f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65

General

Target

f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe
Size

203KB
MD5

62579d15d6d135c6cf000d0c29c2232e
SHA1

804122f30421ba399c1eb17d928794fd51812e71
SHA256

f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65
SHA512

939c55580cd8b5068eee567ad191c0646d349146064afd4df9e68c0c9d0bd8289720149146c9316ca459a2cadfeac4d2a26d17b98e8d0716a44b4c30985e8d67
SSDEEP

3072:h4URpNUUX6z/DBXJfWLXWLBOZMlarAxp8+HQBJMnTrEH2yDlH8A2KsZdQ/vQ5mTK:h4SUjhtWyLsZUQAnWP6RbQ/v0QuG4QM

Score

8^/10

persistence

Malware Config

Signatures

Sets file execution options in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ftdimlhze.exe\DisableExceptionChainValidation	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ftdimlhze.exe	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe

Loads dropped DLL 1 IoCs

Processes:

f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe

pid process

912 f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe

pid	process
912	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe

Checks for any installed AV software in registry 1 TTPs 2 IoCs

Security Software Discovery

T1063

Processes:

f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\avast! Antivirus	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe

Drops desktop.ini file(s) 1 IoCs

Processes:

f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe

description ioc process

File created C:\ProgramData\Nokia Adapter Engine\desktop.ini f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe

description	ioc	process
File created	C:\ProgramData\Nokia Adapter Engine\desktop.ini	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe

description	pid	process	target process
PID 912 set thread context of 1296	912	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

608 schtasks.exe

pid	process
608	schtasks.exe

Modifies registry class 7 IoCs

Processes:

f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\CLSID\{75095E7A-B95B-494B-8132-7A5EF940E8CE}\1B21042E\CG1\HAL = 05ee0000	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\CLSID\{75095E7A-B95B-494B-8132-7A5EF940E8CE}\1B21042E\ê'u3	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\CLSID\{75095E7A-B95B-494B-8132-7A5EF940E8CE}\1B21042E\ê'u3\BID = 2000080018000b00e607000014000000180008003b0033000000000087327f63	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\CLSID\{75095E7A-B95B-494B-8132-7A5EF940E8CE}\1B21042E\CG1	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\CLSID	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\CLSID\{75095E7A-B95B-494B-8132-7A5EF940E8CE}	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\CLSID\{75095E7A-B95B-494B-8132-7A5EF940E8CE}\1B21042E	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe

pid	process
1296	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe
1296	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe

pid process

1296 f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe

description	pid	process
Token: SeRestorePrivilege	1296	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe
Token: SeBackupPrivilege	1296	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe
Token: SeDebugPrivilege	1296	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exef8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe

description	pid	process	target process
PID 912 wrote to memory of 1296	912	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe
PID 912 wrote to memory of 1296	912	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe
PID 912 wrote to memory of 1296	912	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe
PID 912 wrote to memory of 1296	912	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe
PID 912 wrote to memory of 1296	912	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe
PID 912 wrote to memory of 1296	912	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe
PID 912 wrote to memory of 1296	912	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe
PID 912 wrote to memory of 1296	912	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe
PID 912 wrote to memory of 1296	912	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe
PID 912 wrote to memory of 1296	912	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe
PID 1296 wrote to memory of 608	1296	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe	schtasks.exe
PID 1296 wrote to memory of 608	1296	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe	schtasks.exe
PID 1296 wrote to memory of 608	1296	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe	schtasks.exe
PID 1296 wrote to memory of 608	1296	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe	schtasks.exe
PID 1296 wrote to memory of 1772	1296	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe	WerFault.exe
PID 1296 wrote to memory of 1772	1296	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe	WerFault.exe
PID 1296 wrote to memory of 1772	1296	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe	WerFault.exe
PID 1296 wrote to memory of 1772	1296	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe	WerFault.exe
PID 1296 wrote to memory of 1772	1296	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe	WerFault.exe
PID 1296 wrote to memory of 1772	1296	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe	WerFault.exe
PID 1296 wrote to memory of 1772	1296	f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe
"C:\Users\Admin\AppData\Local\Temp\f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:912

C:\Users\Admin\AppData\Local\Temp\f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe
"C:\Users\Admin\AppData\Local\Temp\f8ecb8a1247e224ecb9029f6f2ceb705814af2b8f6ad84961881a1f948349b65.exe"
2⤵
- Sets file execution options in registry
- Checks for any installed AV software in registry
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1296

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /CREATE /SC ONLOGON /TN "Windows Update Check - 0x1B21042E" /TR "C:\ProgramData\Nokia Adapter Engine\ftdimlhze.exe" /RL HIGHEST
3⤵
- Creates scheduled task(s)
PID:608

C:\Windows\SysWOW64\WerFault.exe
"C:\Windows\SysWOW64\WerFault.exe"
3⤵
PID:1772

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Security Software Discovery

1

T1063

System Information Discovery

2

T1082

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nst2ACA.tmp\actability.dll
Filesize
34KB

MD5
10692017651aaf01881c7a31a9ef5515

SHA1
b7f78dc3a3a81e646ad92fa7a2ef5fe675d9d9e1

SHA256
0fd14e6c5962242d15fba61bd0e1e8d7ce754ea6dd8c56c51719c10830f3902f

SHA512
c4bf7a408b1436b435519b7601e3f063b5f8599c86e536bcca9be4fdb4ef1ba588cedd151121ad3e2a8ef9f8b39a61c8fa373405aa55dfd013c02b77ccc5ba4b

Download Submit
memory/608-72-0x0000000000000000-mapping.dmp

Download
memory/912-54-0x00000000761F1000-0x00000000761F3000-memory.dmp

Filesize
8KB

Download
memory/1296-68-0x0000000000230000-0x000000000027B000-memory.dmp

Filesize
300KB

Download
memory/1296-70-0x0000000000230000-0x000000000027B000-memory.dmp

Filesize
300KB

Download
memory/1296-59-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1296-61-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1296-62-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1296-63-0x000000000040120A-mapping.dmp

Download
memory/1296-65-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1296-57-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1296-69-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1296-58-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1296-71-0x0000000000430000-0x000000000043B000-memory.dmp

Filesize
44KB

Download
memory/1296-56-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1296-74-0x0000000000230000-0x000000000027B000-memory.dmp

Filesize
300KB

Download
memory/1772-73-0x0000000000000000-mapping.dmp

Download
memory/1772-76-0x00000000778A0000-0x0000000077A21000-memory.dmp

Filesize
1.5MB

Download
memory/1772-75-0x0000000000190000-0x0000000000211000-memory.dmp

Filesize
516KB

Download
memory/1772-77-0x0000000000190000-0x0000000000211000-memory.dmp

Filesize
516KB

Download
memory/1772-78-0x00000000778A0000-0x0000000077A21000-memory.dmp

Filesize
1.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads