Overview

overview

7

Static

static

3

fenix atc/...co.exe

windows10-1703-x64

1

fenix atc/...er.exe

windows10-1703-x64

7

Analysis

  • max time kernel
    852s
  • max time network
    1604s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-es
  • resource tags

    arch:x64arch:x86image:win10-20240404-eslocale:es-esos:windows10-1703-x64systemwindows
  • submitted
    04/04/2024, 17:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    fenix atc/FenixATCInstaller.exe
  • Size 5.3MB
  • Sample240404-vwtk9sdd6y
  • SHA256 ba4da4c0e7257660436b8c4c49f8046c6d0fd5348a7d24f3cc7734b4dbb31f4d
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 18 IoCs
  • Registers COM server for autorun 1 TTPs 20 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 15 IoCs
  • Drops file in Program Files directory 6 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 45 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 4 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\fenix atc\FenixATCInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\fenix atc\FenixATCInstaller.exe"
    1⤵
    • Loads dropped DLL
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1260
    • C:\Users\Admin\AppData\Local\Temp\fenix atc\FenixATCInstaller.exe
      "C:\Users\Admin\AppData\Local\Temp\fenix atc\FenixATCInstaller.exe" /i "C:\Users\Admin\AppData\Roaming\Tulpep Services\Fenix ATC 1.0\install\FenixATCInstaller.msi" AI_EUIMSI=1 APPDIR="C:\Program Files (x86)\GATCFenix" CLIENTPROCESSID="1260" SECONDSEQUENCE="1" CHAINERUIPROCESSID="1260Chainer" ACTION="INSTALL" EXECUTEACTION="INSTALL" CLIENTUILEVEL="0" ADDLOCAL="LinkCreator,MainFeature" PRIMARYFOLDER="APPDIR" ROOTDRIVE="C:\" AI_PREREQFILES="C:\Users\Admin\AppData\Roaming\Tulpep Services\Fenix ATC\prerequisites\LinkCreator.exe" AI_PREREQDIRS="C:\Users\Admin\AppData\Roaming\Tulpep Services" AI_MISSING_PREREQS="Link Creator" AI_SETUPEXEPATH="C:\Users\Admin\AppData\Local\Temp\fenix atc\FenixATCInstaller.exe" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp\fenix atc\" EXE_CMD_LINE="/exenoupdates " TARGETDIR="C:\" AI_SETUPEXEPATH_ORIGINAL="C:\Users\Admin\AppData\Local\Temp\fenix atc\FenixATCInstaller.exe" AI_INSTALL="1"
      2⤵
      • Enumerates connected drives
      PID:4824
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EXE5288.tmp.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2248
      • C:\Windows\SysWOW64\attrib.exe
        ATTRIB -r "\\?\C:\Users\Admin\AppData\Roaming\TULPEP~1\FENIXA~1.0\install\FENIXA~1.MSI"
        3⤵
        • Views/modifies file attributes
        PID:604
      • C:\Windows\SysWOW64\attrib.exe
        ATTRIB -r "C:\Users\Admin\AppData\Local\Temp\EXE5288.tmp.bat"
        3⤵
        • Views/modifies file attributes
        PID:4464
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /S /D /c" del "C:\Users\Admin\AppData\Local\Temp\EXE5288.tmp.bat" "
        3⤵
          PID:3924
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" cls"
          3⤵
            PID:4728
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EXE5306.tmp.bat" "
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:3168
          • C:\Windows\SysWOW64\attrib.exe
            ATTRIB -r "\\?\C:\Users\Admin\AppData\Roaming\TULPEP~1\FENIXA~1.0\install\FENIXA~1.MSI"
            3⤵
            • Views/modifies file attributes
            PID:4352
          • C:\Windows\SysWOW64\attrib.exe
            ATTRIB -r "C:\Users\Admin\AppData\Local\Temp\EXE5306.tmp.bat"
            3⤵
            • Views/modifies file attributes
            PID:3772
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" del "C:\Users\Admin\AppData\Local\Temp\EXE5306.tmp.bat" "
            3⤵
              PID:4564
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" cls"
              3⤵
                PID:2928
          • C:\Windows\system32\msiexec.exe
            C:\Windows\system32\msiexec.exe /V
            1⤵
            • Registers COM server for autorun
            • Enumerates connected drives
            • Drops file in System32 directory
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4324
            • C:\Windows\syswow64\MsiExec.exe
              C:\Windows\syswow64\MsiExec.exe -Embedding 94B722DBF6921C3B1AAB63C7E2B771AF C
              2⤵
              • Loads dropped DLL
              • Drops file in Windows directory
              • Suspicious use of WriteProcessMemory
              PID:2756
              • C:\Users\Admin\AppData\Local\Temp\fenix atc\FenixATCInstaller.exe
                "C:\Users\Admin\AppData\Local\Temp\fenix atc\FenixATCInstaller.exe" /groupsextract:100; /out:"C:\Users\Admin\AppData\Roaming\Tulpep Services\Fenix ATC\prerequisites" /callbackid:2756
                3⤵
                  PID:4588
                • C:\Users\Admin\AppData\Roaming\Tulpep Services\Fenix ATC\prerequisites\LinkCreator.exe
                  "C:\Users\Admin\AppData\Roaming\Tulpep Services\Fenix ATC\prerequisites\LinkCreator.exe"
                  3⤵
                  • Executes dropped EXE
                  PID:3916
              • C:\Windows\syswow64\MsiExec.exe
                C:\Windows\syswow64\MsiExec.exe -Embedding 918CB0791A687C072AF098ADB1AA54DA
                2⤵
                • Loads dropped DLL
                PID:1376
            • C:\Windows\system32\vssvc.exe
              C:\Windows\system32\vssvc.exe
              1⤵
                PID:4576
              • C:\Windows\System32\rundll32.exe
                C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                1⤵
                  PID:524

                Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      e58555f.rbs
                      • Path C:\Config.Msi\e58555f.rbs
                      • Size 549KB
                      • SHA256 a523026d1c240b23a6e9f09474a4d1305c6237cd05949083556c546feb2e3948
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      banner
                      • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_1260\banner
                      • Size 3KB
                      • SHA256 ca9e2568668e53b2d5f8e276581f31d517cd8d490daba5013a743bd497de5f73
                      • MD5 SHA1 SHA512
                      Submit Download

                      dialog
                      • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_1260\dialog
                      • Size 12KB
                      • SHA256 6e1731d0bc8ceb2bb5677d4b0c5c76ca5510602e0707b19ecb6e8d6f6f51eb8f
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      EXE5288.tmp.bat
                      • Path C:\Users\Admin\AppData\Local\Temp\EXE5288.tmp.bat
                      • Size 415B
                      • SHA256 ec2627a53a98411f35c2ad2006d9dcfde7b78522e4e50d381ea738ff1c5aeac4
                      • MD5 SHA1 SHA512
                      Submit Download

                      EXE5306.tmp.bat
                      • Path C:\Users\Admin\AppData\Local\Temp\EXE5306.tmp.bat
                      • Size 415B
                      • SHA256 82a3f673899d47cc4057ac37286334ff353d13eac2a77c68bcfdab0944a18b8e
                      • MD5 SHA1 SHA512
                      Submit Download

                      MSI9319.tmp
                      • Path C:\Users\Admin\AppData\Local\Temp\MSI9319.tmp
                      • Size 209KB
                      • SHA256 40a493cb6d5a97cb5462f260ea0753ec47e07ac837d0e12d4cab33f985a5a14f
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      MSI965A.tmp
                      • Path C:\Users\Admin\AppData\Local\Temp\MSI965A.tmp
                      • Size 364KB
                      • SHA256 cb5636ea725024d13398a51a487227deca2bbdeaa7bb046064ea3cd33b4680ef
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      shi50F9.tmp
                      • Path C:\Users\Admin\AppData\Local\Temp\shi50F9.tmp
                      • Size 3.2MB
                      • SHA256 daa61c42d53be45c7709a0b0f66a51a0a47ca84eab787e0627f6da255c96ddff
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      FenixATCInstaller.msi
                      • Path C:\Users\Admin\AppData\Roaming\Tulpep Services\Fenix ATC 1.0\install\FenixATCInstaller.msi
                      • Size 1.5MB
                      • SHA256 bcd6373798ab7a398b5022d01ff3eb69338e7e4438816c8af88a61d357762b2c
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      FenixATCInstaller1.cab
                      • Path C:\Users\Admin\AppData\Roaming\Tulpep Services\Fenix ATC 1.0\install\FenixATCInstaller1.cab
                      • Size 2.0MB
                      • SHA256 95d0e7a9a24b64de615e408b80819d50272a126202e199f5849b03b45c281d8f
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      LinkCreator.exe
                      • Path C:\Users\Admin\AppData\Roaming\Tulpep Services\Fenix ATC\prerequisites\LinkCreator.exe
                      • Size 260KB
                      • SHA256 804b33e2a9d7c6a5c21c1f2b138e84fa703156671411460395953b203f4d3eda
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      R000000000008.clb
                      • Path C:\Windows\Registration\R000000000008.clb
                      • Size 46KB
                      • SHA256 2f15d7ca940e8ffd4fdbe888aa20fb34f852c6ee6bab1ab95542772ce7ff3557
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download