size 3.1MB
- SHA256 2150c5bd3a19358e9871159272f6548ff0d1c4184a687ded8ddf0ffcdd93c00b
- MD5 0a668cf0a047438aaaac7f2069d73518
- SHA1 e55d3c8d59876edfe4f8eac5eb53ed3943b1019c
- SHA512 93e8ec00c20f49eb1fd5f55a728cd6ee808ae8921169356f82f72a4a5615b50b48379336fe820403ffeebb5542d18818e60db13a4ac3441b1aabb7da5b211a95
- SSDEEP 24576:isXns8/YnaDiNiyvtMgKu9z3BhV1n1XE1d+bimRKqMyNzarpcud:RXnp/YxizPuguRPMyNCd
- TLSH
  T102E53C11EBBE4C6AD2DF037BF0108068E2B1FC946356E75A29C9B27C2D91BB74645633
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  FrameGlass/Microsoft.Extensions.DependencyInjection.Abstractions.dll
- Size 42KB
- SHA256 9ccd830351aa28bc683d4f8d1cefd9e724161f972d25bfb64eee5bf55c48c5e3
- MD5 d6cfda4e1c948aeb3e5d57376334375f
- SHA1 cb8c35306afd15358104ecfe70e724ad9c753e6f
- SHA512 93a7571c4d186243d78641630b8997fdb69d411df307d95c86aed556102369a98b9a13ca5c7ca8d593244cf0b0f039bc37d330b86194b07b2c9f0bcec3c06b2e
- SSDEEP 768:o8+cxuPn//hpz2XCkCkCdvAb4b4qox06OoV0F8l0HCTpw0wo0emDMtj:/+cxuPn/bvvE0Q0HCNfBsDMZ
- TLSH
  T170133C4577FC8366D5BE5AB065F191149D3BFAC72802E7062948D0AC1CA7FCC2A62FB1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  FrameGlass/Microsoft.Extensions.DependencyInjection.dll
- Size 79KB
- SHA256 2aa8182b5356a8cc5c35fc3641a87e814857d8d9be399ac78f260343754d09e0
- MD5 5db27bdd3d6a9a225b88b12293382f95
- SHA1 eb7d6d2250bf2509b89166bc22c07423ac9c2d91
- SHA512 4ed559768d1f1a405203f1e2d6a72dddc4c7b485461979a14d22566236e169f7e2652e9b3d85f0205c296bc4d705a30519a5f292aa6eda26137b7f2923660b3d
- SSDEEP 1536:iNLmvi666OjIX0h9zMPvHBWCaRweUG4DynjEZnBaMH:Q66fjLb8vH0CiUG4DyneBaQ
- TLSH
  T182834C25A7FC4722CAEF6AB4543595110F7EF9C67003FB481EC8A0691A97FC14B623B6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  FrameGlass/Microsoft.Extensions.Logging.Abstractions.dll
- Size 60KB
- SHA256 d575c9d1543ca726ce14dbdffd103e93ea527cd46bb28316da1f4122dbc55d56
- MD5 a2544f077d57c4ea44a4694efcbea30b
- SHA1 02ec010722bbd1740782b502df30d4475aebe5f2
- SHA512 ded82fdc0cbfd644a6368b9776eb9d5e0899c61373599d8c3485a47140850bba8b7b448ce4bf276fdf1d4b2ca24745a17ceabcbea793255e34d625fb3db68b0e
- SSDEEP 768:N+UfRQY8PGNWovMLJYBjtLgnuAAAAAknwd45FnrfMq1/yJuoiYblHJg6GOmDu3MN:N+tY8PIiq51wcFnDMsno7jRma3MN
- TLSH
  T1EB534B0067EC9323CB6E9DB9E0B1A6026775C2673403EB4B2DDCE2742557BCC6B52366
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  FrameGlass/Microsoft.Extensions.Logging.dll
- Size 43KB
- SHA256 183650081b551dfad967a7cbf79946a229cb79458b8d04a12db7c44b03bb9ab7
- MD5 037fa19d37892f003cb18c3f4f070b66
- SHA1 7bea9201a90f69ff958f5bf64e959d1e4021f252
- SHA512 04dd786ae74827dc3e8c417e1da3cd2603618b4a57a8aa861eba2a96b4e1c795ac27b2aca9f9fb886ae4791af1b356e0243e11bc2b5a3158ecea2cbdfb449391
- SSDEEP 384:kX8pDPkAvn3sac7bhN6hym/DEdwe9Kc78uwAiWMTGLWIMM1uGxzHjzg2DfsZqQOG:kX8pDT8XP6hA+wMaLWCzAVLOPneM0I1W
- TLSH
  T146134A2283AC4367D97E09B4B4B8E5954F35C766B402FB466E8CF19A1CB3BC0162177B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  FrameGlass/Microsoft.Extensions.Options.dll
- Size 57KB
- SHA256 786112cb2f6646ef1170219a8c0bb813c9f14a6781e67c6266414f55a679565d
- MD5 950440793a182cc76ffc7f7280e55daf
- SHA1 6ec0c1fe1332912086247080b55b06623c78326e
- SHA512 132280392e9c60cb764f6f5d9b24c01abd2bdfff4e66ab4ca8dbb7d52150954df02277d49083754df2f2bca82660622c39f75ff80eb4cf9a2bd52dc0292943a1
- SSDEEP 768:sCD3yk2B8+9PwwOxC8wZLq6J4q2r0qafouRVPvW3aMgi:DkB8+94xxBmm6mqaBafouRdiaMN
- TLSH
  T12F436C01A7BC9B92CEBF8B30E43490231A36D6073503A76F86ECE59C2C677646A75335
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  FrameGlass/Microsoft.Extensions.Primitives.dll
- Size 39KB
- SHA256 8ce9a85927ec7507b11ffe90080e7a811d51304a9e8b1da20c350159ba403902
- MD5 a53d11973f75b15bef19c16a35ffb432
- SHA1 376636c20cee083da54d4146479032170ec7231b
- SHA512 99d6a73c8bcd4de86e877c0e5c37960f9bcc5bf40ce2f8fd5ed2ec37650c91d123c29bb254fe6e81fc5aa25749eabdbde9a64352d497eddd862ca10c154f43eb
- SSDEEP 768:slx+oQSHqk49NI0OP7NWEfDkkuiEk3LViOM+1zy:WVQSyI0OP7NxfAkuiEkbwOMX
- TLSH
  T1BF034B12A7DC4333DEEF1A3591A1D1605B38D7FA7822EB5A504CA17819A3BC48732777
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  FrameGlass/PresentMon.exe
- Size 411KB
- SHA256 364e5d98d4d134bd54dd25c22ed2ca2f4883f8bc3ed6502bee0c151e3436d30c
- MD5 a672b620860c9c192993b1b3f54ec464
- SHA1 6038e614c6663cc902126ce09ad81d355373748d
- SHA512 f8f96db9c5e125c61618994e0200cb430981e119927c0c7a112a5dfe0c0825d98c56afd61dac84297753579e577389075e94e2ed038565a15db9234b1c11e3ec
- SSDEEP 6144:SptJccAJb6f6NfEbp1b33iw4ei1GOJdllhWDDJ0K3/6340el4I57s9SORkKRVR:SYyri1GOJdlrqJ0tclYTksVR
- TLSH
  T139948D15F7E404E8F5B7A2788A729602EB767C590730D5DF13A442662F33AE09E3DB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  FrameGlass/TraceReloggerLib.dll
- Size 22KB
- SHA256 6830c0f1d3f3c17719181e73dd5cfa8ccbb3f3c575329d2120576545103467b5
- MD5 63d53278de054ac54da51d94d2bc0c9f
- SHA1 66eefa94909b3d8e2ed0f1d366c27d9b261c1a7b
- SHA512 45aafdc6d20f6eb49f149e6c5fc3930d78d06169c95ab87f7b2aefb13cda1e9072ce7bf5d9d7a07483972ba9d87f7ee98fcf6cd543fa44c46fad49d0a9fd516f
- SSDEEP 384:PoMeAKyr1jSC6JW1m0GftpBjyMi5aQHRN7vzslD161Y7PW:PoMbKK1OBQVidi5LL10W
- TLSH
  T104A24C929BBC5443DCC2ADB067E8DE837E38D7C60D22C81B14AAF1951DC37D5AB28539
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  FrameGlass/amd64/KernelTraceControl.dll
- Size 260KB
- SHA256 98de2f1de4fb1711688c04e2cb0187bf8c47e627771e8f51329671f296bfc688
- MD5 b1c75bf2b5095ac3299403e34d462c4c
- SHA1 e558815bc2c91e67a7f416bb1baf85f82068ff1f
- SHA512 653fd18acb07962a5bc865e61a73ac0645a4b70ef2b31ebb0b4cf50e6ccfb1c22eb665db98e9d1b232de6feea3d7254b785ae58946ce1dae090ca1f71475951a
- SSDEEP 6144:/lPLikZqxz9Prt9e1bd6JcAMaLD0qjR0FC4YPHZN:/FmX9e1bd6JcAMq+FpGZ
- TLSH
  T1C3443A2AABAC9C62D527A07DC987C646F3B2B8125711D3CB11A0C37E1E2BFE47934751
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29
- Target
  FrameGlass/amd64/msdia140.dll
- Size 2.2MB
- SHA256 7341081feac7a2cebcc796c9c2bc5041a295df0673244f2595294e06a0bd7ee8
- MD5 971b779f3717591f52c38db367b71548
- SHA1 0791f1cf7522fe897e1af89629a2300ae509d6ad
- SHA512 f4da5d21ddf3c0152e5396d9b004cdcc1720403cf5cbff0db4581471d297df57a9557d67f2a774125a8de28bcc575841df90067feb941d5aaff83e6ab2b994dd
- SSDEEP 24576:H86rLP1cKsNO5ukZx9MAuyEE9BpajXt7zkDcgQeHOvXsXTcbPKx4GOTyTkKk+D5c:H89YpMA9BpajXBzYcgKskd+u
- TLSH
  T1F9A57C97A7A840E8C1BED07CC65B560BE7F238050750A7DB12A0867E6F67FE05ABD311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral30 behavioral31
- Target
  FrameGlass/arm64/KernelTraceControl.dll
- Size 252KB
- SHA256 45b6d97a6c64229976b71a0fe709617190267fd02147a5c7e1e4fb9b17fa2956
- MD5 705cf5ff005ccdd8a9cb600ca89ad4cf
- SHA1 b9c93ce3a957447315054844adfa8e7dc25f9bc2
- SHA512 826574d529ab49898318a3c17c1be00a808292c6c04b440a4e8b2633a6ec39bc896523d40a25965257c83471aceb66c002bd530d74bafb29257ddcf006e3f2b5
- SSDEEP 3072:VJxCYKhMXJw5eSpmpi4F1Lvvt+S/77gQQgfUFOlkBsTdUM3J/qyPUQrmqMlw2T3L:VJxJK/dpOfr37g1QOe5qWlr0lww7
- TLSH
  T1F6441B816BCE9CA1D6C6AE3DCE178B54B67BF9288910C1873153131FDEAFBD0C991492
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Downloads MZ/PE file

Event Triggered Execution: Component Object Model Hijacking

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32