f8f7a8a64c5f0df58ea7c8283b5388609140b788693107dd924edfed84c89ea1

General

Target

f8f7a8a64c5f0df58ea7c8283b5388609140b788693107dd924edfed84c89ea1.exe
Size

25.2MB
MD5

f6870be4afb8703b537955e5f7e85ef3
SHA1

f10c8ad29f9af87585f582ff9c99ea08b586f470
SHA256

f8f7a8a64c5f0df58ea7c8283b5388609140b788693107dd924edfed84c89ea1
SHA512

f9c96a4ff3bd2b27d3fd2affdc5a92cf14456f13dfdef823de186cc90f6e975650b66788096fa546e594acec3d66340ea659a693fbe8d5e2c0d780c8f4fa4857
SSDEEP

98304:fzicAgirs+wz5tqVFhjbA5t8v4Xr9rGjoQqu5LsCA57sM9G9woz:Li8aKzzqvhja8v0r9rGfwCA5Ip9wI

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3248	3ddown.com_PE.Explorer_setup.exe
776	is-3LFV6.tmp

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\3ddown.com_PE.Explorer = "C:\\Program Files\\Fuwno\\Isxci.exe /3ddown.com_PE.Explorer /{8184D1B4-F152-4A5F-8505-9111C9F75186}"	f8f7a8a64c5f0df58ea7c8283b5388609140b788693107dd924edfed84c89ea1.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files\Fuwno\laases.exe	f8f7a8a64c5f0df58ea7c8283b5388609140b788693107dd924edfed84c89ea1.exe
File opened for modification	C:\Program Files\Fuwno\laases.exe	f8f7a8a64c5f0df58ea7c8283b5388609140b788693107dd924edfed84c89ea1.exe
File opened for modification	C:\Program Files\Fuwno\nicesv.exe	f8f7a8a64c5f0df58ea7c8283b5388609140b788693107dd924edfed84c89ea1.exe
File created	C:\Program Files\Fuwno\nusoce\pat.xml	f8f7a8a64c5f0df58ea7c8283b5388609140b788693107dd924edfed84c89ea1.exe
File created	C:\Program Files\Fuwno\nusoce\recoef.dll	f8f7a8a64c5f0df58ea7c8283b5388609140b788693107dd924edfed84c89ea1.exe
File opened for modification	C:\Program Files\Fuwno\nusoce\recoef.dll	f8f7a8a64c5f0df58ea7c8283b5388609140b788693107dd924edfed84c89ea1.exe
File created	C:\Program Files\Fuwno\nicesv.exe	f8f7a8a64c5f0df58ea7c8283b5388609140b788693107dd924edfed84c89ea1.exe
File opened for modification	C:\Program Files\Fuwno\nusoce\pat.xml	f8f7a8a64c5f0df58ea7c8283b5388609140b788693107dd924edfed84c89ea1.exe
File created	C:\Program Files\Common Files\System\Ole DB\MSPat.xml	f8f7a8a64c5f0df58ea7c8283b5388609140b788693107dd924edfed84c89ea1.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\MSPat.xml	f8f7a8a64c5f0df58ea7c8283b5388609140b788693107dd924edfed84c89ea1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2572 wrote to memory of 3248	2572	f8f7a8a64c5f0df58ea7c8283b5388609140b788693107dd924edfed84c89ea1.exe	82
PID 2572 wrote to memory of 3248	2572	f8f7a8a64c5f0df58ea7c8283b5388609140b788693107dd924edfed84c89ea1.exe	82
PID 2572 wrote to memory of 3248	2572	f8f7a8a64c5f0df58ea7c8283b5388609140b788693107dd924edfed84c89ea1.exe	82
PID 3248 wrote to memory of 776	3248	3ddown.com_PE.Explorer_setup.exe	83
PID 3248 wrote to memory of 776	3248	3ddown.com_PE.Explorer_setup.exe	83
PID 3248 wrote to memory of 776	3248	3ddown.com_PE.Explorer_setup.exe	83

C:\Users\Admin\AppData\Local\Temp\f8f7a8a64c5f0df58ea7c8283b5388609140b788693107dd924edfed84c89ea1.exe
"C:\Users\Admin\AppData\Local\Temp\f8f7a8a64c5f0df58ea7c8283b5388609140b788693107dd924edfed84c89ea1.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Users\Admin\AppData\Local\Temp\g879FD\3ddown.com_PE.Explorer_setup.exe
  C:\Users\Admin\AppData\Local\Temp\g879FD\3ddown.com_PE.Explorer_setup.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3248
- - C:\Users\Admin\AppData\Local\Temp\is-GKC85.tmp\is-3LFV6.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-GKC85.tmp\is-3LFV6.tmp" /SL4 $100046 "C:\Users\Admin\AppData\Local\Temp\g879FD\3ddown.com_PE.Explorer_setup.exe" 3309744 72192
    3⤵
    - Executes dropped EXE
    PID:776

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\g879FD\3ddown.com_PE.Explorer_setup.exe

Filesize
3.4MB

MD5
a1ce79004847ae73d01d2bc4b74fae02

SHA1
6103ae43464c4ffe005b790d2fa52dddd8ceb67b

SHA256
253caa8fc7021202e65372972e447cab37a2f781d6c0b3f46d7943437e190fd6

SHA512
f22230fd33498bb7be3d529725e3ad6d09d35b15603f7b33450016a69de785dbde021909d5cf837a2d754146f8f4bb223294797ef1ba0ad21076769d371d1746

Download Submit
C:\Users\Admin\AppData\Local\Temp\g879FD\3ddown.com_PE.Explorer_setup.exe

Filesize
3.4MB

MD5
a1ce79004847ae73d01d2bc4b74fae02

SHA1
6103ae43464c4ffe005b790d2fa52dddd8ceb67b

SHA256
253caa8fc7021202e65372972e447cab37a2f781d6c0b3f46d7943437e190fd6

SHA512
f22230fd33498bb7be3d529725e3ad6d09d35b15603f7b33450016a69de785dbde021909d5cf837a2d754146f8f4bb223294797ef1ba0ad21076769d371d1746

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-GKC85.tmp\is-3LFV6.tmp

Filesize
657KB

MD5
3dafb498bb15d5260cb2c12b391a0d48

SHA1
c775ae9fdf18ab0ce38a8adffabe378f461e79a1

SHA256
c5d5f5f814c5bc4989d691442051e5e78cf1971eb9b773a7a26b438e58a73d7a

SHA512
a42f39a73bd4615490c6e33c017fa09f9992e3327d244b050b6634ad696d421170fd63ec5d5e66e92d112dc804eabd0bcd56494c9499d78fad8b46fe2ef32a31

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-GKC85.tmp\is-3LFV6.tmp

Filesize
657KB

MD5
3dafb498bb15d5260cb2c12b391a0d48

SHA1
c775ae9fdf18ab0ce38a8adffabe378f461e79a1

SHA256
c5d5f5f814c5bc4989d691442051e5e78cf1971eb9b773a7a26b438e58a73d7a

SHA512
a42f39a73bd4615490c6e33c017fa09f9992e3327d244b050b6634ad696d421170fd63ec5d5e66e92d112dc804eabd0bcd56494c9499d78fad8b46fe2ef32a31

Download Submit
memory/3248-135-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/3248-140-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download

Analysis

Sharing