Overview

overview

10

Static

static

3

44b7eebf7a...93.exe

windows10-2004-x64

10

44b7eebf7a...93.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    93s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    26/03/2026, 13:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    44b7eebf7a26d466f9c7ad4ddb058503f7066aded180ab6d5162197c47780293.exe
  • Size 444KB
  • Sample260326-qstpmsf15m
  • SHA256 44b7eebf7a26d466f9c7ad4ddb058503f7066aded180ab6d5162197c47780293
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
credential_accessdefense_evasiondiscoveryexecutionfogimpactpersistenceprivilege_escalationransomwarestealer

Malware Config

Extracted

Path

  • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\readme.txt

  • fog

Ransom Note
  • If you are reading this, then you have been the victim of a cyber attack. We call ourselves Fog and we take responsibility for this incident. You can check out our blog where we post company data: xbkv2qey6u3gd3qxcojynrt4h5sgrhkar6whuo74wo63hijnn677jnyd.onion You might appear there if you opt out of our communication. We are the ones who encrypted your data and also copied some of it to our internal resource. The sooner you contact us, the sooner we can resolve this incident and get you back to work. To contact us you need to have Tor browser installed: 1. Follow this link: xql562evsy7njcsngacphc2erzjfecwotdkobn3m4uxu2gtqh26newid.onion 2. Enter the code: 1KQOWFH2KYTLDJKX7ZTJDNMX 3. Now we can communicate safely. If you are decision-maker, you will get all the details when you get in touch. We are waiting for you.
URLs

  • http://xbkv2qey6u3gd3qxcojynrt4h5sgrhkar6whuo74wo63hijnn677jnyd.onion

  • http://xql562evsy7njcsngacphc2erzjfecwotdkobn3m4uxu2gtqh26newid.onion

Signatures

  • Fog Ransomware

    Fog ransomware is used to attacks educational organizations and was first seen in the spring of 2024.

    ransomwarefog
  • Fog family
    fog
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (7654) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Modifies Windows Firewall 2 TTPs 2 IoCs
    defense_evasion
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Service Discovery 1 TTPs 2 IoCs

    Attempt to gather information on host's network.

    discovery
  • Enumerates processes with tasklist 1 TTPs 1 IoCs
    discovery
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 33 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Connections Discovery 1 TTPs 2 IoCs

    Attempt to get a listing of network connections.

    discovery
  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry class 1 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\44b7eebf7a26d466f9c7ad4ddb058503f7066aded180ab6d5162197c47780293.exe
    "C:\Users\Admin\AppData\Local\Temp\44b7eebf7a26d466f9c7ad4ddb058503f7066aded180ab6d5162197c47780293.exe"
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1988
    • C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RANSOMNOTE.txt
      2⤵
      • System Location Discovery: System Language Discovery
      • Opens file in notepad (likely ransom note)
      PID:2500
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net config Workstation
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2340
      • C:\Windows\SysWOW64\net.exe
        net config Workstation
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1084
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 config Workstation
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3752
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c systeminfo
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4632
      • C:\Windows\SysWOW64\systeminfo.exe
        systeminfo
        3⤵
        • System Location Discovery: System Language Discovery
        • Gathers system information
        PID:3384
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c hostname
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2108
      • C:\Windows\SysWOW64\HOSTNAME.EXE
        hostname
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3028
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net users
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1704
      • C:\Windows\SysWOW64\net.exe
        net users
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1160
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 users
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1728
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c ipconfig /all
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:564
      • C:\Windows\SysWOW64\ipconfig.exe
        ipconfig /all
        3⤵
        • System Location Discovery: System Language Discovery
        • Gathers network information
        PID:1716
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c route print
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5096
      • C:\Windows\SysWOW64\ROUTE.EXE
        route print
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4620
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c arp -A
      2⤵
      • Network Service Discovery
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4740
      • C:\Windows\SysWOW64\ARP.EXE
        arp -A
        3⤵
        • Network Service Discovery
        • System Location Discovery: System Language Discovery
        PID:2684
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c netstat -ano
      2⤵
      • System Location Discovery: System Language Discovery
      • System Network Connections Discovery
      • Suspicious use of WriteProcessMemory
      PID:5020
      • C:\Windows\SysWOW64\NETSTAT.EXE
        netstat -ano
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Connections Discovery
        • Gathers network information
        • Suspicious use of AdjustPrivilegeToken
        PID:2760
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c netsh firewall show state
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2344
      • C:\Windows\SysWOW64\netsh.exe
        netsh firewall show state
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:3260
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c netsh firewall show config
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4696
      • C:\Windows\SysWOW64\netsh.exe
        netsh firewall show config
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:4208
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c schtasks /query /fo LIST /v
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3964
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /query /fo LIST /v
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1220
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c tasklist /SVC
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1372
      • C:\Windows\SysWOW64\tasklist.exe
        tasklist /SVC
        3⤵
        • Enumerates processes with tasklist
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:4244
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net start
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4608
      • C:\Windows\SysWOW64\net.exe
        net start
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1964
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 start
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1020
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c DRIVERQUERY
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:792
      • C:\Windows\SysWOW64\driverquery.exe
        DRIVERQUERY
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3988
    • C:\Windows\system32\vssadmin.exe
      C:\Windows\Sysnative\vssadmin.exe delete shadows /all /quiet
      2⤵
      • Interacts with shadow copies
      PID:3504
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:7100

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Command and Scripting Interpreter

        1
        T1059

        Windows Management Instrumentation

        1
        T1047

        Persistence

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Event Triggered Execution

        1
        T1546

        Netsh Helper DLL

        1
        T1546.007

        Privilege Escalation

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Event Triggered Execution

        1
        T1546

        Netsh Helper DLL

        1
        T1546.007

        Defense Evasion

        Direct Volume Access

        1
        T1006

        Impair Defenses

        1
        T1562

        Disable or Modify System Firewall

        1
        T1562.004

        Indicator Removal

        2
        T1070

        File Deletion

        2
        T1070.004

        Credential Access

        Credentials from Password Stores

        1
        T1555

        Windows Credential Manager

        1
        T1555.004

        Discovery

        Network Service Discovery

        1
        T1046

        Peripheral Device Discovery

        1
        T1120

        Process Discovery

        1
        T1057

        Query Registry

        1
        T1012

        System Information Discovery

        4
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        System Network Connections Discovery

        1
        T1049

        Lateral Movement

        Collection

        Command and Control

        Exfiltration

        Impact

        Inhibit System Recovery

        2
        T1490

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        readme.txt
        • Path C:\Program Files\Common Files\microsoft shared\ink\ar-SA\readme.txt
        • Size 837B
        • SHA256 4478fff2df7db69e1afef769db2796b2cc9aabf83b6e9d4929858487a2fdf532
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        DbgLog.sys
        • Path C:\Users\Admin\AppData\Local\Temp\DbgLog.sys
        • Size 319B
        • SHA256 22fcb69e55751d8b0b2b83fc0d8cd1ba70b3e2f79240fbd223b44fd8b16c3dd0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        DbgLog.sys
        • Path C:\Users\Admin\AppData\Local\Temp\DbgLog.sys
        • Size 7KB
        • SHA256 2cc1c367ffc460adafa728ec4559116b37b3c289fb6205c87f4301b377910c4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RANSOMNOTE.txt
        • Path C:\Users\Admin\Desktop\RANSOMNOTE.txt
        • Size 470B
        • SHA256 75edcdf92240cbd9dccdc69e83230b17f2402eb21157a24e7f6e1e97be1d7fe6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/1988-3-0x0000000005140000-0x000000000515B000-memory.dmp
        Download

        memory/1988-4-0x0000000010000000-0x000000001001E000-memory.dmp
        Download

        memory/1988-16-0x0000000010000000-0x000000001001E000-memory.dmp
        Download

        memory/1988-35-0x0000000001380000-0x0000000001982000-memory.dmp
        Download

        memory/1988-45465-0x0000000001380000-0x0000000001982000-memory.dmp
        Download

        memory/2500-78-0x0000000000980000-0x0000000000B2C000-memory.dmp
        Download