Analysis
-
max time kernel
146s -
max time network
138s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
04-05-2021 13:06
Static task
static1
Behavioral task
behavioral1
Sample
TT.exe
Resource
win7v20210410
General
-
Target
TT.exe
-
Size
228KB
-
MD5
27c863c479b0542b3bad21a67ad1406d
-
SHA1
791e1d123c275ac4451c5550635c0a67eb4398a6
-
SHA256
2a7a9c6d4505766ddf0a6c7dde9c2ae52369408fbe5ce93d0d3d76bf992b28dd
-
SHA512
9b66354f49ade9d600e741cb2e626796830260745b1cd7540d611dc19e8576cacad95a9e03614ba36149df440cbe1efb7de5e73b4fce3a4ab7d60c42451b04da
Malware Config
Extracted
formbook
4.1
http://www.knighttechinca.com/dxe/
sardarfarm.com
959tremont.com
privat-livecam.net
ansel-homebakery.com
joysupermarket.com
peninsulamatchmakers.net
northsytyle.com
radioconexaoubermusic.com
relocatingrealtor.com
desyrnan.com
onlinehoortoestel.online
enpointe.online
rvvikings.com
paulpoirier.com
shitarpa.net
kerneis.net
rokitreach.com
essentiallygaia.com
prestiged.net
fuerzaagavera.com
soukid.com
moderndatingcoach.com
mentalfreedom.guru
bullishsoftware.com
sectorulb.com
outletyana.com
fptplaybox.website
artinmemory.com
buyruon.com
ljd.xyz
mondaysmatters.com
spiritsoundart.net
ixiangzu.com
lacompagniadelfardello.com
bnctly.com
sarasvati-yoga.com
0055game.com
lagrangewildliferemoval.com
umlausa.com
chaytel.com
kkkc5.com
union-green.com
philreid4cc.com
theanimehat.com
redlightlegal.com
myaustraliarewards.com
barkinlot.com
mujahidservice.online
nugeneraonline.com
sopplugin.com
makemyroom.design
ferienschweden.com
fps2020dkasphotoop.com
stylezbykay.com
royalpropertiesgurugram.com
birzulova.com
cosmicmtn.com
kissanime.press
poweringprogress.today
omsamedic.com
drunkpoetsociety.com
hostbison.com
asapdecor.com
houseofsisson.com
Signatures
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1740-63-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1648-71-0x00000000000D0000-0x00000000000FE000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 752 cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
TT.exepid process 1048 TT.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
TT.exeTT.execmstp.exedescription pid process target process PID 1048 set thread context of 1740 1048 TT.exe TT.exe PID 1740 set thread context of 1208 1740 TT.exe Explorer.EXE PID 1648 set thread context of 1208 1648 cmstp.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
TT.execmstp.exepid process 1740 TT.exe 1740 TT.exe 1648 cmstp.exe 1648 cmstp.exe 1648 cmstp.exe 1648 cmstp.exe 1648 cmstp.exe 1648 cmstp.exe 1648 cmstp.exe 1648 cmstp.exe 1648 cmstp.exe 1648 cmstp.exe 1648 cmstp.exe 1648 cmstp.exe 1648 cmstp.exe 1648 cmstp.exe 1648 cmstp.exe 1648 cmstp.exe 1648 cmstp.exe 1648 cmstp.exe 1648 cmstp.exe 1648 cmstp.exe 1648 cmstp.exe 1648 cmstp.exe 1648 cmstp.exe 1648 cmstp.exe 1648 cmstp.exe 1648 cmstp.exe 1648 cmstp.exe 1648 cmstp.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1208 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
TT.exeTT.execmstp.exepid process 1048 TT.exe 1740 TT.exe 1740 TT.exe 1740 TT.exe 1648 cmstp.exe 1648 cmstp.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
TT.execmstp.exedescription pid process Token: SeDebugPrivilege 1740 TT.exe Token: SeDebugPrivilege 1648 cmstp.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
TT.exeExplorer.EXEcmstp.exedescription pid process target process PID 1048 wrote to memory of 1740 1048 TT.exe TT.exe PID 1048 wrote to memory of 1740 1048 TT.exe TT.exe PID 1048 wrote to memory of 1740 1048 TT.exe TT.exe PID 1048 wrote to memory of 1740 1048 TT.exe TT.exe PID 1048 wrote to memory of 1740 1048 TT.exe TT.exe PID 1208 wrote to memory of 1648 1208 Explorer.EXE cmstp.exe PID 1208 wrote to memory of 1648 1208 Explorer.EXE cmstp.exe PID 1208 wrote to memory of 1648 1208 Explorer.EXE cmstp.exe PID 1208 wrote to memory of 1648 1208 Explorer.EXE cmstp.exe PID 1208 wrote to memory of 1648 1208 Explorer.EXE cmstp.exe PID 1208 wrote to memory of 1648 1208 Explorer.EXE cmstp.exe PID 1208 wrote to memory of 1648 1208 Explorer.EXE cmstp.exe PID 1648 wrote to memory of 752 1648 cmstp.exe cmd.exe PID 1648 wrote to memory of 752 1648 cmstp.exe cmd.exe PID 1648 wrote to memory of 752 1648 cmstp.exe cmd.exe PID 1648 wrote to memory of 752 1648 cmstp.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TT.exe"C:\Users\Admin\AppData\Local\Temp\TT.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TT.exe"C:\Users\Admin\AppData\Local\Temp\TT.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\TT.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsx1151.tmp\myx92o78208f0o.dllMD5
8bb43d922f43f1eff660149ae2561939
SHA1aa781d53bf123d1dead8c960eebb1079412b36f1
SHA256e61d2234de5a9841b5685b5ff23a2baa6d56f564cdafba16709327adb642c2d1
SHA51276dbf56e555404296b185de8b512dd287cb791b0bbdd2882dd2a86dbeed28551ee57e7b699fc0b5133171a4b47155cce6afb7c02c908578e130856092955e96b
-
memory/752-69-0x0000000000000000-mapping.dmp
-
memory/1048-62-0x0000000000430000-0x0000000000432000-memory.dmpFilesize
8KB
-
memory/1048-59-0x0000000075721000-0x0000000075723000-memory.dmpFilesize
8KB
-
memory/1208-74-0x0000000006FC0000-0x000000000714E000-memory.dmpFilesize
1.6MB
-
memory/1208-66-0x0000000004D20000-0x0000000004E1D000-memory.dmpFilesize
1012KB
-
memory/1648-71-0x00000000000D0000-0x00000000000FE000-memory.dmpFilesize
184KB
-
memory/1648-73-0x0000000000880000-0x0000000000913000-memory.dmpFilesize
588KB
-
memory/1648-72-0x0000000000B50000-0x0000000000E53000-memory.dmpFilesize
3.0MB
-
memory/1648-67-0x0000000000000000-mapping.dmp
-
memory/1648-70-0x0000000000F80000-0x0000000000F98000-memory.dmpFilesize
96KB
-
memory/1740-61-0x000000000041EAF0-mapping.dmp
-
memory/1740-64-0x0000000000970000-0x0000000000C73000-memory.dmpFilesize
3.0MB
-
memory/1740-65-0x00000000003E0000-0x00000000003F4000-memory.dmpFilesize
80KB
-
memory/1740-63-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB