Analysis
- max time kernel
163s - max time network
172s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
09/02/2022, 14:59
Static task
static1
Behavioral task
behavioral1
Sample
siparis.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target siparis.exe
- Size 262KB
- Sample220209-scqddsaff5
- SHA256 87cca4e4ba65094241bbb379ca3677932f6e399ece811334a07a72ff5b3073f8
- MD5 24ef3b067bec6162316d28f1057f599c
- SHA1 ca2b44d4a40573e98109d342e45bc527414217ed
- SHA512 6caf391f700d57df9e834df26006f4d4c049b11a15cf50190441484b3efa6fc3a34e7f5bbf3e86864c2389bb5ddb4344d40eac6643635f8297595caa7006bba1
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
Version
-
4.1
Campaign
-
d23n
Decoy
-
keralalotteryresults.com
-
cosnerreview.com
-
tilcompanies.com
-
tokomakmurjaya.xyz
-
twmarketz.com
-
spytfyre.com
-
eyerafitnessapp.com
-
faswebs.com
-
hotcinfin.com
-
modifidecars.com
-
xn--rhqwesct95oo2g0ro.com
-
fruitfulgreenhousefacility.com
-
pomidor.biz
-
volondamasterclass.com
-
latexbbs.com
-
kkh222.com
-
ratted.xyz
-
littlejohnsinc.com
-
vacationdealscorp.website
-
bitcoinbil3arabi.com
-
cjhzgxkl.com
-
myfirstblanket.com
-
umfjytgtz.com
-
sanjoseinteriordesign.com
-
musicalderelict.com
-
communityrealestates.com
-
jordsagency.com
-
fragmentize.xyz
-
bullmatch.net
-
demtate.xyz
-
metakolkata.com
-
xx3bwzac.xyz
-
h3dpy.com
-
smileonimplantsdentalcenter.com
-
comprasessenciais.com
-
mamasustainablefortunebots.com
-
andhrianos.com
-
em64jxyp.xyz
-
mohammadshahjalal.com
-
lldwjs.com
-
modernhippietherapy.com
-
americanegles.com
-
rx10763019.com
-
earthikan.com
-
drawfarm.xyz
-
bghfkk.xyz
-
adkinsvideo.com
-
xclunw.com
-
kutibox.club
-
troos.online
-
nothingbutdd.com
-
alps82.com
-
inviolablenft.com
-
i-do-ilas.com
-
esothereum.com
-
oxidizer.xyz
-
thissunshinyday.com
-
surehulocalsing.com
-
ruzhoulvyou.com
-
cleansolarpanels.info
-
obfexj.com
-
xn--80ahdz7a0d.online
-
peoplehrcapital.net
-
byw9988.com
-
littlespaceandmore.com
Signatures
- Formbook Payload 3 IoCs
resource yara_rule behavioral2/memory/4536-135-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4536-138-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/840-151-0x0000000000670000-0x000000000069F000-memory.dmp formbook - Executes dropped EXE 2 IoCs
pid Process 2672 wgvkh.exe 4536 wgvkh.exe - Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 2672 set thread context of 4536 2672 wgvkh.exe 83 PID 4536 set thread context of 2620 4536 wgvkh.exe 30 PID 4536 set thread context of 2620 4536 wgvkh.exe 30 PID 840 set thread context of 2620 840 cmmon32.exe 30 - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 56 IoCs
pid Process 4536 wgvkh.exe 4536 wgvkh.exe 4536 wgvkh.exe 4536 wgvkh.exe 4536 wgvkh.exe 4536 wgvkh.exe 840 cmmon32.exe 840 cmmon32.exe 840 cmmon32.exe 840 cmmon32.exe 840 cmmon32.exe 840 cmmon32.exe 840 cmmon32.exe 840 cmmon32.exe 840 cmmon32.exe 840 cmmon32.exe 840 cmmon32.exe 840 cmmon32.exe 840 cmmon32.exe 840 cmmon32.exe 840 cmmon32.exe 840 cmmon32.exe 840 cmmon32.exe 840 cmmon32.exe 840 cmmon32.exe 840 cmmon32.exe 840 cmmon32.exe 840 cmmon32.exe 840 cmmon32.exe 840 cmmon32.exe 840 cmmon32.exe 840 cmmon32.exe 840 cmmon32.exe 840 cmmon32.exe 840 cmmon32.exe 840 cmmon32.exe 840 cmmon32.exe 840 cmmon32.exe 840 cmmon32.exe 840 cmmon32.exe 840 cmmon32.exe 840 cmmon32.exe 840 cmmon32.exe 840 cmmon32.exe 840 cmmon32.exe 840 cmmon32.exe 840 cmmon32.exe 840 cmmon32.exe 840 cmmon32.exe 840 cmmon32.exe 840 cmmon32.exe 840 cmmon32.exe 840 cmmon32.exe 840 cmmon32.exe 840 cmmon32.exe 840 cmmon32.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2620 Explorer.EXE - Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 4536 wgvkh.exe 4536 wgvkh.exe 4536 wgvkh.exe 4536 wgvkh.exe 840 cmmon32.exe 840 cmmon32.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4536 wgvkh.exe Token: SeShutdownPrivilege 3164 svchost.exe Token: SeCreatePagefilePrivilege 3164 svchost.exe Token: SeShutdownPrivilege 3164 svchost.exe Token: SeCreatePagefilePrivilege 3164 svchost.exe Token: SeShutdownPrivilege 3164 svchost.exe Token: SeCreatePagefilePrivilege 3164 svchost.exe Token: SeDebugPrivilege 840 cmmon32.exe Token: SeSecurityPrivilege 3136 TiWorker.exe Token: SeRestorePrivilege 3136 TiWorker.exe Token: SeBackupPrivilege 3136 TiWorker.exe Token: SeBackupPrivilege 3136 TiWorker.exe Token: SeRestorePrivilege 3136 TiWorker.exe Token: SeSecurityPrivilege 3136 TiWorker.exe Token: SeBackupPrivilege 3136 TiWorker.exe Token: SeRestorePrivilege 3136 TiWorker.exe Token: SeSecurityPrivilege 3136 TiWorker.exe Token: SeBackupPrivilege 3136 TiWorker.exe Token: SeRestorePrivilege 3136 TiWorker.exe Token: SeSecurityPrivilege 3136 TiWorker.exe Token: SeBackupPrivilege 3136 TiWorker.exe Token: SeRestorePrivilege 3136 TiWorker.exe Token: SeSecurityPrivilege 3136 TiWorker.exe Token: SeBackupPrivilege 3136 TiWorker.exe Token: SeRestorePrivilege 3136 TiWorker.exe Token: SeSecurityPrivilege 3136 TiWorker.exe Token: SeBackupPrivilege 3136 TiWorker.exe Token: SeRestorePrivilege 3136 TiWorker.exe Token: SeSecurityPrivilege 3136 TiWorker.exe Token: SeBackupPrivilege 3136 TiWorker.exe Token: SeRestorePrivilege 3136 TiWorker.exe Token: SeSecurityPrivilege 3136 TiWorker.exe Token: SeBackupPrivilege 3136 TiWorker.exe Token: SeRestorePrivilege 3136 TiWorker.exe Token: SeSecurityPrivilege 3136 TiWorker.exe Token: SeBackupPrivilege 3136 TiWorker.exe Token: SeRestorePrivilege 3136 TiWorker.exe Token: SeSecurityPrivilege 3136 TiWorker.exe Token: SeBackupPrivilege 3136 TiWorker.exe Token: SeRestorePrivilege 3136 TiWorker.exe Token: SeSecurityPrivilege 3136 TiWorker.exe Token: SeBackupPrivilege 3136 TiWorker.exe Token: SeRestorePrivilege 3136 TiWorker.exe Token: SeSecurityPrivilege 3136 TiWorker.exe Token: SeBackupPrivilege 3136 TiWorker.exe Token: SeRestorePrivilege 3136 TiWorker.exe Token: SeSecurityPrivilege 3136 TiWorker.exe Token: SeBackupPrivilege 3136 TiWorker.exe Token: SeRestorePrivilege 3136 TiWorker.exe Token: SeSecurityPrivilege 3136 TiWorker.exe Token: SeBackupPrivilege 3136 TiWorker.exe Token: SeRestorePrivilege 3136 TiWorker.exe Token: SeSecurityPrivilege 3136 TiWorker.exe Token: SeBackupPrivilege 3136 TiWorker.exe Token: SeRestorePrivilege 3136 TiWorker.exe Token: SeSecurityPrivilege 3136 TiWorker.exe Token: SeBackupPrivilege 3136 TiWorker.exe Token: SeRestorePrivilege 3136 TiWorker.exe Token: SeSecurityPrivilege 3136 TiWorker.exe Token: SeBackupPrivilege 3136 TiWorker.exe Token: SeRestorePrivilege 3136 TiWorker.exe Token: SeSecurityPrivilege 3136 TiWorker.exe Token: SeBackupPrivilege 3136 TiWorker.exe Token: SeRestorePrivilege 3136 TiWorker.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 4716 wrote to memory of 2672 4716 siparis.exe 82 PID 4716 wrote to memory of 2672 4716 siparis.exe 82 PID 4716 wrote to memory of 2672 4716 siparis.exe 82 PID 2672 wrote to memory of 4536 2672 wgvkh.exe 83 PID 2672 wrote to memory of 4536 2672 wgvkh.exe 83 PID 2672 wrote to memory of 4536 2672 wgvkh.exe 83 PID 2672 wrote to memory of 4536 2672 wgvkh.exe 83 PID 2672 wrote to memory of 4536 2672 wgvkh.exe 83 PID 2672 wrote to memory of 4536 2672 wgvkh.exe 83 PID 2620 wrote to memory of 840 2620 Explorer.EXE 86 PID 2620 wrote to memory of 840 2620 Explorer.EXE 86 PID 2620 wrote to memory of 840 2620 Explorer.EXE 86 PID 840 wrote to memory of 4672 840 cmmon32.exe 96 PID 840 wrote to memory of 4672 840 cmmon32.exe 96 PID 840 wrote to memory of 4672 840 cmmon32.exe 96
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\siparis.exe"C:\Users\Admin\AppData\Local\Temp\siparis.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\wgvkh.exeC:\Users\Admin\AppData\Local\Temp\wgvkh.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\wgvkh.exeC:\Users\Admin\AppData\Local\Temp\wgvkh.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4536
-
-
-
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\wgvkh.exe"3⤵PID:4672
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3164
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3136