Analysis
-
max time kernel
148s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
12-05-2022 11:57
Static task
static1
Behavioral task
behavioral1
Sample
44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618.exe
Resource
win7-20220414-en
General
-
Target
44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618.exe
-
Size
414KB
-
MD5
f3becd80be8779dfeb8ca5791f7ffb86
-
SHA1
91f03335ff735cef93edafc6748d354d08eabe87
-
SHA256
44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618
-
SHA512
f508be9b45170e7669c69ab6ec4849ddb318ee8d9a0d3ffc906197747de67b94d4c32b8aecb383fee6ce49d7e364a07743c8e3a7ed6e91132219633d65661abb
Malware Config
Extracted
formbook
4.1
kvsz
hdlivesonlinetv24.com
illaheehillsseniorliving.com
wihong.com
christopher-cost.com
huayvipee.com
csdroped.xyz
relationsvivantes.com
xmcombohome.com
qingc2.com
sunsetcinemamusic.com
anotherheadache.com
connectlcv.com
unitermi.com
cugetarileunuisarman.com
agakegois.com
burnercouture.com
ambassador-holidays.com
schnarr-design.com
2013lang.com
httattoos.com
cleanhardinquiries.credit
jinduowei.com
despoticat.com
tclongke.com
medknizgka.com
mouowgoah.com
ehswholesale.com
sababa.club
facelift.pink
johnhall2020.com
superbahis62.com
erodea.com
dahaizhaofang.ltd
hiddenlighttattoo.com
michaelpte.com
easytradeoptions.com
jlnclub-hz.com
preciousmetals.supply
xn--9p4b887a.com
bigjbbq.com
twoamys.com
tor-one.com
freenfearlesscoaching.com
playmomknowsbest.com
maasiraq.com
michelon.solutions
shortpocketsmusic.com
pure-sonic.com
marilrealty.com
sillvoice.com
gawahrzinerbne.com
qsshop.net
globalmobilityinsights.com
psm-gen.com
stray-love.com
cjsweettreats.com
ulcforum.com
jlizf.com
guidemining.com
1440windingoakswest.com
mixedrealitycolabs.com
shealetics.com
11700.cloud
chazhentan.com
whealthypeople.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1992-65-0x000000000041ED10-mapping.dmp formbook behavioral1/memory/1992-64-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1992-67-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1776-75-0x0000000000080000-0x00000000000AE000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618.exeRegSvcs.exeraserver.exedescription pid process target process PID 980 set thread context of 1992 980 44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618.exe RegSvcs.exe PID 1992 set thread context of 1352 1992 RegSvcs.exe Explorer.EXE PID 1776 set thread context of 1352 1776 raserver.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618.exeRegSvcs.exeraserver.exepid process 980 44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618.exe 1992 RegSvcs.exe 1992 RegSvcs.exe 1776 raserver.exe 1776 raserver.exe 1776 raserver.exe 1776 raserver.exe 1776 raserver.exe 1776 raserver.exe 1776 raserver.exe 1776 raserver.exe 1776 raserver.exe 1776 raserver.exe 1776 raserver.exe 1776 raserver.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.exeraserver.exepid process 1992 RegSvcs.exe 1992 RegSvcs.exe 1992 RegSvcs.exe 1776 raserver.exe 1776 raserver.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618.exeRegSvcs.exeraserver.exedescription pid process Token: SeDebugPrivilege 980 44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618.exe Token: SeDebugPrivilege 1992 RegSvcs.exe Token: SeDebugPrivilege 1776 raserver.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1352 Explorer.EXE 1352 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1352 Explorer.EXE 1352 Explorer.EXE -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618.exeExplorer.EXEraserver.exedescription pid process target process PID 980 wrote to memory of 2028 980 44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618.exe schtasks.exe PID 980 wrote to memory of 2028 980 44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618.exe schtasks.exe PID 980 wrote to memory of 2028 980 44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618.exe schtasks.exe PID 980 wrote to memory of 2028 980 44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618.exe schtasks.exe PID 980 wrote to memory of 1992 980 44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618.exe RegSvcs.exe PID 980 wrote to memory of 1992 980 44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618.exe RegSvcs.exe PID 980 wrote to memory of 1992 980 44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618.exe RegSvcs.exe PID 980 wrote to memory of 1992 980 44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618.exe RegSvcs.exe PID 980 wrote to memory of 1992 980 44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618.exe RegSvcs.exe PID 980 wrote to memory of 1992 980 44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618.exe RegSvcs.exe PID 980 wrote to memory of 1992 980 44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618.exe RegSvcs.exe PID 980 wrote to memory of 1992 980 44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618.exe RegSvcs.exe PID 980 wrote to memory of 1992 980 44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618.exe RegSvcs.exe PID 980 wrote to memory of 1992 980 44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618.exe RegSvcs.exe PID 1352 wrote to memory of 1776 1352 Explorer.EXE raserver.exe PID 1352 wrote to memory of 1776 1352 Explorer.EXE raserver.exe PID 1352 wrote to memory of 1776 1352 Explorer.EXE raserver.exe PID 1352 wrote to memory of 1776 1352 Explorer.EXE raserver.exe PID 1776 wrote to memory of 664 1776 raserver.exe cmd.exe PID 1776 wrote to memory of 664 1776 raserver.exe cmd.exe PID 1776 wrote to memory of 664 1776 raserver.exe cmd.exe PID 1776 wrote to memory of 664 1776 raserver.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618.exe"C:\Users\Admin\AppData\Local\Temp\44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HTufYRAKxBK" /XML "C:\Users\Admin\AppData\Local\Temp\tmp52E2.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp52E2.tmpFilesize
1KB
MD58aae7b6b2e5494c436737fac6a8a19c3
SHA1cf382a5aade430c3e845ed41f20a2cf650df8f5d
SHA256be6d5c54b2c350a83532d13a660d9545a49bd19c6a13fc150576aad6dd839af4
SHA51283b2ad319e7ddaa3d34f5e51195a7ee18df459e56fc8f11e35b7d7317bcee6b5447602f65a66bebd8e45fb9cd11971a9b7835fb3d6e397ac5f32bbd2fe050d06
-
memory/664-76-0x0000000000000000-mapping.dmp
-
memory/980-57-0x0000000004780000-0x00000000047D6000-memory.dmpFilesize
344KB
-
memory/980-58-0x0000000000790000-0x00000000007C6000-memory.dmpFilesize
216KB
-
memory/980-56-0x00000000002D0000-0x00000000002DA000-memory.dmpFilesize
40KB
-
memory/980-55-0x0000000076C01000-0x0000000076C03000-memory.dmpFilesize
8KB
-
memory/980-54-0x0000000000120000-0x000000000018E000-memory.dmpFilesize
440KB
-
memory/1352-70-0x0000000006A10000-0x0000000006BA0000-memory.dmpFilesize
1.6MB
-
memory/1352-78-0x00000000049F0000-0x0000000004ABA000-memory.dmpFilesize
808KB
-
memory/1776-77-0x0000000001DC0000-0x0000000001E53000-memory.dmpFilesize
588KB
-
memory/1776-75-0x0000000000080000-0x00000000000AE000-memory.dmpFilesize
184KB
-
memory/1776-74-0x0000000001FF0000-0x00000000022F3000-memory.dmpFilesize
3.0MB
-
memory/1776-73-0x00000000001F0000-0x000000000020C000-memory.dmpFilesize
112KB
-
memory/1776-71-0x0000000000000000-mapping.dmp
-
memory/1992-64-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1992-69-0x0000000000150000-0x0000000000164000-memory.dmpFilesize
80KB
-
memory/1992-68-0x0000000000930000-0x0000000000C33000-memory.dmpFilesize
3.0MB
-
memory/1992-67-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1992-65-0x000000000041ED10-mapping.dmp
-
memory/1992-62-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1992-61-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/2028-59-0x0000000000000000-mapping.dmp