f2e3f685256e5f31b05fc9f9ca470f527d7fdae28fa3190c8eba179473e20789

General

Target

FecitAntiques.exe
Size

12KB
MD5

6ac57a1e090e7abdb9b7212e058c43c6
SHA1

0a1e239348a73b1a95ac1767c8afebe4b98cdeff
SHA256

f2e3f685256e5f31b05fc9f9ca470f527d7fdae28fa3190c8eba179473e20789
SHA512

95748e2a5c90440206a815960eb864b787562d9dbe5d57a3279ef71d24143ff6f0f963925836623bfcb02914c0c0dea3cc0f731860c88101710659c445287a9e

Score

8^/10

ransomware

Malware Config

Signatures

Modifies extensions of user files 12 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\CheckpointResume.crw => C:\Users\Admin\Pictures\CheckpointResume.crw.khonsari	FecitAntiques.exe
File renamed	C:\Users\Admin\Pictures\ConvertFromSet.raw => C:\Users\Admin\Pictures\ConvertFromSet.raw.khonsari	FecitAntiques.exe
File renamed	C:\Users\Admin\Pictures\CopyUndo.crw => C:\Users\Admin\Pictures\CopyUndo.crw.khonsari	FecitAntiques.exe
File renamed	C:\Users\Admin\Pictures\DisableSplit.crw => C:\Users\Admin\Pictures\DisableSplit.crw.khonsari	FecitAntiques.exe
File renamed	C:\Users\Admin\Pictures\ReadWatch.raw => C:\Users\Admin\Pictures\ReadWatch.raw.khonsari	FecitAntiques.exe
File renamed	C:\Users\Admin\Pictures\RevokeFind.crw => C:\Users\Admin\Pictures\RevokeFind.crw.khonsari	FecitAntiques.exe
File renamed	C:\Users\Admin\Pictures\CheckpointOpen.png => C:\Users\Admin\Pictures\CheckpointOpen.png.khonsari	FecitAntiques.exe
File renamed	C:\Users\Admin\Pictures\CompareImport.raw => C:\Users\Admin\Pictures\CompareImport.raw.khonsari	FecitAntiques.exe
File renamed	C:\Users\Admin\Pictures\ConvertFromPing.crw => C:\Users\Admin\Pictures\ConvertFromPing.crw.khonsari	FecitAntiques.exe
File renamed	C:\Users\Admin\Pictures\JoinAdd.raw => C:\Users\Admin\Pictures\JoinAdd.raw.khonsari	FecitAntiques.exe
File renamed	C:\Users\Admin\Pictures\SearchMove.png => C:\Users\Admin\Pictures\SearchMove.png.khonsari	FecitAntiques.exe
File renamed	C:\Users\Admin\Pictures\UndoNew.tif => C:\Users\Admin\Pictures\UndoNew.tif.khonsari	FecitAntiques.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1628	FecitAntiques.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
700	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 556	1628	FecitAntiques.exe	27
PID 1628 wrote to memory of 556	1628	FecitAntiques.exe	27
PID 1628 wrote to memory of 556	1628	FecitAntiques.exe	27

C:\Users\Admin\AppData\Local\Temp\FecitAntiques.exe
"C:\Users\Admin\AppData\Local\Temp\FecitAntiques.exe"
1⤵
- Modifies extensions of user files
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\HOW TO GET YOUR FILES BACK.TXT
  2⤵
  PID:556

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:984

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\HOW TO GET YOUR FILES BACK.TXT
1⤵
- Suspicious use of FindShellTrayWindow
PID:700

Network

GET

http://3.145.115.94/zambos_caldo_de_p.txt

FecitAntiques.exe

Remote address:

3.145.115.94:80

Request

GET /zambos_caldo_de_p.txt HTTP/1.1
Host: 3.145.115.94
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Sun, 12 Dec 2021 04:36:33 GMT
Server: Apache/2.4.51 (Win64) OpenSSL/1.1.1l PHP/8.0.13
Last-Modified: Sat, 11 Dec 2021 09:11:39 GMT
ETag: "0-5d2db3a2b1052"
Accept-Ranges: bytes
Content-Length: 0
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/plain

3.145.115.94:80

http://3.145.115.94/zambos_caldo_de_p.txt

http

FecitAntiques.exe

313 B
399 B
5
2

HTTP Request

GET http://3.145.115.94/zambos_caldo_de_p.txt

HTTP Response

200

No results found

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/556-58-0x000007FEFB591000-0x000007FEFB593000-memory.dmp

Filesize
8KB

Download
memory/1628-54-0x0000000000B30000-0x0000000000B31000-memory.dmp

Filesize
4KB

Download
memory/1628-56-0x000000001B020000-0x000000001B022000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.