Overview

overview

10

Static

static

3

muestra2.exe

windows10-2004-x64

10

muestra2.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    muestra2.exe
  • Size 233KB
  • Sample250610-nnfacaxls5
  • SHA256 a9a4e89aaae8dc3638e3ca0f277ee37c0f3d14cd89f4972de591a531a6302fdd
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
fogcredential_accessdefense_evasiondiscoveryexecutionimpactpersistenceprivilege_escalationransomwarestealer

Malware Config

Extracted

Path

  • C:\Program Files\Common Files\DESIGNER\readme.txt

  • fog

Ransom Note
  • If you are reading this, then you have been the victim of a cyber attack. We call ourselves Fog and we take responsibility for this incident. You can check out our blog where we post company data: xbkv2qey6u3gd3qxcojynrt4h5sgrhkar6whuo74wo63hijnn677jnyd.onion You might appear there if you opt out of our communication. We are the ones who encrypted your data and also copied some of it to our internal resource. The sooner you contact us, the sooner we can resolve this incident and get you back to work. To contact us you need to have Tor browser installed: 1. Follow this link: xql562evsy7njcsngacphc2erzjfecwotdkobn3m4uxu2gtqh26newid.onion 2. Enter the code: 1KQOWFH2KYTLDJKX7ZTJDNMX 3. Now we can communicate safely. If you are decision-maker, you will get all the details when you get in touch. We are waiting for you.
URLs

  • http://xbkv2qey6u3gd3qxcojynrt4h5sgrhkar6whuo74wo63hijnn677jnyd.onion

  • http://xql562evsy7njcsngacphc2erzjfecwotdkobn3m4uxu2gtqh26newid.onion

Targets

    • Target
      muestra2.exe
    • Size 233KB
    • SHA256 a9a4e89aaae8dc3638e3ca0f277ee37c0f3d14cd89f4972de591a531a6302fdd
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    fogcredential_accessdefense_evasiondiscoveryexecutionimpactpersistenceprivilege_escalationransomwarestealer

    • Fog Ransomware

      Fog ransomware is used to attacks educational organizations and was first seen in the spring of 2024.

      ransomwarefog

    • Fog family

      fog

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Renames multiple (7525) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Modifies Windows Firewall

      defense_evasion

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

      credential_accessstealer

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Network Service Discovery

      Attempt to gather information on host's network.

      discovery

    • Enumerates processes with tasklist

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

Windows Management Instrumentation

1
T1047

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Direct Volume Access

1
T1006

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Indicator Removal

2
T1070

File Deletion

2
T1070.004

Credential Access

Credentials from Password Stores

1
T1555

Windows Credential Manager

1
T1555.004

Discovery

Network Service Discovery

1
T1046

Peripheral Device Discovery

1
T1120

Process Discovery

1
T1057

Query Registry

1
T1012

System Information Discovery

4
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Connections Discovery

1
T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

2
T1490

Tasks