Analysis
-
max time kernel
185s -
max time network
188s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
12-05-2022 11:57
Static task
static1
Behavioral task
behavioral1
Sample
44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618.exe
Resource
win7-20220414-en
General
-
Target
44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618.exe
-
Size
414KB
-
MD5
f3becd80be8779dfeb8ca5791f7ffb86
-
SHA1
91f03335ff735cef93edafc6748d354d08eabe87
-
SHA256
44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618
-
SHA512
f508be9b45170e7669c69ab6ec4849ddb318ee8d9a0d3ffc906197747de67b94d4c32b8aecb383fee6ce49d7e364a07743c8e3a7ed6e91132219633d65661abb
Malware Config
Extracted
formbook
4.1
kvsz
hdlivesonlinetv24.com
illaheehillsseniorliving.com
wihong.com
christopher-cost.com
huayvipee.com
csdroped.xyz
relationsvivantes.com
xmcombohome.com
qingc2.com
sunsetcinemamusic.com
anotherheadache.com
connectlcv.com
unitermi.com
cugetarileunuisarman.com
agakegois.com
burnercouture.com
ambassador-holidays.com
schnarr-design.com
2013lang.com
httattoos.com
cleanhardinquiries.credit
jinduowei.com
despoticat.com
tclongke.com
medknizgka.com
mouowgoah.com
ehswholesale.com
sababa.club
facelift.pink
johnhall2020.com
superbahis62.com
erodea.com
dahaizhaofang.ltd
hiddenlighttattoo.com
michaelpte.com
easytradeoptions.com
jlnclub-hz.com
preciousmetals.supply
xn--9p4b887a.com
bigjbbq.com
twoamys.com
tor-one.com
freenfearlesscoaching.com
playmomknowsbest.com
maasiraq.com
michelon.solutions
shortpocketsmusic.com
pure-sonic.com
marilrealty.com
sillvoice.com
gawahrzinerbne.com
qsshop.net
globalmobilityinsights.com
psm-gen.com
stray-love.com
cjsweettreats.com
ulcforum.com
jlizf.com
guidemining.com
1440windingoakswest.com
mixedrealitycolabs.com
shealetics.com
11700.cloud
chazhentan.com
whealthypeople.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1120-141-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/2968-148-0x0000000000380000-0x00000000003AE000-memory.dmp formbook -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation 44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618.exeRegSvcs.execmmon32.exedescription pid process target process PID 4064 set thread context of 1120 4064 44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618.exe RegSvcs.exe PID 1120 set thread context of 3208 1120 RegSvcs.exe Explorer.EXE PID 2968 set thread context of 3208 2968 cmmon32.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 31 IoCs
Processes:
44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618.exeRegSvcs.execmmon32.exepid process 4064 44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618.exe 4064 44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618.exe 4064 44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618.exe 4064 44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618.exe 4064 44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618.exe 1120 RegSvcs.exe 1120 RegSvcs.exe 1120 RegSvcs.exe 1120 RegSvcs.exe 2968 cmmon32.exe 2968 cmmon32.exe 2968 cmmon32.exe 2968 cmmon32.exe 2968 cmmon32.exe 2968 cmmon32.exe 2968 cmmon32.exe 2968 cmmon32.exe 2968 cmmon32.exe 2968 cmmon32.exe 2968 cmmon32.exe 2968 cmmon32.exe 2968 cmmon32.exe 2968 cmmon32.exe 2968 cmmon32.exe 2968 cmmon32.exe 2968 cmmon32.exe 2968 cmmon32.exe 2968 cmmon32.exe 2968 cmmon32.exe 2968 cmmon32.exe 2968 cmmon32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3208 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.execmmon32.exepid process 1120 RegSvcs.exe 1120 RegSvcs.exe 1120 RegSvcs.exe 2968 cmmon32.exe 2968 cmmon32.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618.exeRegSvcs.execmmon32.exedescription pid process Token: SeDebugPrivilege 4064 44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618.exe Token: SeDebugPrivilege 1120 RegSvcs.exe Token: SeDebugPrivilege 2968 cmmon32.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618.exeExplorer.EXEcmmon32.exedescription pid process target process PID 4064 wrote to memory of 636 4064 44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618.exe schtasks.exe PID 4064 wrote to memory of 636 4064 44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618.exe schtasks.exe PID 4064 wrote to memory of 636 4064 44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618.exe schtasks.exe PID 4064 wrote to memory of 4824 4064 44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618.exe RegSvcs.exe PID 4064 wrote to memory of 4824 4064 44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618.exe RegSvcs.exe PID 4064 wrote to memory of 4824 4064 44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618.exe RegSvcs.exe PID 4064 wrote to memory of 1124 4064 44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618.exe RegSvcs.exe PID 4064 wrote to memory of 1124 4064 44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618.exe RegSvcs.exe PID 4064 wrote to memory of 1124 4064 44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618.exe RegSvcs.exe PID 4064 wrote to memory of 1120 4064 44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618.exe RegSvcs.exe PID 4064 wrote to memory of 1120 4064 44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618.exe RegSvcs.exe PID 4064 wrote to memory of 1120 4064 44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618.exe RegSvcs.exe PID 4064 wrote to memory of 1120 4064 44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618.exe RegSvcs.exe PID 4064 wrote to memory of 1120 4064 44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618.exe RegSvcs.exe PID 4064 wrote to memory of 1120 4064 44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618.exe RegSvcs.exe PID 3208 wrote to memory of 2968 3208 Explorer.EXE cmmon32.exe PID 3208 wrote to memory of 2968 3208 Explorer.EXE cmmon32.exe PID 3208 wrote to memory of 2968 3208 Explorer.EXE cmmon32.exe PID 2968 wrote to memory of 3836 2968 cmmon32.exe cmd.exe PID 2968 wrote to memory of 3836 2968 cmmon32.exe cmd.exe PID 2968 wrote to memory of 3836 2968 cmmon32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618.exe"C:\Users\Admin\AppData\Local\Temp\44a8227ccd3bd1fb5285b84d99282b199594457c73bdab74c4cbeb331e671618.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HTufYRAKxBK" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDC56.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpDC56.tmpFilesize
1KB
MD5743111505624ef151253e5ca4720ae85
SHA1431966eef50c42946d75e1af0bce92144a90a5e6
SHA25668b756267e27774c6bcf00d2817d111d2f2410aa5efce335ab593f1100bfb8ff
SHA5120c9e6a7198ff33220bb704db6a13bf8fc8a155ef3bf794162ce10f2684417a6ec9c4c57ca74d85a5c09bd375b0d3b437938c106dbf5b258361f6e0200ea4d34f
-
memory/636-136-0x0000000000000000-mapping.dmp
-
memory/1120-144-0x00000000015E0000-0x00000000015F4000-memory.dmpFilesize
80KB
-
memory/1120-143-0x00000000017B0000-0x0000000001AFA000-memory.dmpFilesize
3.3MB
-
memory/1120-141-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1120-140-0x0000000000000000-mapping.dmp
-
memory/1124-139-0x0000000000000000-mapping.dmp
-
memory/2968-146-0x0000000000000000-mapping.dmp
-
memory/2968-147-0x0000000000470000-0x000000000047C000-memory.dmpFilesize
48KB
-
memory/2968-151-0x00000000023B0000-0x0000000002443000-memory.dmpFilesize
588KB
-
memory/2968-149-0x0000000002680000-0x00000000029CA000-memory.dmpFilesize
3.3MB
-
memory/2968-148-0x0000000000380000-0x00000000003AE000-memory.dmpFilesize
184KB
-
memory/3208-145-0x0000000008AA0000-0x0000000008C22000-memory.dmpFilesize
1.5MB
-
memory/3208-152-0x0000000008C30000-0x0000000008DA3000-memory.dmpFilesize
1.4MB
-
memory/3836-150-0x0000000000000000-mapping.dmp
-
memory/4064-131-0x0000000006FF0000-0x000000000708C000-memory.dmpFilesize
624KB
-
memory/4064-130-0x0000000000150000-0x00000000001BE000-memory.dmpFilesize
440KB
-
memory/4064-132-0x0000000007640000-0x0000000007BE4000-memory.dmpFilesize
5.6MB
-
memory/4064-133-0x0000000007130000-0x00000000071C2000-memory.dmpFilesize
584KB
-
memory/4064-134-0x00000000070D0000-0x00000000070DA000-memory.dmpFilesize
40KB
-
memory/4064-135-0x0000000007340000-0x0000000007396000-memory.dmpFilesize
344KB
-
memory/4824-138-0x0000000000000000-mapping.dmp