Analysis
-
max time kernel
145s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 01:47
Static task
static1
Behavioral task
behavioral1
Sample
caietul de sarcini.exe
Resource
win7-20220414-en
General
-
Target
caietul de sarcini.exe
-
Size
790KB
-
MD5
f28ec13e3098402bc68fea894fd99053
-
SHA1
4c752327d2e9d1118e5daae6100dbeaceecfc987
-
SHA256
f4156e15b465020e6687a23a63eb4b7c84a18f90ead4665087c6c2e5a09b455d
-
SHA512
02703aa721ccbd210ba5fb46421f4c675266edf7a4c2b2e47bbca9b08845088d72e1656f38fcd5f010ad27da0adf395d2d63c11bde672f33f9168e6a847ea173
Malware Config
Extracted
formbook
4.1
kvsz
okashyns.com
sbsgamedaejeon-two.com
drb77.com
top5dating.com
websprings.online
voizers.com
zenith.site
lahistoriade.com
qv85.com
armandonieto.com
priestvedic.com
jessandjeff.net
magic-desktop.com
jitaji.com
ldmeili.com
yuwanqingmy.com
buzhouorg.com
chaiseloungereviews.com
m2g8way.com
freespin-support.com
bocapvang.net
315px.com
eugeniobarros.tech
sif.email
xn--oorv2aj6bj7cds0d6p4b.com
polychips.com
grouptulip.win
landbank.site
bet365c.win
inbonz.com
outofthepark.today
jeaniney.com
weeip.com
dmoneylife.com
rticlubs.com
reisedating.com
marijuanadogbone.com
funippon.com
banknotesync.com
alexandre-boissard.com
valorartetattoo.com
savetheverse.com
specificpcshop.online
h0jt1y.accountant
jiqing3.com
alfaranakle.com
saft-store.com
wanderingcollective.com
santandermobi.online
557023.top
loulancaster.com
vedattelekom.com
jatinangorcity.com
goldencanaries.com
edgaralanbro.com
levelretail.com
taylorsandbek.com
upbeatnewyork.com
motoreselectricoschihuahua.com
hotair.wales
getawomantodoit.com
xiaoxiong365.com
cloudboxsupport.com
vecteur-u-shop.com
fex-tracks.com
Signatures
-
Formbook Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/956-64-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/956-65-0x000000000041ECA0-mapping.dmp formbook behavioral1/memory/956-67-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1736-76-0x0000000000080000-0x00000000000AE000-memory.dmp formbook -
Suspicious use of SetThreadContext 4 IoCs
Processes:
caietul de sarcini.exeRegSvcs.exesystray.exedescription pid process target process PID 1668 set thread context of 956 1668 caietul de sarcini.exe RegSvcs.exe PID 956 set thread context of 1356 956 RegSvcs.exe Explorer.EXE PID 956 set thread context of 1356 956 RegSvcs.exe Explorer.EXE PID 1736 set thread context of 1356 1736 systray.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 17 IoCs
Processes:
caietul de sarcini.exeRegSvcs.exesystray.exepid process 1668 caietul de sarcini.exe 956 RegSvcs.exe 956 RegSvcs.exe 956 RegSvcs.exe 1736 systray.exe 1736 systray.exe 1736 systray.exe 1736 systray.exe 1736 systray.exe 1736 systray.exe 1736 systray.exe 1736 systray.exe 1736 systray.exe 1736 systray.exe 1736 systray.exe 1736 systray.exe 1736 systray.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
RegSvcs.exesystray.exepid process 956 RegSvcs.exe 956 RegSvcs.exe 956 RegSvcs.exe 956 RegSvcs.exe 1736 systray.exe 1736 systray.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
caietul de sarcini.exeRegSvcs.exesystray.exedescription pid process Token: SeDebugPrivilege 1668 caietul de sarcini.exe Token: SeDebugPrivilege 956 RegSvcs.exe Token: SeDebugPrivilege 1736 systray.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1356 Explorer.EXE 1356 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1356 Explorer.EXE 1356 Explorer.EXE -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
caietul de sarcini.exeExplorer.EXEsystray.exedescription pid process target process PID 1668 wrote to memory of 1172 1668 caietul de sarcini.exe schtasks.exe PID 1668 wrote to memory of 1172 1668 caietul de sarcini.exe schtasks.exe PID 1668 wrote to memory of 1172 1668 caietul de sarcini.exe schtasks.exe PID 1668 wrote to memory of 1172 1668 caietul de sarcini.exe schtasks.exe PID 1668 wrote to memory of 956 1668 caietul de sarcini.exe RegSvcs.exe PID 1668 wrote to memory of 956 1668 caietul de sarcini.exe RegSvcs.exe PID 1668 wrote to memory of 956 1668 caietul de sarcini.exe RegSvcs.exe PID 1668 wrote to memory of 956 1668 caietul de sarcini.exe RegSvcs.exe PID 1668 wrote to memory of 956 1668 caietul de sarcini.exe RegSvcs.exe PID 1668 wrote to memory of 956 1668 caietul de sarcini.exe RegSvcs.exe PID 1668 wrote to memory of 956 1668 caietul de sarcini.exe RegSvcs.exe PID 1668 wrote to memory of 956 1668 caietul de sarcini.exe RegSvcs.exe PID 1668 wrote to memory of 956 1668 caietul de sarcini.exe RegSvcs.exe PID 1668 wrote to memory of 956 1668 caietul de sarcini.exe RegSvcs.exe PID 1356 wrote to memory of 1736 1356 Explorer.EXE systray.exe PID 1356 wrote to memory of 1736 1356 Explorer.EXE systray.exe PID 1356 wrote to memory of 1736 1356 Explorer.EXE systray.exe PID 1356 wrote to memory of 1736 1356 Explorer.EXE systray.exe PID 1736 wrote to memory of 360 1736 systray.exe cmd.exe PID 1736 wrote to memory of 360 1736 systray.exe cmd.exe PID 1736 wrote to memory of 360 1736 systray.exe cmd.exe PID 1736 wrote to memory of 360 1736 systray.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\caietul de sarcini.exe"C:\Users\Admin\AppData\Local\Temp\caietul de sarcini.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\oHtylzPIaQr" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDA88.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpDA88.tmpFilesize
1KB
MD54389a92561624069c7171a7d1640aa6e
SHA127caa0458ffb60055c5985f08604886e15380977
SHA2565fa3838ec94acedd551dfb952db8bff51fe07c020c8ece2edcbd5528b50079bc
SHA51232c6517c7b81fbe658051b3ec6926363de8c128d2a347cdf86b1acb139c6f3aaaea34b5199aba55c19dbad2dfad2bcfc08d5efaed2a2713a6b6e6d2d58f3da3f
-
memory/360-77-0x0000000000000000-mapping.dmp
-
memory/956-68-0x0000000000900000-0x0000000000C03000-memory.dmpFilesize
3.0MB
-
memory/956-65-0x000000000041ECA0-mapping.dmp
-
memory/956-69-0x00000000001A0000-0x00000000001B4000-memory.dmpFilesize
80KB
-
memory/956-61-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/956-62-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/956-64-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/956-67-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/956-72-0x00000000001E0000-0x00000000001F4000-memory.dmpFilesize
80KB
-
memory/1172-59-0x0000000000000000-mapping.dmp
-
memory/1356-73-0x00000000061A0000-0x0000000006266000-memory.dmpFilesize
792KB
-
memory/1356-70-0x0000000006AE0000-0x0000000006C35000-memory.dmpFilesize
1.3MB
-
memory/1356-80-0x0000000006D70000-0x0000000006E9B000-memory.dmpFilesize
1.2MB
-
memory/1668-58-0x0000000000820000-0x0000000000864000-memory.dmpFilesize
272KB
-
memory/1668-57-0x0000000005120000-0x0000000005192000-memory.dmpFilesize
456KB
-
memory/1668-56-0x0000000000600000-0x0000000000610000-memory.dmpFilesize
64KB
-
memory/1668-55-0x00000000762C1000-0x00000000762C3000-memory.dmpFilesize
8KB
-
memory/1668-54-0x00000000000C0000-0x000000000018C000-memory.dmpFilesize
816KB
-
memory/1736-74-0x0000000000000000-mapping.dmp
-
memory/1736-75-0x0000000000C80000-0x0000000000C85000-memory.dmpFilesize
20KB
-
memory/1736-76-0x0000000000080000-0x00000000000AE000-memory.dmpFilesize
184KB
-
memory/1736-78-0x0000000002090000-0x0000000002393000-memory.dmpFilesize
3.0MB
-
memory/1736-79-0x00000000004F0000-0x0000000000583000-memory.dmpFilesize
588KB