Analysis
- max time kernel
167s - max time network
176s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
22/02/2022, 09:28
Static task
static1
Behavioral task
behavioral1
Sample
JP181213001.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target JP181213001.exe
- Size 248KB
- Sample220222-lfb7lsgcfp
- SHA256 ff3e94ded64b43f620ba549db99baa31abdd763209b60f7c9fc884b82cfac6d3
- MD5 2227e82af165e9abd6be3e1f88b87bb5
- SHA1 18955ce83951ac6545f1119b4db6a05187545f7b
- SHA512 391f34e1619ecb6990f00d165c5475cacf8f2240dca0c7de35678648c370ba8cd1363b6807cd383589c279af0539ca8d15e4d60aa0394d31646c08ece3cdf09a
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
Version
-
4.1
Campaign
-
d1s8
Decoy
-
xn--hy1b43d3xk9tap20a7jq.com
-
ratedbinoculars.com
-
g1rawat.com
-
solten.online
-
rawmaterialsadvisory.com
-
bulkbackhauls.com
-
oldartbooks.com
-
turtletraxontopsailbeach.com
-
onedollarlights.com
-
iamhwh.com
-
yiyue10000.com
-
denisepishgam.com
-
67ys.net
-
secretparisguide.com
-
stephaniesews.com
-
rubiasytostadas.com
-
azizyagraphics.com
-
magicmea.com
-
villatradin.com
-
icatsles.com
-
runliqy.com
-
meantspan.com
-
footwearnft.net
-
esteyaccounting.com
-
ernesttan.com
-
cryptostocktrading.xyz
-
saraglvz.com
-
rudiio.com
-
itbylaw.com
-
creatorethics.com
-
meridiancrea.com
-
deknop.com
-
twpowe.com
-
playerversusenvironment.com
-
jamesfernandesadvocacia.com
-
freshpaintja.com
-
elvirtualsolutions.com
-
mythsaturdays.com
-
cownerie.com
-
paddlebabe.com
-
ai8112.net
-
garagedoorofnaples.com
-
ikonikartfilm.net
-
shichaworld.com
-
gilac-hygiene.com
-
xaboodftehas.com
-
interbroadinternational.com
-
multiserviciosjrsd.com
-
midtsommerfest.com
-
gloriaescort.com
-
affordablefenceandhandrails.net
-
divinetastebycourtney.com
-
brg-legrandjardin.info
-
pwithouti.com
-
chooseitor.com
-
anysniper.com
-
cocoheavy.com
-
majesticchangemarketers.com
-
unspeaks91saz.com
-
workintui.com
-
comitedaidebeauceville-cab.com
-
rnconekt.com
-
simbecinc.com
-
investingfineart.com
-
bloombox.design
Signatures
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Formbook Payload 2 IoCs
resource yara_rule behavioral2/memory/1780-134-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3168-143-0x0000000002EE0000-0x0000000002F0F000-memory.dmp formbook - Executes dropped EXE 2 IoCs
pid Process 3328 gdtvllu.exe 1780 gdtvllu.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3328 set thread context of 1780 3328 gdtvllu.exe 58 PID 1780 set thread context of 2436 1780 gdtvllu.exe 35 PID 3168 set thread context of 2436 3168 help.exe 35 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies data under HKEY_USERS 46 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "7.143184" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4224" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.000000" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4332" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.195848" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" svchost.exe - Suspicious behavior: EnumeratesProcesses 52 IoCs
pid Process 1780 gdtvllu.exe 1780 gdtvllu.exe 1780 gdtvllu.exe 1780 gdtvllu.exe 3168 help.exe 3168 help.exe 3168 help.exe 3168 help.exe 3168 help.exe 3168 help.exe 3168 help.exe 3168 help.exe 3168 help.exe 3168 help.exe 3168 help.exe 3168 help.exe 3168 help.exe 3168 help.exe 3168 help.exe 3168 help.exe 3168 help.exe 3168 help.exe 3168 help.exe 3168 help.exe 3168 help.exe 3168 help.exe 3168 help.exe 3168 help.exe 3168 help.exe 3168 help.exe 3168 help.exe 3168 help.exe 3168 help.exe 3168 help.exe 3168 help.exe 3168 help.exe 3168 help.exe 3168 help.exe 3168 help.exe 3168 help.exe 3168 help.exe 3168 help.exe 3168 help.exe 3168 help.exe 3168 help.exe 3168 help.exe 3168 help.exe 3168 help.exe 3168 help.exe 3168 help.exe 3168 help.exe 3168 help.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2436 Explorer.EXE - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 1780 gdtvllu.exe 1780 gdtvllu.exe 1780 gdtvllu.exe 3168 help.exe 3168 help.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 1780 gdtvllu.exe Token: SeShutdownPrivilege 2436 Explorer.EXE Token: SeCreatePagefilePrivilege 2436 Explorer.EXE Token: SeDebugPrivilege 3168 help.exe Token: SeShutdownPrivilege 2436 Explorer.EXE Token: SeCreatePagefilePrivilege 2436 Explorer.EXE - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1640 wrote to memory of 3328 1640 JP181213001.exe 55 PID 1640 wrote to memory of 3328 1640 JP181213001.exe 55 PID 1640 wrote to memory of 3328 1640 JP181213001.exe 55 PID 3328 wrote to memory of 1780 3328 gdtvllu.exe 58 PID 3328 wrote to memory of 1780 3328 gdtvllu.exe 58 PID 3328 wrote to memory of 1780 3328 gdtvllu.exe 58 PID 3328 wrote to memory of 1780 3328 gdtvllu.exe 58 PID 3328 wrote to memory of 1780 3328 gdtvllu.exe 58 PID 3328 wrote to memory of 1780 3328 gdtvllu.exe 58 PID 2436 wrote to memory of 3168 2436 Explorer.EXE 61 PID 2436 wrote to memory of 3168 2436 Explorer.EXE 61 PID 2436 wrote to memory of 3168 2436 Explorer.EXE 61 PID 3168 wrote to memory of 3424 3168 help.exe 62 PID 3168 wrote to memory of 3424 3168 help.exe 62 PID 3168 wrote to memory of 3424 3168 help.exe 62
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\JP181213001.exe"C:\Users\Admin\AppData\Local\Temp\JP181213001.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\gdtvllu.exeC:\Users\Admin\AppData\Local\Temp\gdtvllu.exe C:\Users\Admin\AppData\Local\Temp\eitjyct3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\gdtvllu.exeC:\Users\Admin\AppData\Local\Temp\gdtvllu.exe C:\Users\Admin\AppData\Local\Temp\eitjyct4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1780
-
-
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:460
-
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\gdtvllu.exe"3⤵PID:3424
-
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Modifies data under HKEY_USERS
PID:3208