Analysis
- max time kernel
155s - max time network
161s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
11/02/2022, 11:28
Static task
static1
Behavioral task
behavioral1
Sample
7a71fc7a13b8b4cc509aa9f238e80dbf.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target 7a71fc7a13b8b4cc509aa9f238e80dbf.exe
- Size 292KB
- Sample220211-nk1f4scfa4
- SHA256 9bece1a915a3849979795cea77094ccf1c1bc8d93b33ef05a84c8d56988c2816
- MD5 7a71fc7a13b8b4cc509aa9f238e80dbf
- SHA1 9c5a2f5dc83500755c16f4facc98fbf5efc8a1d8
- SHA512 bf4f542dfbd8f5ec8bdbf5748a242ed6595ea08026713c9d4c9950af5c4901633747dcfe8c715e73a12dabe8d73a596e827924dd89a1c0b4149deef3ecc06c27
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
Version
-
4.1
Campaign
-
by73
Decoy
-
advertencys.info
-
printableminis.com
-
mjahpr.icu
-
workremotehome.com
-
es-dailynews.info
-
zaryard.com
-
your-bakemark.com
-
metalypsis.com
-
primehomerealtyut.com
-
turbantechie.com
-
dd-mhgj.com
-
earnwithcryptocurrency.com
-
xn--8dbh2c.com
-
trainopia.com
-
plysec.xyz
-
avis-tente.com
-
pitabel.com
-
gabriannanails.com
-
thebipolarpenguin.com
-
alumistarcomponentes.com
-
unoevento.com
-
webceo.info
-
manukamortgages.ltd
-
tccanadapod.com
-
supersuds.info
-
brcsnow.club
-
beijing911.com
-
jinnkosolar.com
-
monanimes.com
-
depivony.space
-
webstergreenparking.com
-
sp2022.top
-
jenoediting.com
-
beautysurgepodcast.com
-
untitlednft.art
-
abmur.icu
-
albagroup.online
-
hunbrain.com
-
gmiinvestment.com
-
lumpwant.com
-
fr-kamagra.com
-
nightdate.club
-
onlineritual.com
-
shinaideba.com
-
craftsmenmasters.com
-
stock-file.com
-
queensmencocktails.com
-
megaconstructionofct.com
-
youcomway.com
-
multichannels247.com
-
pasti-lite.com
-
pokerfac.info
-
highpointquartet.com
-
smokinwaffles.com
-
ocoremioparis.com
-
decisivedevelopmentllc.com
-
diamondstormentertainment.com
-
vidacanela.com
-
hgwpoh.icu
-
eqajyxeg.space
-
easydocumentssolutions.com
-
perfect-calendar.com
-
oidepps.com
-
solastaacademy.com
-
activusrealtime.com
Signatures
- Formbook Payload 2 IoCs
resource yara_rule behavioral2/memory/3316-134-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2080-142-0x0000000002E40000-0x0000000002E6F000-memory.dmp formbook - Executes dropped EXE 2 IoCs
pid Process 1312 btodu.exe 3316 btodu.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1312 set thread context of 3316 1312 btodu.exe 60 PID 3316 set thread context of 2492 3316 btodu.exe 34 PID 2080 set thread context of 2492 2080 systray.exe 34 - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat svchost.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotifyIcon.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotifyIcon.exe - Modifies data under HKEY_USERS 51 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.013074" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "90228624" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "1157726" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "4" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "3952" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "8.823641" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4124" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132892289178769192" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" svchost.exe - Suspicious behavior: EnumeratesProcesses 56 IoCs
pid Process 3316 btodu.exe 3316 btodu.exe 3316 btodu.exe 3316 btodu.exe 2080 systray.exe 2080 systray.exe 2080 systray.exe 2080 systray.exe 2080 systray.exe 2080 systray.exe 2080 systray.exe 2080 systray.exe 2080 systray.exe 2080 systray.exe 2080 systray.exe 2080 systray.exe 2080 systray.exe 2080 systray.exe 2080 systray.exe 2080 systray.exe 2080 systray.exe 2080 systray.exe 2080 systray.exe 2080 systray.exe 2080 systray.exe 2080 systray.exe 2080 systray.exe 2080 systray.exe 2080 systray.exe 2080 systray.exe 2080 systray.exe 2080 systray.exe 2080 systray.exe 2080 systray.exe 2080 systray.exe 2080 systray.exe 2080 systray.exe 2080 systray.exe 2080 systray.exe 2080 systray.exe 2080 systray.exe 2080 systray.exe 2080 systray.exe 2080 systray.exe 2080 systray.exe 2080 systray.exe 2080 systray.exe 2080 systray.exe 2080 systray.exe 2080 systray.exe 2080 systray.exe 2080 systray.exe 2080 systray.exe 2080 systray.exe 2080 systray.exe 2080 systray.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2492 Explorer.EXE - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 3316 btodu.exe 3316 btodu.exe 3316 btodu.exe 2080 systray.exe 2080 systray.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3316 btodu.exe Token: SeDebugPrivilege 2080 systray.exe Token: SeShutdownPrivilege 2492 Explorer.EXE Token: SeCreatePagefilePrivilege 2492 Explorer.EXE - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1344 wrote to memory of 1312 1344 7a71fc7a13b8b4cc509aa9f238e80dbf.exe 59 PID 1344 wrote to memory of 1312 1344 7a71fc7a13b8b4cc509aa9f238e80dbf.exe 59 PID 1344 wrote to memory of 1312 1344 7a71fc7a13b8b4cc509aa9f238e80dbf.exe 59 PID 1312 wrote to memory of 3316 1312 btodu.exe 60 PID 1312 wrote to memory of 3316 1312 btodu.exe 60 PID 1312 wrote to memory of 3316 1312 btodu.exe 60 PID 1312 wrote to memory of 3316 1312 btodu.exe 60 PID 1312 wrote to memory of 3316 1312 btodu.exe 60 PID 1312 wrote to memory of 3316 1312 btodu.exe 60 PID 2492 wrote to memory of 2080 2492 Explorer.EXE 61 PID 2492 wrote to memory of 2080 2492 Explorer.EXE 61 PID 2492 wrote to memory of 2080 2492 Explorer.EXE 61 PID 2080 wrote to memory of 2252 2080 systray.exe 68 PID 2080 wrote to memory of 2252 2080 systray.exe 68 PID 2080 wrote to memory of 2252 2080 systray.exe 68
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\7a71fc7a13b8b4cc509aa9f238e80dbf.exe"C:\Users\Admin\AppData\Local\Temp\7a71fc7a13b8b4cc509aa9f238e80dbf.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\btodu.exeC:\Users\Admin\AppData\Local\Temp\btodu.exe C:\Users\Admin\AppData\Local\Temp\qbwecwehh3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\btodu.exeC:\Users\Admin\AppData\Local\Temp\btodu.exe C:\Users\Admin\AppData\Local\Temp\qbwecwehh4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3316
-
-
-
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\btodu.exe"3⤵PID:2252
-
-
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
PID:3484
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2636