efe036fd49132595fa7de725775ebf1e8eae046052d8b2c368588b898c6a94d2

Analysis

max time kernel
14s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/09/2024, 02:20

Sharing

Copy URL Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

Fecurity.exe
Size

32.8MB
MD5

a067f1efe56b765be66a9e58adff827c
SHA1

60315081692114b04c3acb3d5e1bc61fa6a1bd58
SHA256

efe036fd49132595fa7de725775ebf1e8eae046052d8b2c368588b898c6a94d2
SHA512

c85eb8e04426f4fc1a37879de579b659552a7c86af33fafb099e092fc353fb4dac9ae9305111f270f011ab4b0443865378d5945c3b683ed85e1373a6d7b16567
SSDEEP

786432:XYfuS/7XuhD+dV7YzuFMKF2u+q60jiCAI:ofLjXuR+d8n0eC

Score

9^/10

evasion ransomware

Malware Config

Signatures

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
3044	bcdedit.exe
776	bcdedit.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2724	Fecurity.exe
2724	Fecurity.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2724	Fecurity.exe

C:\Users\Admin\AppData\Local\Temp\Fecurity.exe
"C:\Users\Admin\AppData\Local\Temp\Fecurity.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2724
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C bcdedit /set hypervisorlaunchtype auto
  2⤵
  PID:2736
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set hypervisorlaunchtype auto
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3044
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Enabled" /t REG_DWORD /d 0 /f
  2⤵
  PID:2572
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Locked" /t REG_DWORD /d 0 /f
  2⤵
  PID:2624
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C bcdedit /default {current}
  2⤵
  PID:2144
- - C:\Windows\system32\bcdedit.exe
    bcdedit /default {current}
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact