Analysis
-
max time kernel
190s -
max time network
194s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
11-05-2022 02:29
Static task
static1
Behavioral task
behavioral1
Sample
5084c2d455003df830c907939adc50ef250e7ccde99041e3f671202d1ec53c28.exe
Resource
win7-20220414-en
General
-
Target
5084c2d455003df830c907939adc50ef250e7ccde99041e3f671202d1ec53c28.exe
-
Size
438KB
-
MD5
7431c0da6bae8041862806106270065d
-
SHA1
ae8611a9ec419855134f5c98999c64552029bfef
-
SHA256
5084c2d455003df830c907939adc50ef250e7ccde99041e3f671202d1ec53c28
-
SHA512
6838862dd49fcd22eb86e1475af170c94e2eea42dc3498c0e884132add9a835406729f1a678d33178a37a8b818d21e00a1cd5a1b4fe87df9e6eb2ca3273d3271
Malware Config
Extracted
formbook
4.1
kvsz
hdlivesonlinetv24.com
illaheehillsseniorliving.com
wihong.com
christopher-cost.com
huayvipee.com
csdroped.xyz
relationsvivantes.com
xmcombohome.com
qingc2.com
sunsetcinemamusic.com
anotherheadache.com
connectlcv.com
unitermi.com
cugetarileunuisarman.com
agakegois.com
burnercouture.com
ambassador-holidays.com
schnarr-design.com
2013lang.com
httattoos.com
cleanhardinquiries.credit
jinduowei.com
despoticat.com
tclongke.com
medknizgka.com
mouowgoah.com
ehswholesale.com
sababa.club
facelift.pink
johnhall2020.com
superbahis62.com
erodea.com
dahaizhaofang.ltd
hiddenlighttattoo.com
michaelpte.com
easytradeoptions.com
jlnclub-hz.com
preciousmetals.supply
xn--9p4b887a.com
bigjbbq.com
twoamys.com
tor-one.com
freenfearlesscoaching.com
playmomknowsbest.com
maasiraq.com
michelon.solutions
shortpocketsmusic.com
pure-sonic.com
marilrealty.com
sillvoice.com
gawahrzinerbne.com
qsshop.net
globalmobilityinsights.com
psm-gen.com
stray-love.com
cjsweettreats.com
ulcforum.com
jlizf.com
guidemining.com
1440windingoakswest.com
mixedrealitycolabs.com
shealetics.com
11700.cloud
chazhentan.com
whealthypeople.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/5072-139-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/5072-141-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/4972-147-0x00000000009D0000-0x00000000009FE000-memory.dmp formbook -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
5084c2d455003df830c907939adc50ef250e7ccde99041e3f671202d1ec53c28.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation 5084c2d455003df830c907939adc50ef250e7ccde99041e3f671202d1ec53c28.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
5084c2d455003df830c907939adc50ef250e7ccde99041e3f671202d1ec53c28.exeRegSvcs.exeexplorer.exedescription pid process target process PID 3280 set thread context of 5072 3280 5084c2d455003df830c907939adc50ef250e7ccde99041e3f671202d1ec53c28.exe RegSvcs.exe PID 5072 set thread context of 3148 5072 RegSvcs.exe Explorer.EXE PID 4972 set thread context of 3148 4972 explorer.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
5084c2d455003df830c907939adc50ef250e7ccde99041e3f671202d1ec53c28.exeRegSvcs.exeexplorer.exepid process 3280 5084c2d455003df830c907939adc50ef250e7ccde99041e3f671202d1ec53c28.exe 5072 RegSvcs.exe 5072 RegSvcs.exe 5072 RegSvcs.exe 5072 RegSvcs.exe 3280 5084c2d455003df830c907939adc50ef250e7ccde99041e3f671202d1ec53c28.exe 4972 explorer.exe 4972 explorer.exe 4972 explorer.exe 4972 explorer.exe 4972 explorer.exe 4972 explorer.exe 4972 explorer.exe 4972 explorer.exe 4972 explorer.exe 4972 explorer.exe 4972 explorer.exe 4972 explorer.exe 4972 explorer.exe 4972 explorer.exe 4972 explorer.exe 4972 explorer.exe 4972 explorer.exe 4972 explorer.exe 4972 explorer.exe 4972 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3148 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.exeexplorer.exepid process 5072 RegSvcs.exe 5072 RegSvcs.exe 5072 RegSvcs.exe 4972 explorer.exe 4972 explorer.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
5084c2d455003df830c907939adc50ef250e7ccde99041e3f671202d1ec53c28.exeRegSvcs.exeExplorer.EXEexplorer.exedescription pid process Token: SeDebugPrivilege 3280 5084c2d455003df830c907939adc50ef250e7ccde99041e3f671202d1ec53c28.exe Token: SeDebugPrivilege 5072 RegSvcs.exe Token: SeShutdownPrivilege 3148 Explorer.EXE Token: SeCreatePagefilePrivilege 3148 Explorer.EXE Token: SeDebugPrivilege 4972 explorer.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
5084c2d455003df830c907939adc50ef250e7ccde99041e3f671202d1ec53c28.exeExplorer.EXEexplorer.exedescription pid process target process PID 3280 wrote to memory of 2016 3280 5084c2d455003df830c907939adc50ef250e7ccde99041e3f671202d1ec53c28.exe schtasks.exe PID 3280 wrote to memory of 2016 3280 5084c2d455003df830c907939adc50ef250e7ccde99041e3f671202d1ec53c28.exe schtasks.exe PID 3280 wrote to memory of 2016 3280 5084c2d455003df830c907939adc50ef250e7ccde99041e3f671202d1ec53c28.exe schtasks.exe PID 3280 wrote to memory of 5072 3280 5084c2d455003df830c907939adc50ef250e7ccde99041e3f671202d1ec53c28.exe RegSvcs.exe PID 3280 wrote to memory of 5072 3280 5084c2d455003df830c907939adc50ef250e7ccde99041e3f671202d1ec53c28.exe RegSvcs.exe PID 3280 wrote to memory of 5072 3280 5084c2d455003df830c907939adc50ef250e7ccde99041e3f671202d1ec53c28.exe RegSvcs.exe PID 3280 wrote to memory of 5072 3280 5084c2d455003df830c907939adc50ef250e7ccde99041e3f671202d1ec53c28.exe RegSvcs.exe PID 3280 wrote to memory of 5072 3280 5084c2d455003df830c907939adc50ef250e7ccde99041e3f671202d1ec53c28.exe RegSvcs.exe PID 3280 wrote to memory of 5072 3280 5084c2d455003df830c907939adc50ef250e7ccde99041e3f671202d1ec53c28.exe RegSvcs.exe PID 3148 wrote to memory of 4972 3148 Explorer.EXE explorer.exe PID 3148 wrote to memory of 4972 3148 Explorer.EXE explorer.exe PID 3148 wrote to memory of 4972 3148 Explorer.EXE explorer.exe PID 4972 wrote to memory of 2124 4972 explorer.exe cmd.exe PID 4972 wrote to memory of 2124 4972 explorer.exe cmd.exe PID 4972 wrote to memory of 2124 4972 explorer.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5084c2d455003df830c907939adc50ef250e7ccde99041e3f671202d1ec53c28.exe"C:\Users\Admin\AppData\Local\Temp\5084c2d455003df830c907939adc50ef250e7ccde99041e3f671202d1ec53c28.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HVCbSjcGXVy" /XML "C:\Users\Admin\AppData\Local\Temp\tmp134.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp134.tmpFilesize
1KB
MD5160154cd5e9f4ffd256004384dceb273
SHA1b0a1170317b5f6528b73ad8b7d3fa3028a444125
SHA256b3349efcfc69303ae05234ae7104e72bfc41ed7480321141d19ebfdfa26a5648
SHA512255c4f5237bd5d16b7a2ed4116c3053463c4d22b5b8a7de54c0ed78ed7e30bae5d7992a42b0a4973206b466c4c796a269cfcb2c76a4927461fc86ff0258a4e3c
-
memory/2016-136-0x0000000000000000-mapping.dmp
-
memory/2124-148-0x0000000000000000-mapping.dmp
-
memory/3148-142-0x0000000002F80000-0x000000000304A000-memory.dmpFilesize
808KB
-
memory/3148-151-0x00000000032C0000-0x000000000336F000-memory.dmpFilesize
700KB
-
memory/3280-131-0x0000000005230000-0x00000000052CC000-memory.dmpFilesize
624KB
-
memory/3280-132-0x00000000058B0000-0x0000000005E54000-memory.dmpFilesize
5.6MB
-
memory/3280-133-0x00000000053A0000-0x0000000005432000-memory.dmpFilesize
584KB
-
memory/3280-134-0x0000000005330000-0x000000000533A000-memory.dmpFilesize
40KB
-
memory/3280-135-0x0000000005590000-0x00000000055E6000-memory.dmpFilesize
344KB
-
memory/3280-130-0x0000000000860000-0x00000000008D4000-memory.dmpFilesize
464KB
-
memory/4972-146-0x0000000000490000-0x00000000008C3000-memory.dmpFilesize
4.2MB
-
memory/4972-145-0x0000000000000000-mapping.dmp
-
memory/4972-147-0x00000000009D0000-0x00000000009FE000-memory.dmpFilesize
184KB
-
memory/4972-149-0x0000000002BA0000-0x0000000002EEA000-memory.dmpFilesize
3.3MB
-
memory/4972-150-0x00000000029D0000-0x0000000002A63000-memory.dmpFilesize
588KB
-
memory/5072-144-0x0000000001210000-0x0000000001224000-memory.dmpFilesize
80KB
-
memory/5072-143-0x0000000001820000-0x0000000001B6A000-memory.dmpFilesize
3.3MB
-
memory/5072-141-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/5072-139-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/5072-138-0x0000000000000000-mapping.dmp