Analysis
-
max time kernel
262s -
max time network
332s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
02/12/2022, 00:42
Static task
static1
Behavioral task
behavioral1
Sample
9b94d8eb43f886c04fa9790a7c1b9ca14503c18e3e3400db33263dff8f8a1e60.exe
Resource
win7-20221111-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
9b94d8eb43f886c04fa9790a7c1b9ca14503c18e3e3400db33263dff8f8a1e60.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
9b94d8eb43f886c04fa9790a7c1b9ca14503c18e3e3400db33263dff8f8a1e60.exe
-
Size
200KB
-
MD5
394d5344688fcd6fa8d0861e7aab6840
-
SHA1
105904da1afdae2cb3c471b1ee9aefe859a98f57
-
SHA256
9b94d8eb43f886c04fa9790a7c1b9ca14503c18e3e3400db33263dff8f8a1e60
-
SHA512
5064cd81a6ab2ab9053095ab976f573106e0727ceeae10e60228b2f739ca844707e9834769d7c151e634b9a5051d6996f475a78b19648f85fdbc5a4a0eff0a48
-
SSDEEP
3072:OCaTo/0Yx1dg0tQ9nLHbB9WPliBs2HWWEakGJm9uYR:OCDTa4QxL7B9WPli+yWWEazNO
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" fiaim.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 9b94d8eb43f886c04fa9790a7c1b9ca14503c18e3e3400db33263dff8f8a1e60.exe -
Executes dropped EXE 1 IoCs
pid Process 1908 fiaim.exe -
Loads dropped DLL 2 IoCs
pid Process 1352 9b94d8eb43f886c04fa9790a7c1b9ca14503c18e3e3400db33263dff8f8a1e60.exe 1352 9b94d8eb43f886c04fa9790a7c1b9ca14503c18e3e3400db33263dff8f8a1e60.exe -
Adds Run key to start application 2 TTPs 28 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fiaim = "C:\\Users\\Admin\\fiaim.exe /l" fiaim.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fiaim = "C:\\Users\\Admin\\fiaim.exe /m" fiaim.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fiaim = "C:\\Users\\Admin\\fiaim.exe /z" fiaim.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fiaim = "C:\\Users\\Admin\\fiaim.exe /e" fiaim.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fiaim = "C:\\Users\\Admin\\fiaim.exe /s" fiaim.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fiaim = "C:\\Users\\Admin\\fiaim.exe /d" fiaim.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fiaim = "C:\\Users\\Admin\\fiaim.exe /b" fiaim.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ fiaim.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fiaim = "C:\\Users\\Admin\\fiaim.exe /n" fiaim.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fiaim = "C:\\Users\\Admin\\fiaim.exe /c" fiaim.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fiaim = "C:\\Users\\Admin\\fiaim.exe /g" fiaim.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fiaim = "C:\\Users\\Admin\\fiaim.exe /k" fiaim.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fiaim = "C:\\Users\\Admin\\fiaim.exe /t" fiaim.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fiaim = "C:\\Users\\Admin\\fiaim.exe /p" 9b94d8eb43f886c04fa9790a7c1b9ca14503c18e3e3400db33263dff8f8a1e60.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 9b94d8eb43f886c04fa9790a7c1b9ca14503c18e3e3400db33263dff8f8a1e60.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fiaim = "C:\\Users\\Admin\\fiaim.exe /u" fiaim.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fiaim = "C:\\Users\\Admin\\fiaim.exe /p" fiaim.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fiaim = "C:\\Users\\Admin\\fiaim.exe /x" fiaim.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fiaim = "C:\\Users\\Admin\\fiaim.exe /h" fiaim.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fiaim = "C:\\Users\\Admin\\fiaim.exe /i" fiaim.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fiaim = "C:\\Users\\Admin\\fiaim.exe /y" fiaim.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fiaim = "C:\\Users\\Admin\\fiaim.exe /o" fiaim.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fiaim = "C:\\Users\\Admin\\fiaim.exe /a" fiaim.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fiaim = "C:\\Users\\Admin\\fiaim.exe /j" fiaim.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fiaim = "C:\\Users\\Admin\\fiaim.exe /q" fiaim.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fiaim = "C:\\Users\\Admin\\fiaim.exe /v" fiaim.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fiaim = "C:\\Users\\Admin\\fiaim.exe /f" fiaim.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\fiaim = "C:\\Users\\Admin\\fiaim.exe /w" fiaim.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1352 9b94d8eb43f886c04fa9790a7c1b9ca14503c18e3e3400db33263dff8f8a1e60.exe 1908 fiaim.exe 1908 fiaim.exe 1908 fiaim.exe 1908 fiaim.exe 1908 fiaim.exe 1908 fiaim.exe 1908 fiaim.exe 1908 fiaim.exe 1908 fiaim.exe 1908 fiaim.exe 1908 fiaim.exe 1908 fiaim.exe 1908 fiaim.exe 1908 fiaim.exe 1908 fiaim.exe 1908 fiaim.exe 1908 fiaim.exe 1908 fiaim.exe 1908 fiaim.exe 1908 fiaim.exe 1908 fiaim.exe 1908 fiaim.exe 1908 fiaim.exe 1908 fiaim.exe 1908 fiaim.exe 1908 fiaim.exe 1908 fiaim.exe 1908 fiaim.exe 1908 fiaim.exe 1908 fiaim.exe 1908 fiaim.exe 1908 fiaim.exe 1908 fiaim.exe 1908 fiaim.exe 1908 fiaim.exe 1908 fiaim.exe 1908 fiaim.exe 1908 fiaim.exe 1908 fiaim.exe 1908 fiaim.exe 1908 fiaim.exe 1908 fiaim.exe 1908 fiaim.exe 1908 fiaim.exe 1908 fiaim.exe 1908 fiaim.exe 1908 fiaim.exe 1908 fiaim.exe 1908 fiaim.exe 1908 fiaim.exe 1908 fiaim.exe 1908 fiaim.exe 1908 fiaim.exe 1908 fiaim.exe 1908 fiaim.exe 1908 fiaim.exe 1908 fiaim.exe 1908 fiaim.exe 1908 fiaim.exe 1908 fiaim.exe 1908 fiaim.exe 1908 fiaim.exe 1908 fiaim.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1352 9b94d8eb43f886c04fa9790a7c1b9ca14503c18e3e3400db33263dff8f8a1e60.exe 1908 fiaim.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1352 wrote to memory of 1908 1352 9b94d8eb43f886c04fa9790a7c1b9ca14503c18e3e3400db33263dff8f8a1e60.exe 28 PID 1352 wrote to memory of 1908 1352 9b94d8eb43f886c04fa9790a7c1b9ca14503c18e3e3400db33263dff8f8a1e60.exe 28 PID 1352 wrote to memory of 1908 1352 9b94d8eb43f886c04fa9790a7c1b9ca14503c18e3e3400db33263dff8f8a1e60.exe 28 PID 1352 wrote to memory of 1908 1352 9b94d8eb43f886c04fa9790a7c1b9ca14503c18e3e3400db33263dff8f8a1e60.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b94d8eb43f886c04fa9790a7c1b9ca14503c18e3e3400db33263dff8f8a1e60.exe"C:\Users\Admin\AppData\Local\Temp\9b94d8eb43f886c04fa9790a7c1b9ca14503c18e3e3400db33263dff8f8a1e60.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Users\Admin\fiaim.exe"C:\Users\Admin\fiaim.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1908
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
200KB
MD5a399780012451efc8e2a5982154abba0
SHA1540c83558f4dab917fac80aa40a78c1238cc34ac
SHA256ff94eed6fe3c90756275e4f661763d90210b066f195f6a5919be9070e6c2c493
SHA51278e1e79e4febe77514b15f57fbfdb4b25e72ca1902a75a61f0853c16cb452f00e56fe0da57633dc0ca03662d6121969771e3e36c68e2aa2022ad40fbdd773617
-
Filesize
200KB
MD5a399780012451efc8e2a5982154abba0
SHA1540c83558f4dab917fac80aa40a78c1238cc34ac
SHA256ff94eed6fe3c90756275e4f661763d90210b066f195f6a5919be9070e6c2c493
SHA51278e1e79e4febe77514b15f57fbfdb4b25e72ca1902a75a61f0853c16cb452f00e56fe0da57633dc0ca03662d6121969771e3e36c68e2aa2022ad40fbdd773617
-
Filesize
200KB
MD5a399780012451efc8e2a5982154abba0
SHA1540c83558f4dab917fac80aa40a78c1238cc34ac
SHA256ff94eed6fe3c90756275e4f661763d90210b066f195f6a5919be9070e6c2c493
SHA51278e1e79e4febe77514b15f57fbfdb4b25e72ca1902a75a61f0853c16cb452f00e56fe0da57633dc0ca03662d6121969771e3e36c68e2aa2022ad40fbdd773617
-
Filesize
200KB
MD5a399780012451efc8e2a5982154abba0
SHA1540c83558f4dab917fac80aa40a78c1238cc34ac
SHA256ff94eed6fe3c90756275e4f661763d90210b066f195f6a5919be9070e6c2c493
SHA51278e1e79e4febe77514b15f57fbfdb4b25e72ca1902a75a61f0853c16cb452f00e56fe0da57633dc0ca03662d6121969771e3e36c68e2aa2022ad40fbdd773617