a56eebd04e0176a36775c0f9644e786c5c30576e1ed36ef989214081bb111f12

General

Target

a56eebd04e0176a36775c0f9644e786c5c30576e1ed36ef989214081bb111f12.exe
Size

84KB
MD5

0ae04f2e6d3dd30f65baed0d0869d7b4
SHA1

1c95880e934fce5cbeb8453059cb082c860b738a
SHA256

a56eebd04e0176a36775c0f9644e786c5c30576e1ed36ef989214081bb111f12
SHA512

3c7605d462c3cee67f9aa72fdd13073da823bead4de5bddc1cbdf719f133c851d52b99b17a7c4fa2eaddab39cb925c745a734ce04d8b6d99a044ca27c9d1b81a
SSDEEP

768:DyV+hOvogEwzpbgJyGE5NIWi3KEyUhL7b7Yqlf4JwQltjmtTBHi7Al+:DoFv9p1rC76Ezh/vYlJwAitTB3l+

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

fieti.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	fieti.exe

Executes dropped EXE 1 IoCs

Processes:

fieti.exe

pid process

888 fieti.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

a56eebd04e0176a36775c0f9644e786c5c30576e1ed36ef989214081bb111f12.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	a56eebd04e0176a36775c0f9644e786c5c30576e1ed36ef989214081bb111f12.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

fieti.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run\	fieti.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fieti = "C:\\Users\\Admin\\fieti.exe"	fieti.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3028 4400 WerFault.exe a56eebd04e0176a36775c0f9644e786c5c30576e1ed36ef989214081bb111f12.exe

pid	pid_target	process	target process
3028	4400	WerFault.exe	a56eebd04e0176a36775c0f9644e786c5c30576e1ed36ef989214081bb111f12.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

fieti.exe

pid	process
888	fieti.exe
888	fieti.exe
888	fieti.exe
888	fieti.exe
888	fieti.exe
888	fieti.exe
888	fieti.exe
888	fieti.exe
888	fieti.exe
888	fieti.exe
888	fieti.exe
888	fieti.exe
888	fieti.exe
888	fieti.exe
888	fieti.exe
888	fieti.exe
888	fieti.exe
888	fieti.exe
888	fieti.exe
888	fieti.exe
888	fieti.exe
888	fieti.exe
888	fieti.exe
888	fieti.exe
888	fieti.exe
888	fieti.exe
888	fieti.exe
888	fieti.exe
888	fieti.exe
888	fieti.exe
888	fieti.exe
888	fieti.exe
888	fieti.exe
888	fieti.exe
888	fieti.exe
888	fieti.exe
888	fieti.exe
888	fieti.exe
888	fieti.exe
888	fieti.exe
888	fieti.exe
888	fieti.exe
888	fieti.exe
888	fieti.exe
888	fieti.exe
888	fieti.exe
888	fieti.exe
888	fieti.exe
888	fieti.exe
888	fieti.exe
888	fieti.exe
888	fieti.exe
888	fieti.exe
888	fieti.exe
888	fieti.exe
888	fieti.exe
888	fieti.exe
888	fieti.exe
888	fieti.exe
888	fieti.exe
888	fieti.exe
888	fieti.exe
888	fieti.exe
888	fieti.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

a56eebd04e0176a36775c0f9644e786c5c30576e1ed36ef989214081bb111f12.exefieti.exe

pid process

4400 a56eebd04e0176a36775c0f9644e786c5c30576e1ed36ef989214081bb111f12.exe
888 fieti.exe

pid	process
4400	a56eebd04e0176a36775c0f9644e786c5c30576e1ed36ef989214081bb111f12.exe
888	fieti.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

a56eebd04e0176a36775c0f9644e786c5c30576e1ed36ef989214081bb111f12.exefieti.exe

description	pid	process	target process
PID 4400 wrote to memory of 888	4400	a56eebd04e0176a36775c0f9644e786c5c30576e1ed36ef989214081bb111f12.exe	fieti.exe
PID 4400 wrote to memory of 888	4400	a56eebd04e0176a36775c0f9644e786c5c30576e1ed36ef989214081bb111f12.exe	fieti.exe
PID 4400 wrote to memory of 888	4400	a56eebd04e0176a36775c0f9644e786c5c30576e1ed36ef989214081bb111f12.exe	fieti.exe
PID 888 wrote to memory of 4400	888	fieti.exe	a56eebd04e0176a36775c0f9644e786c5c30576e1ed36ef989214081bb111f12.exe
PID 888 wrote to memory of 4400	888	fieti.exe	a56eebd04e0176a36775c0f9644e786c5c30576e1ed36ef989214081bb111f12.exe
PID 888 wrote to memory of 4400	888	fieti.exe	a56eebd04e0176a36775c0f9644e786c5c30576e1ed36ef989214081bb111f12.exe
PID 888 wrote to memory of 4400	888	fieti.exe	a56eebd04e0176a36775c0f9644e786c5c30576e1ed36ef989214081bb111f12.exe
PID 888 wrote to memory of 3028	888	fieti.exe	WerFault.exe
PID 888 wrote to memory of 3028	888	fieti.exe	WerFault.exe
PID 888 wrote to memory of 4400	888	fieti.exe	a56eebd04e0176a36775c0f9644e786c5c30576e1ed36ef989214081bb111f12.exe
PID 888 wrote to memory of 4400	888	fieti.exe	a56eebd04e0176a36775c0f9644e786c5c30576e1ed36ef989214081bb111f12.exe
PID 888 wrote to memory of 3028	888	fieti.exe	WerFault.exe
PID 888 wrote to memory of 3028	888	fieti.exe	WerFault.exe
PID 888 wrote to memory of 4400	888	fieti.exe	a56eebd04e0176a36775c0f9644e786c5c30576e1ed36ef989214081bb111f12.exe
PID 888 wrote to memory of 4400	888	fieti.exe	a56eebd04e0176a36775c0f9644e786c5c30576e1ed36ef989214081bb111f12.exe
PID 888 wrote to memory of 3028	888	fieti.exe	WerFault.exe
PID 888 wrote to memory of 3028	888	fieti.exe	WerFault.exe
PID 888 wrote to memory of 4400	888	fieti.exe	a56eebd04e0176a36775c0f9644e786c5c30576e1ed36ef989214081bb111f12.exe
PID 888 wrote to memory of 4400	888	fieti.exe	a56eebd04e0176a36775c0f9644e786c5c30576e1ed36ef989214081bb111f12.exe
PID 888 wrote to memory of 3028	888	fieti.exe	WerFault.exe
PID 888 wrote to memory of 3028	888	fieti.exe	WerFault.exe
PID 888 wrote to memory of 4400	888	fieti.exe	a56eebd04e0176a36775c0f9644e786c5c30576e1ed36ef989214081bb111f12.exe
PID 888 wrote to memory of 4400	888	fieti.exe	a56eebd04e0176a36775c0f9644e786c5c30576e1ed36ef989214081bb111f12.exe
PID 888 wrote to memory of 3028	888	fieti.exe	WerFault.exe
PID 888 wrote to memory of 3028	888	fieti.exe	WerFault.exe
PID 888 wrote to memory of 4400	888	fieti.exe	a56eebd04e0176a36775c0f9644e786c5c30576e1ed36ef989214081bb111f12.exe
PID 888 wrote to memory of 4400	888	fieti.exe	a56eebd04e0176a36775c0f9644e786c5c30576e1ed36ef989214081bb111f12.exe
PID 888 wrote to memory of 3028	888	fieti.exe	WerFault.exe
PID 888 wrote to memory of 3028	888	fieti.exe	WerFault.exe
PID 888 wrote to memory of 4400	888	fieti.exe	a56eebd04e0176a36775c0f9644e786c5c30576e1ed36ef989214081bb111f12.exe
PID 888 wrote to memory of 4400	888	fieti.exe	a56eebd04e0176a36775c0f9644e786c5c30576e1ed36ef989214081bb111f12.exe
PID 888 wrote to memory of 3028	888	fieti.exe	WerFault.exe
PID 888 wrote to memory of 3028	888	fieti.exe	WerFault.exe
PID 888 wrote to memory of 4400	888	fieti.exe	a56eebd04e0176a36775c0f9644e786c5c30576e1ed36ef989214081bb111f12.exe
PID 888 wrote to memory of 4400	888	fieti.exe	a56eebd04e0176a36775c0f9644e786c5c30576e1ed36ef989214081bb111f12.exe
PID 888 wrote to memory of 3028	888	fieti.exe	WerFault.exe
PID 888 wrote to memory of 3028	888	fieti.exe	WerFault.exe
PID 888 wrote to memory of 4400	888	fieti.exe	a56eebd04e0176a36775c0f9644e786c5c30576e1ed36ef989214081bb111f12.exe
PID 888 wrote to memory of 4400	888	fieti.exe	a56eebd04e0176a36775c0f9644e786c5c30576e1ed36ef989214081bb111f12.exe
PID 888 wrote to memory of 3028	888	fieti.exe	WerFault.exe
PID 888 wrote to memory of 3028	888	fieti.exe	WerFault.exe
PID 888 wrote to memory of 4400	888	fieti.exe	a56eebd04e0176a36775c0f9644e786c5c30576e1ed36ef989214081bb111f12.exe
PID 888 wrote to memory of 4400	888	fieti.exe	a56eebd04e0176a36775c0f9644e786c5c30576e1ed36ef989214081bb111f12.exe
PID 888 wrote to memory of 3028	888	fieti.exe	WerFault.exe
PID 888 wrote to memory of 3028	888	fieti.exe	WerFault.exe
PID 888 wrote to memory of 4400	888	fieti.exe	a56eebd04e0176a36775c0f9644e786c5c30576e1ed36ef989214081bb111f12.exe
PID 888 wrote to memory of 4400	888	fieti.exe	a56eebd04e0176a36775c0f9644e786c5c30576e1ed36ef989214081bb111f12.exe
PID 888 wrote to memory of 3028	888	fieti.exe	WerFault.exe
PID 888 wrote to memory of 3028	888	fieti.exe	WerFault.exe
PID 888 wrote to memory of 4400	888	fieti.exe	a56eebd04e0176a36775c0f9644e786c5c30576e1ed36ef989214081bb111f12.exe
PID 888 wrote to memory of 4400	888	fieti.exe	a56eebd04e0176a36775c0f9644e786c5c30576e1ed36ef989214081bb111f12.exe
PID 888 wrote to memory of 3028	888	fieti.exe	WerFault.exe
PID 888 wrote to memory of 3028	888	fieti.exe	WerFault.exe
PID 888 wrote to memory of 4400	888	fieti.exe	a56eebd04e0176a36775c0f9644e786c5c30576e1ed36ef989214081bb111f12.exe
PID 888 wrote to memory of 4400	888	fieti.exe	a56eebd04e0176a36775c0f9644e786c5c30576e1ed36ef989214081bb111f12.exe
PID 888 wrote to memory of 3028	888	fieti.exe	WerFault.exe
PID 888 wrote to memory of 3028	888	fieti.exe	WerFault.exe
PID 888 wrote to memory of 4400	888	fieti.exe	a56eebd04e0176a36775c0f9644e786c5c30576e1ed36ef989214081bb111f12.exe
PID 888 wrote to memory of 4400	888	fieti.exe	a56eebd04e0176a36775c0f9644e786c5c30576e1ed36ef989214081bb111f12.exe
PID 888 wrote to memory of 3028	888	fieti.exe	WerFault.exe
PID 888 wrote to memory of 3028	888	fieti.exe	WerFault.exe
PID 888 wrote to memory of 4400	888	fieti.exe	a56eebd04e0176a36775c0f9644e786c5c30576e1ed36ef989214081bb111f12.exe
PID 888 wrote to memory of 4400	888	fieti.exe	a56eebd04e0176a36775c0f9644e786c5c30576e1ed36ef989214081bb111f12.exe
PID 888 wrote to memory of 3028	888	fieti.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\a56eebd04e0176a36775c0f9644e786c5c30576e1ed36ef989214081bb111f12.exe
"C:\Users\Admin\AppData\Local\Temp\a56eebd04e0176a36775c0f9644e786c5c30576e1ed36ef989214081bb111f12.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4400

C:\Users\Admin\fieti.exe
"C:\Users\Admin\fieti.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4400 -s 1504
2⤵
- Program crash
PID:3028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4400 -ip 4400
1⤵
PID:2544

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\fieti.exe

Filesize
84KB

MD5
5c15dcafa18cf7ed473413aef6c21a57

SHA1
0561ce5e749a703985a72841f87318cc1c16028e

SHA256
0f4ea7c52b89fc640d8ae01b838730fea924619d0f870aba7084fa8ace0dab26

SHA512
ec903bdb22c2c29b0715f92268a598580ff2213c9074aefd6da805932248706e1db4a8dd0c82e977d7871fd24d3ade4fc8c9b090e54e5f5f409034d72161bb66

Download Submit
C:\Users\Admin\fieti.exe

Filesize
84KB

MD5
5c15dcafa18cf7ed473413aef6c21a57

SHA1
0561ce5e749a703985a72841f87318cc1c16028e

SHA256
0f4ea7c52b89fc640d8ae01b838730fea924619d0f870aba7084fa8ace0dab26

SHA512
ec903bdb22c2c29b0715f92268a598580ff2213c9074aefd6da805932248706e1db4a8dd0c82e977d7871fd24d3ade4fc8c9b090e54e5f5f409034d72161bb66

Download Submit
memory/888-134-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads