Overview
overview
8Static
static
1base/DAutils.dll
windows7-x64
1base/DAutils.dll
windows10-2004-x64
1base/FCUI.exe
windows7-x64
6base/FCUI.exe
windows10-2004-x64
6base/FCUI.exe.xml
windows7-x64
1base/FCUI.exe.xml
windows10-2004-x64
1base/Insta...ls.bat
windows7-x64
1base/Insta...ls.bat
windows10-2004-x64
1base/Insta...xp.bat
windows7-x64
1base/Insta...xp.bat
windows10-2004-x64
1base/Inter...Vw.dll
windows7-x64
1base/Inter...Vw.dll
windows10-2004-x64
1base/Loader.exe
windows7-x64
1base/Loader.exe
windows10-2004-x64
1base/Newto...on.dll
windows7-x64
1base/Newto...on.dll
windows10-2004-x64
1base/Regis...rt.exe
windows7-x64
3base/Regis...rt.exe
windows10-2004-x64
3base/Regis...ll.exe
windows7-x64
6base/Regis...ll.exe
windows10-2004-x64
6base/Regis...xe.xml
windows7-x64
1base/Regis...xe.xml
windows10-2004-x64
1base/RunAp...or.bat
windows7-x64
6base/RunAp...or.bat
windows10-2004-x64
6base/openThankYou.bat
windows7-x64
1base/openThankYou.bat
windows10-2004-x64
6base/runApp.bat
windows7-x64
6base/runApp.bat
windows10-2004-x64
6base/uninst.exe
windows7-x64
8base/uninst.exe
windows10-2004-x64
8base/verif...ll.bat
windows7-x64
1base/verif...ll.bat
windows10-2004-x64
1Analysis
-
max time kernel
68s -
max time network
102s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 22:04
Static task
static1
Behavioral task
behavioral1
Sample
base/DAutils.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
base/DAutils.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
base/FCUI.exe
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
base/FCUI.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
base/FCUI.exe.xml
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
base/FCUI.exe.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
base/InstallAddiotionals.bat
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
base/InstallAddiotionals.bat
Resource
win10v2004-20221111-en
Behavioral task
behavioral9
Sample
base/InstallNet35xp.bat
Resource
win7-20221111-en
Behavioral task
behavioral10
Sample
base/InstallNet35xp.bat
Resource
win10v2004-20220901-en
Behavioral task
behavioral11
Sample
base/Interop.SHDocVw.dll
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
base/Interop.SHDocVw.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral13
Sample
base/Loader.exe
Resource
win7-20220901-en
Behavioral task
behavioral14
Sample
base/Loader.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral15
Sample
base/Newtonsoft.Json.dll
Resource
win7-20220901-en
Behavioral task
behavioral16
Sample
base/Newtonsoft.Json.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral17
Sample
base/RegisterInstallStart.exe
Resource
win7-20220901-en
Behavioral task
behavioral18
Sample
base/RegisterInstallStart.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral19
Sample
base/RegisterUninstall.exe
Resource
win7-20221111-en
Behavioral task
behavioral20
Sample
base/RegisterUninstall.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral21
Sample
base/RegisterUninstall.exe.xml
Resource
win7-20220901-en
Behavioral task
behavioral22
Sample
base/RegisterUninstall.exe.xml
Resource
win10v2004-20221111-en
Behavioral task
behavioral23
Sample
base/RunAppMonitor.bat
Resource
win7-20220901-en
Behavioral task
behavioral24
Sample
base/RunAppMonitor.bat
Resource
win10v2004-20220812-en
Behavioral task
behavioral25
Sample
base/openThankYou.bat
Resource
win7-20220901-en
Behavioral task
behavioral26
Sample
base/openThankYou.bat
Resource
win10v2004-20220812-en
Behavioral task
behavioral27
Sample
base/runApp.bat
Resource
win7-20220812-en
Behavioral task
behavioral28
Sample
base/runApp.bat
Resource
win10v2004-20220812-en
Behavioral task
behavioral29
Sample
base/uninst.exe
Resource
win7-20220812-en
Behavioral task
behavioral30
Sample
base/uninst.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral31
Sample
base/verifyUninstall.bat
Resource
win7-20220812-en
Behavioral task
behavioral32
Sample
base/verifyUninstall.bat
Resource
win10v2004-20221111-en
General
-
Target
base/uninst.exe
-
Size
100KB
-
MD5
812ceda63e8fb52f08d13a270f60064f
-
SHA1
3b3108938aab9ccc4d0fbbe16d7670e0b0b4d244
-
SHA256
d2093bfff19f6f22e50aee57086375d99f630eab21c5c429fc5f5bf00583b5c6
-
SHA512
9e09625a39304049d5d4c78f3d420ed8859189a473568b3d8747cc3336c237c65fde4c89f480238f9001a05830bda50a604d0b760f358f1138d617df5a002ce8
-
SSDEEP
3072:bgXdZt9P6D3XJbOpo2eAjEu5fiXEVgfo7M:be341OpTjEu5qXEVgfo7M
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Au_.exepid process 1272 Au_.exe -
Loads dropped DLL 4 IoCs
Processes:
uninst.exeAu_.exepid process 1600 uninst.exe 1272 Au_.exe 1272 Au_.exe 1272 Au_.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegisterUninstall.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\FCcleaner = "C:\\Users\\Admin\\AppData\\Local\\Temp\\FCcleaner.bat" RegisterUninstall.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1104 1756 WerFault.exe RegisterUninstall.exe -
NSIS installer 6 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe nsis_installer_1 \Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe nsis_installer_2 C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe nsis_installer_1 C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe nsis_installer_2 C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe nsis_installer_1 C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe nsis_installer_2 -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
Au_.exeRegisterUninstall.exepid process 1272 Au_.exe 1272 Au_.exe 1756 RegisterUninstall.exe 1756 RegisterUninstall.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegisterUninstall.exedescription pid process Token: SeDebugPrivilege 1756 RegisterUninstall.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
uninst.exeAu_.exeRegisterUninstall.exedescription pid process target process PID 1600 wrote to memory of 1272 1600 uninst.exe Au_.exe PID 1600 wrote to memory of 1272 1600 uninst.exe Au_.exe PID 1600 wrote to memory of 1272 1600 uninst.exe Au_.exe PID 1600 wrote to memory of 1272 1600 uninst.exe Au_.exe PID 1272 wrote to memory of 1756 1272 Au_.exe RegisterUninstall.exe PID 1272 wrote to memory of 1756 1272 Au_.exe RegisterUninstall.exe PID 1272 wrote to memory of 1756 1272 Au_.exe RegisterUninstall.exe PID 1272 wrote to memory of 1756 1272 Au_.exe RegisterUninstall.exe PID 1756 wrote to memory of 1104 1756 RegisterUninstall.exe WerFault.exe PID 1756 wrote to memory of 1104 1756 RegisterUninstall.exe WerFault.exe PID 1756 wrote to memory of 1104 1756 RegisterUninstall.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\base\uninst.exe"C:\Users\Admin\AppData\Local\Temp\base\uninst.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\base\2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\base\RegisterUninstall.exe"C:\Users\Admin\AppData\Local\Temp\base\RegisterUninstall.exe"3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1756 -s 11884⤵
- Program crash
PID:1104
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
MD5812ceda63e8fb52f08d13a270f60064f
SHA13b3108938aab9ccc4d0fbbe16d7670e0b0b4d244
SHA256d2093bfff19f6f22e50aee57086375d99f630eab21c5c429fc5f5bf00583b5c6
SHA5129e09625a39304049d5d4c78f3d420ed8859189a473568b3d8747cc3336c237c65fde4c89f480238f9001a05830bda50a604d0b760f358f1138d617df5a002ce8
-
Filesize
100KB
MD5812ceda63e8fb52f08d13a270f60064f
SHA13b3108938aab9ccc4d0fbbe16d7670e0b0b4d244
SHA256d2093bfff19f6f22e50aee57086375d99f630eab21c5c429fc5f5bf00583b5c6
SHA5129e09625a39304049d5d4c78f3d420ed8859189a473568b3d8747cc3336c237c65fde4c89f480238f9001a05830bda50a604d0b760f358f1138d617df5a002ce8
-
Filesize
5KB
MD59384f4007c492d4fa040924f31c00166
SHA1aba37faef30d7c445584c688a0b5638f5db31c7b
SHA25660a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5
SHA51268f158887e24302673227adffc688fd3edabf097d7f5410f983e06c6b9c7344ca1d8a45c7fa05553adcc5987993df3a298763477168d4842e554c4eb93b9aaaf
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
4KB
MD505450face243b3a7472407b999b03a72
SHA1ffd88af2e338ae606c444390f7eaaf5f4aef2cd9
SHA25695fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
SHA512f4cbe30166aff20a226a7150d93a876873ba699d80d7e9f46f32a9b4753fa7966c3113a3124340b39ca67a13205463a413e740e541e742903e3f89af5a53ad3b
-
Filesize
100KB
MD5812ceda63e8fb52f08d13a270f60064f
SHA13b3108938aab9ccc4d0fbbe16d7670e0b0b4d244
SHA256d2093bfff19f6f22e50aee57086375d99f630eab21c5c429fc5f5bf00583b5c6
SHA5129e09625a39304049d5d4c78f3d420ed8859189a473568b3d8747cc3336c237c65fde4c89f480238f9001a05830bda50a604d0b760f358f1138d617df5a002ce8