7af48b9e159d3548a04b31821c503f643206fa4d9467eb653ff7041ea0cb5c1b

General

Target

7af48b9e159d3548a04b31821c503f643206fa4d9467eb653ff7041ea0cb5c1b.exe
Size

256KB
MD5

2d806efa292017252db826edf6caa020
SHA1

5893e6be349b2048b34d749a77b473a1f17d3cc9
SHA256

7af48b9e159d3548a04b31821c503f643206fa4d9467eb653ff7041ea0cb5c1b
SHA512

5697a57935f4efa4da9f688b313a52a24fd40bed1de09ab9033578472ab822a8533c12caed5b9c2dcb893c6aa83727977c92bfbd0f394d4f4744459ac1c9a218
SSDEEP

6144:yf28PlptNvl9fm0UBFsqMabeYiUDogmFv:y39n9lJvaFsqMvNv

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

7af48b9e159d3548a04b31821c503f643206fa4d9467eb653ff7041ea0cb5c1b.exeftsop.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	7af48b9e159d3548a04b31821c503f643206fa4d9467eb653ff7041ea0cb5c1b.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	ftsop.exe

Executes dropped EXE 1 IoCs

Processes:

ftsop.exe

pid process

1568 ftsop.exe

pid	process
1568	ftsop.exe

Loads dropped DLL 2 IoCs

Processes:

7af48b9e159d3548a04b31821c503f643206fa4d9467eb653ff7041ea0cb5c1b.exe

pid	process
1948	7af48b9e159d3548a04b31821c503f643206fa4d9467eb653ff7041ea0cb5c1b.exe
1948	7af48b9e159d3548a04b31821c503f643206fa4d9467eb653ff7041ea0cb5c1b.exe

Adds Run key to start application 2 TTPs 52 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

ftsop.exe7af48b9e159d3548a04b31821c503f643206fa4d9467eb653ff7041ea0cb5c1b.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftsop = "C:\\Users\\Admin\\ftsop.exe /d"	ftsop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftsop = "C:\\Users\\Admin\\ftsop.exe /I"	ftsop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftsop = "C:\\Users\\Admin\\ftsop.exe /Z"	ftsop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftsop = "C:\\Users\\Admin\\ftsop.exe /f"	ftsop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftsop = "C:\\Users\\Admin\\ftsop.exe /r"	ftsop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftsop = "C:\\Users\\Admin\\ftsop.exe /B"	ftsop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftsop = "C:\\Users\\Admin\\ftsop.exe /o"	ftsop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftsop = "C:\\Users\\Admin\\ftsop.exe /H"	ftsop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftsop = "C:\\Users\\Admin\\ftsop.exe /z"	ftsop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftsop = "C:\\Users\\Admin\\ftsop.exe /b"	ftsop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftsop = "C:\\Users\\Admin\\ftsop.exe /a"	ftsop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftsop = "C:\\Users\\Admin\\ftsop.exe /F"	ftsop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftsop = "C:\\Users\\Admin\\ftsop.exe /q"	ftsop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftsop = "C:\\Users\\Admin\\ftsop.exe /R"	ftsop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftsop = "C:\\Users\\Admin\\ftsop.exe /y"	ftsop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftsop = "C:\\Users\\Admin\\ftsop.exe /W"	ftsop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftsop = "C:\\Users\\Admin\\ftsop.exe /V"	ftsop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftsop = "C:\\Users\\Admin\\ftsop.exe /p"	ftsop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftsop = "C:\\Users\\Admin\\ftsop.exe /K"	ftsop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftsop = "C:\\Users\\Admin\\ftsop.exe /l"	ftsop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftsop = "C:\\Users\\Admin\\ftsop.exe /U"	ftsop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftsop = "C:\\Users\\Admin\\ftsop.exe /c"	ftsop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftsop = "C:\\Users\\Admin\\ftsop.exe /A"	ftsop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftsop = "C:\\Users\\Admin\\ftsop.exe /G"	ftsop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftsop = "C:\\Users\\Admin\\ftsop.exe /x"	ftsop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftsop = "C:\\Users\\Admin\\ftsop.exe /Y"	ftsop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftsop = "C:\\Users\\Admin\\ftsop.exe /P"	ftsop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftsop = "C:\\Users\\Admin\\ftsop.exe /e"	ftsop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftsop = "C:\\Users\\Admin\\ftsop.exe /C"	ftsop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftsop = "C:\\Users\\Admin\\ftsop.exe /i"	ftsop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftsop = "C:\\Users\\Admin\\ftsop.exe /t"	ftsop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftsop = "C:\\Users\\Admin\\ftsop.exe /L"	ftsop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftsop = "C:\\Users\\Admin\\ftsop.exe /J"	ftsop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftsop = "C:\\Users\\Admin\\ftsop.exe /n"	ftsop.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\	7af48b9e159d3548a04b31821c503f643206fa4d9467eb653ff7041ea0cb5c1b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftsop = "C:\\Users\\Admin\\ftsop.exe /g"	ftsop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftsop = "C:\\Users\\Admin\\ftsop.exe /O"	ftsop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftsop = "C:\\Users\\Admin\\ftsop.exe /D"	ftsop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftsop = "C:\\Users\\Admin\\ftsop.exe /Q"	ftsop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftsop = "C:\\Users\\Admin\\ftsop.exe /S"	ftsop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftsop = "C:\\Users\\Admin\\ftsop.exe /s"	ftsop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftsop = "C:\\Users\\Admin\\ftsop.exe /w"	ftsop.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\	ftsop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftsop = "C:\\Users\\Admin\\ftsop.exe /E"	ftsop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftsop = "C:\\Users\\Admin\\ftsop.exe /u"	ftsop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftsop = "C:\\Users\\Admin\\ftsop.exe /v"	ftsop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftsop = "C:\\Users\\Admin\\ftsop.exe /N"	ftsop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftsop = "C:\\Users\\Admin\\ftsop.exe /X"	ftsop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftsop = "C:\\Users\\Admin\\ftsop.exe /A"	7af48b9e159d3548a04b31821c503f643206fa4d9467eb653ff7041ea0cb5c1b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftsop = "C:\\Users\\Admin\\ftsop.exe /T"	ftsop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftsop = "C:\\Users\\Admin\\ftsop.exe /j"	ftsop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftsop = "C:\\Users\\Admin\\ftsop.exe /h"	ftsop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

7af48b9e159d3548a04b31821c503f643206fa4d9467eb653ff7041ea0cb5c1b.exeftsop.exe

pid	process
1948	7af48b9e159d3548a04b31821c503f643206fa4d9467eb653ff7041ea0cb5c1b.exe
1568	ftsop.exe
1568	ftsop.exe
1568	ftsop.exe
1568	ftsop.exe
1568	ftsop.exe
1568	ftsop.exe
1568	ftsop.exe
1568	ftsop.exe
1568	ftsop.exe
1568	ftsop.exe
1568	ftsop.exe
1568	ftsop.exe
1568	ftsop.exe
1568	ftsop.exe
1568	ftsop.exe
1568	ftsop.exe
1568	ftsop.exe
1568	ftsop.exe
1568	ftsop.exe
1568	ftsop.exe
1568	ftsop.exe
1568	ftsop.exe
1568	ftsop.exe
1568	ftsop.exe
1568	ftsop.exe
1568	ftsop.exe
1568	ftsop.exe
1568	ftsop.exe
1568	ftsop.exe
1568	ftsop.exe
1568	ftsop.exe
1568	ftsop.exe
1568	ftsop.exe
1568	ftsop.exe
1568	ftsop.exe
1568	ftsop.exe
1568	ftsop.exe
1568	ftsop.exe
1568	ftsop.exe
1568	ftsop.exe
1568	ftsop.exe
1568	ftsop.exe
1568	ftsop.exe
1568	ftsop.exe
1568	ftsop.exe
1568	ftsop.exe
1568	ftsop.exe
1568	ftsop.exe
1568	ftsop.exe
1568	ftsop.exe
1568	ftsop.exe
1568	ftsop.exe
1568	ftsop.exe
1568	ftsop.exe
1568	ftsop.exe
1568	ftsop.exe
1568	ftsop.exe
1568	ftsop.exe
1568	ftsop.exe
1568	ftsop.exe
1568	ftsop.exe
1568	ftsop.exe
1568	ftsop.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

7af48b9e159d3548a04b31821c503f643206fa4d9467eb653ff7041ea0cb5c1b.exeftsop.exe

pid process

1948 7af48b9e159d3548a04b31821c503f643206fa4d9467eb653ff7041ea0cb5c1b.exe
1568 ftsop.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

7af48b9e159d3548a04b31821c503f643206fa4d9467eb653ff7041ea0cb5c1b.exe

description	pid	process	target process
PID 1948 wrote to memory of 1568	1948	7af48b9e159d3548a04b31821c503f643206fa4d9467eb653ff7041ea0cb5c1b.exe	ftsop.exe
PID 1948 wrote to memory of 1568	1948	7af48b9e159d3548a04b31821c503f643206fa4d9467eb653ff7041ea0cb5c1b.exe	ftsop.exe
PID 1948 wrote to memory of 1568	1948	7af48b9e159d3548a04b31821c503f643206fa4d9467eb653ff7041ea0cb5c1b.exe	ftsop.exe
PID 1948 wrote to memory of 1568	1948	7af48b9e159d3548a04b31821c503f643206fa4d9467eb653ff7041ea0cb5c1b.exe	ftsop.exe

C:\Users\Admin\AppData\Local\Temp\7af48b9e159d3548a04b31821c503f643206fa4d9467eb653ff7041ea0cb5c1b.exe
"C:\Users\Admin\AppData\Local\Temp\7af48b9e159d3548a04b31821c503f643206fa4d9467eb653ff7041ea0cb5c1b.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Users\Admin\ftsop.exe
  "C:\Users\Admin\ftsop.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1568

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\ftsop.exe

Filesize
256KB

MD5
c069efcafa7a78588d8cec5005929997

SHA1
2ad5f1b7b085d640601723125bfe2b8fddbab6fd

SHA256
c304eafa9fd9400c0e6846574f1fa2b2dc3b1e0ca78c0c7ad2b03d14b1fba326

SHA512
90f636a0a52fc0e4cb4f465c6676285b9a84bbfd033856b3bf877c40d688d3a60d0a8315086752290f5793a1459820ae957a58f63610e07dcad4022afd452597

Download Submit
C:\Users\Admin\ftsop.exe

Filesize
256KB

MD5
c069efcafa7a78588d8cec5005929997

SHA1
2ad5f1b7b085d640601723125bfe2b8fddbab6fd

SHA256
c304eafa9fd9400c0e6846574f1fa2b2dc3b1e0ca78c0c7ad2b03d14b1fba326

SHA512
90f636a0a52fc0e4cb4f465c6676285b9a84bbfd033856b3bf877c40d688d3a60d0a8315086752290f5793a1459820ae957a58f63610e07dcad4022afd452597

Download Submit
\Users\Admin\ftsop.exe

Filesize
256KB

MD5
c069efcafa7a78588d8cec5005929997

SHA1
2ad5f1b7b085d640601723125bfe2b8fddbab6fd

SHA256
c304eafa9fd9400c0e6846574f1fa2b2dc3b1e0ca78c0c7ad2b03d14b1fba326

SHA512
90f636a0a52fc0e4cb4f465c6676285b9a84bbfd033856b3bf877c40d688d3a60d0a8315086752290f5793a1459820ae957a58f63610e07dcad4022afd452597

Download Submit
\Users\Admin\ftsop.exe

Filesize
256KB

MD5
c069efcafa7a78588d8cec5005929997

SHA1
2ad5f1b7b085d640601723125bfe2b8fddbab6fd

SHA256
c304eafa9fd9400c0e6846574f1fa2b2dc3b1e0ca78c0c7ad2b03d14b1fba326

SHA512
90f636a0a52fc0e4cb4f465c6676285b9a84bbfd033856b3bf877c40d688d3a60d0a8315086752290f5793a1459820ae957a58f63610e07dcad4022afd452597

Download Submit
memory/1568-59-0x0000000000000000-mapping.dmp

Download
memory/1948-56-0x0000000076031000-0x0000000076033000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads