Analysis
-
max time kernel
4294209s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20220311-en -
submitted
15-03-2022 15:41
Static task
static1
Behavioral task
behavioral1
Sample
f44d75390275e2f15ea0111de765cdaede7436331101363ba1db17b74f8cd88e.js
Resource
win7-20220311-en
General
-
Target
f44d75390275e2f15ea0111de765cdaede7436331101363ba1db17b74f8cd88e.js
-
Size
864KB
-
MD5
fe330e62ee592637466d5def2358afa8
-
SHA1
62bb2ec1f62e38b9c2605ba661b85ac10cddefe0
-
SHA256
f44d75390275e2f15ea0111de765cdaede7436331101363ba1db17b74f8cd88e
-
SHA512
ba59ac6e0070aae34b5cc98b6ba041f21fbbb52cd2e4551bc30a0570aa48175abb2c2aef14886bfc54128d080558e5dfd20f8800f572d7286dfa242c7032a9d2
Malware Config
Extracted
xloader
2.5
qatv
sexycurvycool.com
webundefinedstaging.website
gaspeehaze.com
adomnaturals.com
best10canadianreviews.info
nikekogan.com
5537sbishop.info
khonnaisoi.com
cures8t.com
garthoaks.com
belvederepharmagroup.com
chivo.plus
qishanlin.top
ccjon1.com
biz-financeagency.com
bdqimeng88.top
3-little-pigs.com
ord13route.art
webku-trial.xyz
ncgf28.xyz
nickatwoodrealestate.com
123piezas.com
woodju.com
afmview.com
travessiacursos.com
shreerragroindustries.com
lilacw.com
travelingbrunchbesties.com
cityloot.net
healthspecialist.info
kaliseastrand.com
jecoman.com
ystmo.com
lifecoach.directory
callahaninsurancegroup.com
commercialglassreplacement.com
webesluts.com
h5aolyhh6.com
drgcatherine.com
ronas.top
thevoilagroup.com
diemcrypto.tools
invest68.com
eleinmsa.xyz
sddn3.xyz
7dakka.online
endesasoluciounica.com
authenticinvesments.com
texasjusticelawyers.com
canada-settlement.com
outlook-admins.com
primarywatch.com
kaboomslots.email
innoattic.com
upstreetbarbershop.com
trulyproofreading.com
calciumsignaling.com
13977999.com
sheriffindiana.biz
uncorrectly.com
jjyymh.com
worldpasspassport.com
yjwnktaz.com
royalknightent.store
swachharepolymix.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 5 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\bin.exe xloader behavioral1/memory/1372-58-0x0000000001340000-0x0000000001369000-memory.dmp xloader behavioral1/memory/1372-61-0x0000000001340000-0x0000000001369000-memory.dmp xloader C:\Users\Admin\AppData\Local\Temp\bin.exe xloader behavioral1/memory/1640-67-0x0000000000080000-0x00000000000A9000-memory.dmp xloader -
Blocklisted process makes network request 6 IoCs
Processes:
wscript.exeflow pid process 5 468 wscript.exe 12 468 wscript.exe 19 468 wscript.exe 29 468 wscript.exe 40 468 wscript.exe 53 468 wscript.exe -
Executes dropped EXE 1 IoCs
Processes:
bin.exepid process 1372 bin.exe -
Drops startup file 2 IoCs
Processes:
wscript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vFloVdiJJT.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vFloVdiJJT.js wscript.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
wscript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows\CurrentVersion\Run\00FAYTSXGU = "\"C:\\Users\\Admin\\AppData\\Roaming\\vFloVdiJJT.js\"" wscript.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
bin.exemstsc.exedescription pid process target process PID 1372 set thread context of 1420 1372 bin.exe Explorer.EXE PID 1372 set thread context of 1420 1372 bin.exe Explorer.EXE PID 1640 set thread context of 1420 1640 mstsc.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 31 IoCs
Processes:
bin.exemstsc.exepid process 1372 bin.exe 1372 bin.exe 1372 bin.exe 1640 mstsc.exe 1640 mstsc.exe 1640 mstsc.exe 1640 mstsc.exe 1640 mstsc.exe 1640 mstsc.exe 1640 mstsc.exe 1640 mstsc.exe 1640 mstsc.exe 1640 mstsc.exe 1640 mstsc.exe 1640 mstsc.exe 1640 mstsc.exe 1640 mstsc.exe 1640 mstsc.exe 1640 mstsc.exe 1640 mstsc.exe 1640 mstsc.exe 1640 mstsc.exe 1640 mstsc.exe 1640 mstsc.exe 1640 mstsc.exe 1640 mstsc.exe 1640 mstsc.exe 1640 mstsc.exe 1640 mstsc.exe 1640 mstsc.exe 1640 mstsc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1420 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
bin.exemstsc.exepid process 1372 bin.exe 1372 bin.exe 1372 bin.exe 1372 bin.exe 1640 mstsc.exe 1640 mstsc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
bin.exemstsc.exedescription pid process Token: SeDebugPrivilege 1372 bin.exe Token: SeDebugPrivilege 1640 mstsc.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1420 Explorer.EXE 1420 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1420 Explorer.EXE 1420 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
wscript.exeExplorer.EXEmstsc.exedescription pid process target process PID 1832 wrote to memory of 468 1832 wscript.exe wscript.exe PID 1832 wrote to memory of 468 1832 wscript.exe wscript.exe PID 1832 wrote to memory of 468 1832 wscript.exe wscript.exe PID 1832 wrote to memory of 1372 1832 wscript.exe bin.exe PID 1832 wrote to memory of 1372 1832 wscript.exe bin.exe PID 1832 wrote to memory of 1372 1832 wscript.exe bin.exe PID 1832 wrote to memory of 1372 1832 wscript.exe bin.exe PID 1420 wrote to memory of 1640 1420 Explorer.EXE mstsc.exe PID 1420 wrote to memory of 1640 1420 Explorer.EXE mstsc.exe PID 1420 wrote to memory of 1640 1420 Explorer.EXE mstsc.exe PID 1420 wrote to memory of 1640 1420 Explorer.EXE mstsc.exe PID 1640 wrote to memory of 1064 1640 mstsc.exe cmd.exe PID 1640 wrote to memory of 1064 1640 mstsc.exe cmd.exe PID 1640 wrote to memory of 1064 1640 mstsc.exe cmd.exe PID 1640 wrote to memory of 1064 1640 mstsc.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\f44d75390275e2f15ea0111de765cdaede7436331101363ba1db17b74f8cd88e.js2⤵
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\vFloVdiJJT.js"3⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:468 -
C:\Users\Admin\AppData\Local\Temp\bin.exe"C:\Users\Admin\AppData\Local\Temp\bin.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1372 -
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\bin.exe"3⤵PID:1064
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\bin.exeMD5
d2bc603d4e0e7011f2b8ba93bcd75293
SHA19fb2540d65441714cfcf7e4cc2432a96255f1f6d
SHA256c70b39662e04b20fb68d78b0dc45694b6cc9c564c7c0535c286ee37fd1730d4b
SHA51249835fc13efa9406fb7d7b85247013f45eeaa3e3cd9d1ae2a5c867f9231afae08c1051799b3b137f79476065035bedf5953d999da12e43a761dc369dfe90956b
-
C:\Users\Admin\AppData\Local\Temp\bin.exeMD5
d2bc603d4e0e7011f2b8ba93bcd75293
SHA19fb2540d65441714cfcf7e4cc2432a96255f1f6d
SHA256c70b39662e04b20fb68d78b0dc45694b6cc9c564c7c0535c286ee37fd1730d4b
SHA51249835fc13efa9406fb7d7b85247013f45eeaa3e3cd9d1ae2a5c867f9231afae08c1051799b3b137f79476065035bedf5953d999da12e43a761dc369dfe90956b
-
C:\Users\Admin\AppData\Roaming\vFloVdiJJT.jsMD5
039b788c510573fb8d1c19038ad1ec14
SHA18c8928d097a198ddf6664d56191f74a9ac404804
SHA25628b87f27295a93bedcd9aed6896971a7bc9317194968e6f1f532b2b47d972b2d
SHA512a6755442e1936f61d35a6ce3af5c154fd0288a822029428c7675255aa97186b58185c2e53bdb94580256cc7c62eb6dce03cffff6388fd7942e699a020ecae00e
-
memory/1372-61-0x0000000001340000-0x0000000001369000-memory.dmpFilesize
164KB
-
memory/1372-57-0x0000000000710000-0x0000000000A13000-memory.dmpFilesize
3.0MB
-
memory/1372-59-0x0000000000180000-0x0000000000191000-memory.dmpFilesize
68KB
-
memory/1372-62-0x0000000000440000-0x0000000000451000-memory.dmpFilesize
68KB
-
memory/1372-58-0x0000000001340000-0x0000000001369000-memory.dmpFilesize
164KB
-
memory/1420-60-0x00000000068E0000-0x00000000069F7000-memory.dmpFilesize
1.1MB
-
memory/1420-70-0x0000000004D50000-0x0000000004E22000-memory.dmpFilesize
840KB
-
memory/1420-63-0x0000000006C90000-0x0000000006D8E000-memory.dmpFilesize
1016KB
-
memory/1640-64-0x00000000759B1000-0x00000000759B3000-memory.dmpFilesize
8KB
-
memory/1640-66-0x0000000000A90000-0x0000000000B94000-memory.dmpFilesize
1.0MB
-
memory/1640-67-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1640-68-0x0000000002130000-0x0000000002433000-memory.dmpFilesize
3.0MB
-
memory/1640-69-0x00000000009F0000-0x0000000000A80000-memory.dmpFilesize
576KB
-
memory/1832-54-0x000007FEFBCB1000-0x000007FEFBCB3000-memory.dmpFilesize
8KB