Analysis
-
max time kernel
187s -
max time network
198s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
11-05-2022 02:29
Static task
static1
Behavioral task
behavioral1
Sample
5084c2d455003df830c907939adc50ef250e7ccde99041e3f671202d1ec53c28.exe
Resource
win7-20220414-en
General
-
Target
5084c2d455003df830c907939adc50ef250e7ccde99041e3f671202d1ec53c28.exe
-
Size
438KB
-
MD5
7431c0da6bae8041862806106270065d
-
SHA1
ae8611a9ec419855134f5c98999c64552029bfef
-
SHA256
5084c2d455003df830c907939adc50ef250e7ccde99041e3f671202d1ec53c28
-
SHA512
6838862dd49fcd22eb86e1475af170c94e2eea42dc3498c0e884132add9a835406729f1a678d33178a37a8b818d21e00a1cd5a1b4fe87df9e6eb2ca3273d3271
Malware Config
Extracted
formbook
4.1
kvsz
hdlivesonlinetv24.com
illaheehillsseniorliving.com
wihong.com
christopher-cost.com
huayvipee.com
csdroped.xyz
relationsvivantes.com
xmcombohome.com
qingc2.com
sunsetcinemamusic.com
anotherheadache.com
connectlcv.com
unitermi.com
cugetarileunuisarman.com
agakegois.com
burnercouture.com
ambassador-holidays.com
schnarr-design.com
2013lang.com
httattoos.com
cleanhardinquiries.credit
jinduowei.com
despoticat.com
tclongke.com
medknizgka.com
mouowgoah.com
ehswholesale.com
sababa.club
facelift.pink
johnhall2020.com
superbahis62.com
erodea.com
dahaizhaofang.ltd
hiddenlighttattoo.com
michaelpte.com
easytradeoptions.com
jlnclub-hz.com
preciousmetals.supply
xn--9p4b887a.com
bigjbbq.com
twoamys.com
tor-one.com
freenfearlesscoaching.com
playmomknowsbest.com
maasiraq.com
michelon.solutions
shortpocketsmusic.com
pure-sonic.com
marilrealty.com
sillvoice.com
gawahrzinerbne.com
qsshop.net
globalmobilityinsights.com
psm-gen.com
stray-love.com
cjsweettreats.com
ulcforum.com
jlizf.com
guidemining.com
1440windingoakswest.com
mixedrealitycolabs.com
shealetics.com
11700.cloud
chazhentan.com
whealthypeople.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2000-64-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/2000-65-0x000000000041ED10-mapping.dmp formbook behavioral1/memory/2000-67-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1196-73-0x00000000000D0000-0x00000000000FE000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
5084c2d455003df830c907939adc50ef250e7ccde99041e3f671202d1ec53c28.exeRegSvcs.exewuapp.exedescription pid process target process PID 1416 set thread context of 2000 1416 5084c2d455003df830c907939adc50ef250e7ccde99041e3f671202d1ec53c28.exe RegSvcs.exe PID 2000 set thread context of 1260 2000 RegSvcs.exe Explorer.EXE PID 1196 set thread context of 1260 1196 wuapp.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 17 IoCs
Processes:
5084c2d455003df830c907939adc50ef250e7ccde99041e3f671202d1ec53c28.exeRegSvcs.exewuapp.exepid process 1416 5084c2d455003df830c907939adc50ef250e7ccde99041e3f671202d1ec53c28.exe 2000 RegSvcs.exe 2000 RegSvcs.exe 1196 wuapp.exe 1196 wuapp.exe 1196 wuapp.exe 1196 wuapp.exe 1196 wuapp.exe 1196 wuapp.exe 1196 wuapp.exe 1196 wuapp.exe 1196 wuapp.exe 1196 wuapp.exe 1196 wuapp.exe 1196 wuapp.exe 1196 wuapp.exe 1196 wuapp.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.exewuapp.exepid process 2000 RegSvcs.exe 2000 RegSvcs.exe 2000 RegSvcs.exe 1196 wuapp.exe 1196 wuapp.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
5084c2d455003df830c907939adc50ef250e7ccde99041e3f671202d1ec53c28.exeRegSvcs.exewuapp.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1416 5084c2d455003df830c907939adc50ef250e7ccde99041e3f671202d1ec53c28.exe Token: SeDebugPrivilege 2000 RegSvcs.exe Token: SeDebugPrivilege 1196 wuapp.exe Token: SeShutdownPrivilege 1260 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1260 Explorer.EXE 1260 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1260 Explorer.EXE 1260 Explorer.EXE -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
5084c2d455003df830c907939adc50ef250e7ccde99041e3f671202d1ec53c28.exeExplorer.EXEwuapp.exedescription pid process target process PID 1416 wrote to memory of 1252 1416 5084c2d455003df830c907939adc50ef250e7ccde99041e3f671202d1ec53c28.exe schtasks.exe PID 1416 wrote to memory of 1252 1416 5084c2d455003df830c907939adc50ef250e7ccde99041e3f671202d1ec53c28.exe schtasks.exe PID 1416 wrote to memory of 1252 1416 5084c2d455003df830c907939adc50ef250e7ccde99041e3f671202d1ec53c28.exe schtasks.exe PID 1416 wrote to memory of 1252 1416 5084c2d455003df830c907939adc50ef250e7ccde99041e3f671202d1ec53c28.exe schtasks.exe PID 1416 wrote to memory of 2000 1416 5084c2d455003df830c907939adc50ef250e7ccde99041e3f671202d1ec53c28.exe RegSvcs.exe PID 1416 wrote to memory of 2000 1416 5084c2d455003df830c907939adc50ef250e7ccde99041e3f671202d1ec53c28.exe RegSvcs.exe PID 1416 wrote to memory of 2000 1416 5084c2d455003df830c907939adc50ef250e7ccde99041e3f671202d1ec53c28.exe RegSvcs.exe PID 1416 wrote to memory of 2000 1416 5084c2d455003df830c907939adc50ef250e7ccde99041e3f671202d1ec53c28.exe RegSvcs.exe PID 1416 wrote to memory of 2000 1416 5084c2d455003df830c907939adc50ef250e7ccde99041e3f671202d1ec53c28.exe RegSvcs.exe PID 1416 wrote to memory of 2000 1416 5084c2d455003df830c907939adc50ef250e7ccde99041e3f671202d1ec53c28.exe RegSvcs.exe PID 1416 wrote to memory of 2000 1416 5084c2d455003df830c907939adc50ef250e7ccde99041e3f671202d1ec53c28.exe RegSvcs.exe PID 1416 wrote to memory of 2000 1416 5084c2d455003df830c907939adc50ef250e7ccde99041e3f671202d1ec53c28.exe RegSvcs.exe PID 1416 wrote to memory of 2000 1416 5084c2d455003df830c907939adc50ef250e7ccde99041e3f671202d1ec53c28.exe RegSvcs.exe PID 1416 wrote to memory of 2000 1416 5084c2d455003df830c907939adc50ef250e7ccde99041e3f671202d1ec53c28.exe RegSvcs.exe PID 1260 wrote to memory of 1196 1260 Explorer.EXE wuapp.exe PID 1260 wrote to memory of 1196 1260 Explorer.EXE wuapp.exe PID 1260 wrote to memory of 1196 1260 Explorer.EXE wuapp.exe PID 1260 wrote to memory of 1196 1260 Explorer.EXE wuapp.exe PID 1260 wrote to memory of 1196 1260 Explorer.EXE wuapp.exe PID 1260 wrote to memory of 1196 1260 Explorer.EXE wuapp.exe PID 1260 wrote to memory of 1196 1260 Explorer.EXE wuapp.exe PID 1196 wrote to memory of 1056 1196 wuapp.exe cmd.exe PID 1196 wrote to memory of 1056 1196 wuapp.exe cmd.exe PID 1196 wrote to memory of 1056 1196 wuapp.exe cmd.exe PID 1196 wrote to memory of 1056 1196 wuapp.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5084c2d455003df830c907939adc50ef250e7ccde99041e3f671202d1ec53c28.exe"C:\Users\Admin\AppData\Local\Temp\5084c2d455003df830c907939adc50ef250e7ccde99041e3f671202d1ec53c28.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HVCbSjcGXVy" /XML "C:\Users\Admin\AppData\Local\Temp\tmp87E6.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wuapp.exe"C:\Windows\SysWOW64\wuapp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp87E6.tmpFilesize
1KB
MD5331804837ffdce7b9226b955b1252776
SHA1b56df39e2d4ddb4792a0e180ebe64140f32c69ea
SHA25688f7983f6939f0a4b815d29cf2978086d14d287f643b6f97f75326bad45ab962
SHA512e7356c131fa8ff1819d3f6bf211580403f69d2be1f1d667d91774d9e6196732807f9490d516d04b0f75922f3862eee0984248b09dc649ff849651b8d17bb6f08
-
memory/1056-75-0x0000000000000000-mapping.dmp
-
memory/1196-71-0x0000000000000000-mapping.dmp
-
memory/1196-76-0x0000000000830000-0x00000000008C3000-memory.dmpFilesize
588KB
-
memory/1196-74-0x00000000009B0000-0x0000000000CB3000-memory.dmpFilesize
3.0MB
-
memory/1196-72-0x0000000000FE0000-0x0000000000FEB000-memory.dmpFilesize
44KB
-
memory/1196-73-0x00000000000D0000-0x00000000000FE000-memory.dmpFilesize
184KB
-
memory/1252-59-0x0000000000000000-mapping.dmp
-
memory/1260-70-0x00000000064A0000-0x00000000065A6000-memory.dmpFilesize
1.0MB
-
memory/1260-77-0x0000000006AE0000-0x0000000006C53000-memory.dmpFilesize
1.4MB
-
memory/1416-58-0x0000000000B50000-0x0000000000B86000-memory.dmpFilesize
216KB
-
memory/1416-54-0x0000000001130000-0x00000000011A4000-memory.dmpFilesize
464KB
-
memory/1416-57-0x0000000000E60000-0x0000000000EB6000-memory.dmpFilesize
344KB
-
memory/1416-56-0x0000000000470000-0x0000000000478000-memory.dmpFilesize
32KB
-
memory/1416-55-0x0000000075BF1000-0x0000000075BF3000-memory.dmpFilesize
8KB
-
memory/2000-67-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/2000-68-0x0000000000800000-0x0000000000B03000-memory.dmpFilesize
3.0MB
-
memory/2000-69-0x0000000000310000-0x0000000000324000-memory.dmpFilesize
80KB
-
memory/2000-65-0x000000000041ED10-mapping.dmp
-
memory/2000-61-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/2000-62-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/2000-64-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB