Analysis
-
max time kernel
77s -
max time network
130s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
15-10-2021 13:53
Static task
static1
General
-
Target
4ce42b0b74090b13a3a1692caeabfd4df748e8fa0220ba1342765fe56b399348.exe
-
Size
684KB
-
MD5
f1d94fcc611053cd5162e70dc36fddfa
-
SHA1
52ecf628c9fe25f2eedca8da56aa0785958e2638
-
SHA256
4ce42b0b74090b13a3a1692caeabfd4df748e8fa0220ba1342765fe56b399348
-
SHA512
f422f6332bb00eabec395ce4154c940632feafba67a2206cbfa5700114dee0bc38b394febe09aecdf4cae6f9bdfd232491c1f8a179813c52c763ce3b7bbd87f7
Malware Config
Extracted
formbook
4.1
hs3h
http://www.alefisrael.com/hs3h/
slairt.com
teresasellsflorida.com
resouthcarolina.com
npccfbf.com
hutshed.com
westatesmarking.com
rustmonkeys.com
kagawa-rentacar.com
easyvoip-system.com
admorinsulation.com
ericaleighjensen.com
zhonghaojiaju.net
apple-iphone.xyz
b0t.info
torgetmc.xyz
lawrencemargarse.com
6123655.com
macdonalds-delivery.com
cvpfl.com
ayudaparaturent.com
toptenanimals.com
zambiadawn.com
muzoe.com
xtrembabes.com
nomadicfoodpods.com
sibernewskaltara.com
thelyfetour.com
sailinn.xyz
cisiworld.com
right-effort.com
emmanuelleramaroson.com
aptgdaycare.com
yanceyhomes.com
minooshargh.com
littlemontars.com
liuhemustam.com
tajaraenterprises.com
myteepathfinder.com
nectarselector.com
digitalbusinesscard.website
kirakira-woman.xyz
tntexpressdelivery.com
collectcuriously.com
marielagarciarealty.com
javierramonmartinezalarcon.com
eis-investment.com
bookanyclick.com
primespotshop.com
heatdistrict.xyz
beadedjoy.com
oyster-gal.com
umateam.com
reservadaspalmeiras-mg.com
thiramirez.info
stanfec.xyz
cowcoupon.com
humaneeventmedia.com
exquisitepdc.com
silverartandcraft.com
plomeroelectricistaquintana.com
encounterniagara.com
ram-nilu.com
standwithcode.com
sphereexit.com
Signatures
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2572-129-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2572-130-0x000000000041F1A0-mapping.dmp formbook -
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Looks for VMWare Tools registry key 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
4ce42b0b74090b13a3a1692caeabfd4df748e8fa0220ba1342765fe56b399348.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 4ce42b0b74090b13a3a1692caeabfd4df748e8fa0220ba1342765fe56b399348.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 4ce42b0b74090b13a3a1692caeabfd4df748e8fa0220ba1342765fe56b399348.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
4ce42b0b74090b13a3a1692caeabfd4df748e8fa0220ba1342765fe56b399348.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 4ce42b0b74090b13a3a1692caeabfd4df748e8fa0220ba1342765fe56b399348.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0 4ce42b0b74090b13a3a1692caeabfd4df748e8fa0220ba1342765fe56b399348.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
4ce42b0b74090b13a3a1692caeabfd4df748e8fa0220ba1342765fe56b399348.exedescription pid process target process PID 1684 set thread context of 2572 1684 4ce42b0b74090b13a3a1692caeabfd4df748e8fa0220ba1342765fe56b399348.exe 4ce42b0b74090b13a3a1692caeabfd4df748e8fa0220ba1342765fe56b399348.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
4ce42b0b74090b13a3a1692caeabfd4df748e8fa0220ba1342765fe56b399348.exe4ce42b0b74090b13a3a1692caeabfd4df748e8fa0220ba1342765fe56b399348.exepid process 1684 4ce42b0b74090b13a3a1692caeabfd4df748e8fa0220ba1342765fe56b399348.exe 2572 4ce42b0b74090b13a3a1692caeabfd4df748e8fa0220ba1342765fe56b399348.exe 2572 4ce42b0b74090b13a3a1692caeabfd4df748e8fa0220ba1342765fe56b399348.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
4ce42b0b74090b13a3a1692caeabfd4df748e8fa0220ba1342765fe56b399348.exedescription pid process Token: SeDebugPrivilege 1684 4ce42b0b74090b13a3a1692caeabfd4df748e8fa0220ba1342765fe56b399348.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
4ce42b0b74090b13a3a1692caeabfd4df748e8fa0220ba1342765fe56b399348.exedescription pid process target process PID 1684 wrote to memory of 2844 1684 4ce42b0b74090b13a3a1692caeabfd4df748e8fa0220ba1342765fe56b399348.exe schtasks.exe PID 1684 wrote to memory of 2844 1684 4ce42b0b74090b13a3a1692caeabfd4df748e8fa0220ba1342765fe56b399348.exe schtasks.exe PID 1684 wrote to memory of 2844 1684 4ce42b0b74090b13a3a1692caeabfd4df748e8fa0220ba1342765fe56b399348.exe schtasks.exe PID 1684 wrote to memory of 2572 1684 4ce42b0b74090b13a3a1692caeabfd4df748e8fa0220ba1342765fe56b399348.exe 4ce42b0b74090b13a3a1692caeabfd4df748e8fa0220ba1342765fe56b399348.exe PID 1684 wrote to memory of 2572 1684 4ce42b0b74090b13a3a1692caeabfd4df748e8fa0220ba1342765fe56b399348.exe 4ce42b0b74090b13a3a1692caeabfd4df748e8fa0220ba1342765fe56b399348.exe PID 1684 wrote to memory of 2572 1684 4ce42b0b74090b13a3a1692caeabfd4df748e8fa0220ba1342765fe56b399348.exe 4ce42b0b74090b13a3a1692caeabfd4df748e8fa0220ba1342765fe56b399348.exe PID 1684 wrote to memory of 2572 1684 4ce42b0b74090b13a3a1692caeabfd4df748e8fa0220ba1342765fe56b399348.exe 4ce42b0b74090b13a3a1692caeabfd4df748e8fa0220ba1342765fe56b399348.exe PID 1684 wrote to memory of 2572 1684 4ce42b0b74090b13a3a1692caeabfd4df748e8fa0220ba1342765fe56b399348.exe 4ce42b0b74090b13a3a1692caeabfd4df748e8fa0220ba1342765fe56b399348.exe PID 1684 wrote to memory of 2572 1684 4ce42b0b74090b13a3a1692caeabfd4df748e8fa0220ba1342765fe56b399348.exe 4ce42b0b74090b13a3a1692caeabfd4df748e8fa0220ba1342765fe56b399348.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ce42b0b74090b13a3a1692caeabfd4df748e8fa0220ba1342765fe56b399348.exe"C:\Users\Admin\AppData\Local\Temp\4ce42b0b74090b13a3a1692caeabfd4df748e8fa0220ba1342765fe56b399348.exe"1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HhpQDpq" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4031.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\4ce42b0b74090b13a3a1692caeabfd4df748e8fa0220ba1342765fe56b399348.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp4031.tmpMD5
82633e05ca2ccae6cfa78db31badae6a
SHA1eab45d9c58a29ccadd26f1075ce23007510aab01
SHA256401550a68ce1e0786e35f8083e3d2c51113c77320855bad3a26f9c1b67667040
SHA512ff542547e5a208155fecb9f745117d0437ebe06392e313a0a63d04f15fda80a3c5c9dbe7c397d750574f2dc893ef36055804b58714a16ca762b563eb8c3a2324
-
memory/1684-120-0x0000000005270000-0x0000000005271000-memory.dmpFilesize
4KB
-
memory/1684-125-0x0000000009E80000-0x0000000009EB1000-memory.dmpFilesize
196KB
-
memory/1684-119-0x0000000005310000-0x0000000005311000-memory.dmpFilesize
4KB
-
memory/1684-115-0x0000000000900000-0x0000000000901000-memory.dmpFilesize
4KB
-
memory/1684-121-0x0000000005520000-0x0000000005521000-memory.dmpFilesize
4KB
-
memory/1684-122-0x0000000005270000-0x000000000576E000-memory.dmpFilesize
5.0MB
-
memory/1684-118-0x0000000005770000-0x0000000005771000-memory.dmpFilesize
4KB
-
memory/1684-124-0x0000000008DF0000-0x0000000008E74000-memory.dmpFilesize
528KB
-
memory/1684-123-0x0000000002A80000-0x0000000002A8E000-memory.dmpFilesize
56KB
-
memory/1684-126-0x0000000009F30000-0x0000000009F31000-memory.dmpFilesize
4KB
-
memory/1684-117-0x00000000051D0000-0x00000000051D1000-memory.dmpFilesize
4KB
-
memory/2572-129-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2572-130-0x000000000041F1A0-mapping.dmp
-
memory/2572-131-0x0000000000F20000-0x0000000001240000-memory.dmpFilesize
3.1MB
-
memory/2844-127-0x0000000000000000-mapping.dmp