Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
15-10-2021 08:16
Static task
static1
Behavioral task
behavioral1
Sample
f1d94fcc611053cd5162e70dc36fddfa.exe
Resource
win7-en-20210920
General
-
Target
f1d94fcc611053cd5162e70dc36fddfa.exe
-
Size
684KB
-
MD5
f1d94fcc611053cd5162e70dc36fddfa
-
SHA1
52ecf628c9fe25f2eedca8da56aa0785958e2638
-
SHA256
4ce42b0b74090b13a3a1692caeabfd4df748e8fa0220ba1342765fe56b399348
-
SHA512
f422f6332bb00eabec395ce4154c940632feafba67a2206cbfa5700114dee0bc38b394febe09aecdf4cae6f9bdfd232491c1f8a179813c52c763ce3b7bbd87f7
Malware Config
Extracted
formbook
4.1
hs3h
http://www.alefisrael.com/hs3h/
slairt.com
teresasellsflorida.com
resouthcarolina.com
npccfbf.com
hutshed.com
westatesmarking.com
rustmonkeys.com
kagawa-rentacar.com
easyvoip-system.com
admorinsulation.com
ericaleighjensen.com
zhonghaojiaju.net
apple-iphone.xyz
b0t.info
torgetmc.xyz
lawrencemargarse.com
6123655.com
macdonalds-delivery.com
cvpfl.com
ayudaparaturent.com
toptenanimals.com
zambiadawn.com
muzoe.com
xtrembabes.com
nomadicfoodpods.com
sibernewskaltara.com
thelyfetour.com
sailinn.xyz
cisiworld.com
right-effort.com
emmanuelleramaroson.com
aptgdaycare.com
yanceyhomes.com
minooshargh.com
littlemontars.com
liuhemustam.com
tajaraenterprises.com
myteepathfinder.com
nectarselector.com
digitalbusinesscard.website
kirakira-woman.xyz
tntexpressdelivery.com
collectcuriously.com
marielagarciarealty.com
javierramonmartinezalarcon.com
eis-investment.com
bookanyclick.com
primespotshop.com
heatdistrict.xyz
beadedjoy.com
oyster-gal.com
umateam.com
reservadaspalmeiras-mg.com
thiramirez.info
stanfec.xyz
cowcoupon.com
humaneeventmedia.com
exquisitepdc.com
silverartandcraft.com
plomeroelectricistaquintana.com
encounterniagara.com
ram-nilu.com
standwithcode.com
sphereexit.com
Signatures
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2868-129-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2868-130-0x000000000041F1A0-mapping.dmp formbook -
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Looks for VMWare Tools registry key 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
f1d94fcc611053cd5162e70dc36fddfa.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion f1d94fcc611053cd5162e70dc36fddfa.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion f1d94fcc611053cd5162e70dc36fddfa.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
f1d94fcc611053cd5162e70dc36fddfa.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum f1d94fcc611053cd5162e70dc36fddfa.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0 f1d94fcc611053cd5162e70dc36fddfa.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
f1d94fcc611053cd5162e70dc36fddfa.exedescription pid process target process PID 2056 set thread context of 2868 2056 f1d94fcc611053cd5162e70dc36fddfa.exe f1d94fcc611053cd5162e70dc36fddfa.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
f1d94fcc611053cd5162e70dc36fddfa.exef1d94fcc611053cd5162e70dc36fddfa.exepid process 2056 f1d94fcc611053cd5162e70dc36fddfa.exe 2868 f1d94fcc611053cd5162e70dc36fddfa.exe 2868 f1d94fcc611053cd5162e70dc36fddfa.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
f1d94fcc611053cd5162e70dc36fddfa.exedescription pid process Token: SeDebugPrivilege 2056 f1d94fcc611053cd5162e70dc36fddfa.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
f1d94fcc611053cd5162e70dc36fddfa.exedescription pid process target process PID 2056 wrote to memory of 3540 2056 f1d94fcc611053cd5162e70dc36fddfa.exe schtasks.exe PID 2056 wrote to memory of 3540 2056 f1d94fcc611053cd5162e70dc36fddfa.exe schtasks.exe PID 2056 wrote to memory of 3540 2056 f1d94fcc611053cd5162e70dc36fddfa.exe schtasks.exe PID 2056 wrote to memory of 2868 2056 f1d94fcc611053cd5162e70dc36fddfa.exe f1d94fcc611053cd5162e70dc36fddfa.exe PID 2056 wrote to memory of 2868 2056 f1d94fcc611053cd5162e70dc36fddfa.exe f1d94fcc611053cd5162e70dc36fddfa.exe PID 2056 wrote to memory of 2868 2056 f1d94fcc611053cd5162e70dc36fddfa.exe f1d94fcc611053cd5162e70dc36fddfa.exe PID 2056 wrote to memory of 2868 2056 f1d94fcc611053cd5162e70dc36fddfa.exe f1d94fcc611053cd5162e70dc36fddfa.exe PID 2056 wrote to memory of 2868 2056 f1d94fcc611053cd5162e70dc36fddfa.exe f1d94fcc611053cd5162e70dc36fddfa.exe PID 2056 wrote to memory of 2868 2056 f1d94fcc611053cd5162e70dc36fddfa.exe f1d94fcc611053cd5162e70dc36fddfa.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f1d94fcc611053cd5162e70dc36fddfa.exe"C:\Users\Admin\AppData\Local\Temp\f1d94fcc611053cd5162e70dc36fddfa.exe"1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HhpQDpq" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6DE9.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\f1d94fcc611053cd5162e70dc36fddfa.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp6DE9.tmpMD5
0cb6cb4413c66945f8e7388cc9803168
SHA1ee9c1d7ff865a9ba566125ab1b032ac3c09e5ca7
SHA256641f8513823cb418920cf2471a94afa18c65e2ee4177153649590828e4f92a65
SHA5120a01ebda5e39d88845f8bd045780422f147f03b839afce872eaa188883d6d1b4e7927f68d5ed008b0f9900340e3a1df231d8804eb5eb04d4e71acd90320b89af
-
memory/2056-120-0x0000000004EC0000-0x0000000004EC1000-memory.dmpFilesize
4KB
-
memory/2056-125-0x0000000009B60000-0x0000000009B91000-memory.dmpFilesize
196KB
-
memory/2056-119-0x0000000004FC0000-0x0000000004FC1000-memory.dmpFilesize
4KB
-
memory/2056-115-0x0000000000600000-0x0000000000601000-memory.dmpFilesize
4KB
-
memory/2056-121-0x00000000051F0000-0x00000000051F1000-memory.dmpFilesize
4KB
-
memory/2056-122-0x0000000004FC0000-0x00000000054BE000-memory.dmpFilesize
5.0MB
-
memory/2056-118-0x00000000054C0000-0x00000000054C1000-memory.dmpFilesize
4KB
-
memory/2056-124-0x0000000008AD0000-0x0000000008B54000-memory.dmpFilesize
528KB
-
memory/2056-123-0x00000000028B0000-0x00000000028BE000-memory.dmpFilesize
56KB
-
memory/2056-126-0x0000000009C30000-0x0000000009C31000-memory.dmpFilesize
4KB
-
memory/2056-117-0x0000000004F20000-0x0000000004F21000-memory.dmpFilesize
4KB
-
memory/2868-129-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2868-130-0x000000000041F1A0-mapping.dmp
-
memory/2868-131-0x0000000000F70000-0x0000000001290000-memory.dmpFilesize
3.1MB
-
memory/3540-127-0x0000000000000000-mapping.dmp