Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05-04-2024 02:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fb2158b6181d7ff6f7857d369118d5e28a79ece69f6fc35cf8b6510217f734f3.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
fb2158b6181d7ff6f7857d369118d5e28a79ece69f6fc35cf8b6510217f734f3.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
fb2158b6181d7ff6f7857d369118d5e28a79ece69f6fc35cf8b6510217f734f3.exe
-
Size
208KB
-
MD5
0a830b8c7c2dd711037c3e46cdc32446
-
SHA1
ea404a0d31c489291387ed982911a94a47523134
-
SHA256
fb2158b6181d7ff6f7857d369118d5e28a79ece69f6fc35cf8b6510217f734f3
-
SHA512
5f5a44078c85207075f874c590525c977525720795d5375d589ca6fad11b8c424b499e49379c26832faa8bfd3705d4f09886f2ce2882500078259e50557f9c93
-
SSDEEP
6144:tRGynenu5W98TFK/fObT/bGiA14DFsqmVrWpMY9FAN:t8iB5W98TFK/fObT/bGidIrW39FAN
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" fb2158b6181d7ff6f7857d369118d5e28a79ece69f6fc35cf8b6510217f734f3.exe Set value (int) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" fwlaay.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation fb2158b6181d7ff6f7857d369118d5e28a79ece69f6fc35cf8b6510217f734f3.exe -
Executes dropped EXE 1 IoCs
pid Process 4780 fwlaay.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fwlaay = "C:\\Users\\Admin\\fwlaay.exe /y" fwlaay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fwlaay = "C:\\Users\\Admin\\fwlaay.exe /D" fwlaay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fwlaay = "C:\\Users\\Admin\\fwlaay.exe /g" fwlaay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fwlaay = "C:\\Users\\Admin\\fwlaay.exe /R" fwlaay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fwlaay = "C:\\Users\\Admin\\fwlaay.exe /F" fwlaay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fwlaay = "C:\\Users\\Admin\\fwlaay.exe /U" fwlaay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fwlaay = "C:\\Users\\Admin\\fwlaay.exe /t" fwlaay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fwlaay = "C:\\Users\\Admin\\fwlaay.exe /Z" fwlaay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fwlaay = "C:\\Users\\Admin\\fwlaay.exe /q" fwlaay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fwlaay = "C:\\Users\\Admin\\fwlaay.exe /m" fwlaay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fwlaay = "C:\\Users\\Admin\\fwlaay.exe /f" fwlaay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fwlaay = "C:\\Users\\Admin\\fwlaay.exe /X" fwlaay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fwlaay = "C:\\Users\\Admin\\fwlaay.exe /c" fwlaay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fwlaay = "C:\\Users\\Admin\\fwlaay.exe /b" fwlaay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fwlaay = "C:\\Users\\Admin\\fwlaay.exe /Q" fwlaay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fwlaay = "C:\\Users\\Admin\\fwlaay.exe /W" fwlaay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fwlaay = "C:\\Users\\Admin\\fwlaay.exe /w" fwlaay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fwlaay = "C:\\Users\\Admin\\fwlaay.exe /u" fwlaay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fwlaay = "C:\\Users\\Admin\\fwlaay.exe /T" fwlaay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fwlaay = "C:\\Users\\Admin\\fwlaay.exe /K" fwlaay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fwlaay = "C:\\Users\\Admin\\fwlaay.exe /k" fwlaay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fwlaay = "C:\\Users\\Admin\\fwlaay.exe /L" fwlaay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fwlaay = "C:\\Users\\Admin\\fwlaay.exe /o" fwlaay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fwlaay = "C:\\Users\\Admin\\fwlaay.exe /I" fwlaay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fwlaay = "C:\\Users\\Admin\\fwlaay.exe /z" fwlaay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fwlaay = "C:\\Users\\Admin\\fwlaay.exe /i" fwlaay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fwlaay = "C:\\Users\\Admin\\fwlaay.exe /p" fwlaay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fwlaay = "C:\\Users\\Admin\\fwlaay.exe /r" fwlaay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fwlaay = "C:\\Users\\Admin\\fwlaay.exe /E" fwlaay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fwlaay = "C:\\Users\\Admin\\fwlaay.exe /e" fwlaay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fwlaay = "C:\\Users\\Admin\\fwlaay.exe /Y" fwlaay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fwlaay = "C:\\Users\\Admin\\fwlaay.exe /n" fwlaay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fwlaay = "C:\\Users\\Admin\\fwlaay.exe /s" fwlaay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fwlaay = "C:\\Users\\Admin\\fwlaay.exe /S" fwlaay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fwlaay = "C:\\Users\\Admin\\fwlaay.exe /A" fwlaay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fwlaay = "C:\\Users\\Admin\\fwlaay.exe /V" fwlaay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fwlaay = "C:\\Users\\Admin\\fwlaay.exe /B" fwlaay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fwlaay = "C:\\Users\\Admin\\fwlaay.exe /O" fwlaay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fwlaay = "C:\\Users\\Admin\\fwlaay.exe /G" fwlaay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fwlaay = "C:\\Users\\Admin\\fwlaay.exe /P" fwlaay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fwlaay = "C:\\Users\\Admin\\fwlaay.exe /N" fb2158b6181d7ff6f7857d369118d5e28a79ece69f6fc35cf8b6510217f734f3.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fwlaay = "C:\\Users\\Admin\\fwlaay.exe /x" fwlaay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fwlaay = "C:\\Users\\Admin\\fwlaay.exe /N" fwlaay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fwlaay = "C:\\Users\\Admin\\fwlaay.exe /l" fwlaay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fwlaay = "C:\\Users\\Admin\\fwlaay.exe /h" fwlaay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fwlaay = "C:\\Users\\Admin\\fwlaay.exe /a" fwlaay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fwlaay = "C:\\Users\\Admin\\fwlaay.exe /J" fwlaay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fwlaay = "C:\\Users\\Admin\\fwlaay.exe /v" fwlaay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fwlaay = "C:\\Users\\Admin\\fwlaay.exe /j" fwlaay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fwlaay = "C:\\Users\\Admin\\fwlaay.exe /d" fwlaay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fwlaay = "C:\\Users\\Admin\\fwlaay.exe /M" fwlaay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fwlaay = "C:\\Users\\Admin\\fwlaay.exe /C" fwlaay.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3816 fb2158b6181d7ff6f7857d369118d5e28a79ece69f6fc35cf8b6510217f734f3.exe 3816 fb2158b6181d7ff6f7857d369118d5e28a79ece69f6fc35cf8b6510217f734f3.exe 4780 fwlaay.exe 4780 fwlaay.exe 4780 fwlaay.exe 4780 fwlaay.exe 4780 fwlaay.exe 4780 fwlaay.exe 4780 fwlaay.exe 4780 fwlaay.exe 4780 fwlaay.exe 4780 fwlaay.exe 4780 fwlaay.exe 4780 fwlaay.exe 4780 fwlaay.exe 4780 fwlaay.exe 4780 fwlaay.exe 4780 fwlaay.exe 4780 fwlaay.exe 4780 fwlaay.exe 4780 fwlaay.exe 4780 fwlaay.exe 4780 fwlaay.exe 4780 fwlaay.exe 4780 fwlaay.exe 4780 fwlaay.exe 4780 fwlaay.exe 4780 fwlaay.exe 4780 fwlaay.exe 4780 fwlaay.exe 4780 fwlaay.exe 4780 fwlaay.exe 4780 fwlaay.exe 4780 fwlaay.exe 4780 fwlaay.exe 4780 fwlaay.exe 4780 fwlaay.exe 4780 fwlaay.exe 4780 fwlaay.exe 4780 fwlaay.exe 4780 fwlaay.exe 4780 fwlaay.exe 4780 fwlaay.exe 4780 fwlaay.exe 4780 fwlaay.exe 4780 fwlaay.exe 4780 fwlaay.exe 4780 fwlaay.exe 4780 fwlaay.exe 4780 fwlaay.exe 4780 fwlaay.exe 4780 fwlaay.exe 4780 fwlaay.exe 4780 fwlaay.exe 4780 fwlaay.exe 4780 fwlaay.exe 4780 fwlaay.exe 4780 fwlaay.exe 4780 fwlaay.exe 4780 fwlaay.exe 4780 fwlaay.exe 4780 fwlaay.exe 4780 fwlaay.exe 4780 fwlaay.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3816 fb2158b6181d7ff6f7857d369118d5e28a79ece69f6fc35cf8b6510217f734f3.exe 4780 fwlaay.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3816 wrote to memory of 4780 3816 fb2158b6181d7ff6f7857d369118d5e28a79ece69f6fc35cf8b6510217f734f3.exe 91 PID 3816 wrote to memory of 4780 3816 fb2158b6181d7ff6f7857d369118d5e28a79ece69f6fc35cf8b6510217f734f3.exe 91 PID 3816 wrote to memory of 4780 3816 fb2158b6181d7ff6f7857d369118d5e28a79ece69f6fc35cf8b6510217f734f3.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb2158b6181d7ff6f7857d369118d5e28a79ece69f6fc35cf8b6510217f734f3.exe"C:\Users\Admin\AppData\Local\Temp\fb2158b6181d7ff6f7857d369118d5e28a79ece69f6fc35cf8b6510217f734f3.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Users\Admin\fwlaay.exe"C:\Users\Admin\fwlaay.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4780
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
208KB
MD50b766f407e703152d6a497f040833fc4
SHA1cd17f74d7c8e818085acfad1c9e88afbe428f9e1
SHA256666bf4c3832047712a65daf09c2d248ad4fd6360912e785ad1ffa3ce4d6f7d74
SHA512b151817d9af944ecf8be024fb8a9b64b749b343303e8c8137e28baa93b3c9852581b96acba9e2d078b46e79fe2cd09afa57699bb3e75e6cde7510dbe2e8a8a64