664f1bd8392588ce5807a1447c6509ffc4c6ac592367c8fc89eae5d31131a934

General

Target

664f1bd8392588ce5807a1447c6509ffc4c6ac592367c8fc89eae5d31131a934.exe
Size

224KB
MD5

76db1fa23c08fe920f2daa3e2423ab9f
SHA1

8b5187e5c8413636bb5545f1c7c9bc219f64063b
SHA256

664f1bd8392588ce5807a1447c6509ffc4c6ac592367c8fc89eae5d31131a934
SHA512

11221493011102a4e1b14b34a7ea40d3e4f2de8fc62aede6f1762381c07fc5e26e84479c948c49d848a41450e35136522d5cb27e129c55312b7871e69733a7f1
SSDEEP

1536:MiriVfOfb/awoIZsh0CF+sKE0C1rZL4H0c2BHtl1/J+iZAb+j9WCyiHC/XRXTfFV:BiA/MOFCsv/CL0+JM6WCyiHCL1psA

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	664f1bd8392588ce5807a1447c6509ffc4c6ac592367c8fc89eae5d31131a934.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	flmav.exe

Executes dropped EXE 1 IoCs

pid	Process
2220	flmav.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	664f1bd8392588ce5807a1447c6509ffc4c6ac592367c8fc89eae5d31131a934.exe

Adds Run key to start application 2 TTPs 13 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run\	664f1bd8392588ce5807a1447c6509ffc4c6ac592367c8fc89eae5d31131a934.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\flmav = "C:\\Users\\Admin\\flmav.exe /w"	flmav.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\flmav = "C:\\Users\\Admin\\flmav.exe /z"	flmav.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\flmav = "C:\\Users\\Admin\\flmav.exe /b"	flmav.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\flmav = "C:\\Users\\Admin\\flmav.exe /o"	664f1bd8392588ce5807a1447c6509ffc4c6ac592367c8fc89eae5d31131a934.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run\	flmav.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\flmav = "C:\\Users\\Admin\\flmav.exe /d"	flmav.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\flmav = "C:\\Users\\Admin\\flmav.exe /a"	flmav.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\flmav = "C:\\Users\\Admin\\flmav.exe /y"	flmav.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\flmav = "C:\\Users\\Admin\\flmav.exe /v"	flmav.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\flmav = "C:\\Users\\Admin\\flmav.exe /x"	flmav.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\flmav = "C:\\Users\\Admin\\flmav.exe /c"	flmav.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\flmav = "C:\\Users\\Admin\\flmav.exe /h"	flmav.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
4188	664f1bd8392588ce5807a1447c6509ffc4c6ac592367c8fc89eae5d31131a934.exe
4188	664f1bd8392588ce5807a1447c6509ffc4c6ac592367c8fc89eae5d31131a934.exe
2220	flmav.exe
2220	flmav.exe
2220	flmav.exe
2220	flmav.exe
2220	flmav.exe
2220	flmav.exe
2220	flmav.exe
2220	flmav.exe
2220	flmav.exe
2220	flmav.exe
2220	flmav.exe
2220	flmav.exe
2220	flmav.exe
2220	flmav.exe
2220	flmav.exe
2220	flmav.exe
2220	flmav.exe
2220	flmav.exe
2220	flmav.exe
2220	flmav.exe
2220	flmav.exe
2220	flmav.exe
2220	flmav.exe
2220	flmav.exe
2220	flmav.exe
2220	flmav.exe
2220	flmav.exe
2220	flmav.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4188	664f1bd8392588ce5807a1447c6509ffc4c6ac592367c8fc89eae5d31131a934.exe
4188	664f1bd8392588ce5807a1447c6509ffc4c6ac592367c8fc89eae5d31131a934.exe
2220	flmav.exe
2220	flmav.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4188 wrote to memory of 2220	4188	664f1bd8392588ce5807a1447c6509ffc4c6ac592367c8fc89eae5d31131a934.exe	86
PID 4188 wrote to memory of 2220	4188	664f1bd8392588ce5807a1447c6509ffc4c6ac592367c8fc89eae5d31131a934.exe	86
PID 4188 wrote to memory of 2220	4188	664f1bd8392588ce5807a1447c6509ffc4c6ac592367c8fc89eae5d31131a934.exe	86
PID 4188 wrote to memory of 2220	4188	664f1bd8392588ce5807a1447c6509ffc4c6ac592367c8fc89eae5d31131a934.exe	86
PID 4188 wrote to memory of 2220	4188	664f1bd8392588ce5807a1447c6509ffc4c6ac592367c8fc89eae5d31131a934.exe	86

C:\Users\Admin\AppData\Local\Temp\664f1bd8392588ce5807a1447c6509ffc4c6ac592367c8fc89eae5d31131a934.exe
"C:\Users\Admin\AppData\Local\Temp\664f1bd8392588ce5807a1447c6509ffc4c6ac592367c8fc89eae5d31131a934.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4188
- C:\Users\Admin\flmav.exe
  "C:\Users\Admin\flmav.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2220

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\flmav.exe

Filesize
224KB

MD5
3c373a63385a59454436f02726de0276

SHA1
4810399b5bc62fea6a8bdf68c64bb97cfaa8e085

SHA256
519fe9b4b1209a8e11838d7eff8433cd566b241a4256934d45e1131a2601951c

SHA512
9b2e6a7443b23cc12e66d4d4336088a42d62c878ffc46f855cfee2cec2f373be75dc964f3a69c710673598df9f0c16eee70713317235160d0591618bd5895940

Download Submit
C:\Users\Admin\flmav.exe

Filesize
224KB

MD5
3c373a63385a59454436f02726de0276

SHA1
4810399b5bc62fea6a8bdf68c64bb97cfaa8e085

SHA256
519fe9b4b1209a8e11838d7eff8433cd566b241a4256934d45e1131a2601951c

SHA512
9b2e6a7443b23cc12e66d4d4336088a42d62c878ffc46f855cfee2cec2f373be75dc964f3a69c710673598df9f0c16eee70713317235160d0591618bd5895940

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads