46efa46a07219dd38811c4b39b536c47f8e98f4b61471edb92b485936d19ed6a

General

Target

FortiClientVPNOnlineInstaller/FortiClientVPNOnlineInstaller.exe
Size

680.0MB
MD5

04ef98f4529be357048652711b07a229
SHA1

29c83c44525fabdd00975a2d86dc89a57254e427
SHA256

3845e4da0576f1738714186dcf9546174256f8293192010df857955d4bf025af
SHA512

e8d5124166f649e63e2abf09455a168a72fca59da9539cb6145bc3bafb71c4bfb2d0e539b993d2b38f8a19c59014a6512d9ee73981f4a52ad46e5489778b2883
SSDEEP

49152:5IvoPne7uqQd/BAranpu07jFcRqzx21F3B2IoZ+HNCCskbxtOX:5IvoPnVqG/WapuEj+g0H3YJMt1xts

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

FORTIC~1.EXEFORTIC~1.tmp

pid process

572 FORTIC~1.EXE
868 FORTIC~1.tmp
Loads dropped DLL 1 IoCs

Processes:

FORTIC~1.EXE

pid process

572 FORTIC~1.EXE

pid	process
572	FORTIC~1.EXE
868	FORTIC~1.tmp

pid	process
572	FORTIC~1.EXE

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

FortiClientVPNOnlineInstaller.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	FortiClientVPNOnlineInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	FortiClientVPNOnlineInstaller.exe

Drops file in Program Files directory 4 IoCs

Processes:

FORTIC~1.tmp

description	ioc	process
File created	C:\Program Files (x86)\FortiClient VPN\is-G7NAE.tmp	FORTIC~1.tmp
File created	C:\Program Files (x86)\FortiClient VPN\is-EL39C.tmp	FORTIC~1.tmp
File opened for modification	C:\Program Files (x86)\FortiClient VPN\FortiClientVPNOnlineInstaller.exe	FORTIC~1.tmp
File created	C:\Program Files (x86)\FortiClient VPN\unins000.dat	FORTIC~1.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

FORTIC~1.tmp

pid process

868 FORTIC~1.tmp
868 FORTIC~1.tmp
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

FORTIC~1.tmp

pid process

868 FORTIC~1.tmp

pid	process
868	FORTIC~1.tmp
868	FORTIC~1.tmp

pid	process
868	FORTIC~1.tmp

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

FortiClientVPNOnlineInstaller.exeFORTIC~1.EXE

description	pid	process	target process
PID 268 wrote to memory of 572	268	FortiClientVPNOnlineInstaller.exe	FORTIC~1.EXE
PID 268 wrote to memory of 572	268	FortiClientVPNOnlineInstaller.exe	FORTIC~1.EXE
PID 268 wrote to memory of 572	268	FortiClientVPNOnlineInstaller.exe	FORTIC~1.EXE
PID 268 wrote to memory of 572	268	FortiClientVPNOnlineInstaller.exe	FORTIC~1.EXE
PID 268 wrote to memory of 572	268	FortiClientVPNOnlineInstaller.exe	FORTIC~1.EXE
PID 268 wrote to memory of 572	268	FortiClientVPNOnlineInstaller.exe	FORTIC~1.EXE
PID 268 wrote to memory of 572	268	FortiClientVPNOnlineInstaller.exe	FORTIC~1.EXE
PID 572 wrote to memory of 868	572	FORTIC~1.EXE	FORTIC~1.tmp
PID 572 wrote to memory of 868	572	FORTIC~1.EXE	FORTIC~1.tmp
PID 572 wrote to memory of 868	572	FORTIC~1.EXE	FORTIC~1.tmp
PID 572 wrote to memory of 868	572	FORTIC~1.EXE	FORTIC~1.tmp
PID 572 wrote to memory of 868	572	FORTIC~1.EXE	FORTIC~1.tmp
PID 572 wrote to memory of 868	572	FORTIC~1.EXE	FORTIC~1.tmp
PID 572 wrote to memory of 868	572	FORTIC~1.EXE	FORTIC~1.tmp

C:\Users\Admin\AppData\Local\Temp\FortiClientVPNOnlineInstaller\FortiClientVPNOnlineInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\FortiClientVPNOnlineInstaller\FortiClientVPNOnlineInstaller.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:268

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\FORTIC~1.EXE
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\FORTIC~1.EXE
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:572

C:\Users\Admin\AppData\Local\Temp\is-UMCR0.tmp\FORTIC~1.tmp
"C:\Users\Admin\AppData\Local\Temp\is-UMCR0.tmp\FORTIC~1.tmp" /SL5="$70122,2041410,838656,C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\FORTIC~1.EXE"
3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:868

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\FORTIC~1.EXE

Filesize
2.8MB

MD5
15418e0f2fb2a9810ed34c525e95490b

SHA1
6948aa9643d2c48451e64720bbcd1d517f7e8e80

SHA256
cba86ae04af61570ffe19934a56b79130bc52d12fd511c2d2b07ad0df2f2308d

SHA512
d552b6cf24c3e69577b14a54a792105475dac5b9422a46175ef5bc4b13faa2ef51604aed4dc37029a99fca7a886aa5783410b09e3db13eb2470a80662356f9b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\FORTIC~1.EXE

Filesize
2.8MB

MD5
15418e0f2fb2a9810ed34c525e95490b

SHA1
6948aa9643d2c48451e64720bbcd1d517f7e8e80

SHA256
cba86ae04af61570ffe19934a56b79130bc52d12fd511c2d2b07ad0df2f2308d

SHA512
d552b6cf24c3e69577b14a54a792105475dac5b9422a46175ef5bc4b13faa2ef51604aed4dc37029a99fca7a886aa5783410b09e3db13eb2470a80662356f9b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UMCR0.tmp\FORTIC~1.tmp

Filesize
3.0MB

MD5
c4002887e71fa65f737cbd2f99584f20

SHA1
d8c54373edca8b049df497a20c5c0b6da4737299

SHA256
ad9c8857feafa68459e2fa1010e93563b02a3c9f28180f3ac0a57528ff5d8f69

SHA512
9362b1c4a8d6feefac18c7f16e49f4bad91f849d49f1d3e911b2f23505f1b702b3992d6f816fa7eace66cc7d55afff1b298a249c9fc702f662b8294b284b1ded

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UMCR0.tmp\FORTIC~1.tmp

Filesize
3.0MB

MD5
c4002887e71fa65f737cbd2f99584f20

SHA1
d8c54373edca8b049df497a20c5c0b6da4737299

SHA256
ad9c8857feafa68459e2fa1010e93563b02a3c9f28180f3ac0a57528ff5d8f69

SHA512
9362b1c4a8d6feefac18c7f16e49f4bad91f849d49f1d3e911b2f23505f1b702b3992d6f816fa7eace66cc7d55afff1b298a249c9fc702f662b8294b284b1ded

Download Submit
\Users\Admin\AppData\Local\Temp\is-UMCR0.tmp\FORTIC~1.tmp

Filesize
3.0MB

MD5
c4002887e71fa65f737cbd2f99584f20

SHA1
d8c54373edca8b049df497a20c5c0b6da4737299

SHA256
ad9c8857feafa68459e2fa1010e93563b02a3c9f28180f3ac0a57528ff5d8f69

SHA512
9362b1c4a8d6feefac18c7f16e49f4bad91f849d49f1d3e911b2f23505f1b702b3992d6f816fa7eace66cc7d55afff1b298a249c9fc702f662b8294b284b1ded

Download Submit
memory/572-54-0x0000000000000000-mapping.dmp

Download
memory/572-56-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

Filesize
8KB

Download
memory/572-57-0x0000000000400000-0x00000000004DA000-memory.dmp

Filesize
872KB

Download
memory/572-60-0x0000000000400000-0x00000000004DA000-memory.dmp

Filesize
872KB

Download
memory/572-65-0x0000000000400000-0x00000000004DA000-memory.dmp

Filesize
872KB

Download
memory/868-62-0x0000000000000000-mapping.dmp

Download
memory/868-66-0x00000000745D1000-0x00000000745D3000-memory.dmp

Filesize
8KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads