Analysis
-
max time kernel
152s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 03:33
Static task
static1
Behavioral task
behavioral1
Sample
PO.9758752img.exe
Resource
win7-20220414-en
General
-
Target
PO.9758752img.exe
-
Size
419KB
-
MD5
58727beb95ca8e5ec902f266901f3ebe
-
SHA1
6322381826a448cc3618ad343ebba8e82d309984
-
SHA256
359e02b2d5f52a490ef6811663993437866b52e86e9c9c4e633f30b716d73883
-
SHA512
30b9248a37190f486c3507eb517fb9ca2153b2ecb1989ff3e1aebc8c0b63507ca776dc08e4976e94308075a9d848aee4fedf9d2579d2be1ce12f14a0caf14e73
Malware Config
Extracted
formbook
4.1
duj
deapink.pink
tkmdz.com
nytzshicai.com
photos-identite-dijon.com
ekanun.net
xn--fiqy4bxl57l9sag6f6wb.ink
slivercat5.com
ai-ethics.net
510ns.com
inotherways.com
ridesharesettelment.com
zjxiangnong.com
aoraessentials.com
sheap-list.com
heshengqy.com
experts-comptables-paris-17.com
parissummerolympics2024.info
gtyx88.com
devopsonjob.com
vodacred.com
kandilakes.com
digitalcoincollective.com
seedrazer.com
24houremergencyroomnearme.com
xn--lg3bu5if3f.com
557486.top
czqfkj.com
running0711.com
aimwizard.com
holdingtoken.com
qgyldzw.com
mt1618.com
chiquicreates.com
0pe345.com
shopmomsthebomb.com
cheerzhangover.com
tascoxuanphuong.info
suitablepersonalprotection.com
dh12345.com
pixelfocusphotography.com
tianhegongcheng.com
foodsweet.com
hoamailand.com
btr96.info
eatsmartcookie.com
studebakergs.com
110422.info
infoicobit.com
northeastphillyshuttle.com
lover-road.com
pacificsolo.com
intangiblebitcoin.info
quericus.tech
indianchemicalmart.com
trublueroanokeva.com
apollontimes.news
interiordesignersudbury.com
klarkindustria.com
fraisgr.com
marketersarbitrage.com
adoriagroep.com
hxjfqe.com
stoneandstran.com
genkicoffee.com
spatren.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1980-134-0x0000000000400000-0x000000000042D000-memory.dmp formbook behavioral2/memory/1980-136-0x0000000000400000-0x000000000042D000-memory.dmp formbook behavioral2/memory/336-142-0x0000000000520000-0x000000000054D000-memory.dmp formbook -
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Looks for VMWare Tools registry key 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
PO.9758752img.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion PO.9758752img.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion PO.9758752img.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
PO.9758752img.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation PO.9758752img.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
PO.9758752img.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum PO.9758752img.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 PO.9758752img.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
PO.9758752img.exeMSBuild.execscript.exedescription pid process target process PID 5036 set thread context of 1980 5036 PO.9758752img.exe MSBuild.exe PID 1980 set thread context of 3164 1980 MSBuild.exe Explorer.EXE PID 336 set thread context of 3164 336 cscript.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
PO.9758752img.exeMSBuild.execscript.exepid process 5036 PO.9758752img.exe 5036 PO.9758752img.exe 5036 PO.9758752img.exe 1980 MSBuild.exe 1980 MSBuild.exe 1980 MSBuild.exe 1980 MSBuild.exe 336 cscript.exe 336 cscript.exe 336 cscript.exe 336 cscript.exe 336 cscript.exe 336 cscript.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
MSBuild.execscript.exepid process 1980 MSBuild.exe 1980 MSBuild.exe 1980 MSBuild.exe 336 cscript.exe 336 cscript.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
PO.9758752img.exeMSBuild.execscript.exedescription pid process Token: SeDebugPrivilege 5036 PO.9758752img.exe Token: SeDebugPrivilege 1980 MSBuild.exe Token: SeDebugPrivilege 336 cscript.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
PO.9758752img.exeExplorer.EXEcscript.exedescription pid process target process PID 5036 wrote to memory of 4968 5036 PO.9758752img.exe schtasks.exe PID 5036 wrote to memory of 4968 5036 PO.9758752img.exe schtasks.exe PID 5036 wrote to memory of 4968 5036 PO.9758752img.exe schtasks.exe PID 5036 wrote to memory of 1980 5036 PO.9758752img.exe MSBuild.exe PID 5036 wrote to memory of 1980 5036 PO.9758752img.exe MSBuild.exe PID 5036 wrote to memory of 1980 5036 PO.9758752img.exe MSBuild.exe PID 5036 wrote to memory of 1980 5036 PO.9758752img.exe MSBuild.exe PID 5036 wrote to memory of 1980 5036 PO.9758752img.exe MSBuild.exe PID 5036 wrote to memory of 1980 5036 PO.9758752img.exe MSBuild.exe PID 3164 wrote to memory of 336 3164 Explorer.EXE cscript.exe PID 3164 wrote to memory of 336 3164 Explorer.EXE cscript.exe PID 3164 wrote to memory of 336 3164 Explorer.EXE cscript.exe PID 336 wrote to memory of 4936 336 cscript.exe cmd.exe PID 336 wrote to memory of 4936 336 cscript.exe cmd.exe PID 336 wrote to memory of 4936 336 cscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO.9758752img.exe"C:\Users\Admin\AppData\Local\Temp\PO.9758752img.exe"2⤵
- Checks BIOS information in registry
- Checks computer location settings
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cWBTWBNA" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB2B1.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpB2B1.tmpFilesize
1KB
MD541c3251da9319433527ecfe49b0cbc68
SHA1327a4d44275ace5c890775503438027a22225fb6
SHA25631fbe6cefd87daf621d83a16b8a760b163ad23985717d574bdf6084ea7847a81
SHA512a11edbe1f0c7a7ff71d582a58e456df230a417bb5931c3fe34b0a1be9d03de4de5b2a649a9211aa990fd9a9b6cc6dea537c030a4c0fbd4a94a1396e7e9a71650
-
memory/336-141-0x0000000000620000-0x0000000000647000-memory.dmpFilesize
156KB
-
memory/336-145-0x0000000002440000-0x00000000024D3000-memory.dmpFilesize
588KB
-
memory/336-144-0x0000000002700000-0x0000000002A4A000-memory.dmpFilesize
3.3MB
-
memory/336-140-0x0000000000000000-mapping.dmp
-
memory/336-142-0x0000000000520000-0x000000000054D000-memory.dmpFilesize
180KB
-
memory/1980-133-0x0000000000000000-mapping.dmp
-
memory/1980-134-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/1980-136-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/1980-137-0x00000000013C0000-0x000000000170A000-memory.dmpFilesize
3.3MB
-
memory/1980-138-0x0000000001830000-0x0000000001844000-memory.dmpFilesize
80KB
-
memory/3164-139-0x00000000085A0000-0x00000000086BB000-memory.dmpFilesize
1.1MB
-
memory/3164-146-0x00000000086C0000-0x00000000087C5000-memory.dmpFilesize
1.0MB
-
memory/4936-143-0x0000000000000000-mapping.dmp
-
memory/4968-131-0x0000000000000000-mapping.dmp
-
memory/5036-130-0x0000000075540000-0x0000000075AF1000-memory.dmpFilesize
5.7MB