Analysis
-
max time kernel
205s -
max time network
217s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
05-12-2022 23:49
Static task
static1
Behavioral task
behavioral1
Sample
bbba4a44fbfb9087c0bb987f96ffa1ae89103b23163976ab729ff5736c9d4e40.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
bbba4a44fbfb9087c0bb987f96ffa1ae89103b23163976ab729ff5736c9d4e40.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
bbba4a44fbfb9087c0bb987f96ffa1ae89103b23163976ab729ff5736c9d4e40.exe
-
Size
276KB
-
MD5
74d2a708fc425847e54376f4f2adc6bd
-
SHA1
a84d3709e962997b5460f8322b393af1772e5755
-
SHA256
bbba4a44fbfb9087c0bb987f96ffa1ae89103b23163976ab729ff5736c9d4e40
-
SHA512
a11207e3a46bd7814b7f5e52cab0f3575a27a7306b5dcb76c6edead792931385e89544702c38e55e17f061d8f6be6585d3faf3e3ca418558f7b48dec068191a4
-
SSDEEP
3072:FdZJa8ix7vUPbzaqBAyQsSNTlMKmmo4xTbWI+QV7Ir//5F5MUUAeBuUBcest:va5x2tAy+JlbxbWIsr/B7MVdFceO
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" bbba4a44fbfb9087c0bb987f96ffa1ae89103b23163976ab729ff5736c9d4e40.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" fiaket.exe -
Executes dropped EXE 1 IoCs
pid Process 888 fiaket.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation bbba4a44fbfb9087c0bb987f96ffa1ae89103b23163976ab729ff5736c9d4e40.exe -
Adds Run key to start application 2 TTPs 29 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fiaket = "C:\\Users\\Admin\\fiaket.exe /s" bbba4a44fbfb9087c0bb987f96ffa1ae89103b23163976ab729ff5736c9d4e40.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fiaket = "C:\\Users\\Admin\\fiaket.exe /y" fiaket.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fiaket = "C:\\Users\\Admin\\fiaket.exe /s" fiaket.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fiaket = "C:\\Users\\Admin\\fiaket.exe /l" fiaket.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fiaket = "C:\\Users\\Admin\\fiaket.exe /d" fiaket.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fiaket = "C:\\Users\\Admin\\fiaket.exe /z" fiaket.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fiaket = "C:\\Users\\Admin\\fiaket.exe /w" fiaket.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fiaket = "C:\\Users\\Admin\\fiaket.exe /i" fiaket.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fiaket = "C:\\Users\\Admin\\fiaket.exe /r" fiaket.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fiaket = "C:\\Users\\Admin\\fiaket.exe /x" fiaket.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run\ bbba4a44fbfb9087c0bb987f96ffa1ae89103b23163976ab729ff5736c9d4e40.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fiaket = "C:\\Users\\Admin\\fiaket.exe /u" fiaket.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fiaket = "C:\\Users\\Admin\\fiaket.exe /t" fiaket.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fiaket = "C:\\Users\\Admin\\fiaket.exe /p" fiaket.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fiaket = "C:\\Users\\Admin\\fiaket.exe /k" fiaket.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fiaket = "C:\\Users\\Admin\\fiaket.exe /b" fiaket.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fiaket = "C:\\Users\\Admin\\fiaket.exe /a" fiaket.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fiaket = "C:\\Users\\Admin\\fiaket.exe /e" fiaket.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fiaket = "C:\\Users\\Admin\\fiaket.exe /g" fiaket.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fiaket = "C:\\Users\\Admin\\fiaket.exe /f" fiaket.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run\ fiaket.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fiaket = "C:\\Users\\Admin\\fiaket.exe /j" fiaket.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fiaket = "C:\\Users\\Admin\\fiaket.exe /n" fiaket.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fiaket = "C:\\Users\\Admin\\fiaket.exe /h" fiaket.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fiaket = "C:\\Users\\Admin\\fiaket.exe /m" fiaket.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fiaket = "C:\\Users\\Admin\\fiaket.exe /q" fiaket.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fiaket = "C:\\Users\\Admin\\fiaket.exe /o" fiaket.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fiaket = "C:\\Users\\Admin\\fiaket.exe /c" fiaket.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fiaket = "C:\\Users\\Admin\\fiaket.exe /v" fiaket.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4080 bbba4a44fbfb9087c0bb987f96ffa1ae89103b23163976ab729ff5736c9d4e40.exe 4080 bbba4a44fbfb9087c0bb987f96ffa1ae89103b23163976ab729ff5736c9d4e40.exe 888 fiaket.exe 888 fiaket.exe 888 fiaket.exe 888 fiaket.exe 888 fiaket.exe 888 fiaket.exe 888 fiaket.exe 888 fiaket.exe 888 fiaket.exe 888 fiaket.exe 888 fiaket.exe 888 fiaket.exe 888 fiaket.exe 888 fiaket.exe 888 fiaket.exe 888 fiaket.exe 888 fiaket.exe 888 fiaket.exe 888 fiaket.exe 888 fiaket.exe 888 fiaket.exe 888 fiaket.exe 888 fiaket.exe 888 fiaket.exe 888 fiaket.exe 888 fiaket.exe 888 fiaket.exe 888 fiaket.exe 888 fiaket.exe 888 fiaket.exe 888 fiaket.exe 888 fiaket.exe 888 fiaket.exe 888 fiaket.exe 888 fiaket.exe 888 fiaket.exe 888 fiaket.exe 888 fiaket.exe 888 fiaket.exe 888 fiaket.exe 888 fiaket.exe 888 fiaket.exe 888 fiaket.exe 888 fiaket.exe 888 fiaket.exe 888 fiaket.exe 888 fiaket.exe 888 fiaket.exe 888 fiaket.exe 888 fiaket.exe 888 fiaket.exe 888 fiaket.exe 888 fiaket.exe 888 fiaket.exe 888 fiaket.exe 888 fiaket.exe 888 fiaket.exe 888 fiaket.exe 888 fiaket.exe 888 fiaket.exe 888 fiaket.exe 888 fiaket.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4080 bbba4a44fbfb9087c0bb987f96ffa1ae89103b23163976ab729ff5736c9d4e40.exe 888 fiaket.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4080 wrote to memory of 888 4080 bbba4a44fbfb9087c0bb987f96ffa1ae89103b23163976ab729ff5736c9d4e40.exe 88 PID 4080 wrote to memory of 888 4080 bbba4a44fbfb9087c0bb987f96ffa1ae89103b23163976ab729ff5736c9d4e40.exe 88 PID 4080 wrote to memory of 888 4080 bbba4a44fbfb9087c0bb987f96ffa1ae89103b23163976ab729ff5736c9d4e40.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\bbba4a44fbfb9087c0bb987f96ffa1ae89103b23163976ab729ff5736c9d4e40.exe"C:\Users\Admin\AppData\Local\Temp\bbba4a44fbfb9087c0bb987f96ffa1ae89103b23163976ab729ff5736c9d4e40.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Users\Admin\fiaket.exe"C:\Users\Admin\fiaket.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:888
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
276KB
MD593f3d67e606e49be28db2e4c6b958980
SHA16fdbb218fbd4bdc82c7e767680d3cb89138befc6
SHA2560bff4a8724a99a16af05d3e071420213360440cf790e5981b073bfe39b26e249
SHA5126e3e9a6dad5a545ffdf0093d7cd962c61485e8decad653051e93dc63fc277c0e9dc40f2d5e973511e16c014e7ca9495b47cda8d6809036d8a65548c7ab395b4b
-
Filesize
276KB
MD593f3d67e606e49be28db2e4c6b958980
SHA16fdbb218fbd4bdc82c7e767680d3cb89138befc6
SHA2560bff4a8724a99a16af05d3e071420213360440cf790e5981b073bfe39b26e249
SHA5126e3e9a6dad5a545ffdf0093d7cd962c61485e8decad653051e93dc63fc277c0e9dc40f2d5e973511e16c014e7ca9495b47cda8d6809036d8a65548c7ab395b4b