Analysis
-
max time kernel
154s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 19:00
Static task
static1
Behavioral task
behavioral1
Sample
149dac716b72428daf24d3e0ae11aafdea0a401b87995651b0a1ee4510b68479.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
149dac716b72428daf24d3e0ae11aafdea0a401b87995651b0a1ee4510b68479.exe
Resource
win10v2004-20220901-en
General
-
Target
149dac716b72428daf24d3e0ae11aafdea0a401b87995651b0a1ee4510b68479.exe
-
Size
232KB
-
MD5
44381948c8f32f90a00620b667db078c
-
SHA1
606f2c82c0539f055a8aa052fed57983b16f3c17
-
SHA256
149dac716b72428daf24d3e0ae11aafdea0a401b87995651b0a1ee4510b68479
-
SHA512
361e8190928c3514083ed9209478f62bd01953a2a71aa8109cbc5a40d0f969067950d1d9a38b70f997980cc7cc02bfec8087362ab903a52e963b3d296e040f63
-
SSDEEP
6144:aG5y2uK3PFKs78vpRTlEqxF6snji81RUinKbLqq:aGRuYPhpX
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
149dac716b72428daf24d3e0ae11aafdea0a401b87995651b0a1ee4510b68479.exefoaku.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 149dac716b72428daf24d3e0ae11aafdea0a401b87995651b0a1ee4510b68479.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" foaku.exe -
Executes dropped EXE 1 IoCs
Processes:
foaku.exepid process 2620 foaku.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
149dac716b72428daf24d3e0ae11aafdea0a401b87995651b0a1ee4510b68479.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 149dac716b72428daf24d3e0ae11aafdea0a401b87995651b0a1ee4510b68479.exe -
Adds Run key to start application 2 TTPs 29 IoCs
Processes:
foaku.exe149dac716b72428daf24d3e0ae11aafdea0a401b87995651b0a1ee4510b68479.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foaku = "C:\\Users\\Admin\\foaku.exe /h" foaku.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foaku = "C:\\Users\\Admin\\foaku.exe /m" foaku.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foaku = "C:\\Users\\Admin\\foaku.exe /k" foaku.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foaku = "C:\\Users\\Admin\\foaku.exe /n" foaku.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 149dac716b72428daf24d3e0ae11aafdea0a401b87995651b0a1ee4510b68479.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\ foaku.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foaku = "C:\\Users\\Admin\\foaku.exe /q" foaku.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foaku = "C:\\Users\\Admin\\foaku.exe /i" foaku.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foaku = "C:\\Users\\Admin\\foaku.exe /a" 149dac716b72428daf24d3e0ae11aafdea0a401b87995651b0a1ee4510b68479.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foaku = "C:\\Users\\Admin\\foaku.exe /u" foaku.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foaku = "C:\\Users\\Admin\\foaku.exe /z" foaku.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foaku = "C:\\Users\\Admin\\foaku.exe /r" foaku.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foaku = "C:\\Users\\Admin\\foaku.exe /y" foaku.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foaku = "C:\\Users\\Admin\\foaku.exe /v" foaku.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foaku = "C:\\Users\\Admin\\foaku.exe /w" foaku.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foaku = "C:\\Users\\Admin\\foaku.exe /a" foaku.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foaku = "C:\\Users\\Admin\\foaku.exe /x" foaku.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foaku = "C:\\Users\\Admin\\foaku.exe /g" foaku.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foaku = "C:\\Users\\Admin\\foaku.exe /s" foaku.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foaku = "C:\\Users\\Admin\\foaku.exe /j" foaku.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foaku = "C:\\Users\\Admin\\foaku.exe /o" foaku.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foaku = "C:\\Users\\Admin\\foaku.exe /b" foaku.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foaku = "C:\\Users\\Admin\\foaku.exe /e" foaku.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foaku = "C:\\Users\\Admin\\foaku.exe /l" foaku.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foaku = "C:\\Users\\Admin\\foaku.exe /p" foaku.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foaku = "C:\\Users\\Admin\\foaku.exe /d" foaku.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foaku = "C:\\Users\\Admin\\foaku.exe /f" foaku.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foaku = "C:\\Users\\Admin\\foaku.exe /t" foaku.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foaku = "C:\\Users\\Admin\\foaku.exe /c" foaku.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
149dac716b72428daf24d3e0ae11aafdea0a401b87995651b0a1ee4510b68479.exefoaku.exepid process 2828 149dac716b72428daf24d3e0ae11aafdea0a401b87995651b0a1ee4510b68479.exe 2828 149dac716b72428daf24d3e0ae11aafdea0a401b87995651b0a1ee4510b68479.exe 2620 foaku.exe 2620 foaku.exe 2620 foaku.exe 2620 foaku.exe 2620 foaku.exe 2620 foaku.exe 2620 foaku.exe 2620 foaku.exe 2620 foaku.exe 2620 foaku.exe 2620 foaku.exe 2620 foaku.exe 2620 foaku.exe 2620 foaku.exe 2620 foaku.exe 2620 foaku.exe 2620 foaku.exe 2620 foaku.exe 2620 foaku.exe 2620 foaku.exe 2620 foaku.exe 2620 foaku.exe 2620 foaku.exe 2620 foaku.exe 2620 foaku.exe 2620 foaku.exe 2620 foaku.exe 2620 foaku.exe 2620 foaku.exe 2620 foaku.exe 2620 foaku.exe 2620 foaku.exe 2620 foaku.exe 2620 foaku.exe 2620 foaku.exe 2620 foaku.exe 2620 foaku.exe 2620 foaku.exe 2620 foaku.exe 2620 foaku.exe 2620 foaku.exe 2620 foaku.exe 2620 foaku.exe 2620 foaku.exe 2620 foaku.exe 2620 foaku.exe 2620 foaku.exe 2620 foaku.exe 2620 foaku.exe 2620 foaku.exe 2620 foaku.exe 2620 foaku.exe 2620 foaku.exe 2620 foaku.exe 2620 foaku.exe 2620 foaku.exe 2620 foaku.exe 2620 foaku.exe 2620 foaku.exe 2620 foaku.exe 2620 foaku.exe 2620 foaku.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
149dac716b72428daf24d3e0ae11aafdea0a401b87995651b0a1ee4510b68479.exefoaku.exepid process 2828 149dac716b72428daf24d3e0ae11aafdea0a401b87995651b0a1ee4510b68479.exe 2620 foaku.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
149dac716b72428daf24d3e0ae11aafdea0a401b87995651b0a1ee4510b68479.exedescription pid process target process PID 2828 wrote to memory of 2620 2828 149dac716b72428daf24d3e0ae11aafdea0a401b87995651b0a1ee4510b68479.exe foaku.exe PID 2828 wrote to memory of 2620 2828 149dac716b72428daf24d3e0ae11aafdea0a401b87995651b0a1ee4510b68479.exe foaku.exe PID 2828 wrote to memory of 2620 2828 149dac716b72428daf24d3e0ae11aafdea0a401b87995651b0a1ee4510b68479.exe foaku.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\149dac716b72428daf24d3e0ae11aafdea0a401b87995651b0a1ee4510b68479.exe"C:\Users\Admin\AppData\Local\Temp\149dac716b72428daf24d3e0ae11aafdea0a401b87995651b0a1ee4510b68479.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\foaku.exe"C:\Users\Admin\foaku.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2620
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\foaku.exeFilesize
232KB
MD50849ab0c97fdfa551f886db294fbd512
SHA1683b308e1b0089d7217480fbc6376ef8362395ba
SHA256835eda1f7bf718db8f91772e4596614cb13693bbcf4d399ab4f05f2d90ba5a08
SHA5127df4ff0781a17ffec9cf15b12e5003c90b2d718130afc78eba949af0bf55c34568f56892ad9a24afb2ea96416a02303b95194bb5a27b1d7e689fc9ce92c2d4c4
-
C:\Users\Admin\foaku.exeFilesize
232KB
MD50849ab0c97fdfa551f886db294fbd512
SHA1683b308e1b0089d7217480fbc6376ef8362395ba
SHA256835eda1f7bf718db8f91772e4596614cb13693bbcf4d399ab4f05f2d90ba5a08
SHA5127df4ff0781a17ffec9cf15b12e5003c90b2d718130afc78eba949af0bf55c34568f56892ad9a24afb2ea96416a02303b95194bb5a27b1d7e689fc9ce92c2d4c4
-
memory/2620-134-0x0000000000000000-mapping.dmp