Analysis
-
max time kernel
35s -
max time network
45s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
15-10-2021 08:16
Static task
static1
Behavioral task
behavioral1
Sample
f1d94fcc611053cd5162e70dc36fddfa.exe
Resource
win7-en-20210920
General
-
Target
f1d94fcc611053cd5162e70dc36fddfa.exe
-
Size
684KB
-
MD5
f1d94fcc611053cd5162e70dc36fddfa
-
SHA1
52ecf628c9fe25f2eedca8da56aa0785958e2638
-
SHA256
4ce42b0b74090b13a3a1692caeabfd4df748e8fa0220ba1342765fe56b399348
-
SHA512
f422f6332bb00eabec395ce4154c940632feafba67a2206cbfa5700114dee0bc38b394febe09aecdf4cae6f9bdfd232491c1f8a179813c52c763ce3b7bbd87f7
Malware Config
Extracted
formbook
4.1
hs3h
http://www.alefisrael.com/hs3h/
slairt.com
teresasellsflorida.com
resouthcarolina.com
npccfbf.com
hutshed.com
westatesmarking.com
rustmonkeys.com
kagawa-rentacar.com
easyvoip-system.com
admorinsulation.com
ericaleighjensen.com
zhonghaojiaju.net
apple-iphone.xyz
b0t.info
torgetmc.xyz
lawrencemargarse.com
6123655.com
macdonalds-delivery.com
cvpfl.com
ayudaparaturent.com
toptenanimals.com
zambiadawn.com
muzoe.com
xtrembabes.com
nomadicfoodpods.com
sibernewskaltara.com
thelyfetour.com
sailinn.xyz
cisiworld.com
right-effort.com
emmanuelleramaroson.com
aptgdaycare.com
yanceyhomes.com
minooshargh.com
littlemontars.com
liuhemustam.com
tajaraenterprises.com
myteepathfinder.com
nectarselector.com
digitalbusinesscard.website
kirakira-woman.xyz
tntexpressdelivery.com
collectcuriously.com
marielagarciarealty.com
javierramonmartinezalarcon.com
eis-investment.com
bookanyclick.com
primespotshop.com
heatdistrict.xyz
beadedjoy.com
oyster-gal.com
umateam.com
reservadaspalmeiras-mg.com
thiramirez.info
stanfec.xyz
cowcoupon.com
humaneeventmedia.com
exquisitepdc.com
silverartandcraft.com
plomeroelectricistaquintana.com
encounterniagara.com
ram-nilu.com
standwithcode.com
sphereexit.com
Signatures
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1508-64-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1508-65-0x000000000041F1A0-mapping.dmp formbook -
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Looks for VMWare Tools registry key 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
f1d94fcc611053cd5162e70dc36fddfa.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion f1d94fcc611053cd5162e70dc36fddfa.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion f1d94fcc611053cd5162e70dc36fddfa.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
f1d94fcc611053cd5162e70dc36fddfa.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum f1d94fcc611053cd5162e70dc36fddfa.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 f1d94fcc611053cd5162e70dc36fddfa.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
f1d94fcc611053cd5162e70dc36fddfa.exedescription pid process target process PID 1112 set thread context of 1508 1112 f1d94fcc611053cd5162e70dc36fddfa.exe f1d94fcc611053cd5162e70dc36fddfa.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
f1d94fcc611053cd5162e70dc36fddfa.exef1d94fcc611053cd5162e70dc36fddfa.exepid process 1112 f1d94fcc611053cd5162e70dc36fddfa.exe 1112 f1d94fcc611053cd5162e70dc36fddfa.exe 1112 f1d94fcc611053cd5162e70dc36fddfa.exe 1508 f1d94fcc611053cd5162e70dc36fddfa.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
f1d94fcc611053cd5162e70dc36fddfa.exedescription pid process Token: SeDebugPrivilege 1112 f1d94fcc611053cd5162e70dc36fddfa.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
f1d94fcc611053cd5162e70dc36fddfa.exedescription pid process target process PID 1112 wrote to memory of 1172 1112 f1d94fcc611053cd5162e70dc36fddfa.exe schtasks.exe PID 1112 wrote to memory of 1172 1112 f1d94fcc611053cd5162e70dc36fddfa.exe schtasks.exe PID 1112 wrote to memory of 1172 1112 f1d94fcc611053cd5162e70dc36fddfa.exe schtasks.exe PID 1112 wrote to memory of 1172 1112 f1d94fcc611053cd5162e70dc36fddfa.exe schtasks.exe PID 1112 wrote to memory of 1944 1112 f1d94fcc611053cd5162e70dc36fddfa.exe f1d94fcc611053cd5162e70dc36fddfa.exe PID 1112 wrote to memory of 1944 1112 f1d94fcc611053cd5162e70dc36fddfa.exe f1d94fcc611053cd5162e70dc36fddfa.exe PID 1112 wrote to memory of 1944 1112 f1d94fcc611053cd5162e70dc36fddfa.exe f1d94fcc611053cd5162e70dc36fddfa.exe PID 1112 wrote to memory of 1944 1112 f1d94fcc611053cd5162e70dc36fddfa.exe f1d94fcc611053cd5162e70dc36fddfa.exe PID 1112 wrote to memory of 1508 1112 f1d94fcc611053cd5162e70dc36fddfa.exe f1d94fcc611053cd5162e70dc36fddfa.exe PID 1112 wrote to memory of 1508 1112 f1d94fcc611053cd5162e70dc36fddfa.exe f1d94fcc611053cd5162e70dc36fddfa.exe PID 1112 wrote to memory of 1508 1112 f1d94fcc611053cd5162e70dc36fddfa.exe f1d94fcc611053cd5162e70dc36fddfa.exe PID 1112 wrote to memory of 1508 1112 f1d94fcc611053cd5162e70dc36fddfa.exe f1d94fcc611053cd5162e70dc36fddfa.exe PID 1112 wrote to memory of 1508 1112 f1d94fcc611053cd5162e70dc36fddfa.exe f1d94fcc611053cd5162e70dc36fddfa.exe PID 1112 wrote to memory of 1508 1112 f1d94fcc611053cd5162e70dc36fddfa.exe f1d94fcc611053cd5162e70dc36fddfa.exe PID 1112 wrote to memory of 1508 1112 f1d94fcc611053cd5162e70dc36fddfa.exe f1d94fcc611053cd5162e70dc36fddfa.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f1d94fcc611053cd5162e70dc36fddfa.exe"C:\Users\Admin\AppData\Local\Temp\f1d94fcc611053cd5162e70dc36fddfa.exe"1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HhpQDpq" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFD91.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\f1d94fcc611053cd5162e70dc36fddfa.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\f1d94fcc611053cd5162e70dc36fddfa.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpFD91.tmpMD5
0a9ccbf88f66c270566535c1b5a9f5e0
SHA11da40e8b864bd9de26d35aa449446a9f0e8f86ad
SHA25666574fe8f321f5316f613242499c335f316a51ba43e6df7b07dd36adf38075c3
SHA5128bbcbed48ca144c37b2268e07830286e16d4e8cb7d7d864fe768abe73a47f69bb8f93d6c48fa61fa4465d2df9b09c86fca2b36e41e49c78a3303940b64653179
-
memory/1112-55-0x00000000751A1000-0x00000000751A3000-memory.dmpFilesize
8KB
-
memory/1112-56-0x0000000004BD0000-0x0000000004BD1000-memory.dmpFilesize
4KB
-
memory/1112-57-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/1112-58-0x0000000004F90000-0x0000000005014000-memory.dmpFilesize
528KB
-
memory/1112-59-0x0000000000780000-0x00000000007B1000-memory.dmpFilesize
196KB
-
memory/1112-53-0x0000000000090000-0x0000000000091000-memory.dmpFilesize
4KB
-
memory/1172-60-0x0000000000000000-mapping.dmp
-
memory/1508-62-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1508-63-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1508-64-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1508-65-0x000000000041F1A0-mapping.dmp
-
memory/1508-66-0x00000000008F0000-0x0000000000BF3000-memory.dmpFilesize
3.0MB