Analysis
-
max time kernel
156s -
max time network
153s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
25-01-2022 10:04
Static task
static1
Behavioral task
behavioral1
Sample
CC2107139144.exe
Resource
win7-en-20211208
General
-
Target
CC2107139144.exe
-
Size
856KB
-
MD5
51beaa7443a361691a0cbef6e56d890b
-
SHA1
5a851452118c729d94b99f83c85cd819f5f96de6
-
SHA256
bdfb763b51cd4a618ad0d10388f1f478d1acddc7917891a990e8f390c9319b76
-
SHA512
2f41652699b858e31182ad7c14593034c75c78929ce24ab1ec65cf62f800cc04e0c64acc08a3e4c3d28d5d38769a829d38ce4fa684ed89f384ca663bb1b4a440
Malware Config
Extracted
formbook
4.1
v32s
water-hada-utsukushii.xyz
9v6v.com
rechtsanwalt-trnka.com
lets-eat-healthy.com
vannyscreamycreations.com
cosy-bamboo.com
leedexamtraining.com
lilbusinessowner.com
cncvietnam.net
gpsplayback.com
aroidaddictfl.com
patienpower.info
777londonescorts.com
whrpky078.xyz
yqamuh.com
virtualft.com
fanfanway.com
56789r.com
926397.com
kp-crane.com
thesocialmediaunion.com
9975888.com
jasperellis.com
print-excellent.com
mymaternacare.com
yuanmeisl.com
cashflows12daysofchristmas.com
kanhajipolyfilms.com
sexyfishsgp.com
starkelcapitalmanagement.com
speedplaner.xyz
georgiacryptos.com
thesmeeze.com
sinaschmeiter.com
urbanluxestudio.store
koamrealtyhi.com
photographybackpacks.com
1xbet-ve.xyz
nexteartheth.com
comedymint.com
campusinteractio.com
cretaurl0.com
silveradostudio.com
bogti.xyz
daonband.com
votek.online
wennft.xyz
punkratters.com
indiewilde.com
buydelishous.com
shoppingzware.com
regentautovaluers.com
lingquangou-e.one
sairamjalakamdevarajulu.com
ginakdesings.com
travpromobile.net
acupressuretips.com
maxizcollectibles.com
app015.com
xu6f5w5seihl.xyz
christinealbertsen.com
hypnosispastlives.com
creativevisionaries.net
hadyintenational.com
hitzcoins.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2704-128-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2704-134-0x0000000000C30000-0x0000000000D7A000-memory.dmp formbook behavioral2/memory/2800-150-0x00000000002C0000-0x00000000002EF000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
CC2107139144.exeCC2107139144.exeexplorer.exedescription pid process target process PID 2780 set thread context of 2704 2780 CC2107139144.exe CC2107139144.exe PID 2704 set thread context of 3000 2704 CC2107139144.exe Explorer.EXE PID 2800 set thread context of 3000 2800 explorer.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 49 IoCs
Processes:
CC2107139144.exeCC2107139144.exepowershell.exeexplorer.exepid process 2780 CC2107139144.exe 2780 CC2107139144.exe 2704 CC2107139144.exe 2704 CC2107139144.exe 3752 powershell.exe 2704 CC2107139144.exe 2704 CC2107139144.exe 3752 powershell.exe 3752 powershell.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3000 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
CC2107139144.exeexplorer.exepid process 2704 CC2107139144.exe 2704 CC2107139144.exe 2704 CC2107139144.exe 2800 explorer.exe 2800 explorer.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
CC2107139144.exepowershell.exeCC2107139144.exeexplorer.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 2780 CC2107139144.exe Token: SeDebugPrivilege 3752 powershell.exe Token: SeDebugPrivilege 2704 CC2107139144.exe Token: SeDebugPrivilege 2800 explorer.exe Token: SeShutdownPrivilege 3000 Explorer.EXE Token: SeCreatePagefilePrivilege 3000 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
CC2107139144.exeExplorer.EXEexplorer.exedescription pid process target process PID 2780 wrote to memory of 3752 2780 CC2107139144.exe powershell.exe PID 2780 wrote to memory of 3752 2780 CC2107139144.exe powershell.exe PID 2780 wrote to memory of 3752 2780 CC2107139144.exe powershell.exe PID 2780 wrote to memory of 1252 2780 CC2107139144.exe schtasks.exe PID 2780 wrote to memory of 1252 2780 CC2107139144.exe schtasks.exe PID 2780 wrote to memory of 1252 2780 CC2107139144.exe schtasks.exe PID 2780 wrote to memory of 2704 2780 CC2107139144.exe CC2107139144.exe PID 2780 wrote to memory of 2704 2780 CC2107139144.exe CC2107139144.exe PID 2780 wrote to memory of 2704 2780 CC2107139144.exe CC2107139144.exe PID 2780 wrote to memory of 2704 2780 CC2107139144.exe CC2107139144.exe PID 2780 wrote to memory of 2704 2780 CC2107139144.exe CC2107139144.exe PID 2780 wrote to memory of 2704 2780 CC2107139144.exe CC2107139144.exe PID 3000 wrote to memory of 2800 3000 Explorer.EXE explorer.exe PID 3000 wrote to memory of 2800 3000 Explorer.EXE explorer.exe PID 3000 wrote to memory of 2800 3000 Explorer.EXE explorer.exe PID 2800 wrote to memory of 1168 2800 explorer.exe cmd.exe PID 2800 wrote to memory of 1168 2800 explorer.exe cmd.exe PID 2800 wrote to memory of 1168 2800 explorer.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CC2107139144.exe"C:\Users\Admin\AppData\Local\Temp\CC2107139144.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\syYqoKuzIfgUfe.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\syYqoKuzIfgUfe" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEFAB.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\CC2107139144.exe"C:\Users\Admin\AppData\Local\Temp\CC2107139144.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\CC2107139144.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpEFAB.tmpMD5
2606a06ceee201a6554cb1aa3410c4bc
SHA1e2acc2ba718d8274922232036497d6fcd9f18c1e
SHA2564e7a40a5cc0ab3fcedcb897cec97fc2615cfc925a34852fac6278874efea8af5
SHA5121fd57cab43096fadf3f85eed2773d56ce7342a2e32a985fd7918a07ef2fa78fea30d1a0888e3e58cf3d6ae91497e43812cff3397036f075d71f8788826741c49
-
memory/2704-138-0x0000000001130000-0x0000000001450000-memory.dmpFilesize
3.1MB
-
memory/2704-128-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2704-134-0x0000000000C30000-0x0000000000D7A000-memory.dmpFilesize
1.3MB
-
memory/2780-118-0x0000000005420000-0x000000000542A000-memory.dmpFilesize
40KB
-
memory/2780-120-0x0000000005700000-0x000000000579C000-memory.dmpFilesize
624KB
-
memory/2780-121-0x0000000005A60000-0x0000000005A6E000-memory.dmpFilesize
56KB
-
memory/2780-122-0x000000007E5D0000-0x000000007E5D1000-memory.dmpFilesize
4KB
-
memory/2780-123-0x00000000063C0000-0x000000000646C000-memory.dmpFilesize
688KB
-
memory/2780-119-0x00000000053A0000-0x0000000005432000-memory.dmpFilesize
584KB
-
memory/2780-115-0x0000000000B20000-0x0000000000BFC000-memory.dmpFilesize
880KB
-
memory/2780-117-0x0000000005440000-0x00000000054D2000-memory.dmpFilesize
584KB
-
memory/2780-116-0x0000000005A70000-0x0000000005F6E000-memory.dmpFilesize
5.0MB
-
memory/2800-151-0x00000000048F0000-0x0000000004C10000-memory.dmpFilesize
3.1MB
-
memory/2800-149-0x0000000000380000-0x00000000007BF000-memory.dmpFilesize
4.2MB
-
memory/2800-232-0x0000000004750000-0x00000000048E7000-memory.dmpFilesize
1.6MB
-
memory/2800-150-0x00000000002C0000-0x00000000002EF000-memory.dmpFilesize
188KB
-
memory/3000-233-0x00000000059A0000-0x0000000005B0B000-memory.dmpFilesize
1.4MB
-
memory/3000-136-0x0000000005880000-0x000000000599E000-memory.dmpFilesize
1.1MB
-
memory/3752-129-0x0000000006EB0000-0x00000000074D8000-memory.dmpFilesize
6.2MB
-
memory/3752-154-0x0000000008DC0000-0x0000000008DF3000-memory.dmpFilesize
204KB
-
memory/3752-139-0x0000000007810000-0x0000000007B60000-memory.dmpFilesize
3.3MB
-
memory/3752-140-0x0000000007620000-0x000000000763C000-memory.dmpFilesize
112KB
-
memory/3752-141-0x0000000007C30000-0x0000000007C7B000-memory.dmpFilesize
300KB
-
memory/3752-142-0x0000000007F80000-0x0000000007FF6000-memory.dmpFilesize
472KB
-
memory/3752-137-0x0000000004502000-0x0000000004503000-memory.dmpFilesize
4KB
-
memory/3752-135-0x00000000076A0000-0x0000000007706000-memory.dmpFilesize
408KB
-
memory/3752-127-0x00000000043E0000-0x0000000004416000-memory.dmpFilesize
216KB
-
memory/3752-133-0x0000000007550000-0x00000000075B6000-memory.dmpFilesize
408KB
-
memory/3752-155-0x0000000008DA0000-0x0000000008DBE000-memory.dmpFilesize
120KB
-
memory/3752-160-0x0000000008EF0000-0x0000000008F95000-memory.dmpFilesize
660KB
-
memory/3752-161-0x000000007E570000-0x000000007E571000-memory.dmpFilesize
4KB
-
memory/3752-162-0x0000000004503000-0x0000000004504000-memory.dmpFilesize
4KB
-
memory/3752-163-0x00000000092D0000-0x0000000009364000-memory.dmpFilesize
592KB
-
memory/3752-130-0x0000000006D40000-0x0000000006D62000-memory.dmpFilesize
136KB
-
memory/3752-132-0x0000000004500000-0x0000000004501000-memory.dmpFilesize
4KB
-
memory/3752-358-0x00000000091D0000-0x00000000091EA000-memory.dmpFilesize
104KB
-
memory/3752-363-0x00000000091C0000-0x00000000091C8000-memory.dmpFilesize
32KB