Analysis
-
max time kernel
151s -
max time network
152s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
25-01-2022 10:04
Static task
static1
Behavioral task
behavioral1
Sample
CC2107139144.exe
Resource
win7-en-20211208
General
-
Target
CC2107139144.exe
-
Size
856KB
-
MD5
51beaa7443a361691a0cbef6e56d890b
-
SHA1
5a851452118c729d94b99f83c85cd819f5f96de6
-
SHA256
bdfb763b51cd4a618ad0d10388f1f478d1acddc7917891a990e8f390c9319b76
-
SHA512
2f41652699b858e31182ad7c14593034c75c78929ce24ab1ec65cf62f800cc04e0c64acc08a3e4c3d28d5d38769a829d38ce4fa684ed89f384ca663bb1b4a440
Malware Config
Extracted
formbook
4.1
v32s
water-hada-utsukushii.xyz
9v6v.com
rechtsanwalt-trnka.com
lets-eat-healthy.com
vannyscreamycreations.com
cosy-bamboo.com
leedexamtraining.com
lilbusinessowner.com
cncvietnam.net
gpsplayback.com
aroidaddictfl.com
patienpower.info
777londonescorts.com
whrpky078.xyz
yqamuh.com
virtualft.com
fanfanway.com
56789r.com
926397.com
kp-crane.com
thesocialmediaunion.com
9975888.com
jasperellis.com
print-excellent.com
mymaternacare.com
yuanmeisl.com
cashflows12daysofchristmas.com
kanhajipolyfilms.com
sexyfishsgp.com
starkelcapitalmanagement.com
speedplaner.xyz
georgiacryptos.com
thesmeeze.com
sinaschmeiter.com
urbanluxestudio.store
koamrealtyhi.com
photographybackpacks.com
1xbet-ve.xyz
nexteartheth.com
comedymint.com
campusinteractio.com
cretaurl0.com
silveradostudio.com
bogti.xyz
daonband.com
votek.online
wennft.xyz
punkratters.com
indiewilde.com
buydelishous.com
shoppingzware.com
regentautovaluers.com
lingquangou-e.one
sairamjalakamdevarajulu.com
ginakdesings.com
travpromobile.net
acupressuretips.com
maxizcollectibles.com
app015.com
xu6f5w5seihl.xyz
christinealbertsen.com
hypnosispastlives.com
creativevisionaries.net
hadyintenational.com
hitzcoins.com
Signatures
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1624-65-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1536-76-0x00000000000E0000-0x000000000010F000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1932 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
CC2107139144.exeCC2107139144.exechkdsk.exedescription pid process target process PID 1576 set thread context of 1624 1576 CC2107139144.exe CC2107139144.exe PID 1624 set thread context of 1380 1624 CC2107139144.exe Explorer.EXE PID 1536 set thread context of 1380 1536 chkdsk.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 27 IoCs
Processes:
CC2107139144.exeCC2107139144.exepowershell.exechkdsk.exepid process 1576 CC2107139144.exe 1576 CC2107139144.exe 1576 CC2107139144.exe 1576 CC2107139144.exe 1624 CC2107139144.exe 1624 CC2107139144.exe 1648 powershell.exe 1536 chkdsk.exe 1536 chkdsk.exe 1536 chkdsk.exe 1536 chkdsk.exe 1536 chkdsk.exe 1536 chkdsk.exe 1536 chkdsk.exe 1536 chkdsk.exe 1536 chkdsk.exe 1536 chkdsk.exe 1536 chkdsk.exe 1536 chkdsk.exe 1536 chkdsk.exe 1536 chkdsk.exe 1536 chkdsk.exe 1536 chkdsk.exe 1536 chkdsk.exe 1536 chkdsk.exe 1536 chkdsk.exe 1536 chkdsk.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
CC2107139144.exechkdsk.exepid process 1624 CC2107139144.exe 1624 CC2107139144.exe 1624 CC2107139144.exe 1536 chkdsk.exe 1536 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
CC2107139144.exeCC2107139144.exepowershell.exechkdsk.exedescription pid process Token: SeDebugPrivilege 1576 CC2107139144.exe Token: SeDebugPrivilege 1624 CC2107139144.exe Token: SeDebugPrivilege 1648 powershell.exe Token: SeDebugPrivilege 1536 chkdsk.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1380 Explorer.EXE 1380 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1380 Explorer.EXE 1380 Explorer.EXE -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
CC2107139144.exeExplorer.EXEchkdsk.exedescription pid process target process PID 1576 wrote to memory of 1648 1576 CC2107139144.exe powershell.exe PID 1576 wrote to memory of 1648 1576 CC2107139144.exe powershell.exe PID 1576 wrote to memory of 1648 1576 CC2107139144.exe powershell.exe PID 1576 wrote to memory of 1648 1576 CC2107139144.exe powershell.exe PID 1576 wrote to memory of 1156 1576 CC2107139144.exe schtasks.exe PID 1576 wrote to memory of 1156 1576 CC2107139144.exe schtasks.exe PID 1576 wrote to memory of 1156 1576 CC2107139144.exe schtasks.exe PID 1576 wrote to memory of 1156 1576 CC2107139144.exe schtasks.exe PID 1576 wrote to memory of 1832 1576 CC2107139144.exe CC2107139144.exe PID 1576 wrote to memory of 1832 1576 CC2107139144.exe CC2107139144.exe PID 1576 wrote to memory of 1832 1576 CC2107139144.exe CC2107139144.exe PID 1576 wrote to memory of 1832 1576 CC2107139144.exe CC2107139144.exe PID 1576 wrote to memory of 1624 1576 CC2107139144.exe CC2107139144.exe PID 1576 wrote to memory of 1624 1576 CC2107139144.exe CC2107139144.exe PID 1576 wrote to memory of 1624 1576 CC2107139144.exe CC2107139144.exe PID 1576 wrote to memory of 1624 1576 CC2107139144.exe CC2107139144.exe PID 1576 wrote to memory of 1624 1576 CC2107139144.exe CC2107139144.exe PID 1576 wrote to memory of 1624 1576 CC2107139144.exe CC2107139144.exe PID 1576 wrote to memory of 1624 1576 CC2107139144.exe CC2107139144.exe PID 1380 wrote to memory of 1536 1380 Explorer.EXE chkdsk.exe PID 1380 wrote to memory of 1536 1380 Explorer.EXE chkdsk.exe PID 1380 wrote to memory of 1536 1380 Explorer.EXE chkdsk.exe PID 1380 wrote to memory of 1536 1380 Explorer.EXE chkdsk.exe PID 1536 wrote to memory of 1932 1536 chkdsk.exe cmd.exe PID 1536 wrote to memory of 1932 1536 chkdsk.exe cmd.exe PID 1536 wrote to memory of 1932 1536 chkdsk.exe cmd.exe PID 1536 wrote to memory of 1932 1536 chkdsk.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CC2107139144.exe"C:\Users\Admin\AppData\Local\Temp\CC2107139144.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\syYqoKuzIfgUfe.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\syYqoKuzIfgUfe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9231.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\CC2107139144.exe"C:\Users\Admin\AppData\Local\Temp\CC2107139144.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\CC2107139144.exe"C:\Users\Admin\AppData\Local\Temp\CC2107139144.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\CC2107139144.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp9231.tmpMD5
a374dcccef3865fc427d830c6f9d5cdc
SHA132a2c5333f2335944c294f4fba932ff6f8ffced1
SHA2560f258b2371d855517366a055b0ffc2e8e3e39221fecb4d315d31b8195ec5a3e6
SHA512314a9f2e15211c9acdadb84320ae6f55853445e56b1e288ee92bcb7dd21e7f0ff25728be0b88490c8c29bb18f2ecb74c6a6b175bb346fde88d68d616bc94b291
-
memory/1380-71-0x0000000007490000-0x00000000075FB000-memory.dmpFilesize
1.4MB
-
memory/1380-79-0x00000000044B0000-0x0000000004577000-memory.dmpFilesize
796KB
-
memory/1536-77-0x0000000002080000-0x0000000002383000-memory.dmpFilesize
3.0MB
-
memory/1536-78-0x0000000001CB0000-0x0000000001EEC000-memory.dmpFilesize
2.2MB
-
memory/1536-75-0x00000000006C0000-0x00000000006C7000-memory.dmpFilesize
28KB
-
memory/1536-76-0x00000000000E0000-0x000000000010F000-memory.dmpFilesize
188KB
-
memory/1576-59-0x0000000000620000-0x000000000062E000-memory.dmpFilesize
56KB
-
memory/1576-60-0x0000000005550000-0x00000000055FC000-memory.dmpFilesize
688KB
-
memory/1576-58-0x000000007EF40000-0x000000007EF41000-memory.dmpFilesize
4KB
-
memory/1576-57-0x0000000004C40000-0x0000000004C41000-memory.dmpFilesize
4KB
-
memory/1576-55-0x0000000000220000-0x00000000002FC000-memory.dmpFilesize
880KB
-
memory/1576-56-0x0000000076141000-0x0000000076143000-memory.dmpFilesize
8KB
-
memory/1624-69-0x0000000000C50000-0x0000000000F53000-memory.dmpFilesize
3.0MB
-
memory/1624-70-0x0000000000140000-0x0000000000155000-memory.dmpFilesize
84KB
-
memory/1624-65-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1624-64-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1624-63-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1648-73-0x0000000002220000-0x00000000023D0000-memory.dmpFilesize
1.7MB
-
memory/1648-74-0x0000000002220000-0x00000000023D0000-memory.dmpFilesize
1.7MB
-
memory/1648-72-0x0000000002220000-0x00000000023D0000-memory.dmpFilesize
1.7MB