Analysis
-
max time kernel
565s -
max time network
576s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
26-09-2021 15:01
Static task
static1
Behavioral task
behavioral1
Sample
fbf.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
fbf.exe
Resource
win10-en-20210920
windows10_x64
0 signatures
0 seconds
General
-
Target
fbf.exe
-
Size
249KB
-
MD5
fbf3187db919beaddb30ae7e52bd9a49
-
SHA1
d2891928551f2adff238547c7cae4e3fef7cc057
-
SHA256
a83b8dfadf92be244ccc6b2964eea2f67e0c807befa3ab969a68ee321be583dd
-
SHA512
1d609711a21609d3bc3df80d3616ef388f32e0adcb9af865bfa3aeb9c61f81e099e5591cdecbe5412a4ea18ef236043c977faad4245ae45fd58eeb15119715ab
Score
10/10
Malware Config
Signatures
-
Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
-
Chinese Botnet Payload 1 IoCs
resource yara_rule behavioral2/memory/2484-117-0x0000000010000000-0x0000000010018000-memory.dmp unk_chinese_botnet -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Uuuocai.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fbf.exe" fbf.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: fbf.exe File opened (read-only) \??\I: fbf.exe File opened (read-only) \??\K: fbf.exe File opened (read-only) \??\O: fbf.exe File opened (read-only) \??\P: fbf.exe File opened (read-only) \??\S: fbf.exe File opened (read-only) \??\W: fbf.exe File opened (read-only) \??\B: fbf.exe File opened (read-only) \??\Y: fbf.exe File opened (read-only) \??\M: fbf.exe File opened (read-only) \??\U: fbf.exe File opened (read-only) \??\V: fbf.exe File opened (read-only) \??\Z: fbf.exe File opened (read-only) \??\H: fbf.exe File opened (read-only) \??\J: fbf.exe File opened (read-only) \??\Q: fbf.exe File opened (read-only) \??\R: fbf.exe File opened (read-only) \??\T: fbf.exe File opened (read-only) \??\G: fbf.exe File opened (read-only) \??\L: fbf.exe File opened (read-only) \??\N: fbf.exe File opened (read-only) \??\X: fbf.exe File opened (read-only) \??\E: fbf.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\rescache\_merged\1742034116\2087166547.pri SystemSettings.exe File created C:\Windows\rescache\_merged\2717123927\1713683155.pri SystemSettings.exe File created C:\Windows\rescache\_merged\3060194815\335381474.pri SystemSettings.exe File created C:\Windows\rescache\_merged\2717123927\1713683155.pri SystemSettings.exe File created C:\Windows\rescache\_merged\3060194815\335381474.pri SystemSettings.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 8 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000 SystemSettings.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\HardwareID SystemSettings.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000 SystemSettings.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\HardwareID SystemSettings.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000 SystemSettings.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\HardwareID SystemSettings.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000 SystemSettings.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\HardwareID SystemSettings.exe -
Checks processor information in registry 2 TTPs 7 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 fbf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz fbf.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings firefox.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2484 fbf.exe 2484 fbf.exe 2484 fbf.exe 2484 fbf.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 3656 SystemSettings.exe Token: SeCreatePagefilePrivilege 3656 SystemSettings.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1192 firefox.exe 1192 firefox.exe 1192 firefox.exe 1192 firefox.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 1192 firefox.exe 1192 firefox.exe 1192 firefox.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2484 fbf.exe 2596 SystemSettings.exe 3656 SystemSettings.exe 1192 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3976 wrote to memory of 1192 3976 firefox.exe 74 PID 3976 wrote to memory of 1192 3976 firefox.exe 74 PID 3976 wrote to memory of 1192 3976 firefox.exe 74 PID 3976 wrote to memory of 1192 3976 firefox.exe 74 PID 3976 wrote to memory of 1192 3976 firefox.exe 74 PID 3976 wrote to memory of 1192 3976 firefox.exe 74 PID 3976 wrote to memory of 1192 3976 firefox.exe 74 PID 3976 wrote to memory of 1192 3976 firefox.exe 74 PID 3976 wrote to memory of 1192 3976 firefox.exe 74 PID 1192 wrote to memory of 3020 1192 firefox.exe 81 PID 1192 wrote to memory of 3020 1192 firefox.exe 81 PID 1192 wrote to memory of 2240 1192 firefox.exe 83 PID 1192 wrote to memory of 2240 1192 firefox.exe 83 PID 1192 wrote to memory of 2240 1192 firefox.exe 83 PID 1192 wrote to memory of 2240 1192 firefox.exe 83 PID 1192 wrote to memory of 2240 1192 firefox.exe 83 PID 1192 wrote to memory of 2240 1192 firefox.exe 83 PID 1192 wrote to memory of 2240 1192 firefox.exe 83 PID 1192 wrote to memory of 2240 1192 firefox.exe 83 PID 1192 wrote to memory of 2240 1192 firefox.exe 83 PID 1192 wrote to memory of 2240 1192 firefox.exe 83 PID 1192 wrote to memory of 2240 1192 firefox.exe 83 PID 1192 wrote to memory of 2240 1192 firefox.exe 83 PID 1192 wrote to memory of 2240 1192 firefox.exe 83 PID 1192 wrote to memory of 2240 1192 firefox.exe 83 PID 1192 wrote to memory of 2240 1192 firefox.exe 83 PID 1192 wrote to memory of 2240 1192 firefox.exe 83 PID 1192 wrote to memory of 2240 1192 firefox.exe 83 PID 1192 wrote to memory of 2240 1192 firefox.exe 83 PID 1192 wrote to memory of 2240 1192 firefox.exe 83 PID 1192 wrote to memory of 2240 1192 firefox.exe 83 PID 1192 wrote to memory of 2240 1192 firefox.exe 83 PID 1192 wrote to memory of 2240 1192 firefox.exe 83 PID 1192 wrote to memory of 2240 1192 firefox.exe 83 PID 1192 wrote to memory of 2240 1192 firefox.exe 83 PID 1192 wrote to memory of 2240 1192 firefox.exe 83 PID 1192 wrote to memory of 2240 1192 firefox.exe 83 PID 1192 wrote to memory of 2240 1192 firefox.exe 83 PID 1192 wrote to memory of 2240 1192 firefox.exe 83 PID 1192 wrote to memory of 2240 1192 firefox.exe 83 PID 1192 wrote to memory of 2240 1192 firefox.exe 83 PID 1192 wrote to memory of 2240 1192 firefox.exe 83 PID 1192 wrote to memory of 2240 1192 firefox.exe 83 PID 1192 wrote to memory of 2240 1192 firefox.exe 83 PID 1192 wrote to memory of 2240 1192 firefox.exe 83 PID 1192 wrote to memory of 2240 1192 firefox.exe 83 PID 1192 wrote to memory of 2240 1192 firefox.exe 83 PID 1192 wrote to memory of 2240 1192 firefox.exe 83 PID 1192 wrote to memory of 2240 1192 firefox.exe 83 PID 1192 wrote to memory of 2240 1192 firefox.exe 83 PID 1192 wrote to memory of 2240 1192 firefox.exe 83 PID 1192 wrote to memory of 2240 1192 firefox.exe 83 PID 1192 wrote to memory of 2240 1192 firefox.exe 83 PID 1192 wrote to memory of 2240 1192 firefox.exe 83 PID 1192 wrote to memory of 3704 1192 firefox.exe 84 PID 1192 wrote to memory of 3704 1192 firefox.exe 84 PID 1192 wrote to memory of 3704 1192 firefox.exe 84 PID 1192 wrote to memory of 3704 1192 firefox.exe 84 PID 1192 wrote to memory of 3704 1192 firefox.exe 84 PID 1192 wrote to memory of 3704 1192 firefox.exe 84 PID 1192 wrote to memory of 3704 1192 firefox.exe 84 PID 1192 wrote to memory of 3704 1192 firefox.exe 84 PID 1192 wrote to memory of 3704 1192 firefox.exe 84 PID 1192 wrote to memory of 3704 1192 firefox.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\fbf.exe"C:\Users\Admin\AppData\Local\Temp\fbf.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2484
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1192.0.950619275\1495569214" -parentBuildID 20200403170909 -prefsHandle 1516 -prefMapHandle 1500 -prefsLen 1 -prefMapSize 219808 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1192 "\\.\pipe\gecko-crash-server-pipe.1192" 1600 gpu3⤵PID:3020
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1192.3.1514248659\512633359" -childID 1 -isForBrowser -prefsHandle 2212 -prefMapHandle 1264 -prefsLen 500 -prefMapSize 219808 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1192 "\\.\pipe\gecko-crash-server-pipe.1192" 2224 tab3⤵PID:2240
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1192.13.1439293297\1558605896" -childID 2 -isForBrowser -prefsHandle 3144 -prefMapHandle 3140 -prefsLen 1368 -prefMapSize 219808 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1192 "\\.\pipe\gecko-crash-server-pipe.1192" 3152 tab3⤵PID:3704
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1192.20.712621250\1563055686" -childID 3 -isForBrowser -prefsHandle 3676 -prefMapHandle 3672 -prefsLen 7430 -prefMapSize 219808 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1192 "\\.\pipe\gecko-crash-server-pipe.1192" 3688 tab3⤵PID:3628
-
-
-
C:\Windows\ImmersiveControlPanel\SystemSettings.exe"C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
PID:2596
-
C:\Windows\ImmersiveControlPanel\SystemSettings.exe"C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3656