ee3745dd28fd195213141696a2e7dc17969dc30f38184435ebc3056f5a9e7f87

Analysis

max time kernel
104s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2025, 15:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Flarenew.exe
Size

91KB
MD5

dcf416f9becda3e83d80b808906c68d3
SHA1

29f9377f467bd5b6223316f6ea84e4c334515df6
SHA256

ee3745dd28fd195213141696a2e7dc17969dc30f38184435ebc3056f5a9e7f87
SHA512

afc632c1de34db1b801adf908241dd79e0e2abb8dfaa192f459f91e6d8786a6b055715031526348d30a2f0a5ee86fdf6d07fee861e06329304ced171a591f380
SSDEEP

1536:j7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIfKw7YfV/OV:/7DhdC6kzWypvaQ0FxyNTBfKO

Score

8^/10

defense_evasion discovery exploit persistence

Malware Config

Signatures

Possible privilege escalation attempt 16 IoCs

exploit

pid	Process
4360	icacls.exe
208	takeown.exe
3692	takeown.exe
2192	icacls.exe
4580	icacls.exe
4772	icacls.exe
4124	icacls.exe
3560	icacls.exe
3612	icacls.exe
4584	icacls.exe
5224	icacls.exe
2884	icacls.exe
3516	icacls.exe
4700	icacls.exe
3992	icacls.exe
5108	icacls.exe

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1964	attrib.exe
4920	attrib.exe

Modifies file permissions 1 TTPs 16 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5224	icacls.exe
208	takeown.exe
4124	icacls.exe
4700	icacls.exe
2192	icacls.exe
4360	icacls.exe
3992	icacls.exe
2884	icacls.exe
4584	icacls.exe
4580	icacls.exe
3560	icacls.exe
4772	icacls.exe
3692	takeown.exe
3516	icacls.exe
3612	icacls.exe
5108	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-83325578-304917428-1200496059-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Security Update = "C:\\Windows\\System32\\flare.bat"	reg.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\flare_helper.bat	cmd.exe
File created	C:\Windows\System32\flare.bat	cmd.exe
File opened for modification	C:\Windows\System32\flare.bat	cmd.exe
File opened for modification	C:\Windows\System32\flare.bat	attrib.exe
File created	C:\Windows\System32\flare_helper.bat	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flarenew.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4560	taskkill.exe

Opens file in notepad (likely ransom note) 3 IoCs

ransomware

pid	Process
4828	notepad.exe
2072	notepad.exe
5704	NOTEPAD.EXE

Runs net.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4560	taskkill.exe
Token: SeTakeOwnershipPrivilege	208	takeown.exe
Token: SeTakeOwnershipPrivilege	3692	takeown.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 4668 wrote to memory of 6012	4668	Flarenew.exe	88
PID 4668 wrote to memory of 6012	4668	Flarenew.exe	88
PID 6012 wrote to memory of 5456	6012	cmd.exe	89
PID 6012 wrote to memory of 5456	6012	cmd.exe	89
PID 6012 wrote to memory of 1576	6012	cmd.exe	90
PID 6012 wrote to memory of 1576	6012	cmd.exe	90
PID 1576 wrote to memory of 1636	1576	net.exe	91
PID 1576 wrote to memory of 1636	1576	net.exe	91
PID 6012 wrote to memory of 4560	6012	cmd.exe	92
PID 6012 wrote to memory of 4560	6012	cmd.exe	92
PID 6012 wrote to memory of 208	6012	cmd.exe	94
PID 6012 wrote to memory of 208	6012	cmd.exe	94
PID 6012 wrote to memory of 3692	6012	cmd.exe	95
PID 6012 wrote to memory of 3692	6012	cmd.exe	95
PID 6012 wrote to memory of 3516	6012	cmd.exe	96
PID 6012 wrote to memory of 3516	6012	cmd.exe	96
PID 6012 wrote to memory of 4124	6012	cmd.exe	97
PID 6012 wrote to memory of 4124	6012	cmd.exe	97
PID 6012 wrote to memory of 1964	6012	cmd.exe	98
PID 6012 wrote to memory of 1964	6012	cmd.exe	98
PID 6012 wrote to memory of 3612	6012	cmd.exe	99
PID 6012 wrote to memory of 3612	6012	cmd.exe	99
PID 6012 wrote to memory of 4584	6012	cmd.exe	100
PID 6012 wrote to memory of 4584	6012	cmd.exe	100
PID 6012 wrote to memory of 4700	6012	cmd.exe	101
PID 6012 wrote to memory of 4700	6012	cmd.exe	101
PID 6012 wrote to memory of 5644	6012	cmd.exe	102
PID 6012 wrote to memory of 5644	6012	cmd.exe	102
PID 6012 wrote to memory of 2864	6012	cmd.exe	103
PID 6012 wrote to memory of 2864	6012	cmd.exe	103
PID 6012 wrote to memory of 4828	6012	cmd.exe	104
PID 6012 wrote to memory of 4828	6012	cmd.exe	104
PID 6012 wrote to memory of 3992	6012	cmd.exe	105
PID 6012 wrote to memory of 3992	6012	cmd.exe	105
PID 6012 wrote to memory of 5108	6012	cmd.exe	106
PID 6012 wrote to memory of 5108	6012	cmd.exe	106
PID 6012 wrote to memory of 2192	6012	cmd.exe	107
PID 6012 wrote to memory of 2192	6012	cmd.exe	107
PID 6012 wrote to memory of 4580	6012	cmd.exe	108
PID 6012 wrote to memory of 4580	6012	cmd.exe	108
PID 6012 wrote to memory of 3560	6012	cmd.exe	109
PID 6012 wrote to memory of 3560	6012	cmd.exe	109
PID 6012 wrote to memory of 4360	6012	cmd.exe	110
PID 6012 wrote to memory of 4360	6012	cmd.exe	110
PID 6012 wrote to memory of 5224	6012	cmd.exe	111
PID 6012 wrote to memory of 5224	6012	cmd.exe	111
PID 6012 wrote to memory of 4772	6012	cmd.exe	112
PID 6012 wrote to memory of 4772	6012	cmd.exe	112
PID 6012 wrote to memory of 2884	6012	cmd.exe	114
PID 6012 wrote to memory of 2884	6012	cmd.exe	114
PID 6012 wrote to memory of 4920	6012	cmd.exe	115
PID 6012 wrote to memory of 4920	6012	cmd.exe	115
PID 6012 wrote to memory of 2072	6012	cmd.exe	116
PID 6012 wrote to memory of 2072	6012	cmd.exe	116

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1964	attrib.exe
4920	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Flarenew.exe
"C:\Users\Admin\AppData\Local\Temp\Flarenew.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4668
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\6745.tmp\6746.tmp\6747.bat C:\Users\Admin\AppData\Local\Temp\Flarenew.exe"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:6012
- - C:\Windows\system32\msg.exe
    msg * "Fatal Error: Something unusual has occured. Maybe try restarting your PC?"
    3⤵
    PID:5456
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1576
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:1636
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4560
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Windows\System32\taskmgr.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:208
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Windows\SysWOW64\taskmgr.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:3692
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\System32\taskmgr.exe /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3516
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\SysWOW64\taskmgr.exe /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4124
- - C:\Windows\system32\attrib.exe
    attrib +s +h +r "C:\Windows\System32\flare.bat"
    3⤵
    - Sets file to hidden
    - Drops file in System32 directory
    - Views/modifies file attributes
    PID:1964
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\flare.bat" /deny Everyone:(F)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3612
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\flare.bat" /deny SYSTEM:(F)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4584
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\flare.bat" /deny Administrators:(F)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4700
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Security Update" /t REG_SZ /d "C:\Windows\System32\flare.bat" /f
    3⤵
    - Adds Run key to start application
    PID:5644
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:2864
- - C:\Windows\system32\notepad.exe
    notepad "C:\Users\Admin\Desktop\flare_warning.txt"
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:4828
- - C:\Windows\system32\icacls.exe
    icacls "C:\Users\Admin\Desktop\CON" /deny Everyone:(F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3992
- - C:\Windows\system32\icacls.exe
    icacls "C:\Users\Admin\Desktop\PRN" /deny Everyone:(F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5108
- - C:\Windows\system32\icacls.exe
    icacls "C:\Users\Admin\Desktop\AUX" /deny Everyone:(F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2192
- - C:\Windows\system32\icacls.exe
    icacls "C:\Users\Admin\Desktop\NUL" /deny Everyone:(F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4580
- - C:\Windows\system32\icacls.exe
    icacls "C:\Users\Admin\Desktop\COM1" /deny Everyone:(F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3560
- - C:\Windows\system32\icacls.exe
    icacls "C:\Users\Admin\Desktop\COM2" /deny Everyone:(F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4360
- - C:\Windows\system32\icacls.exe
    icacls "C:\Users\Admin\Desktop\COM3" /deny Everyone:(F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5224
- - C:\Windows\system32\icacls.exe
    icacls "C:\Users\Admin\Desktop\LPT1" /deny Everyone:(F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4772
- - C:\Windows\system32\icacls.exe
    icacls "C:\Users\Admin\Desktop\LPT2" /deny Everyone:(F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2884
- - C:\Windows\system32\attrib.exe
    attrib +s +h "C:\Users\Admin\Desktop\LPT2"
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:4920
- - C:\Windows\system32\notepad.exe
    notepad "C:\Users\Admin\Desktop\LPT2\Fixes.txt"
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:2072

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\NewBlock.cmd" "
1⤵
PID:2116

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\NewBlock.cmd" "
1⤵
PID:3932

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\NewBlock.cmd
1⤵
- Opens file in notepad (likely ransom note)
PID:5704

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\6745.tmp\6746.tmp\6747.bat

Filesize
2KB

MD5
609ced098dfea6705927a7d4a2bbb428

SHA1
8d51ca8d8803416876fc7b982b7cf016a767cf43

SHA256
1e6d201ba24db437a12d988b90781863c07c7b60da89208841c189ed2350a560

SHA512
53bccd0663b065ef63370f6e75fe9f6f7ce13812862b4b2850d0ea03d8007c117f55fc51f3eb3205ace0d9a3c4ed1df34aad0bd743ccc7d0a4ac67faf10ee9bb

Download Submit
C:\Users\Admin\Desktop\LPT2\Fixes.txt

Filesize
36B

MD5
9ea9c312f34cfeda8394b84c0dfd1fc9

SHA1
d587d14e675fa07820e4a3c513285b42831c90bf

SHA256
4bfc6d2ad894c24dcedc920096679c80c1dd4340528ba9a071cff8b9bf8ab9e7

SHA512
0ed43563d7e3492773d30abdad9199b5cb9fd49ffb32c0c0a9cc1471545991131644b81c61f70f0f062ee9ab5314005b7677982c8074696aa832b226cd32ca8d

Download Submit
C:\Users\Admin\Desktop\flare_warning.txt

Filesize
85B

MD5
06f0a7e183c60d2d25359f8805ac79c8

SHA1
88dcb58b0342aaa5d26fbcc4f331980280d8788e

SHA256
c4ee6d94b5725af6c1ed91eb62fc34db9be62aca661976a5c24bdbb3db24e1d6

SHA512
ee60f735fcee65e0c76a9240b660bb850f285900d5229dcf102d244e14248b24f5f102523efee659f4de6ac339fa1f554e36a712bd3209a4f3ab1897a63314b3

Download Submit
C:\Windows\System32\flare.bat

Filesize
91KB

MD5
dcf416f9becda3e83d80b808906c68d3

SHA1
29f9377f467bd5b6223316f6ea84e4c334515df6

SHA256
ee3745dd28fd195213141696a2e7dc17969dc30f38184435ebc3056f5a9e7f87

SHA512
afc632c1de34db1b801adf908241dd79e0e2abb8dfaa192f459f91e6d8786a6b055715031526348d30a2f0a5ee86fdf6d07fee861e06329304ced171a591f380

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads