Analysis
-
max time kernel
154s -
max time network
198s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 02:18
Static task
static1
Behavioral task
behavioral1
Sample
mgkreERjvr7XiMz.exe
Resource
win7-20220414-en
General
-
Target
mgkreERjvr7XiMz.exe
-
Size
404KB
-
MD5
332c98e548482176fda185f932f2ed18
-
SHA1
8bd6cfdc0950cd2fad8f64765b6107cc2d6f87eb
-
SHA256
ce6d1fc239eb571fde9427c0d7f11d7b6a7a1c0466711524b690ca0de3556a6b
-
SHA512
20a1a33c6e4358469ea2227687fdcb7eec13503a483c866e4196ac70a639b8320e496d6b2bb75facbd0789e0bd01aed1c9bfa0626c3b136c99b27b8840d5696a
Malware Config
Extracted
formbook
4.1
duj
deapink.pink
tkmdz.com
nytzshicai.com
photos-identite-dijon.com
ekanun.net
xn--fiqy4bxl57l9sag6f6wb.ink
slivercat5.com
ai-ethics.net
510ns.com
inotherways.com
ridesharesettelment.com
zjxiangnong.com
aoraessentials.com
sheap-list.com
heshengqy.com
experts-comptables-paris-17.com
parissummerolympics2024.info
gtyx88.com
devopsonjob.com
vodacred.com
kandilakes.com
digitalcoincollective.com
seedrazer.com
24houremergencyroomnearme.com
xn--lg3bu5if3f.com
557486.top
czqfkj.com
running0711.com
aimwizard.com
holdingtoken.com
qgyldzw.com
mt1618.com
chiquicreates.com
0pe345.com
shopmomsthebomb.com
cheerzhangover.com
tascoxuanphuong.info
suitablepersonalprotection.com
dh12345.com
pixelfocusphotography.com
tianhegongcheng.com
foodsweet.com
hoamailand.com
btr96.info
eatsmartcookie.com
studebakergs.com
110422.info
infoicobit.com
northeastphillyshuttle.com
lover-road.com
pacificsolo.com
intangiblebitcoin.info
quericus.tech
indianchemicalmart.com
trublueroanokeva.com
apollontimes.news
interiordesignersudbury.com
klarkindustria.com
fraisgr.com
marketersarbitrage.com
adoriagroep.com
hxjfqe.com
stoneandstran.com
genkicoffee.com
spatren.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4276-134-0x0000000000400000-0x000000000042D000-memory.dmp formbook behavioral2/memory/4012-141-0x0000000000D90000-0x0000000000DBD000-memory.dmp formbook -
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Looks for VMWare Tools registry key 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
mgkreERjvr7XiMz.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion mgkreERjvr7XiMz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion mgkreERjvr7XiMz.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
mgkreERjvr7XiMz.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation mgkreERjvr7XiMz.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
mgkreERjvr7XiMz.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum mgkreERjvr7XiMz.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 mgkreERjvr7XiMz.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
mgkreERjvr7XiMz.exeMSBuild.execolorcpl.exedescription pid process target process PID 3004 set thread context of 4276 3004 mgkreERjvr7XiMz.exe MSBuild.exe PID 4276 set thread context of 3136 4276 MSBuild.exe Explorer.EXE PID 4012 set thread context of 3136 4012 colorcpl.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
MSBuild.execolorcpl.exepid process 4276 MSBuild.exe 4276 MSBuild.exe 4276 MSBuild.exe 4276 MSBuild.exe 4012 colorcpl.exe 4012 colorcpl.exe 4012 colorcpl.exe 4012 colorcpl.exe 4012 colorcpl.exe 4012 colorcpl.exe 4012 colorcpl.exe 4012 colorcpl.exe 4012 colorcpl.exe 4012 colorcpl.exe 4012 colorcpl.exe 4012 colorcpl.exe 4012 colorcpl.exe 4012 colorcpl.exe 4012 colorcpl.exe 4012 colorcpl.exe 4012 colorcpl.exe 4012 colorcpl.exe 4012 colorcpl.exe 4012 colorcpl.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
MSBuild.execolorcpl.exepid process 4276 MSBuild.exe 4276 MSBuild.exe 4276 MSBuild.exe 4012 colorcpl.exe 4012 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
mgkreERjvr7XiMz.exeMSBuild.execolorcpl.exedescription pid process Token: SeDebugPrivilege 3004 mgkreERjvr7XiMz.exe Token: SeDebugPrivilege 4276 MSBuild.exe Token: SeDebugPrivilege 4012 colorcpl.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
mgkreERjvr7XiMz.exeExplorer.EXEcolorcpl.exedescription pid process target process PID 3004 wrote to memory of 260 3004 mgkreERjvr7XiMz.exe schtasks.exe PID 3004 wrote to memory of 260 3004 mgkreERjvr7XiMz.exe schtasks.exe PID 3004 wrote to memory of 260 3004 mgkreERjvr7XiMz.exe schtasks.exe PID 3004 wrote to memory of 4276 3004 mgkreERjvr7XiMz.exe MSBuild.exe PID 3004 wrote to memory of 4276 3004 mgkreERjvr7XiMz.exe MSBuild.exe PID 3004 wrote to memory of 4276 3004 mgkreERjvr7XiMz.exe MSBuild.exe PID 3004 wrote to memory of 4276 3004 mgkreERjvr7XiMz.exe MSBuild.exe PID 3004 wrote to memory of 4276 3004 mgkreERjvr7XiMz.exe MSBuild.exe PID 3004 wrote to memory of 4276 3004 mgkreERjvr7XiMz.exe MSBuild.exe PID 3136 wrote to memory of 4012 3136 Explorer.EXE colorcpl.exe PID 3136 wrote to memory of 4012 3136 Explorer.EXE colorcpl.exe PID 3136 wrote to memory of 4012 3136 Explorer.EXE colorcpl.exe PID 4012 wrote to memory of 3472 4012 colorcpl.exe cmd.exe PID 4012 wrote to memory of 3472 4012 colorcpl.exe cmd.exe PID 4012 wrote to memory of 3472 4012 colorcpl.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\mgkreERjvr7XiMz.exe"C:\Users\Admin\AppData\Local\Temp\mgkreERjvr7XiMz.exe"2⤵
- Checks BIOS information in registry
- Checks computer location settings
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jlygIECUDei" /XML "C:\Users\Admin\AppData\Local\Temp\tmp821C.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp821C.tmpFilesize
1KB
MD58366a69a3d18ff43db67b920bdf70b52
SHA1d539c930b05e0b73a01a5826105ccd8dcabb7798
SHA256244db488ec53b054fda4dff1738e4862fec3127d46e6f2cba28692bb8cdea133
SHA512d91000ec34f728a01030f754efc689e3638bde04c77adfab784fb885b08005fe9c0f0c94834152eaca867b02c762b141edec5ece3ac6a9ece8c6fb8815434bb9
-
memory/260-131-0x0000000000000000-mapping.dmp
-
memory/3004-130-0x00000000747B0000-0x0000000074D61000-memory.dmpFilesize
5.7MB
-
memory/3136-145-0x00000000031C0000-0x0000000003277000-memory.dmpFilesize
732KB
-
memory/3136-138-0x0000000008A40000-0x0000000008BE5000-memory.dmpFilesize
1.6MB
-
memory/3472-143-0x0000000000000000-mapping.dmp
-
memory/4012-142-0x0000000002EC0000-0x000000000320A000-memory.dmpFilesize
3.3MB
-
memory/4012-144-0x0000000002CF0000-0x0000000002D83000-memory.dmpFilesize
588KB
-
memory/4012-139-0x0000000000000000-mapping.dmp
-
memory/4012-140-0x0000000000780000-0x0000000000799000-memory.dmpFilesize
100KB
-
memory/4012-141-0x0000000000D90000-0x0000000000DBD000-memory.dmpFilesize
180KB
-
memory/4276-133-0x0000000000000000-mapping.dmp
-
memory/4276-137-0x0000000001A90000-0x0000000001AA4000-memory.dmpFilesize
80KB
-
memory/4276-135-0x0000000001740000-0x0000000001A8A000-memory.dmpFilesize
3.3MB
-
memory/4276-134-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB