Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 01:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
09a1118612737fc0ee167f2dfc9c0f87.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
09a1118612737fc0ee167f2dfc9c0f87.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
09a1118612737fc0ee167f2dfc9c0f87.exe
-
Size
100KB
-
MD5
09a1118612737fc0ee167f2dfc9c0f87
-
SHA1
7ad4dd7177647ab11dc629d0b4beb957e05eea37
-
SHA256
ec7248c45fde9174a4e05d6b7461089e4695ae8330dfd33d986a0f5bfb602bd1
-
SHA512
8210496b24b4dcf646bed953bca521bac35724286740f693d21f34e4a51fcf3ade611d7758759dd788f33c713b3eb735ea8739dd6fa50c804aafa5643e220716
-
SSDEEP
1536:zIWCcX220mQKxJKIRGWcOUP7vXArnY1ZqAefzyeshNIjnZ1:0uQ5NAfzyemCnn
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 09a1118612737fc0ee167f2dfc9c0f87.exe Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" faidi.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation 09a1118612737fc0ee167f2dfc9c0f87.exe -
Executes dropped EXE 1 IoCs
pid Process 3916 faidi.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\faidi = "C:\\Users\\Admin\\faidi.exe /k" faidi.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\faidi = "C:\\Users\\Admin\\faidi.exe /I" faidi.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\faidi = "C:\\Users\\Admin\\faidi.exe /Q" faidi.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\faidi = "C:\\Users\\Admin\\faidi.exe /c" faidi.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\faidi = "C:\\Users\\Admin\\faidi.exe /R" faidi.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\faidi = "C:\\Users\\Admin\\faidi.exe /A" faidi.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\faidi = "C:\\Users\\Admin\\faidi.exe /G" faidi.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\faidi = "C:\\Users\\Admin\\faidi.exe /w" faidi.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\faidi = "C:\\Users\\Admin\\faidi.exe /v" faidi.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\faidi = "C:\\Users\\Admin\\faidi.exe /C" faidi.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\faidi = "C:\\Users\\Admin\\faidi.exe /x" faidi.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\faidi = "C:\\Users\\Admin\\faidi.exe /l" faidi.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\faidi = "C:\\Users\\Admin\\faidi.exe /T" faidi.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\faidi = "C:\\Users\\Admin\\faidi.exe /P" faidi.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\faidi = "C:\\Users\\Admin\\faidi.exe /J" faidi.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\faidi = "C:\\Users\\Admin\\faidi.exe /W" faidi.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\faidi = "C:\\Users\\Admin\\faidi.exe /j" faidi.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\faidi = "C:\\Users\\Admin\\faidi.exe /K" faidi.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\faidi = "C:\\Users\\Admin\\faidi.exe /h" faidi.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\faidi = "C:\\Users\\Admin\\faidi.exe /y" faidi.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\faidi = "C:\\Users\\Admin\\faidi.exe /u" faidi.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\faidi = "C:\\Users\\Admin\\faidi.exe /L" faidi.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\faidi = "C:\\Users\\Admin\\faidi.exe /H" faidi.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\faidi = "C:\\Users\\Admin\\faidi.exe /e" faidi.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\faidi = "C:\\Users\\Admin\\faidi.exe /V" faidi.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\faidi = "C:\\Users\\Admin\\faidi.exe /q" faidi.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\faidi = "C:\\Users\\Admin\\faidi.exe /Y" faidi.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\faidi = "C:\\Users\\Admin\\faidi.exe /O" faidi.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\faidi = "C:\\Users\\Admin\\faidi.exe /m" faidi.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\faidi = "C:\\Users\\Admin\\faidi.exe /E" faidi.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\faidi = "C:\\Users\\Admin\\faidi.exe /M" 09a1118612737fc0ee167f2dfc9c0f87.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\faidi = "C:\\Users\\Admin\\faidi.exe /g" faidi.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\faidi = "C:\\Users\\Admin\\faidi.exe /B" faidi.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\faidi = "C:\\Users\\Admin\\faidi.exe /X" faidi.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\faidi = "C:\\Users\\Admin\\faidi.exe /n" faidi.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\faidi = "C:\\Users\\Admin\\faidi.exe /U" faidi.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\faidi = "C:\\Users\\Admin\\faidi.exe /i" faidi.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\faidi = "C:\\Users\\Admin\\faidi.exe /z" faidi.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\faidi = "C:\\Users\\Admin\\faidi.exe /Z" faidi.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\faidi = "C:\\Users\\Admin\\faidi.exe /F" faidi.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\faidi = "C:\\Users\\Admin\\faidi.exe /t" faidi.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\faidi = "C:\\Users\\Admin\\faidi.exe /N" faidi.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\faidi = "C:\\Users\\Admin\\faidi.exe /s" faidi.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\faidi = "C:\\Users\\Admin\\faidi.exe /M" faidi.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\faidi = "C:\\Users\\Admin\\faidi.exe /d" faidi.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\faidi = "C:\\Users\\Admin\\faidi.exe /D" faidi.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\faidi = "C:\\Users\\Admin\\faidi.exe /p" faidi.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\faidi = "C:\\Users\\Admin\\faidi.exe /a" faidi.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\faidi = "C:\\Users\\Admin\\faidi.exe /b" faidi.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\faidi = "C:\\Users\\Admin\\faidi.exe /f" faidi.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\faidi = "C:\\Users\\Admin\\faidi.exe /r" faidi.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\faidi = "C:\\Users\\Admin\\faidi.exe /o" faidi.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2620 09a1118612737fc0ee167f2dfc9c0f87.exe 2620 09a1118612737fc0ee167f2dfc9c0f87.exe 3916 faidi.exe 3916 faidi.exe 3916 faidi.exe 3916 faidi.exe 3916 faidi.exe 3916 faidi.exe 3916 faidi.exe 3916 faidi.exe 3916 faidi.exe 3916 faidi.exe 3916 faidi.exe 3916 faidi.exe 3916 faidi.exe 3916 faidi.exe 3916 faidi.exe 3916 faidi.exe 3916 faidi.exe 3916 faidi.exe 3916 faidi.exe 3916 faidi.exe 3916 faidi.exe 3916 faidi.exe 3916 faidi.exe 3916 faidi.exe 3916 faidi.exe 3916 faidi.exe 3916 faidi.exe 3916 faidi.exe 3916 faidi.exe 3916 faidi.exe 3916 faidi.exe 3916 faidi.exe 3916 faidi.exe 3916 faidi.exe 3916 faidi.exe 3916 faidi.exe 3916 faidi.exe 3916 faidi.exe 3916 faidi.exe 3916 faidi.exe 3916 faidi.exe 3916 faidi.exe 3916 faidi.exe 3916 faidi.exe 3916 faidi.exe 3916 faidi.exe 3916 faidi.exe 3916 faidi.exe 3916 faidi.exe 3916 faidi.exe 3916 faidi.exe 3916 faidi.exe 3916 faidi.exe 3916 faidi.exe 3916 faidi.exe 3916 faidi.exe 3916 faidi.exe 3916 faidi.exe 3916 faidi.exe 3916 faidi.exe 3916 faidi.exe 3916 faidi.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2620 09a1118612737fc0ee167f2dfc9c0f87.exe 3916 faidi.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2620 wrote to memory of 3916 2620 09a1118612737fc0ee167f2dfc9c0f87.exe 92 PID 2620 wrote to memory of 3916 2620 09a1118612737fc0ee167f2dfc9c0f87.exe 92 PID 2620 wrote to memory of 3916 2620 09a1118612737fc0ee167f2dfc9c0f87.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\09a1118612737fc0ee167f2dfc9c0f87.exe"C:\Users\Admin\AppData\Local\Temp\09a1118612737fc0ee167f2dfc9c0f87.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\faidi.exe"C:\Users\Admin\faidi.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3916
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
MD57313a4bcb34d1ad46ce60fd000f6a2dc
SHA12e16af103615d4537a59e4aa4e01e7e313f6c238
SHA2568a50d7f9671b7f5c08f2dbfa3c6365cb59269f9d6a241beb817f212ee9e2b805
SHA5124a4b2a8d2a04b7fdd864d7b2ac062c68900e5fcbcd2fc9702e61eebcd701299135762ad61c799dd237cad09c79d2a9a4dda2d5bd485875463c31a7216f2201e8