bae5c7c3ef2f07138cac148d8a601a52225938c94f1210d1b6b44a236d9018b8

Analysis

max time kernel
62s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
02-04-2023 08:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e923f2506ca1ec6f33a4cc4230d2d79b.exe
Size

1.9MB
MD5

e923f2506ca1ec6f33a4cc4230d2d79b
SHA1

03cdaa5317f5fe81d286eb90b33daaaf54c8e30e
SHA256

bae5c7c3ef2f07138cac148d8a601a52225938c94f1210d1b6b44a236d9018b8
SHA512

915e3719c1c63bc8f97f91da5610f4a3c189add2d01ab0f027f3642a6a725bb810f7a174a627f806e4482fea3f3c3246446536ebe287003bfece0c983c5fcee4
SSDEEP

49152:EGlJfs0CB1goIHxWynwVD1JPHcF9XT6lIFUfRagK0sgRQ4yBNg5dlLYp:541go6Ry19cDXTxSsn4MCPYp

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

is-UHLHJ.tmpFRec42.exe

pid process

2288 is-UHLHJ.tmp
2172 FRec42.exe
Loads dropped DLL 1 IoCs

Processes:

is-UHLHJ.tmp

pid process

2288 is-UHLHJ.tmp
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
2288	is-UHLHJ.tmp
2172	FRec42.exe

pid	process
2288	is-UHLHJ.tmp

Drops file in Program Files directory 9 IoCs

Processes:

is-UHLHJ.tmp

description	ioc	process
File created	C:\Program Files (x86)\FJMsoftFR\FRec42\unins000.dat	is-UHLHJ.tmp
File created	C:\Program Files (x86)\FJMsoftFR\FRec42\is-BBLLG.tmp	is-UHLHJ.tmp
File created	C:\Program Files (x86)\FJMsoftFR\FRec42\is-DT075.tmp	is-UHLHJ.tmp
File created	C:\Program Files (x86)\FJMsoftFR\FRec42\is-14U47.tmp	is-UHLHJ.tmp
File opened for modification	C:\Program Files (x86)\FJMsoftFR\FRec42\FRec42.exe	is-UHLHJ.tmp
File created	C:\Program Files (x86)\FJMsoftFR\FRec42\is-NIIID.tmp	is-UHLHJ.tmp
File created	C:\Program Files (x86)\FJMsoftFR\FRec42\is-MCRVP.tmp	is-UHLHJ.tmp
File created	C:\Program Files (x86)\FJMsoftFR\FRec42\data\is-082ST.tmp	is-UHLHJ.tmp
File opened for modification	C:\Program Files (x86)\FJMsoftFR\FRec42\unins000.dat	is-UHLHJ.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

e923f2506ca1ec6f33a4cc4230d2d79b.exeis-UHLHJ.tmp

description	pid	process	target process
PID 4736 wrote to memory of 2288	4736	e923f2506ca1ec6f33a4cc4230d2d79b.exe	is-UHLHJ.tmp
PID 4736 wrote to memory of 2288	4736	e923f2506ca1ec6f33a4cc4230d2d79b.exe	is-UHLHJ.tmp
PID 4736 wrote to memory of 2288	4736	e923f2506ca1ec6f33a4cc4230d2d79b.exe	is-UHLHJ.tmp
PID 2288 wrote to memory of 2172	2288	is-UHLHJ.tmp	FRec42.exe
PID 2288 wrote to memory of 2172	2288	is-UHLHJ.tmp	FRec42.exe
PID 2288 wrote to memory of 2172	2288	is-UHLHJ.tmp	FRec42.exe

C:\Users\Admin\AppData\Local\Temp\e923f2506ca1ec6f33a4cc4230d2d79b.exe
"C:\Users\Admin\AppData\Local\Temp\e923f2506ca1ec6f33a4cc4230d2d79b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4736

C:\Users\Admin\AppData\Local\Temp\is-CR33N.tmp\is-UHLHJ.tmp
"C:\Users\Admin\AppData\Local\Temp\is-CR33N.tmp\is-UHLHJ.tmp" /SL4 $90040 "C:\Users\Admin\AppData\Local\Temp\e923f2506ca1ec6f33a4cc4230d2d79b.exe" 1776066 52736
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2288

C:\Program Files (x86)\FJMsoftFR\FRec42\FRec42.exe
"C:\Program Files (x86)\FJMsoftFR\FRec42\FRec42.exe"
3⤵
- Executes dropped EXE
PID:2172

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\FJMsoftFR\FRec42\FRec42.exe
Filesize
1.6MB

MD5
f8b085cce34021cdfa812095de1ef80d

SHA1
2a3427873d6f9157f3a85be1ec290b229feab7fa

SHA256
9f7fc0c346a847d534a6e2f8fc6457b05281334bddd000e0deb5aca69290a41c

SHA512
1f8194ba83f4c2f0c100272b9ba26329fd56d847b5665a330166809dc665c09e92fc2c209fdc988dae1116354b25d1c55ceee4cb431c48f4ad3337e8c20f5a85

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-CR33N.tmp\is-UHLHJ.tmp
Filesize
659KB

MD5
63bdf487b26c0886dbced14bab4d4257

SHA1
e3621d870aa54d552861f1c71dea1fb36d71def6

SHA256
ca5e816fa95cbcd2a880f2c319d3ddf09686e96ee633af63a396969e5e62335a

SHA512
b433e540c9da175efdd09d44be39c563176046d89aa03edcc43e3582aa1f180e40e283503d152a46e07d4e77f8fa18b76118e425961b507ad5ca3864c39a7c40

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-CR33N.tmp\is-UHLHJ.tmp
Filesize
659KB

MD5
63bdf487b26c0886dbced14bab4d4257

SHA1
e3621d870aa54d552861f1c71dea1fb36d71def6

SHA256
ca5e816fa95cbcd2a880f2c319d3ddf09686e96ee633af63a396969e5e62335a

SHA512
b433e540c9da175efdd09d44be39c563176046d89aa03edcc43e3582aa1f180e40e283503d152a46e07d4e77f8fa18b76118e425961b507ad5ca3864c39a7c40

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-LF3TV.tmp\_isetup\_iscrypt.dll
Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
memory/2172-168-0x0000000000400000-0x00000000013A4000-memory.dmp

Filesize
15.6MB

Download
memory/2288-153-0x0000000000570000-0x0000000000571000-memory.dmp

Filesize
4KB

Download
memory/2288-169-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/4736-136-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/4736-170-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download