e501318c0db899d1426736cc45c07f55b033fb2f6c53ecb398e10596fcd0f2f4

General

Target

e501318c0db899d1426736cc45c07f55b033fb2f6c53ecb398e10596fcd0f2f4.exe
Size

184KB
MD5

5487995934b0c66b93cb306bc0bd2d42
SHA1

d9d41a959dea84df11b2af86908a931ffecc7d8d
SHA256

e501318c0db899d1426736cc45c07f55b033fb2f6c53ecb398e10596fcd0f2f4
SHA512

badc480d4a298dffda41f046d8cf8b02afed3ad1400003a4a0709c4741c374826fc38583497dc8a99d9c2fefc0421f08dd98829d9f63936b932871d5f33353a1
SSDEEP

3072:xX+qdeVb4rNjWrbC0QuKnvmb7/D26SwP9llwnlr8RMFDjsyvI+cdcFT0uLFaXmGu:xpcVb4rNjW1Knvmb7/D26SwVllwnlr8c

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

foauwam.exee501318c0db899d1426736cc45c07f55b033fb2f6c53ecb398e10596fcd0f2f4.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	foauwam.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	e501318c0db899d1426736cc45c07f55b033fb2f6c53ecb398e10596fcd0f2f4.exe

Executes dropped EXE 1 IoCs

Processes:

foauwam.exe

pid process

4384 foauwam.exe

pid	process
4384	foauwam.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

e501318c0db899d1426736cc45c07f55b033fb2f6c53ecb398e10596fcd0f2f4.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	e501318c0db899d1426736cc45c07f55b033fb2f6c53ecb398e10596fcd0f2f4.exe

Adds Run key to start application 2 TTPs 54 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

foauwam.exee501318c0db899d1426736cc45c07f55b033fb2f6c53ecb398e10596fcd0f2f4.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foauwam = "C:\\Users\\Admin\\foauwam.exe /f"	foauwam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foauwam = "C:\\Users\\Admin\\foauwam.exe /V"	foauwam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foauwam = "C:\\Users\\Admin\\foauwam.exe /N"	foauwam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foauwam = "C:\\Users\\Admin\\foauwam.exe /z"	foauwam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foauwam = "C:\\Users\\Admin\\foauwam.exe /C"	foauwam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foauwam = "C:\\Users\\Admin\\foauwam.exe /x"	foauwam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foauwam = "C:\\Users\\Admin\\foauwam.exe /p"	foauwam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foauwam = "C:\\Users\\Admin\\foauwam.exe /d"	foauwam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foauwam = "C:\\Users\\Admin\\foauwam.exe /b"	foauwam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foauwam = "C:\\Users\\Admin\\foauwam.exe /M"	foauwam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foauwam = "C:\\Users\\Admin\\foauwam.exe /G"	foauwam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foauwam = "C:\\Users\\Admin\\foauwam.exe /q"	foauwam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foauwam = "C:\\Users\\Admin\\foauwam.exe /D"	foauwam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foauwam = "C:\\Users\\Admin\\foauwam.exe /t"	foauwam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foauwam = "C:\\Users\\Admin\\foauwam.exe /Q"	foauwam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foauwam = "C:\\Users\\Admin\\foauwam.exe /J"	foauwam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foauwam = "C:\\Users\\Admin\\foauwam.exe /h"	foauwam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foauwam = "C:\\Users\\Admin\\foauwam.exe /I"	foauwam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foauwam = "C:\\Users\\Admin\\foauwam.exe /A"	foauwam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foauwam = "C:\\Users\\Admin\\foauwam.exe /S"	foauwam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foauwam = "C:\\Users\\Admin\\foauwam.exe /Y"	foauwam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foauwam = "C:\\Users\\Admin\\foauwam.exe /o"	foauwam.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run\	e501318c0db899d1426736cc45c07f55b033fb2f6c53ecb398e10596fcd0f2f4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foauwam = "C:\\Users\\Admin\\foauwam.exe /h"	e501318c0db899d1426736cc45c07f55b033fb2f6c53ecb398e10596fcd0f2f4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foauwam = "C:\\Users\\Admin\\foauwam.exe /H"	foauwam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foauwam = "C:\\Users\\Admin\\foauwam.exe /a"	foauwam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foauwam = "C:\\Users\\Admin\\foauwam.exe /g"	foauwam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foauwam = "C:\\Users\\Admin\\foauwam.exe /w"	foauwam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foauwam = "C:\\Users\\Admin\\foauwam.exe /L"	foauwam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foauwam = "C:\\Users\\Admin\\foauwam.exe /R"	foauwam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foauwam = "C:\\Users\\Admin\\foauwam.exe /O"	foauwam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foauwam = "C:\\Users\\Admin\\foauwam.exe /X"	foauwam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foauwam = "C:\\Users\\Admin\\foauwam.exe /l"	foauwam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foauwam = "C:\\Users\\Admin\\foauwam.exe /n"	foauwam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foauwam = "C:\\Users\\Admin\\foauwam.exe /P"	foauwam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foauwam = "C:\\Users\\Admin\\foauwam.exe /s"	foauwam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foauwam = "C:\\Users\\Admin\\foauwam.exe /r"	foauwam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foauwam = "C:\\Users\\Admin\\foauwam.exe /j"	foauwam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foauwam = "C:\\Users\\Admin\\foauwam.exe /i"	foauwam.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run\	foauwam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foauwam = "C:\\Users\\Admin\\foauwam.exe /B"	foauwam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foauwam = "C:\\Users\\Admin\\foauwam.exe /c"	foauwam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foauwam = "C:\\Users\\Admin\\foauwam.exe /Z"	foauwam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foauwam = "C:\\Users\\Admin\\foauwam.exe /E"	foauwam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foauwam = "C:\\Users\\Admin\\foauwam.exe /v"	foauwam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foauwam = "C:\\Users\\Admin\\foauwam.exe /m"	foauwam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foauwam = "C:\\Users\\Admin\\foauwam.exe /k"	foauwam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foauwam = "C:\\Users\\Admin\\foauwam.exe /u"	foauwam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foauwam = "C:\\Users\\Admin\\foauwam.exe /y"	foauwam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foauwam = "C:\\Users\\Admin\\foauwam.exe /W"	foauwam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foauwam = "C:\\Users\\Admin\\foauwam.exe /e"	foauwam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foauwam = "C:\\Users\\Admin\\foauwam.exe /F"	foauwam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foauwam = "C:\\Users\\Admin\\foauwam.exe /K"	foauwam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foauwam = "C:\\Users\\Admin\\foauwam.exe /T"	foauwam.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

e501318c0db899d1426736cc45c07f55b033fb2f6c53ecb398e10596fcd0f2f4.exefoauwam.exe

pid	process
4084	e501318c0db899d1426736cc45c07f55b033fb2f6c53ecb398e10596fcd0f2f4.exe
4084	e501318c0db899d1426736cc45c07f55b033fb2f6c53ecb398e10596fcd0f2f4.exe
4384	foauwam.exe
4384	foauwam.exe
4384	foauwam.exe
4384	foauwam.exe
4384	foauwam.exe
4384	foauwam.exe
4384	foauwam.exe
4384	foauwam.exe
4384	foauwam.exe
4384	foauwam.exe
4384	foauwam.exe
4384	foauwam.exe
4384	foauwam.exe
4384	foauwam.exe
4384	foauwam.exe
4384	foauwam.exe
4384	foauwam.exe
4384	foauwam.exe
4384	foauwam.exe
4384	foauwam.exe
4384	foauwam.exe
4384	foauwam.exe
4384	foauwam.exe
4384	foauwam.exe
4384	foauwam.exe
4384	foauwam.exe
4384	foauwam.exe
4384	foauwam.exe
4384	foauwam.exe
4384	foauwam.exe
4384	foauwam.exe
4384	foauwam.exe
4384	foauwam.exe
4384	foauwam.exe
4384	foauwam.exe
4384	foauwam.exe
4384	foauwam.exe
4384	foauwam.exe
4384	foauwam.exe
4384	foauwam.exe
4384	foauwam.exe
4384	foauwam.exe
4384	foauwam.exe
4384	foauwam.exe
4384	foauwam.exe
4384	foauwam.exe
4384	foauwam.exe
4384	foauwam.exe
4384	foauwam.exe
4384	foauwam.exe
4384	foauwam.exe
4384	foauwam.exe
4384	foauwam.exe
4384	foauwam.exe
4384	foauwam.exe
4384	foauwam.exe
4384	foauwam.exe
4384	foauwam.exe
4384	foauwam.exe
4384	foauwam.exe
4384	foauwam.exe
4384	foauwam.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

e501318c0db899d1426736cc45c07f55b033fb2f6c53ecb398e10596fcd0f2f4.exefoauwam.exe

pid process

4084 e501318c0db899d1426736cc45c07f55b033fb2f6c53ecb398e10596fcd0f2f4.exe
4384 foauwam.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

e501318c0db899d1426736cc45c07f55b033fb2f6c53ecb398e10596fcd0f2f4.exe

description	pid	process	target process
PID 4084 wrote to memory of 4384	4084	e501318c0db899d1426736cc45c07f55b033fb2f6c53ecb398e10596fcd0f2f4.exe	foauwam.exe
PID 4084 wrote to memory of 4384	4084	e501318c0db899d1426736cc45c07f55b033fb2f6c53ecb398e10596fcd0f2f4.exe	foauwam.exe
PID 4084 wrote to memory of 4384	4084	e501318c0db899d1426736cc45c07f55b033fb2f6c53ecb398e10596fcd0f2f4.exe	foauwam.exe

C:\Users\Admin\AppData\Local\Temp\e501318c0db899d1426736cc45c07f55b033fb2f6c53ecb398e10596fcd0f2f4.exe
"C:\Users\Admin\AppData\Local\Temp\e501318c0db899d1426736cc45c07f55b033fb2f6c53ecb398e10596fcd0f2f4.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4084
- C:\Users\Admin\foauwam.exe
  "C:\Users\Admin\foauwam.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4384

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\foauwam.exe

Filesize
184KB

MD5
27268de463e8d88d342a66f18bd51b48

SHA1
541400a4363cbb33c0587785768d9485db5fc494

SHA256
9a655b0fe7664a2c03ab4f0c9c6a12880e4a0a03c892ade80c43fc5659e35e73

SHA512
60d6e05cfe07de88874e7f34a26474a56475704005d9b52b1857af60f46622e42196f6d430221ce7efcfc87919958fd2f30300cdd5fa2507d06952682db40c36

Download Submit
C:\Users\Admin\foauwam.exe

Filesize
184KB

MD5
27268de463e8d88d342a66f18bd51b48

SHA1
541400a4363cbb33c0587785768d9485db5fc494

SHA256
9a655b0fe7664a2c03ab4f0c9c6a12880e4a0a03c892ade80c43fc5659e35e73

SHA512
60d6e05cfe07de88874e7f34a26474a56475704005d9b52b1857af60f46622e42196f6d430221ce7efcfc87919958fd2f30300cdd5fa2507d06952682db40c36

Download Submit
memory/4384-134-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads