fbdfee5e766033327b05f575c3cf456fa4f71ec39b1bd5ddbfd0dcc69a73bd81

General

Target

fbdfee5e766033327b05f575c3cf456fa4f71ec39b1bd5ddbfd0dcc69a73bd81.exe
Size

685KB
MD5

90d83c7d3477803d847ce89613b035d6
SHA1

5eac96da556f831ed687fbcd78549e6c476ffe61
SHA256

fbdfee5e766033327b05f575c3cf456fa4f71ec39b1bd5ddbfd0dcc69a73bd81
SHA512

7eed2ee49fa2285f78fcae0175c5bea0fad19839713ba94ec6b2adcdb3ab736f69cb1ed6de4936d18a25a9ca3eca77b7bcc469f2ed534389155bd2e9bf14bf06
SSDEEP

12288:rXi1xcZVNe+keYaOeoG7FCibEPVMVWmQYfIjBKEZa+rUlynwMEcR157N59lU98:NdejCOeoQHbEPVMVWmQYgjB115A

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3500	InternetExplorer.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	fbdfee5e766033327b05f575c3cf456fa4f71ec39b1bd5ddbfd0dcc69a73bd81.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	fbdfee5e766033327b05f575c3cf456fa4f71ec39b1bd5ddbfd0dcc69a73bd81.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Internet Explorer = "C:\\Windows\\system32\\InternetExplorer.exe"	fbdfee5e766033327b05f575c3cf456fa4f71ec39b1bd5ddbfd0dcc69a73bd81.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.ini	fbdfee5e766033327b05f575c3cf456fa4f71ec39b1bd5ddbfd0dcc69a73bd81.exe
File created	C:\Windows\SysWOW64\InternetExplorer.exe	fbdfee5e766033327b05f575c3cf456fa4f71ec39b1bd5ddbfd0dcc69a73bd81.exe
File opened for modification	C:\Windows\SysWOW64\InternetExplorer.exe	fbdfee5e766033327b05f575c3cf456fa4f71ec39b1bd5ddbfd0dcc69a73bd81.exe
File created	C:\Windows\SysWOW64\explorer_setup.txt	fbdfee5e766033327b05f575c3cf456fa4f71ec39b1bd5ddbfd0dcc69a73bd81.exe
File created	C:\Windows\SysWOW64\explorer_log.txt	InternetExplorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3248	4084	WerFault.exe	80
1404	4084	WerFault.exe	80

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3500	InternetExplorer.exe
3500	InternetExplorer.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4084 wrote to memory of 3500	4084	fbdfee5e766033327b05f575c3cf456fa4f71ec39b1bd5ddbfd0dcc69a73bd81.exe	83
PID 4084 wrote to memory of 3500	4084	fbdfee5e766033327b05f575c3cf456fa4f71ec39b1bd5ddbfd0dcc69a73bd81.exe	83
PID 4084 wrote to memory of 3500	4084	fbdfee5e766033327b05f575c3cf456fa4f71ec39b1bd5ddbfd0dcc69a73bd81.exe	83
PID 4084 wrote to memory of 3248	4084	fbdfee5e766033327b05f575c3cf456fa4f71ec39b1bd5ddbfd0dcc69a73bd81.exe	87
PID 4084 wrote to memory of 3248	4084	fbdfee5e766033327b05f575c3cf456fa4f71ec39b1bd5ddbfd0dcc69a73bd81.exe	87
PID 4084 wrote to memory of 3248	4084	fbdfee5e766033327b05f575c3cf456fa4f71ec39b1bd5ddbfd0dcc69a73bd81.exe	87

C:\Users\Admin\AppData\Local\Temp\fbdfee5e766033327b05f575c3cf456fa4f71ec39b1bd5ddbfd0dcc69a73bd81.exe
"C:\Users\Admin\AppData\Local\Temp\fbdfee5e766033327b05f575c3cf456fa4f71ec39b1bd5ddbfd0dcc69a73bd81.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4084
- C:\Windows\SysWOW64\InternetExplorer.exe
  "C:\Windows\System32\InternetExplorer.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:3500
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4084 -s 1096
  2⤵
  - Program crash
  PID:3248
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4084 -s 1096
  2⤵
  - Program crash
  PID:1404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4084 -ip 4084
1⤵
PID:3896

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\InternetExplorer.exe

Filesize
685KB

MD5
90d83c7d3477803d847ce89613b035d6

SHA1
5eac96da556f831ed687fbcd78549e6c476ffe61

SHA256
fbdfee5e766033327b05f575c3cf456fa4f71ec39b1bd5ddbfd0dcc69a73bd81

SHA512
7eed2ee49fa2285f78fcae0175c5bea0fad19839713ba94ec6b2adcdb3ab736f69cb1ed6de4936d18a25a9ca3eca77b7bcc469f2ed534389155bd2e9bf14bf06

Download Submit
C:\Windows\SysWOW64\InternetExplorer.exe

Filesize
685KB

MD5
90d83c7d3477803d847ce89613b035d6

SHA1
5eac96da556f831ed687fbcd78549e6c476ffe61

SHA256
fbdfee5e766033327b05f575c3cf456fa4f71ec39b1bd5ddbfd0dcc69a73bd81

SHA512
7eed2ee49fa2285f78fcae0175c5bea0fad19839713ba94ec6b2adcdb3ab736f69cb1ed6de4936d18a25a9ca3eca77b7bcc469f2ed534389155bd2e9bf14bf06

Download Submit
C:\Windows\SysWOW64\explorer.ini

Filesize
54B

MD5
345015190a6467a6d5e1c1f91ffe25d9

SHA1
5d7bdb44a6bc46d3dc5922eefee24880e46b6031

SHA256
fa872975e8a137600775446a8f0cc60876e2e984783fca1f3e4d0e847e838cd9

SHA512
e11e22b63af0ba20d9abd5d72d24ff70cba86229b9221f785df4a1b4b311c9b505a63a01f395403be94a2a70c4792efee8c50b674fa301804cd6272bd5ed5269

Download Submit

Analysis

Sharing