Analysis
- max time kernel
148s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
11/02/2022, 18:10
Static task
static1
Behavioral task
behavioral1
Sample
Pago en su nombre.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target Pago en su nombre.exe
- Size 29KB
- Sample220211-wr4fcaefak
- SHA256 fa4fe52b60d9da8ae735fe5ff04114abd194754fcd4ca94c0558ca7f6a3b3945
- MD5 f19ee52e8d1b10d2b91d24662fa56a2f
- SHA1 6e022db1a83984e4f02744834bfbe4ac6b03117c
- SHA512 5a938eb45b7e578a740fa7a0ae9632d4d7e93461caef9c857f9a9b255f82ba94d9abd056df7e308e9f826bb73412bcde3e94ece341b9c2e540d50995924ac9a8
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
Version
-
4.1
Campaign
-
by78
Decoy
-
nyobserve.com
-
vowelssys.com
-
amanwp.com
-
nappig.com
-
ibnusinagroups.com
-
globaleyetechnologies.com
-
getjuicebox.today
-
expotuauto.com
-
yummy-t.com
-
livingtheneurodivergentlife.com
-
wseason.com
-
pediatricsurgerymx.com
-
mtgalerts.com
-
shirlaws.biz
-
pqqkcu.icu
-
gharaten.club
-
dustyjacketdesigns.com
-
fwouz.icu
-
fabricariqueza.site
-
headkandypr.com
-
slmioi.icu
-
historicdowntowngreenville.com
-
chamb33rs.net
-
casamascolo.com
-
sxpehg.icu
-
rjsdaenterprise.com
-
0x666.club
-
phasesmion.com
-
metacoinhouse.com
-
b2xtech.com
-
prachthoutbouw.com
-
vrielinktrade.online
-
tropicalbreezegh.com
-
factoryplus.net
-
artigianishanghai.com
-
clearedgetech.com
-
vibrantindiamagazine.com
-
xn--chamleon-3za.online
-
mamoriya-aqua.com
-
allinteriorrenovations.com
-
huzod.com
-
filmlio.com
-
pcc426.net
-
gerhardpirker.com
-
metauve.com
-
bfjlda.icu
-
myjobtalk.com
-
sethmartransportation.com
-
aapfund.com
-
presetsmagics.com
-
aidecrusadepodcast.com
-
mybulypousa.xyz
-
jaelysslife.com
-
rntaplx.com
-
saskatoonbarber.com
-
nftfnfree.com
-
gunbarrelsafetyclip.com
-
hgystudio.com
-
frombot.net
-
f8in0.icu
-
diginews.tech
-
tsms6.top
-
micapod.com
-
groupltmmexico.com
-
lightgun.tech
Signatures
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Formbook Payload 2 IoCs
resource yara_rule behavioral2/memory/2760-138-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4756-145-0x0000000000140000-0x000000000016F000-memory.dmp formbook - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation Pago en su nombre.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 4388 set thread context of 2760 4388 Pago en su nombre.exe 105 PID 2760 set thread context of 2264 2760 MSBuild.exe 39 PID 4756 set thread context of 2264 4756 chkdsk.exe 39 - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe - Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 4388 Pago en su nombre.exe 4388 Pago en su nombre.exe 2760 MSBuild.exe 2760 MSBuild.exe 2760 MSBuild.exe 2760 MSBuild.exe 4756 chkdsk.exe 4756 chkdsk.exe 4756 chkdsk.exe 4756 chkdsk.exe 4756 chkdsk.exe 4756 chkdsk.exe 4756 chkdsk.exe 4756 chkdsk.exe 4756 chkdsk.exe 4756 chkdsk.exe 4756 chkdsk.exe 4756 chkdsk.exe 4756 chkdsk.exe 4756 chkdsk.exe 4756 chkdsk.exe 4756 chkdsk.exe 4756 chkdsk.exe 4756 chkdsk.exe - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 2760 MSBuild.exe 2760 MSBuild.exe 2760 MSBuild.exe 4756 chkdsk.exe 4756 chkdsk.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2772 svchost.exe Token: SeCreatePagefilePrivilege 2772 svchost.exe Token: SeShutdownPrivilege 2772 svchost.exe Token: SeCreatePagefilePrivilege 2772 svchost.exe Token: SeShutdownPrivilege 2772 svchost.exe Token: SeCreatePagefilePrivilege 2772 svchost.exe Token: SeSecurityPrivilege 1388 TiWorker.exe Token: SeRestorePrivilege 1388 TiWorker.exe Token: SeBackupPrivilege 1388 TiWorker.exe Token: SeBackupPrivilege 1388 TiWorker.exe Token: SeRestorePrivilege 1388 TiWorker.exe Token: SeSecurityPrivilege 1388 TiWorker.exe Token: SeBackupPrivilege 1388 TiWorker.exe Token: SeRestorePrivilege 1388 TiWorker.exe Token: SeSecurityPrivilege 1388 TiWorker.exe Token: SeBackupPrivilege 1388 TiWorker.exe Token: SeRestorePrivilege 1388 TiWorker.exe Token: SeSecurityPrivilege 1388 TiWorker.exe Token: SeBackupPrivilege 1388 TiWorker.exe Token: SeRestorePrivilege 1388 TiWorker.exe Token: SeSecurityPrivilege 1388 TiWorker.exe Token: SeBackupPrivilege 1388 TiWorker.exe Token: SeRestorePrivilege 1388 TiWorker.exe Token: SeSecurityPrivilege 1388 TiWorker.exe Token: SeBackupPrivilege 1388 TiWorker.exe Token: SeRestorePrivilege 1388 TiWorker.exe Token: SeSecurityPrivilege 1388 TiWorker.exe Token: SeBackupPrivilege 1388 TiWorker.exe Token: SeRestorePrivilege 1388 TiWorker.exe Token: SeSecurityPrivilege 1388 TiWorker.exe Token: SeBackupPrivilege 1388 TiWorker.exe Token: SeRestorePrivilege 1388 TiWorker.exe Token: SeSecurityPrivilege 1388 TiWorker.exe Token: SeBackupPrivilege 1388 TiWorker.exe Token: SeRestorePrivilege 1388 TiWorker.exe Token: SeSecurityPrivilege 1388 TiWorker.exe Token: SeBackupPrivilege 1388 TiWorker.exe Token: SeRestorePrivilege 1388 TiWorker.exe Token: SeSecurityPrivilege 1388 TiWorker.exe Token: SeBackupPrivilege 1388 TiWorker.exe Token: SeRestorePrivilege 1388 TiWorker.exe Token: SeSecurityPrivilege 1388 TiWorker.exe Token: SeBackupPrivilege 1388 TiWorker.exe Token: SeRestorePrivilege 1388 TiWorker.exe Token: SeSecurityPrivilege 1388 TiWorker.exe Token: SeBackupPrivilege 1388 TiWorker.exe Token: SeRestorePrivilege 1388 TiWorker.exe Token: SeSecurityPrivilege 1388 TiWorker.exe Token: SeBackupPrivilege 1388 TiWorker.exe Token: SeRestorePrivilege 1388 TiWorker.exe Token: SeSecurityPrivilege 1388 TiWorker.exe Token: SeBackupPrivilege 1388 TiWorker.exe Token: SeRestorePrivilege 1388 TiWorker.exe Token: SeSecurityPrivilege 1388 TiWorker.exe Token: SeBackupPrivilege 1388 TiWorker.exe Token: SeRestorePrivilege 1388 TiWorker.exe Token: SeSecurityPrivilege 1388 TiWorker.exe Token: SeBackupPrivilege 1388 TiWorker.exe Token: SeRestorePrivilege 1388 TiWorker.exe Token: SeSecurityPrivilege 1388 TiWorker.exe Token: SeBackupPrivilege 1388 TiWorker.exe Token: SeRestorePrivilege 1388 TiWorker.exe Token: SeSecurityPrivilege 1388 TiWorker.exe Token: SeBackupPrivilege 1388 TiWorker.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3624 wrote to memory of 4388 3624 Pago en su nombre.exe 96 PID 3624 wrote to memory of 4388 3624 Pago en su nombre.exe 96 PID 3624 wrote to memory of 4388 3624 Pago en su nombre.exe 96 PID 4388 wrote to memory of 2760 4388 Pago en su nombre.exe 105 PID 4388 wrote to memory of 2760 4388 Pago en su nombre.exe 105 PID 4388 wrote to memory of 2760 4388 Pago en su nombre.exe 105 PID 4388 wrote to memory of 2760 4388 Pago en su nombre.exe 105 PID 4388 wrote to memory of 2760 4388 Pago en su nombre.exe 105 PID 4388 wrote to memory of 2760 4388 Pago en su nombre.exe 105 PID 2264 wrote to memory of 4756 2264 Explorer.EXE 106 PID 2264 wrote to memory of 4756 2264 Explorer.EXE 106 PID 2264 wrote to memory of 4756 2264 Explorer.EXE 106 PID 4756 wrote to memory of 5072 4756 chkdsk.exe 107 PID 4756 wrote to memory of 5072 4756 chkdsk.exe 107 PID 4756 wrote to memory of 5072 4756 chkdsk.exe 107
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\Pago en su nombre.exe"C:\Users\Admin\AppData\Local\Temp\Pago en su nombre.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\Pago en su nombre.exe"C:\Users\Admin\AppData\Local\Temp\Pago en su nombre.exe" Admin3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2760
-
-
-
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵PID:5072
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2772
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1388