fcc60369e4aa2dc1654e2b8e3473e1c68bfeb593f547c2e0533f3db91a9d04db

General

Target

fcc60369e4aa2dc1654e2b8e3473e1c68bfeb593f547c2e0533f3db91a9d04db.exe
Size

803KB
MD5

e86e2e7020b0e203d8726354ef420e3c
SHA1

821062816582ffce9ed85e8c14c032f6e3829008
SHA256

fcc60369e4aa2dc1654e2b8e3473e1c68bfeb593f547c2e0533f3db91a9d04db
SHA512

ee82994445650d534241476b7b1139bcf5f4f12fe3219effd1ccb850c05e38bab9562b3279b6b7ef7ea97eb74e712e5c114cfe815ec3dccab55b696a9447532f
SSDEEP

24576:a1L5BUmg934RlFtrdC7WM2sGjo0pAjNkZ5bVS80r:74RlFtxCjC+8s

Score

8^/10

evasion persistence

Malware Config

Signatures

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1158

pid	Process
4752	attrib.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FlashXp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\FlashXp.exe"	fcc60369e4aa2dc1654e2b8e3473e1c68bfeb593f547c2e0533f3db91a9d04db.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1852 set thread context of 4696	1852	fcc60369e4aa2dc1654e2b8e3473e1c68bfeb593f547c2e0533f3db91a9d04db.exe	80

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	fcc60369e4aa2dc1654e2b8e3473e1c68bfeb593f547c2e0533f3db91a9d04db.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	fcc60369e4aa2dc1654e2b8e3473e1c68bfeb593f547c2e0533f3db91a9d04db.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	fcc60369e4aa2dc1654e2b8e3473e1c68bfeb593f547c2e0533f3db91a9d04db.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\IESettingSync	fcc60369e4aa2dc1654e2b8e3473e1c68bfeb593f547c2e0533f3db91a9d04db.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4696	fcc60369e4aa2dc1654e2b8e3473e1c68bfeb593f547c2e0533f3db91a9d04db.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4696	fcc60369e4aa2dc1654e2b8e3473e1c68bfeb593f547c2e0533f3db91a9d04db.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1852	fcc60369e4aa2dc1654e2b8e3473e1c68bfeb593f547c2e0533f3db91a9d04db.exe
4696	fcc60369e4aa2dc1654e2b8e3473e1c68bfeb593f547c2e0533f3db91a9d04db.exe
4696	fcc60369e4aa2dc1654e2b8e3473e1c68bfeb593f547c2e0533f3db91a9d04db.exe
4696	fcc60369e4aa2dc1654e2b8e3473e1c68bfeb593f547c2e0533f3db91a9d04db.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 4696	1852	fcc60369e4aa2dc1654e2b8e3473e1c68bfeb593f547c2e0533f3db91a9d04db.exe	80
PID 1852 wrote to memory of 4696	1852	fcc60369e4aa2dc1654e2b8e3473e1c68bfeb593f547c2e0533f3db91a9d04db.exe	80
PID 1852 wrote to memory of 4696	1852	fcc60369e4aa2dc1654e2b8e3473e1c68bfeb593f547c2e0533f3db91a9d04db.exe	80
PID 1852 wrote to memory of 4696	1852	fcc60369e4aa2dc1654e2b8e3473e1c68bfeb593f547c2e0533f3db91a9d04db.exe	80
PID 1852 wrote to memory of 4696	1852	fcc60369e4aa2dc1654e2b8e3473e1c68bfeb593f547c2e0533f3db91a9d04db.exe	80
PID 1852 wrote to memory of 4696	1852	fcc60369e4aa2dc1654e2b8e3473e1c68bfeb593f547c2e0533f3db91a9d04db.exe	80
PID 1852 wrote to memory of 4696	1852	fcc60369e4aa2dc1654e2b8e3473e1c68bfeb593f547c2e0533f3db91a9d04db.exe	80
PID 1852 wrote to memory of 4696	1852	fcc60369e4aa2dc1654e2b8e3473e1c68bfeb593f547c2e0533f3db91a9d04db.exe	80
PID 1852 wrote to memory of 4696	1852	fcc60369e4aa2dc1654e2b8e3473e1c68bfeb593f547c2e0533f3db91a9d04db.exe	80
PID 1852 wrote to memory of 4696	1852	fcc60369e4aa2dc1654e2b8e3473e1c68bfeb593f547c2e0533f3db91a9d04db.exe	80
PID 1852 wrote to memory of 4696	1852	fcc60369e4aa2dc1654e2b8e3473e1c68bfeb593f547c2e0533f3db91a9d04db.exe	80
PID 1852 wrote to memory of 4696	1852	fcc60369e4aa2dc1654e2b8e3473e1c68bfeb593f547c2e0533f3db91a9d04db.exe	80
PID 1852 wrote to memory of 4696	1852	fcc60369e4aa2dc1654e2b8e3473e1c68bfeb593f547c2e0533f3db91a9d04db.exe	80
PID 4696 wrote to memory of 4752	4696	fcc60369e4aa2dc1654e2b8e3473e1c68bfeb593f547c2e0533f3db91a9d04db.exe	81
PID 4696 wrote to memory of 4752	4696	fcc60369e4aa2dc1654e2b8e3473e1c68bfeb593f547c2e0533f3db91a9d04db.exe	81
PID 4696 wrote to memory of 4752	4696	fcc60369e4aa2dc1654e2b8e3473e1c68bfeb593f547c2e0533f3db91a9d04db.exe	81

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
4752	attrib.exe

C:\Users\Admin\AppData\Local\Temp\fcc60369e4aa2dc1654e2b8e3473e1c68bfeb593f547c2e0533f3db91a9d04db.exe
"C:\Users\Admin\AppData\Local\Temp\fcc60369e4aa2dc1654e2b8e3473e1c68bfeb593f547c2e0533f3db91a9d04db.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Users\Admin\AppData\Local\Temp\fcc60369e4aa2dc1654e2b8e3473e1c68bfeb593f547c2e0533f3db91a9d04db.exe
  "C:\Users\Admin\AppData\Local\Temp\fcc60369e4aa2dc1654e2b8e3473e1c68bfeb593f547c2e0533f3db91a9d04db.exe"
  2⤵
  - Adds Run key to start application
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4696
- - C:\Windows\SysWOW64\attrib.exe
    attrib +r +s +h +a C:\Users\Admin\AppData\Local\Temp\FlashXp.exe
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:4752

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

2

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\FlashXp.exe

Filesize
803KB

MD5
e86e2e7020b0e203d8726354ef420e3c

SHA1
821062816582ffce9ed85e8c14c032f6e3829008

SHA256
fcc60369e4aa2dc1654e2b8e3473e1c68bfeb593f547c2e0533f3db91a9d04db

SHA512
ee82994445650d534241476b7b1139bcf5f4f12fe3219effd1ccb850c05e38bab9562b3279b6b7ef7ea97eb74e712e5c114cfe815ec3dccab55b696a9447532f

Download Submit
memory/4696-134-0x0000000000000000-mapping.dmp

Download
memory/4696-135-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/4696-136-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/4696-137-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/4696-138-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/4696-139-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/4752-140-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads