Analysis
- max time kernel
155s - max time network
158s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
09/02/2022, 15:32
Static task
static1
Behavioral task
behavioral1
Sample
HSBC Payment Advice.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target HSBC Payment Advice.exe
- Size 688KB
- Sample220209-syn3fsagc7
- SHA256 d2d2107ce64f31669e2c8dbe31da2cc683087050492fa4e8e31940e30f33ff04
- MD5 d35c34f7c23809c5ec5e9b484f5fe953
- SHA1 d5e668051348018352e72cf745c600ddf3afff2b
- SHA512 4ba552fd6a133e9c0f45f7705447a81d4d1507d08adfaafa5a3b2103896a181e71d78b63ba61b0b0636b5029950eda53bf38a72bdaec08deb1b3f4659d9ac210
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
Version
-
4.1
Campaign
-
r3hg
Decoy
-
ease-dev-core.com
-
bologna-wine.com
-
wettybucket.com
-
tubeclass.com
-
xn--wgvyex1as30j.xn--55qx5d
-
drmas.clinic
-
zhjtaszh.com
-
bendedbundel.quest
-
doctorpritzker.com
-
sumiyoshiku-kensyoen.xyz
-
stpcreative.digital
-
marinaegeorgeprasempre.com
-
ibasho.group
-
elespaciohabana.online
-
aiinblockchain.com
-
nmkangan.com
-
sutorimogemu.xyz
-
punksushi.com
-
0atey.com
-
laindofficial.com
-
whitepace.xyz
-
sportmasster.host
-
ypjlleseekus.quest
-
liontechsl.com
-
event-sudio.online
-
xn--alfadiseo-s6a.com
-
leroyalstevenson.com
-
investmentselectuk.com
-
odopola.xyz
-
irvnwrks.com
-
pavlonmedia.net
-
oostensundet.quest
-
logternal.com
-
gesmedio.com
-
discovercotswoldcottages.com
-
jormme.club
-
tehoierenursery.online
-
jkqipaiyouxikaifa.com
-
cse-hiventy.com
-
airpods-case.com
-
wetassbrisket.net
-
ita-pots.website
-
holowatcher.com
-
web-solutiontnpasumo5.xyz
-
elitepackingpros.com
-
karollucas.com
-
whatsvapp.xyz
-
zaxisfinancial.online
-
mettlesome.xyz
-
atxhousecleaning.com
-
shreerragroindustries.com
-
instantbooking.agency
-
a-zdog.com
-
ravierkonan.com
-
hoachathanbon.com
-
jlvip1057.com
-
harsors.com
-
label-things.com
-
alnaim.online
-
dingfishingstore.com
-
onnoff.net
-
albumuniverse.com
-
thejeffries.net
-
onlinemusicfestival.store
-
ameliapardo.net
Signatures
- Formbook Payload 3 IoCs
resource yara_rule behavioral2/memory/4524-135-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4524-142-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4772-147-0x0000000001030000-0x000000000105F000-memory.dmp formbook - Executes dropped EXE 2 IoCs
pid Process 4700 bsvsg.exe 4524 bsvsg.exe - Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 4700 set thread context of 4524 4700 bsvsg.exe 83 PID 4524 set thread context of 2620 4524 bsvsg.exe 44 PID 4524 set thread context of 2620 4524 bsvsg.exe 44 PID 4772 set thread context of 2620 4772 colorcpl.exe 44 - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 4524 bsvsg.exe 4524 bsvsg.exe 4524 bsvsg.exe 4524 bsvsg.exe 4524 bsvsg.exe 4524 bsvsg.exe 4772 colorcpl.exe 4772 colorcpl.exe 4772 colorcpl.exe 4772 colorcpl.exe 4772 colorcpl.exe 4772 colorcpl.exe 4772 colorcpl.exe 4772 colorcpl.exe 4772 colorcpl.exe 4772 colorcpl.exe 4772 colorcpl.exe 4772 colorcpl.exe 4772 colorcpl.exe 4772 colorcpl.exe 4772 colorcpl.exe 4772 colorcpl.exe 4772 colorcpl.exe 4772 colorcpl.exe 4772 colorcpl.exe 4772 colorcpl.exe 4772 colorcpl.exe 4772 colorcpl.exe 4772 colorcpl.exe 4772 colorcpl.exe 4772 colorcpl.exe 4772 colorcpl.exe 4772 colorcpl.exe 4772 colorcpl.exe 4772 colorcpl.exe 4772 colorcpl.exe 4772 colorcpl.exe 4772 colorcpl.exe 4772 colorcpl.exe 4772 colorcpl.exe 4772 colorcpl.exe 4772 colorcpl.exe 4772 colorcpl.exe 4772 colorcpl.exe 4772 colorcpl.exe 4772 colorcpl.exe 4772 colorcpl.exe 4772 colorcpl.exe 4772 colorcpl.exe 4772 colorcpl.exe 4772 colorcpl.exe 4772 colorcpl.exe 4772 colorcpl.exe 4772 colorcpl.exe 4772 colorcpl.exe 4772 colorcpl.exe 4772 colorcpl.exe 4772 colorcpl.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2620 Explorer.EXE - Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 4524 bsvsg.exe 4524 bsvsg.exe 4524 bsvsg.exe 4524 bsvsg.exe 4772 colorcpl.exe 4772 colorcpl.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4524 bsvsg.exe Token: SeShutdownPrivilege 3752 svchost.exe Token: SeCreatePagefilePrivilege 3752 svchost.exe Token: SeShutdownPrivilege 3752 svchost.exe Token: SeCreatePagefilePrivilege 3752 svchost.exe Token: SeDebugPrivilege 4772 colorcpl.exe Token: SeShutdownPrivilege 3752 svchost.exe Token: SeCreatePagefilePrivilege 3752 svchost.exe Token: SeSecurityPrivilege 4296 TiWorker.exe Token: SeRestorePrivilege 4296 TiWorker.exe Token: SeBackupPrivilege 4296 TiWorker.exe Token: SeBackupPrivilege 4296 TiWorker.exe Token: SeRestorePrivilege 4296 TiWorker.exe Token: SeSecurityPrivilege 4296 TiWorker.exe Token: SeBackupPrivilege 4296 TiWorker.exe Token: SeRestorePrivilege 4296 TiWorker.exe Token: SeSecurityPrivilege 4296 TiWorker.exe Token: SeBackupPrivilege 4296 TiWorker.exe Token: SeRestorePrivilege 4296 TiWorker.exe Token: SeSecurityPrivilege 4296 TiWorker.exe Token: SeBackupPrivilege 4296 TiWorker.exe Token: SeRestorePrivilege 4296 TiWorker.exe Token: SeSecurityPrivilege 4296 TiWorker.exe Token: SeBackupPrivilege 4296 TiWorker.exe Token: SeRestorePrivilege 4296 TiWorker.exe Token: SeSecurityPrivilege 4296 TiWorker.exe Token: SeBackupPrivilege 4296 TiWorker.exe Token: SeRestorePrivilege 4296 TiWorker.exe Token: SeSecurityPrivilege 4296 TiWorker.exe Token: SeBackupPrivilege 4296 TiWorker.exe Token: SeRestorePrivilege 4296 TiWorker.exe Token: SeSecurityPrivilege 4296 TiWorker.exe Token: SeBackupPrivilege 4296 TiWorker.exe Token: SeRestorePrivilege 4296 TiWorker.exe Token: SeSecurityPrivilege 4296 TiWorker.exe Token: SeBackupPrivilege 4296 TiWorker.exe Token: SeRestorePrivilege 4296 TiWorker.exe Token: SeSecurityPrivilege 4296 TiWorker.exe Token: SeBackupPrivilege 4296 TiWorker.exe Token: SeRestorePrivilege 4296 TiWorker.exe Token: SeSecurityPrivilege 4296 TiWorker.exe Token: SeBackupPrivilege 4296 TiWorker.exe Token: SeRestorePrivilege 4296 TiWorker.exe Token: SeSecurityPrivilege 4296 TiWorker.exe Token: SeBackupPrivilege 4296 TiWorker.exe Token: SeRestorePrivilege 4296 TiWorker.exe Token: SeSecurityPrivilege 4296 TiWorker.exe Token: SeBackupPrivilege 4296 TiWorker.exe Token: SeRestorePrivilege 4296 TiWorker.exe Token: SeSecurityPrivilege 4296 TiWorker.exe Token: SeBackupPrivilege 4296 TiWorker.exe Token: SeRestorePrivilege 4296 TiWorker.exe Token: SeSecurityPrivilege 4296 TiWorker.exe Token: SeBackupPrivilege 4296 TiWorker.exe Token: SeRestorePrivilege 4296 TiWorker.exe Token: SeSecurityPrivilege 4296 TiWorker.exe Token: SeBackupPrivilege 4296 TiWorker.exe Token: SeRestorePrivilege 4296 TiWorker.exe Token: SeSecurityPrivilege 4296 TiWorker.exe Token: SeBackupPrivilege 4296 TiWorker.exe Token: SeRestorePrivilege 4296 TiWorker.exe Token: SeSecurityPrivilege 4296 TiWorker.exe Token: SeBackupPrivilege 4296 TiWorker.exe Token: SeRestorePrivilege 4296 TiWorker.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3132 wrote to memory of 4700 3132 HSBC Payment Advice.exe 82 PID 3132 wrote to memory of 4700 3132 HSBC Payment Advice.exe 82 PID 3132 wrote to memory of 4700 3132 HSBC Payment Advice.exe 82 PID 4700 wrote to memory of 4524 4700 bsvsg.exe 83 PID 4700 wrote to memory of 4524 4700 bsvsg.exe 83 PID 4700 wrote to memory of 4524 4700 bsvsg.exe 83 PID 4700 wrote to memory of 4524 4700 bsvsg.exe 83 PID 4700 wrote to memory of 4524 4700 bsvsg.exe 83 PID 4700 wrote to memory of 4524 4700 bsvsg.exe 83 PID 2620 wrote to memory of 4772 2620 Explorer.EXE 86 PID 2620 wrote to memory of 4772 2620 Explorer.EXE 86 PID 2620 wrote to memory of 4772 2620 Explorer.EXE 86 PID 4772 wrote to memory of 4852 4772 colorcpl.exe 93 PID 4772 wrote to memory of 4852 4772 colorcpl.exe 93 PID 4772 wrote to memory of 4852 4772 colorcpl.exe 93
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\HSBC Payment Advice.exe"C:\Users\Admin\AppData\Local\Temp\HSBC Payment Advice.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\bsvsg.exeC:\Users\Admin\AppData\Local\Temp\bsvsg.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\bsvsg.exeC:\Users\Admin\AppData\Local\Temp\bsvsg.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4524
-
-
-
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\bsvsg.exe"3⤵PID:4852
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3752
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4296