f2e3f685256e5f31b05fc9f9ca470f527d7fdae28fa3190c8eba179473e20789

General

Target
FecitAntiques.exe
Size 12KB
Sample211212-e8ed4scaf5
SHA256 f2e3f685256e5f31b05fc9f9ca470f527d7fdae28fa3190c8eba179473e20789
MD5 6ac57a1e090e7abdb9b7212e058c43c6
SHA1 0a1e239348a73b1a95ac1767c8afebe4b98cdeff
SHA512 95748e2a5c90440206a815960eb864b787562d9dbe5d57a3279ef71d24143ff6f0f963925836623bfcb02914c0c0dea3cc0f731860c88101710659c445287a9e
MD5 SHA1 SHA512

Score

8^/10

ransomware

Malware Config

Signatures

Modifies extensions of user files 12 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\CheckpointResume.crw => C:\Users\Admin\Pictures\CheckpointResume.crw.khonsari	FecitAntiques.exe
File renamed	C:\Users\Admin\Pictures\ConvertFromSet.raw => C:\Users\Admin\Pictures\ConvertFromSet.raw.khonsari	FecitAntiques.exe
File renamed	C:\Users\Admin\Pictures\CopyUndo.crw => C:\Users\Admin\Pictures\CopyUndo.crw.khonsari	FecitAntiques.exe
File renamed	C:\Users\Admin\Pictures\DisableSplit.crw => C:\Users\Admin\Pictures\DisableSplit.crw.khonsari	FecitAntiques.exe
File renamed	C:\Users\Admin\Pictures\ReadWatch.raw => C:\Users\Admin\Pictures\ReadWatch.raw.khonsari	FecitAntiques.exe
File renamed	C:\Users\Admin\Pictures\RevokeFind.crw => C:\Users\Admin\Pictures\RevokeFind.crw.khonsari	FecitAntiques.exe
File renamed	C:\Users\Admin\Pictures\CheckpointOpen.png => C:\Users\Admin\Pictures\CheckpointOpen.png.khonsari	FecitAntiques.exe
File renamed	C:\Users\Admin\Pictures\CompareImport.raw => C:\Users\Admin\Pictures\CompareImport.raw.khonsari	FecitAntiques.exe
File renamed	C:\Users\Admin\Pictures\ConvertFromPing.crw => C:\Users\Admin\Pictures\ConvertFromPing.crw.khonsari	FecitAntiques.exe
File renamed	C:\Users\Admin\Pictures\JoinAdd.raw => C:\Users\Admin\Pictures\JoinAdd.raw.khonsari	FecitAntiques.exe
File renamed	C:\Users\Admin\Pictures\SearchMove.png => C:\Users\Admin\Pictures\SearchMove.png.khonsari	FecitAntiques.exe
File renamed	C:\Users\Admin\Pictures\UndoNew.tif => C:\Users\Admin\Pictures\UndoNew.tif.khonsari	FecitAntiques.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1628	FecitAntiques.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
700	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 556	1628	FecitAntiques.exe	27
PID 1628 wrote to memory of 556	1628	FecitAntiques.exe	27
PID 1628 wrote to memory of 556	1628	FecitAntiques.exe	27

C:\Users\Admin\AppData\Local\Temp\FecitAntiques.exe
"C:\Users\Admin\AppData\Local\Temp\FecitAntiques.exe"
1⤵
- Modifies extensions of user files
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\HOW TO GET YOUR FILES BACK.TXT
  2⤵
  PID:556

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:984

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\HOW TO GET YOUR FILES BACK.TXT
1⤵
- Suspicious use of FindShellTrayWindow
PID:700

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/556-58-0x000007FEFB591000-0x000007FEFB593000-memory.dmp

Download

memory/1628-54-0x0000000000B30000-0x0000000000B31000-memory.dmp

Download

memory/1628-56-0x000000001B020000-0x000000001B022000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads