Analysis
-
max time kernel
91s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
23-06-2022 15:08
Static task
static1
Behavioral task
behavioral1
Sample
aec8a50a932ca187c7c0745772ac12db.exe
Resource
win7-20220414-en
General
-
Target
aec8a50a932ca187c7c0745772ac12db.exe
-
Size
896KB
-
MD5
aec8a50a932ca187c7c0745772ac12db
-
SHA1
dcbc7db37f8840164f7979d6967020f245c9958a
-
SHA256
a700153db70dd52ea66a74fc09145bbcf39a8019a7d31f733e8ef204494ca6ab
-
SHA512
c017175f5ef00aad1b080c92cc9e6a70d2ef4a8a9c0a233c776922b15712b8196fe1b91f5007b461ed4090b2b0033fe5edfc1d912fae8160696c645589a02a9d
Malware Config
Extracted
formbook
4.1
g2fg
snowcrash.website
pointman.us
newheartvalve.care
drandl.com
sandspringsramblers.com
programagubernamental.online
boja.us
mvrsnike.com
mentallyillmotherhood.com
facom.us
programagubernamental.store
izivente.com
roller-v.fr
amazonbioactives.com
metaverseapple.xyz
5gt-mobilevsverizon.com
gtwebsolutions.co
scottdunn.life
usdp.trade
pikmin.run
cardano-dogs.com
bf2hgfy.xyz
teslafoot.com
rubertquintana.com
wellsfargroewards.com
santel.us
couponatonline.com
theunitedhomeland.com
pmstnly.com
strlocal.com
shelleysmucker.com
youser.online
emansdesign.com
usnikeshoesbot.top
starfish.press
scotwork.us
metamorgana.com
onyxbx.net
rivas.company
firstcoastalfb.com
onpurposetraumainformedcare.com
celimot.xyz
jecunikepemej.rest
lenovolatenightit.com
unitedsterlingcompanyky.com
safety2venture.us
facebookismetanow.com
scottdunn.review
mentallyillmotherhood.com
firstincargo.com
vikavivi.com
investmenofpairs.club
nexans.cloud
farcloud.fr
ivermectinforhumans.quest
5gmalesdf.sbs
majenta.info
6vvvvvwmetam.top
metafirstclass.com
firstcoinnews.com
btcetffutures.online
funinfortmyers.com
mangoirslk.top
metaversebasicprivacy.com
blancheshelley.xyz
Signatures
-
Formbook Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3984-141-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
aec8a50a932ca187c7c0745772ac12db.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation aec8a50a932ca187c7c0745772ac12db.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
aec8a50a932ca187c7c0745772ac12db.exedescription pid process target process PID 2620 set thread context of 3984 2620 aec8a50a932ca187c7c0745772ac12db.exe aec8a50a932ca187c7c0745772ac12db.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exeaec8a50a932ca187c7c0745772ac12db.exepid process 4200 powershell.exe 3984 aec8a50a932ca187c7c0745772ac12db.exe 3984 aec8a50a932ca187c7c0745772ac12db.exe 4200 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 4200 powershell.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
aec8a50a932ca187c7c0745772ac12db.exedescription pid process target process PID 2620 wrote to memory of 4200 2620 aec8a50a932ca187c7c0745772ac12db.exe powershell.exe PID 2620 wrote to memory of 4200 2620 aec8a50a932ca187c7c0745772ac12db.exe powershell.exe PID 2620 wrote to memory of 4200 2620 aec8a50a932ca187c7c0745772ac12db.exe powershell.exe PID 2620 wrote to memory of 2072 2620 aec8a50a932ca187c7c0745772ac12db.exe schtasks.exe PID 2620 wrote to memory of 2072 2620 aec8a50a932ca187c7c0745772ac12db.exe schtasks.exe PID 2620 wrote to memory of 2072 2620 aec8a50a932ca187c7c0745772ac12db.exe schtasks.exe PID 2620 wrote to memory of 3984 2620 aec8a50a932ca187c7c0745772ac12db.exe aec8a50a932ca187c7c0745772ac12db.exe PID 2620 wrote to memory of 3984 2620 aec8a50a932ca187c7c0745772ac12db.exe aec8a50a932ca187c7c0745772ac12db.exe PID 2620 wrote to memory of 3984 2620 aec8a50a932ca187c7c0745772ac12db.exe aec8a50a932ca187c7c0745772ac12db.exe PID 2620 wrote to memory of 3984 2620 aec8a50a932ca187c7c0745772ac12db.exe aec8a50a932ca187c7c0745772ac12db.exe PID 2620 wrote to memory of 3984 2620 aec8a50a932ca187c7c0745772ac12db.exe aec8a50a932ca187c7c0745772ac12db.exe PID 2620 wrote to memory of 3984 2620 aec8a50a932ca187c7c0745772ac12db.exe aec8a50a932ca187c7c0745772ac12db.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\aec8a50a932ca187c7c0745772ac12db.exe"C:\Users\Admin\AppData\Local\Temp\aec8a50a932ca187c7c0745772ac12db.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\KShFPWjQ.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\KShFPWjQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp815A.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\aec8a50a932ca187c7c0745772ac12db.exe"C:\Users\Admin\AppData\Local\Temp\aec8a50a932ca187c7c0745772ac12db.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp815A.tmpFilesize
1KB
MD59894e844def0ca226e1da5fd612a6329
SHA151ff465561468126e1cd981eb1dc2cd25a03905b
SHA2561ad4fc6ba8736ebfbc8f384171fa788231d5eb244a206333ed2d1898ecc6a841
SHA51294dc4e9d9f345b35e4e8ff539692c1bb7db853cadce6d02e07ba8e76f5a6612a278522e646c1ec8341e1e5986af9087f4ea652c4be9359073db7a424304c1304
-
memory/2072-136-0x0000000000000000-mapping.dmp
-
memory/2620-131-0x0000000005DC0000-0x0000000006364000-memory.dmpFilesize
5.6MB
-
memory/2620-132-0x00000000058B0000-0x0000000005942000-memory.dmpFilesize
584KB
-
memory/2620-133-0x0000000005860000-0x000000000586A000-memory.dmpFilesize
40KB
-
memory/2620-134-0x0000000009320000-0x00000000093BC000-memory.dmpFilesize
624KB
-
memory/2620-130-0x0000000000DD0000-0x0000000000EB6000-memory.dmpFilesize
920KB
-
memory/3984-141-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3984-145-0x0000000001040000-0x000000000138A000-memory.dmpFilesize
3.3MB
-
memory/3984-140-0x0000000000000000-mapping.dmp
-
memory/4200-142-0x00000000053F0000-0x0000000005412000-memory.dmpFilesize
136KB
-
memory/4200-149-0x0000000006850000-0x000000000686E000-memory.dmpFilesize
120KB
-
memory/4200-137-0x00000000029B0000-0x00000000029E6000-memory.dmpFilesize
216KB
-
memory/4200-143-0x0000000005C30000-0x0000000005C96000-memory.dmpFilesize
408KB
-
memory/4200-144-0x0000000005DA0000-0x0000000005E06000-memory.dmpFilesize
408KB
-
memory/4200-135-0x0000000000000000-mapping.dmp
-
memory/4200-146-0x00000000062A0000-0x00000000062BE000-memory.dmpFilesize
120KB
-
memory/4200-147-0x0000000006870000-0x00000000068A2000-memory.dmpFilesize
200KB
-
memory/4200-148-0x0000000070C60000-0x0000000070CAC000-memory.dmpFilesize
304KB
-
memory/4200-139-0x0000000005600000-0x0000000005C28000-memory.dmpFilesize
6.2MB
-
memory/4200-150-0x0000000007C00000-0x000000000827A000-memory.dmpFilesize
6.5MB
-
memory/4200-151-0x00000000075C0000-0x00000000075DA000-memory.dmpFilesize
104KB
-
memory/4200-152-0x0000000007630000-0x000000000763A000-memory.dmpFilesize
40KB
-
memory/4200-153-0x0000000007840000-0x00000000078D6000-memory.dmpFilesize
600KB
-
memory/4200-154-0x00000000077F0000-0x00000000077FE000-memory.dmpFilesize
56KB
-
memory/4200-155-0x0000000007900000-0x000000000791A000-memory.dmpFilesize
104KB
-
memory/4200-156-0x00000000078E0000-0x00000000078E8000-memory.dmpFilesize
32KB