Analysis
-
max time kernel
152s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
11-05-2022 02:43
Static task
static1
Behavioral task
behavioral1
Sample
a17edecac2d18b23265bb37f240b5a8cd9eedc00ed6154f384f8ddd7e538ca88.exe
Resource
win7-20220414-en
General
-
Target
a17edecac2d18b23265bb37f240b5a8cd9eedc00ed6154f384f8ddd7e538ca88.exe
-
Size
352KB
-
MD5
aed32e73954c2d390a835e4a9d142a59
-
SHA1
e0aa4527d20f23d3975914e271f17cddfc178b69
-
SHA256
a17edecac2d18b23265bb37f240b5a8cd9eedc00ed6154f384f8ddd7e538ca88
-
SHA512
306d6ee82a5906e575e2882a8ecb880532300499029296ef5e69b1fe1000e3b0a3b224d061fee2368ee2aa788ca92d627726df350a67262b9e0d54beedb5a688
Malware Config
Extracted
formbook
4.1
kvsz
hdlivesonlinetv24.com
illaheehillsseniorliving.com
wihong.com
christopher-cost.com
huayvipee.com
csdroped.xyz
relationsvivantes.com
xmcombohome.com
qingc2.com
sunsetcinemamusic.com
anotherheadache.com
connectlcv.com
unitermi.com
cugetarileunuisarman.com
agakegois.com
burnercouture.com
ambassador-holidays.com
schnarr-design.com
2013lang.com
httattoos.com
cleanhardinquiries.credit
jinduowei.com
despoticat.com
tclongke.com
medknizgka.com
mouowgoah.com
ehswholesale.com
sababa.club
facelift.pink
johnhall2020.com
superbahis62.com
erodea.com
dahaizhaofang.ltd
hiddenlighttattoo.com
michaelpte.com
easytradeoptions.com
jlnclub-hz.com
preciousmetals.supply
xn--9p4b887a.com
bigjbbq.com
twoamys.com
tor-one.com
freenfearlesscoaching.com
playmomknowsbest.com
maasiraq.com
michelon.solutions
shortpocketsmusic.com
pure-sonic.com
marilrealty.com
sillvoice.com
gawahrzinerbne.com
qsshop.net
globalmobilityinsights.com
psm-gen.com
stray-love.com
cjsweettreats.com
ulcforum.com
jlizf.com
guidemining.com
1440windingoakswest.com
mixedrealitycolabs.com
shealetics.com
11700.cloud
chazhentan.com
whealthypeople.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1120-64-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1120-65-0x000000000041ED10-mapping.dmp formbook behavioral1/memory/1552-74-0x0000000000090000-0x00000000000BE000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
a17edecac2d18b23265bb37f240b5a8cd9eedc00ed6154f384f8ddd7e538ca88.exeRegSvcs.execmstp.exedescription pid process target process PID 1512 set thread context of 1120 1512 a17edecac2d18b23265bb37f240b5a8cd9eedc00ed6154f384f8ddd7e538ca88.exe RegSvcs.exe PID 1120 set thread context of 1420 1120 RegSvcs.exe Explorer.EXE PID 1552 set thread context of 1420 1552 cmstp.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 17 IoCs
Processes:
RegSvcs.execmstp.exepid process 1120 RegSvcs.exe 1120 RegSvcs.exe 1552 cmstp.exe 1552 cmstp.exe 1552 cmstp.exe 1552 cmstp.exe 1552 cmstp.exe 1552 cmstp.exe 1552 cmstp.exe 1552 cmstp.exe 1552 cmstp.exe 1552 cmstp.exe 1552 cmstp.exe 1552 cmstp.exe 1552 cmstp.exe 1552 cmstp.exe 1552 cmstp.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.execmstp.exepid process 1120 RegSvcs.exe 1120 RegSvcs.exe 1120 RegSvcs.exe 1552 cmstp.exe 1552 cmstp.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
RegSvcs.execmstp.exedescription pid process Token: SeDebugPrivilege 1120 RegSvcs.exe Token: SeDebugPrivilege 1552 cmstp.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1420 Explorer.EXE 1420 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1420 Explorer.EXE 1420 Explorer.EXE -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
a17edecac2d18b23265bb37f240b5a8cd9eedc00ed6154f384f8ddd7e538ca88.exeExplorer.EXEcmstp.exedescription pid process target process PID 1512 wrote to memory of 628 1512 a17edecac2d18b23265bb37f240b5a8cd9eedc00ed6154f384f8ddd7e538ca88.exe schtasks.exe PID 1512 wrote to memory of 628 1512 a17edecac2d18b23265bb37f240b5a8cd9eedc00ed6154f384f8ddd7e538ca88.exe schtasks.exe PID 1512 wrote to memory of 628 1512 a17edecac2d18b23265bb37f240b5a8cd9eedc00ed6154f384f8ddd7e538ca88.exe schtasks.exe PID 1512 wrote to memory of 628 1512 a17edecac2d18b23265bb37f240b5a8cd9eedc00ed6154f384f8ddd7e538ca88.exe schtasks.exe PID 1512 wrote to memory of 1120 1512 a17edecac2d18b23265bb37f240b5a8cd9eedc00ed6154f384f8ddd7e538ca88.exe RegSvcs.exe PID 1512 wrote to memory of 1120 1512 a17edecac2d18b23265bb37f240b5a8cd9eedc00ed6154f384f8ddd7e538ca88.exe RegSvcs.exe PID 1512 wrote to memory of 1120 1512 a17edecac2d18b23265bb37f240b5a8cd9eedc00ed6154f384f8ddd7e538ca88.exe RegSvcs.exe PID 1512 wrote to memory of 1120 1512 a17edecac2d18b23265bb37f240b5a8cd9eedc00ed6154f384f8ddd7e538ca88.exe RegSvcs.exe PID 1512 wrote to memory of 1120 1512 a17edecac2d18b23265bb37f240b5a8cd9eedc00ed6154f384f8ddd7e538ca88.exe RegSvcs.exe PID 1512 wrote to memory of 1120 1512 a17edecac2d18b23265bb37f240b5a8cd9eedc00ed6154f384f8ddd7e538ca88.exe RegSvcs.exe PID 1512 wrote to memory of 1120 1512 a17edecac2d18b23265bb37f240b5a8cd9eedc00ed6154f384f8ddd7e538ca88.exe RegSvcs.exe PID 1512 wrote to memory of 1120 1512 a17edecac2d18b23265bb37f240b5a8cd9eedc00ed6154f384f8ddd7e538ca88.exe RegSvcs.exe PID 1512 wrote to memory of 1120 1512 a17edecac2d18b23265bb37f240b5a8cd9eedc00ed6154f384f8ddd7e538ca88.exe RegSvcs.exe PID 1512 wrote to memory of 1120 1512 a17edecac2d18b23265bb37f240b5a8cd9eedc00ed6154f384f8ddd7e538ca88.exe RegSvcs.exe PID 1420 wrote to memory of 1552 1420 Explorer.EXE cmstp.exe PID 1420 wrote to memory of 1552 1420 Explorer.EXE cmstp.exe PID 1420 wrote to memory of 1552 1420 Explorer.EXE cmstp.exe PID 1420 wrote to memory of 1552 1420 Explorer.EXE cmstp.exe PID 1420 wrote to memory of 1552 1420 Explorer.EXE cmstp.exe PID 1420 wrote to memory of 1552 1420 Explorer.EXE cmstp.exe PID 1420 wrote to memory of 1552 1420 Explorer.EXE cmstp.exe PID 1552 wrote to memory of 804 1552 cmstp.exe cmd.exe PID 1552 wrote to memory of 804 1552 cmstp.exe cmd.exe PID 1552 wrote to memory of 804 1552 cmstp.exe cmd.exe PID 1552 wrote to memory of 804 1552 cmstp.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a17edecac2d18b23265bb37f240b5a8cd9eedc00ed6154f384f8ddd7e538ca88.exe"C:\Users\Admin\AppData\Local\Temp\a17edecac2d18b23265bb37f240b5a8cd9eedc00ed6154f384f8ddd7e538ca88.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wWtPFU" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCFED.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpCFED.tmpFilesize
1KB
MD5d83ecc720da92ae4bb5a18c4cf79fcc9
SHA13f9ebf78c5656fc00364b831b461b3e299b3c2e4
SHA25609ae69b771d8bfb84e74e964b079cbfd65f718b627eb0bff02e6b7ee7430085c
SHA512ce6e8b8a6b5654ad72bc9d2fb14bd1b36c2e971c92b6ac0a12195ae0b87cb8aec577ce112b1883b123a6625662b8c0618f3de9f5d91ff657d0f96bf332bc8910
-
memory/628-59-0x0000000000000000-mapping.dmp
-
memory/804-72-0x0000000000000000-mapping.dmp
-
memory/1120-67-0x0000000000BD0000-0x0000000000ED3000-memory.dmpFilesize
3.0MB
-
memory/1120-68-0x0000000000470000-0x0000000000484000-memory.dmpFilesize
80KB
-
memory/1120-61-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1120-62-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1120-64-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1120-65-0x000000000041ED10-mapping.dmp
-
memory/1420-77-0x0000000004A50000-0x0000000004B31000-memory.dmpFilesize
900KB
-
memory/1420-69-0x0000000007030000-0x000000000718B000-memory.dmpFilesize
1.4MB
-
memory/1512-56-0x0000000000390000-0x0000000000398000-memory.dmpFilesize
32KB
-
memory/1512-58-0x0000000004C70000-0x0000000004CA6000-memory.dmpFilesize
216KB
-
memory/1512-55-0x0000000076421000-0x0000000076423000-memory.dmpFilesize
8KB
-
memory/1512-54-0x00000000012D0000-0x000000000132E000-memory.dmpFilesize
376KB
-
memory/1512-57-0x0000000004C20000-0x0000000004C76000-memory.dmpFilesize
344KB
-
memory/1552-70-0x0000000000000000-mapping.dmp
-
memory/1552-73-0x0000000000C50000-0x0000000000C68000-memory.dmpFilesize
96KB
-
memory/1552-74-0x0000000000090000-0x00000000000BE000-memory.dmpFilesize
184KB
-
memory/1552-75-0x0000000002070000-0x0000000002373000-memory.dmpFilesize
3.0MB
-
memory/1552-76-0x0000000000920000-0x00000000009B3000-memory.dmpFilesize
588KB