fa4e9ac913f6ba98a1ee861ed47fca84d7eea8ae6f600552b52d99ddc71289bf

General

Target

fa4e9ac913f6ba98a1ee861ed47fca84d7eea8ae6f600552b52d99ddc71289bf.exe
Size

1.8MB
MD5

363be1525f4249ed58ba0e18135fa9f0
SHA1

b01f427345fcf80a84d9844c4157fa8c5a527ddb
SHA256

fa4e9ac913f6ba98a1ee861ed47fca84d7eea8ae6f600552b52d99ddc71289bf
SHA512

866fec0153c5950f764942f794c31891df699b93f28cb9639576ed733cc497008e53484b193d0fbf5cddf8a2218b2a4780b15e107d4428bd9e354942953aa5cc
SSDEEP

24576:zWNG+uwBEN5ykw7hoBtqFoOGbCkV0a+9n:zWNxn

Score

9^/10

evasion

Malware Config

Signatures

Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
evasion

Software Discovery
T1518

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	fa4e9ac913f6ba98a1ee861ed47fca84d7eea8ae6f600552b52d99ddc71289bf.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\International\Geo\Nation	fa4e9ac913f6ba98a1ee861ed47fca84d7eea8ae6f600552b52d99ddc71289bf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	fa4e9ac913f6ba98a1ee861ed47fca84d7eea8ae6f600552b52d99ddc71289bf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	fa4e9ac913f6ba98a1ee861ed47fca84d7eea8ae6f600552b52d99ddc71289bf.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	fa4e9ac913f6ba98a1ee861ed47fca84d7eea8ae6f600552b52d99ddc71289bf.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	fa4e9ac913f6ba98a1ee861ed47fca84d7eea8ae6f600552b52d99ddc71289bf.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	fa4e9ac913f6ba98a1ee861ed47fca84d7eea8ae6f600552b52d99ddc71289bf.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_Classes\Local Settings	fa4e9ac913f6ba98a1ee861ed47fca84d7eea8ae6f600552b52d99ddc71289bf.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	fa4e9ac913f6ba98a1ee861ed47fca84d7eea8ae6f600552b52d99ddc71289bf.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1748	fa4e9ac913f6ba98a1ee861ed47fca84d7eea8ae6f600552b52d99ddc71289bf.exe
1748	fa4e9ac913f6ba98a1ee861ed47fca84d7eea8ae6f600552b52d99ddc71289bf.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1748	fa4e9ac913f6ba98a1ee861ed47fca84d7eea8ae6f600552b52d99ddc71289bf.exe
Token: SeSecurityPrivilege	1748	fa4e9ac913f6ba98a1ee861ed47fca84d7eea8ae6f600552b52d99ddc71289bf.exe
Token: SeTakeOwnershipPrivilege	1748	fa4e9ac913f6ba98a1ee861ed47fca84d7eea8ae6f600552b52d99ddc71289bf.exe
Token: SeLoadDriverPrivilege	1748	fa4e9ac913f6ba98a1ee861ed47fca84d7eea8ae6f600552b52d99ddc71289bf.exe
Token: SeSystemProfilePrivilege	1748	fa4e9ac913f6ba98a1ee861ed47fca84d7eea8ae6f600552b52d99ddc71289bf.exe
Token: SeSystemtimePrivilege	1748	fa4e9ac913f6ba98a1ee861ed47fca84d7eea8ae6f600552b52d99ddc71289bf.exe
Token: SeProfSingleProcessPrivilege	1748	fa4e9ac913f6ba98a1ee861ed47fca84d7eea8ae6f600552b52d99ddc71289bf.exe
Token: SeIncBasePriorityPrivilege	1748	fa4e9ac913f6ba98a1ee861ed47fca84d7eea8ae6f600552b52d99ddc71289bf.exe
Token: SeCreatePagefilePrivilege	1748	fa4e9ac913f6ba98a1ee861ed47fca84d7eea8ae6f600552b52d99ddc71289bf.exe
Token: SeBackupPrivilege	1748	fa4e9ac913f6ba98a1ee861ed47fca84d7eea8ae6f600552b52d99ddc71289bf.exe
Token: SeRestorePrivilege	1748	fa4e9ac913f6ba98a1ee861ed47fca84d7eea8ae6f600552b52d99ddc71289bf.exe
Token: SeShutdownPrivilege	1748	fa4e9ac913f6ba98a1ee861ed47fca84d7eea8ae6f600552b52d99ddc71289bf.exe
Token: SeDebugPrivilege	1748	fa4e9ac913f6ba98a1ee861ed47fca84d7eea8ae6f600552b52d99ddc71289bf.exe
Token: SeSystemEnvironmentPrivilege	1748	fa4e9ac913f6ba98a1ee861ed47fca84d7eea8ae6f600552b52d99ddc71289bf.exe
Token: SeChangeNotifyPrivilege	1748	fa4e9ac913f6ba98a1ee861ed47fca84d7eea8ae6f600552b52d99ddc71289bf.exe
Token: SeRemoteShutdownPrivilege	1748	fa4e9ac913f6ba98a1ee861ed47fca84d7eea8ae6f600552b52d99ddc71289bf.exe
Token: SeUndockPrivilege	1748	fa4e9ac913f6ba98a1ee861ed47fca84d7eea8ae6f600552b52d99ddc71289bf.exe
Token: SeManageVolumePrivilege	1748	fa4e9ac913f6ba98a1ee861ed47fca84d7eea8ae6f600552b52d99ddc71289bf.exe
Token: SeImpersonatePrivilege	1748	fa4e9ac913f6ba98a1ee861ed47fca84d7eea8ae6f600552b52d99ddc71289bf.exe
Token: SeCreateGlobalPrivilege	1748	fa4e9ac913f6ba98a1ee861ed47fca84d7eea8ae6f600552b52d99ddc71289bf.exe
Token: 33	1748	fa4e9ac913f6ba98a1ee861ed47fca84d7eea8ae6f600552b52d99ddc71289bf.exe
Token: 34	1748	fa4e9ac913f6ba98a1ee861ed47fca84d7eea8ae6f600552b52d99ddc71289bf.exe
Token: 35	1748	fa4e9ac913f6ba98a1ee861ed47fca84d7eea8ae6f600552b52d99ddc71289bf.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1748	fa4e9ac913f6ba98a1ee861ed47fca84d7eea8ae6f600552b52d99ddc71289bf.exe

C:\Users\Admin\AppData\Local\Temp\fa4e9ac913f6ba98a1ee861ed47fca84d7eea8ae6f600552b52d99ddc71289bf.exe
"C:\Users\Admin\AppData\Local\Temp\fa4e9ac913f6ba98a1ee861ed47fca84d7eea8ae6f600552b52d99ddc71289bf.exe"
1⤵
- Enumerates VirtualBox registry keys
- Checks computer location settings
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1748

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

Software Discovery

System Information Discovery

3

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1748-54-0x0000000076381000-0x0000000076383000-memory.dmp

Filesize
8KB

Download
memory/1748-55-0x0000000000240000-0x000000000027B000-memory.dmp

Filesize
236KB

Download
memory/1748-56-0x0000000000240000-0x000000000027B000-memory.dmp

Filesize
236KB

Download
memory/1748-57-0x0000000000240000-0x0000000000245000-memory.dmp

Filesize
20KB

Download
memory/1748-58-0x0000000000400000-0x00000000005D0000-memory.dmp

Filesize
1.8MB

Download
memory/1748-59-0x0000000000400000-0x00000000005D0000-memory.dmp

Filesize
1.8MB

Download
memory/1748-60-0x0000000000400000-0x00000000005D0000-memory.dmp

Filesize
1.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads