ebd837364c93a1ad5b74c6c6c1bd9adc3173d7f6d462a0b89aaf431738253047

General

Target

ebd837364c93a1ad5b74c6c6c1bd9adc3173d7f6d462a0b89aaf431738253047.exe
Size

140KB
MD5

1616f984a8c4ba4c4d87b72c08dc3e24
SHA1

ba3b0dd554dd1f13ddd8d9640fb097b99e7833ae
SHA256

ebd837364c93a1ad5b74c6c6c1bd9adc3173d7f6d462a0b89aaf431738253047
SHA512

2b1c8517759c48693681665412168a33233041c3f5a4d92c847041c80f79c035c6ef722c14c240f0bfc8335aee102ac7c8a9e8021e1afe6dd46d9027446fe0cb
SSDEEP

3072:Ll2rglCJmkD73mQtFDPB1P85XvbM7h8bdaqmRIxqeHHNMBeeYGT:Lsr6CJ/72QtFDPB1P85Xvw7h8boqfqeG

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

ebd837364c93a1ad5b74c6c6c1bd9adc3173d7f6d462a0b89aaf431738253047.exefapap.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	ebd837364c93a1ad5b74c6c6c1bd9adc3173d7f6d462a0b89aaf431738253047.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	fapap.exe

Executes dropped EXE 1 IoCs

Processes:

fapap.exe

pid process

696 fapap.exe

pid	process
696	fapap.exe

Loads dropped DLL 2 IoCs

Processes:

ebd837364c93a1ad5b74c6c6c1bd9adc3173d7f6d462a0b89aaf431738253047.exe

pid	process
1104	ebd837364c93a1ad5b74c6c6c1bd9adc3173d7f6d462a0b89aaf431738253047.exe
1104	ebd837364c93a1ad5b74c6c6c1bd9adc3173d7f6d462a0b89aaf431738253047.exe

Adds Run key to start application 2 TTPs 45 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

fapap.exeebd837364c93a1ad5b74c6c6c1bd9adc3173d7f6d462a0b89aaf431738253047.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fapap = "C:\\Users\\Admin\\fapap.exe /G"	fapap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fapap = "C:\\Users\\Admin\\fapap.exe /c"	fapap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fapap = "C:\\Users\\Admin\\fapap.exe /Z"	fapap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fapap = "C:\\Users\\Admin\\fapap.exe /z"	fapap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fapap = "C:\\Users\\Admin\\fapap.exe /F"	fapap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fapap = "C:\\Users\\Admin\\fapap.exe /A"	fapap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fapap = "C:\\Users\\Admin\\fapap.exe /C"	fapap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fapap = "C:\\Users\\Admin\\fapap.exe /L"	fapap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fapap = "C:\\Users\\Admin\\fapap.exe /a"	fapap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fapap = "C:\\Users\\Admin\\fapap.exe /D"	fapap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fapap = "C:\\Users\\Admin\\fapap.exe /w"	fapap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fapap = "C:\\Users\\Admin\\fapap.exe /g"	fapap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fapap = "C:\\Users\\Admin\\fapap.exe /H"	fapap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fapap = "C:\\Users\\Admin\\fapap.exe /o"	fapap.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\	fapap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fapap = "C:\\Users\\Admin\\fapap.exe /I"	fapap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fapap = "C:\\Users\\Admin\\fapap.exe /R"	fapap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fapap = "C:\\Users\\Admin\\fapap.exe /M"	fapap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fapap = "C:\\Users\\Admin\\fapap.exe /u"	fapap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fapap = "C:\\Users\\Admin\\fapap.exe /x"	fapap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fapap = "C:\\Users\\Admin\\fapap.exe /U"	fapap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fapap = "C:\\Users\\Admin\\fapap.exe /p"	fapap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fapap = "C:\\Users\\Admin\\fapap.exe /e"	fapap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fapap = "C:\\Users\\Admin\\fapap.exe /i"	fapap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fapap = "C:\\Users\\Admin\\fapap.exe /b"	fapap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fapap = "C:\\Users\\Admin\\fapap.exe /f"	fapap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fapap = "C:\\Users\\Admin\\fapap.exe /r"	fapap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fapap = "C:\\Users\\Admin\\fapap.exe /K"	fapap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fapap = "C:\\Users\\Admin\\fapap.exe /s"	fapap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fapap = "C:\\Users\\Admin\\fapap.exe /T"	fapap.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\	ebd837364c93a1ad5b74c6c6c1bd9adc3173d7f6d462a0b89aaf431738253047.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fapap = "C:\\Users\\Admin\\fapap.exe /H"	ebd837364c93a1ad5b74c6c6c1bd9adc3173d7f6d462a0b89aaf431738253047.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fapap = "C:\\Users\\Admin\\fapap.exe /y"	fapap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fapap = "C:\\Users\\Admin\\fapap.exe /k"	fapap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fapap = "C:\\Users\\Admin\\fapap.exe /v"	fapap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fapap = "C:\\Users\\Admin\\fapap.exe /q"	fapap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fapap = "C:\\Users\\Admin\\fapap.exe /j"	fapap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fapap = "C:\\Users\\Admin\\fapap.exe /Q"	fapap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fapap = "C:\\Users\\Admin\\fapap.exe /n"	fapap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fapap = "C:\\Users\\Admin\\fapap.exe /S"	fapap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fapap = "C:\\Users\\Admin\\fapap.exe /l"	fapap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fapap = "C:\\Users\\Admin\\fapap.exe /t"	fapap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fapap = "C:\\Users\\Admin\\fapap.exe /B"	fapap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fapap = "C:\\Users\\Admin\\fapap.exe /O"	fapap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fapap = "C:\\Users\\Admin\\fapap.exe /W"	fapap.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

ebd837364c93a1ad5b74c6c6c1bd9adc3173d7f6d462a0b89aaf431738253047.exefapap.exe

pid	process
1104	ebd837364c93a1ad5b74c6c6c1bd9adc3173d7f6d462a0b89aaf431738253047.exe
696	fapap.exe
696	fapap.exe
696	fapap.exe
696	fapap.exe
696	fapap.exe
696	fapap.exe
696	fapap.exe
696	fapap.exe
696	fapap.exe
696	fapap.exe
696	fapap.exe
696	fapap.exe
696	fapap.exe
696	fapap.exe
696	fapap.exe
696	fapap.exe
696	fapap.exe
696	fapap.exe
696	fapap.exe
696	fapap.exe
696	fapap.exe
696	fapap.exe
696	fapap.exe
696	fapap.exe
696	fapap.exe
696	fapap.exe
696	fapap.exe
696	fapap.exe
696	fapap.exe
696	fapap.exe
696	fapap.exe
696	fapap.exe
696	fapap.exe
696	fapap.exe
696	fapap.exe
696	fapap.exe
696	fapap.exe
696	fapap.exe
696	fapap.exe
696	fapap.exe
696	fapap.exe
696	fapap.exe
696	fapap.exe
696	fapap.exe
696	fapap.exe
696	fapap.exe
696	fapap.exe
696	fapap.exe
696	fapap.exe
696	fapap.exe
696	fapap.exe
696	fapap.exe
696	fapap.exe
696	fapap.exe
696	fapap.exe
696	fapap.exe
696	fapap.exe
696	fapap.exe
696	fapap.exe
696	fapap.exe
696	fapap.exe
696	fapap.exe
696	fapap.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

ebd837364c93a1ad5b74c6c6c1bd9adc3173d7f6d462a0b89aaf431738253047.exefapap.exe

pid process

1104 ebd837364c93a1ad5b74c6c6c1bd9adc3173d7f6d462a0b89aaf431738253047.exe
696 fapap.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

ebd837364c93a1ad5b74c6c6c1bd9adc3173d7f6d462a0b89aaf431738253047.exe

description	pid	process	target process
PID 1104 wrote to memory of 696	1104	ebd837364c93a1ad5b74c6c6c1bd9adc3173d7f6d462a0b89aaf431738253047.exe	fapap.exe
PID 1104 wrote to memory of 696	1104	ebd837364c93a1ad5b74c6c6c1bd9adc3173d7f6d462a0b89aaf431738253047.exe	fapap.exe
PID 1104 wrote to memory of 696	1104	ebd837364c93a1ad5b74c6c6c1bd9adc3173d7f6d462a0b89aaf431738253047.exe	fapap.exe
PID 1104 wrote to memory of 696	1104	ebd837364c93a1ad5b74c6c6c1bd9adc3173d7f6d462a0b89aaf431738253047.exe	fapap.exe

C:\Users\Admin\AppData\Local\Temp\ebd837364c93a1ad5b74c6c6c1bd9adc3173d7f6d462a0b89aaf431738253047.exe
"C:\Users\Admin\AppData\Local\Temp\ebd837364c93a1ad5b74c6c6c1bd9adc3173d7f6d462a0b89aaf431738253047.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1104

C:\Users\Admin\fapap.exe
"C:\Users\Admin\fapap.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:696

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\fapap.exe

Filesize
140KB

MD5
f93d85b7b3970c99127e182f2c48bb03

SHA1
9aef9a8be80a715f0b34f597ebde95cdc6bc6dbd

SHA256
342a67cdace5dc372108865c6e2677ea26d8b2b9b32891a280a88d2f0fa71950

SHA512
39e3bd26e6ca073f025850c31d44fb876f40bb65397b2baf2ba4e493cea1e0b6e4e55ce495225b72ca3298bd8f255a2ddf672d4742f1171a57c82c58432e0c99

Download Submit
C:\Users\Admin\fapap.exe

Filesize
140KB

MD5
f93d85b7b3970c99127e182f2c48bb03

SHA1
9aef9a8be80a715f0b34f597ebde95cdc6bc6dbd

SHA256
342a67cdace5dc372108865c6e2677ea26d8b2b9b32891a280a88d2f0fa71950

SHA512
39e3bd26e6ca073f025850c31d44fb876f40bb65397b2baf2ba4e493cea1e0b6e4e55ce495225b72ca3298bd8f255a2ddf672d4742f1171a57c82c58432e0c99

Download Submit
\Users\Admin\fapap.exe

Filesize
140KB

MD5
f93d85b7b3970c99127e182f2c48bb03

SHA1
9aef9a8be80a715f0b34f597ebde95cdc6bc6dbd

SHA256
342a67cdace5dc372108865c6e2677ea26d8b2b9b32891a280a88d2f0fa71950

SHA512
39e3bd26e6ca073f025850c31d44fb876f40bb65397b2baf2ba4e493cea1e0b6e4e55ce495225b72ca3298bd8f255a2ddf672d4742f1171a57c82c58432e0c99

Download Submit
\Users\Admin\fapap.exe

Filesize
140KB

MD5
f93d85b7b3970c99127e182f2c48bb03

SHA1
9aef9a8be80a715f0b34f597ebde95cdc6bc6dbd

SHA256
342a67cdace5dc372108865c6e2677ea26d8b2b9b32891a280a88d2f0fa71950

SHA512
39e3bd26e6ca073f025850c31d44fb876f40bb65397b2baf2ba4e493cea1e0b6e4e55ce495225b72ca3298bd8f255a2ddf672d4742f1171a57c82c58432e0c99

Download Submit
memory/696-59-0x0000000000000000-mapping.dmp

Download
memory/1104-56-0x0000000075441000-0x0000000075443000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads