fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21

General

Target

fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
Size

176KB
MD5

f4f1e0e4e2ea4b9b895c17e66215d341
SHA1

e5792724f1fe3e987b782083b86d997e67bbfc9a
SHA256

fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21
SHA512

073cb4d7b0c4796297aa1a2b712796fdafbb0013af374cf5c724632d40dfafd4634f7a566a8859b1dc1ffef26d2a40cef79fefe822d440c3c8e9aa444ac1eab1
SSDEEP

3072:6cGddOJDTnu4uZD6JMcCYFn0VXxRxIJpP+6W3FaSv3HS1y0Iqh:6cedKXCZDmMx+nMxR+d7W3FaS8

Score

8^/10

persistence vmprotect

Malware Config

Signatures

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral1/memory/864-54-0x0000000000400000-0x0000000000471000-memory.dmp	vmprotect
behavioral1/memory/864-58-0x0000000000400000-0x0000000000471000-memory.dmp	vmprotect
behavioral1/memory/864-59-0x0000000000400000-0x0000000000471000-memory.dmp	vmprotect

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ads = "C:\\Windows\\ads4.exe"	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe

Drops file in System32 directory 1 IoCs

Processes:

fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\ads4.exe fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\ads4.exe	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe

Drops file in Windows directory 5 IoCs

Processes:

fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe

description	ioc	process
File opened for modification	C:\Windows\ads2.exe	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
File opened for modification	C:\Windows\ads3.exe	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
File opened for modification	C:\Windows\ads4.exe	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
File opened for modification	C:\Windows\mlang.dll	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
File opened for modification	C:\Windows\ads.exe	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe

pid	process
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe

description	pid	process
Token: SeDebugPrivilege	864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
Token: SeDebugPrivilege	864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
Token: SeDebugPrivilege	864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
Token: SeDebugPrivilege	864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
Token: SeDebugPrivilege	864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
Token: SeDebugPrivilege	864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
Token: SeDebugPrivilege	864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe

pid	process
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
864	fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe

C:\Users\Admin\AppData\Local\Temp\fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe
"C:\Users\Admin\AppData\Local\Temp\fae2c942a46f8c9619d4cbb4bc2c267a0a75fd1aacfa30d034b51be3fbd88f21.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:864

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/864-54-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/864-57-0x0000000076261000-0x0000000076263000-memory.dmp

Filesize
8KB

Download
memory/864-58-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/864-59-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads