Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 01:32
Static task
static1
Behavioral task
behavioral1
Sample
???? ???????.exe
Resource
win7-20220414-en
General
-
Target
???? ???????.exe
-
Size
479KB
-
MD5
0552dc2eb77ff766b362f1cdef722a14
-
SHA1
e00a9c847419d53e21f6edb25d70a79bdf30723f
-
SHA256
c9b141757defd483a6ff17438e86be87e0c1e5bc3d943c15989d84f577def797
-
SHA512
307b9296e101c18a75e7d38f945e486cd3bb7165f3fdc25362a47efcc9530e98b931c6d3c672c08d1c88af9c2cd6afac234e6cfadae4b6ab10dfaf84a80a47a6
Malware Config
Extracted
formbook
4.1
kvsz
okashyns.com
sbsgamedaejeon-two.com
drb77.com
top5dating.com
websprings.online
voizers.com
zenith.site
lahistoriade.com
qv85.com
armandonieto.com
priestvedic.com
jessandjeff.net
magic-desktop.com
jitaji.com
ldmeili.com
yuwanqingmy.com
buzhouorg.com
chaiseloungereviews.com
m2g8way.com
freespin-support.com
bocapvang.net
315px.com
eugeniobarros.tech
sif.email
xn--oorv2aj6bj7cds0d6p4b.com
polychips.com
grouptulip.win
landbank.site
bet365c.win
inbonz.com
outofthepark.today
jeaniney.com
weeip.com
dmoneylife.com
rticlubs.com
reisedating.com
marijuanadogbone.com
funippon.com
banknotesync.com
alexandre-boissard.com
valorartetattoo.com
savetheverse.com
specificpcshop.online
h0jt1y.accountant
jiqing3.com
alfaranakle.com
saft-store.com
wanderingcollective.com
santandermobi.online
557023.top
loulancaster.com
vedattelekom.com
jatinangorcity.com
goldencanaries.com
edgaralanbro.com
levelretail.com
taylorsandbek.com
upbeatnewyork.com
motoreselectricoschihuahua.com
hotair.wales
getawomantodoit.com
xiaoxiong365.com
cloudboxsupport.com
vecteur-u-shop.com
fex-tracks.com
Signatures
-
Formbook Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/968-64-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/968-65-0x000000000041ECA0-mapping.dmp formbook behavioral1/memory/968-67-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1956-75-0x00000000000F0000-0x000000000011E000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
____ _______.exeRegSvcs.exerundll32.exedescription pid process target process PID 1012 set thread context of 968 1012 ____ _______.exe RegSvcs.exe PID 968 set thread context of 1268 968 RegSvcs.exe Explorer.EXE PID 1956 set thread context of 1268 1956 rundll32.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
____ _______.exeRegSvcs.exerundll32.exepid process 1012 ____ _______.exe 1012 ____ _______.exe 1012 ____ _______.exe 1012 ____ _______.exe 968 RegSvcs.exe 968 RegSvcs.exe 1956 rundll32.exe 1956 rundll32.exe 1956 rundll32.exe 1956 rundll32.exe 1956 rundll32.exe 1956 rundll32.exe 1956 rundll32.exe 1956 rundll32.exe 1956 rundll32.exe 1956 rundll32.exe 1956 rundll32.exe 1956 rundll32.exe 1956 rundll32.exe 1956 rundll32.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.exerundll32.exepid process 968 RegSvcs.exe 968 RegSvcs.exe 968 RegSvcs.exe 1956 rundll32.exe 1956 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
____ _______.exeRegSvcs.exerundll32.exedescription pid process Token: SeDebugPrivilege 1012 ____ _______.exe Token: SeDebugPrivilege 968 RegSvcs.exe Token: SeDebugPrivilege 1956 rundll32.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
____ _______.exeExplorer.EXErundll32.exedescription pid process target process PID 1012 wrote to memory of 2044 1012 ____ _______.exe schtasks.exe PID 1012 wrote to memory of 2044 1012 ____ _______.exe schtasks.exe PID 1012 wrote to memory of 2044 1012 ____ _______.exe schtasks.exe PID 1012 wrote to memory of 2044 1012 ____ _______.exe schtasks.exe PID 1012 wrote to memory of 1988 1012 ____ _______.exe RegSvcs.exe PID 1012 wrote to memory of 1988 1012 ____ _______.exe RegSvcs.exe PID 1012 wrote to memory of 1988 1012 ____ _______.exe RegSvcs.exe PID 1012 wrote to memory of 1988 1012 ____ _______.exe RegSvcs.exe PID 1012 wrote to memory of 1988 1012 ____ _______.exe RegSvcs.exe PID 1012 wrote to memory of 1988 1012 ____ _______.exe RegSvcs.exe PID 1012 wrote to memory of 1988 1012 ____ _______.exe RegSvcs.exe PID 1012 wrote to memory of 968 1012 ____ _______.exe RegSvcs.exe PID 1012 wrote to memory of 968 1012 ____ _______.exe RegSvcs.exe PID 1012 wrote to memory of 968 1012 ____ _______.exe RegSvcs.exe PID 1012 wrote to memory of 968 1012 ____ _______.exe RegSvcs.exe PID 1012 wrote to memory of 968 1012 ____ _______.exe RegSvcs.exe PID 1012 wrote to memory of 968 1012 ____ _______.exe RegSvcs.exe PID 1012 wrote to memory of 968 1012 ____ _______.exe RegSvcs.exe PID 1012 wrote to memory of 968 1012 ____ _______.exe RegSvcs.exe PID 1012 wrote to memory of 968 1012 ____ _______.exe RegSvcs.exe PID 1012 wrote to memory of 968 1012 ____ _______.exe RegSvcs.exe PID 1268 wrote to memory of 1956 1268 Explorer.EXE rundll32.exe PID 1268 wrote to memory of 1956 1268 Explorer.EXE rundll32.exe PID 1268 wrote to memory of 1956 1268 Explorer.EXE rundll32.exe PID 1268 wrote to memory of 1956 1268 Explorer.EXE rundll32.exe PID 1268 wrote to memory of 1956 1268 Explorer.EXE rundll32.exe PID 1268 wrote to memory of 1956 1268 Explorer.EXE rundll32.exe PID 1268 wrote to memory of 1956 1268 Explorer.EXE rundll32.exe PID 1956 wrote to memory of 876 1956 rundll32.exe cmd.exe PID 1956 wrote to memory of 876 1956 rundll32.exe cmd.exe PID 1956 wrote to memory of 876 1956 rundll32.exe cmd.exe PID 1956 wrote to memory of 876 1956 rundll32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\____ _______.exe"C:\Users\Admin\AppData\Local\Temp\____ _______.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sLYatF" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB74F.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpB74F.tmpFilesize
1KB
MD5b6fbbaeca23ab3767c1a7075a87e52fd
SHA1b8eebe53bcc9a3f8c33ad53bbf58bfc5f99ec0a5
SHA2561efc807ae329869f474755027b8b5ea24f72cd78c29cff334e6f425c15f11a61
SHA5128b9149f2905e6302c3b862b7be537dee25ca35b61e06e7322db96b58c9d050a4f1965aabc173b9dd6f946faae5d193120d6f984de28a233ffdd1996a90f1a46c
-
memory/876-73-0x0000000000000000-mapping.dmp
-
memory/968-68-0x0000000000700000-0x0000000000A03000-memory.dmpFilesize
3.0MB
-
memory/968-64-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/968-69-0x00000000004A0000-0x00000000004B4000-memory.dmpFilesize
80KB
-
memory/968-67-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/968-65-0x000000000041ECA0-mapping.dmp
-
memory/968-61-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/968-62-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1012-56-0x00000000002F0000-0x0000000000300000-memory.dmpFilesize
64KB
-
memory/1012-57-0x0000000004880000-0x00000000048D4000-memory.dmpFilesize
336KB
-
memory/1012-55-0x0000000076851000-0x0000000076853000-memory.dmpFilesize
8KB
-
memory/1012-58-0x0000000004DD0000-0x0000000004E04000-memory.dmpFilesize
208KB
-
memory/1012-54-0x0000000000A40000-0x0000000000ABE000-memory.dmpFilesize
504KB
-
memory/1268-78-0x0000000004E50000-0x0000000004F91000-memory.dmpFilesize
1.3MB
-
memory/1268-70-0x00000000040B0000-0x0000000004174000-memory.dmpFilesize
784KB
-
memory/1956-71-0x0000000000000000-mapping.dmp
-
memory/1956-74-0x0000000000290000-0x000000000029E000-memory.dmpFilesize
56KB
-
memory/1956-75-0x00000000000F0000-0x000000000011E000-memory.dmpFilesize
184KB
-
memory/1956-76-0x0000000002120000-0x0000000002423000-memory.dmpFilesize
3.0MB
-
memory/1956-77-0x0000000000A00000-0x0000000000A93000-memory.dmpFilesize
588KB
-
memory/2044-59-0x0000000000000000-mapping.dmp