fb7d928e52ab0175f51b32013d148e2c2d62cc6942081299bef63408fb8b3ef1

General

Target

fb7d928e52ab0175f51b32013d148e2c2d62cc6942081299bef63408fb8b3ef1.exe
Size

1.3MB
MD5

70079993331d49d407de6fdf3c6c5279
SHA1

167c201d77bf03e425868aa7031b74d90e5dbef3
SHA256

fb7d928e52ab0175f51b32013d148e2c2d62cc6942081299bef63408fb8b3ef1
SHA512

7c282a3fff7d12cbf0da9e59d942fa4a753b65f043abf370611e44c106608fd80366d87c4c64c5cb5721f3e3fddd43de0df57acc6187ea6acb22217537beb40a
SSDEEP

24576:lX48QE+UDd6l+BwMSYapPSdBEiNRqheC1iXh5sfHiVHBJTNRj4MIo1dv:lXz+w6lMwMKSdBKeC1s5sSvTNRTP

Score

8^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1708	svchost.exe
1952	free_update.exe

Drops startup file 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\íàïîìèíàíèå.txt	fb7d928e52ab0175f51b32013d148e2c2d62cc6942081299bef63408fb8b3ef1.exe

Loads dropped DLL 3 IoCs

pid	Process
748	fb7d928e52ab0175f51b32013d148e2c2d62cc6942081299bef63408fb8b3ef1.exe
748	fb7d928e52ab0175f51b32013d148e2c2d62cc6942081299bef63408fb8b3ef1.exe
748	fb7d928e52ab0175f51b32013d148e2c2d62cc6942081299bef63408fb8b3ef1.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1708	svchost.exe
1952	free_update.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\WinRaR.inc\Àðõèâ WinRaR\svchost.exe	fb7d928e52ab0175f51b32013d148e2c2d62cc6942081299bef63408fb8b3ef1.exe
File opened for modification	C:\Program Files (x86)\WinRaR.inc\Àðõèâ WinRaR\free_update.exe	fb7d928e52ab0175f51b32013d148e2c2d62cc6942081299bef63408fb8b3ef1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1952	free_update.exe
1708	svchost.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 748 wrote to memory of 1708	748	fb7d928e52ab0175f51b32013d148e2c2d62cc6942081299bef63408fb8b3ef1.exe	28
PID 748 wrote to memory of 1708	748	fb7d928e52ab0175f51b32013d148e2c2d62cc6942081299bef63408fb8b3ef1.exe	28
PID 748 wrote to memory of 1708	748	fb7d928e52ab0175f51b32013d148e2c2d62cc6942081299bef63408fb8b3ef1.exe	28
PID 748 wrote to memory of 1708	748	fb7d928e52ab0175f51b32013d148e2c2d62cc6942081299bef63408fb8b3ef1.exe	28
PID 748 wrote to memory of 1952	748	fb7d928e52ab0175f51b32013d148e2c2d62cc6942081299bef63408fb8b3ef1.exe	29
PID 748 wrote to memory of 1952	748	fb7d928e52ab0175f51b32013d148e2c2d62cc6942081299bef63408fb8b3ef1.exe	29
PID 748 wrote to memory of 1952	748	fb7d928e52ab0175f51b32013d148e2c2d62cc6942081299bef63408fb8b3ef1.exe	29
PID 748 wrote to memory of 1952	748	fb7d928e52ab0175f51b32013d148e2c2d62cc6942081299bef63408fb8b3ef1.exe	29
PID 748 wrote to memory of 1952	748	fb7d928e52ab0175f51b32013d148e2c2d62cc6942081299bef63408fb8b3ef1.exe	29
PID 748 wrote to memory of 1952	748	fb7d928e52ab0175f51b32013d148e2c2d62cc6942081299bef63408fb8b3ef1.exe	29
PID 748 wrote to memory of 1952	748	fb7d928e52ab0175f51b32013d148e2c2d62cc6942081299bef63408fb8b3ef1.exe	29

C:\Users\Admin\AppData\Local\Temp\fb7d928e52ab0175f51b32013d148e2c2d62cc6942081299bef63408fb8b3ef1.exe
"C:\Users\Admin\AppData\Local\Temp\fb7d928e52ab0175f51b32013d148e2c2d62cc6942081299bef63408fb8b3ef1.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:748
- C:\Program Files (x86)\WinRaR.inc\Àðõèâ WinRaR\svchost.exe
  "C:\Program Files (x86)\WinRaR.inc\Àðõèâ WinRaR\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:1708
- C:\Program Files (x86)\WinRaR.inc\Àðõèâ WinRaR\free_update.exe
  "C:\Program Files (x86)\WinRaR.inc\Àðõèâ WinRaR\free_update.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:1952

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\WinRaR.inc\Àðõèâ WinRaR\free_update.exe

Filesize
339KB

MD5
a3daca77161f75f0ebf7f2bf343d2b38

SHA1
2f6be30680082fd8690710f1b76b833e478f29da

SHA256
19298080eff068155d2fdc12d1bc8ccd3c819dd7d4502570e5a71330898f432f

SHA512
01f1c77d7348cc5ac7e40e36da7c1c3f316678396d980a01d82f2a84ea19ffc1c949bcf1c081fed729a53545ae3ffbfce816460964894306c8e91e7caccb8f8a

Download Submit
C:\Program Files (x86)\WinRaR.inc\Àðõèâ WinRaR\free_update.exe

Filesize
339KB

MD5
a3daca77161f75f0ebf7f2bf343d2b38

SHA1
2f6be30680082fd8690710f1b76b833e478f29da

SHA256
19298080eff068155d2fdc12d1bc8ccd3c819dd7d4502570e5a71330898f432f

SHA512
01f1c77d7348cc5ac7e40e36da7c1c3f316678396d980a01d82f2a84ea19ffc1c949bcf1c081fed729a53545ae3ffbfce816460964894306c8e91e7caccb8f8a

Download Submit
C:\Program Files (x86)\WinRaR.inc\Àðõèâ WinRaR\svchost.exe

Filesize
803KB

MD5
edf0527ea272715953aa57bc53926d51

SHA1
022541a2280c71941e3c99e3ac439ce200618158

SHA256
f705bd9b21169d41d88149bc4de5b2a512a05a07b547aaee9496837d40b06d33

SHA512
c2fa16fdc6a742b4e3e2c5b2ceebdfcc062c39087dafce58fcdea5b380c59bdc17a43bf5d4b9f8cdcb3c700ffd85c95c674a201f849180f4c6b842ee10782b82

Download Submit
C:\Program Files (x86)\WinRaR.inc\Àðõèâ WinRaR\svchost.exe

Filesize
803KB

MD5
edf0527ea272715953aa57bc53926d51

SHA1
022541a2280c71941e3c99e3ac439ce200618158

SHA256
f705bd9b21169d41d88149bc4de5b2a512a05a07b547aaee9496837d40b06d33

SHA512
c2fa16fdc6a742b4e3e2c5b2ceebdfcc062c39087dafce58fcdea5b380c59bdc17a43bf5d4b9f8cdcb3c700ffd85c95c674a201f849180f4c6b842ee10782b82

Download Submit
\Program Files (x86)\WinRaR.inc\Àðõèâ WinRaR\free_update.exe

Filesize
339KB

MD5
a3daca77161f75f0ebf7f2bf343d2b38

SHA1
2f6be30680082fd8690710f1b76b833e478f29da

SHA256
19298080eff068155d2fdc12d1bc8ccd3c819dd7d4502570e5a71330898f432f

SHA512
01f1c77d7348cc5ac7e40e36da7c1c3f316678396d980a01d82f2a84ea19ffc1c949bcf1c081fed729a53545ae3ffbfce816460964894306c8e91e7caccb8f8a

Download Submit
\Program Files (x86)\WinRaR.inc\Àðõèâ WinRaR\svchost.exe

Filesize
803KB

MD5
edf0527ea272715953aa57bc53926d51

SHA1
022541a2280c71941e3c99e3ac439ce200618158

SHA256
f705bd9b21169d41d88149bc4de5b2a512a05a07b547aaee9496837d40b06d33

SHA512
c2fa16fdc6a742b4e3e2c5b2ceebdfcc062c39087dafce58fcdea5b380c59bdc17a43bf5d4b9f8cdcb3c700ffd85c95c674a201f849180f4c6b842ee10782b82

Download Submit
\Program Files (x86)\WinRaR.inc\Àðõèâ WinRaR\svchost.exe

Filesize
803KB

MD5
edf0527ea272715953aa57bc53926d51

SHA1
022541a2280c71941e3c99e3ac439ce200618158

SHA256
f705bd9b21169d41d88149bc4de5b2a512a05a07b547aaee9496837d40b06d33

SHA512
c2fa16fdc6a742b4e3e2c5b2ceebdfcc062c39087dafce58fcdea5b380c59bdc17a43bf5d4b9f8cdcb3c700ffd85c95c674a201f849180f4c6b842ee10782b82

Download Submit
memory/748-54-0x0000000075B11000-0x0000000075B13000-memory.dmp

Filesize
8KB

Download
memory/1708-66-0x0000000000360000-0x000000000039E000-memory.dmp

Filesize
248KB

Download
memory/1708-74-0x0000000000400000-0x00000000004EA000-memory.dmp

Filesize
936KB

Download
memory/1708-65-0x0000000000400000-0x00000000004EA000-memory.dmp

Filesize
936KB

Download
memory/1708-79-0x0000000000360000-0x000000000039E000-memory.dmp

Filesize
248KB

Download
memory/1708-78-0x0000000000400000-0x00000000004EA000-memory.dmp

Filesize
936KB

Download
memory/1708-77-0x0000000000400000-0x00000000004EA000-memory.dmp

Filesize
936KB

Download
memory/1708-76-0x0000000000400000-0x00000000004EA000-memory.dmp

Filesize
936KB

Download
memory/1708-75-0x0000000000500000-0x0000000000503000-memory.dmp

Filesize
12KB

Download
memory/1952-67-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/1952-72-0x00000000001B0000-0x00000000001ED000-memory.dmp

Filesize
244KB

Download
memory/1952-73-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/1952-71-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/1952-70-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/1952-69-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/1952-68-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/1952-64-0x00000000001B0000-0x00000000001ED000-memory.dmp

Filesize
244KB

Download

Analysis

Sharing