Analysis
-
max time kernel
148s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
29-06-2022 17:19
Static task
static1
Behavioral task
behavioral1
Sample
triage_dropped_file.exe
Resource
win7-20220414-en
General
-
Target
triage_dropped_file.exe
-
Size
704KB
-
MD5
6b25cd644f183af7c7447ba2d658e8c5
-
SHA1
b3fee68e0d04e03c34ba546bc714096d13641815
-
SHA256
7952c76d1d86927893a2ef8ca0a23bb1b45af38565f2ad9cea09a942bd5059f8
-
SHA512
877ca781d89283c5bf7e26e45dce561d52c7a580aa08b172313443681494bf2aa24664a42ca95b6d88e76b43196c51997509098dd0979459ebe9ff48a6f658a9
Malware Config
Extracted
formbook
4.1
m56u
tercantiq.com
fortvillechicken.net
spiritsandtheb.com
alliant-inc.biz
yh1902.com
xiaodewenhua.net
cityjobs.xyz
seniorlivingwisconsin.com
piadagrilla.com
truistfinancebank.online
nft-fashionlover.com
hangmandownload.com
chun888.xyz
lemonviral.com
getagrip.network
daniellepinnock.info
chiswickstudios.com
essayservicee.com
bharatpragatifoundation.com
800vn.com
leslieskraftboutique.com
massimusdescanso.com
bastadidiabete.com
tufkase.com
fifyx.xyz
xn--hausarzt-lneburg-szb.com
healthcarecheap.com
minshangjt.com
therapistorangecounty.com
thehappyfinn.com
cannalytics-test.com
thejunglees.com
hotel-tuerkiye.com
80at39.com
elsiemckellar.com
jia-he.net
www-kerassentials.com
sang-pakar.xyz
bivirtual.com
ventul.online
mikateknik.xyz
comparazionequote.net
suffolkpolefitness.com
395136.com
kui88.xyz
keohps.com
laketarponresort.com
betaal.fyi
ekascollection.com
rawreporter.com
regionhere.xyz
theartistknownaskayla.com
bobbihub.com
ezviz.xyz
kiffiybeauty.com
mocthaotay.com
glacies-financial.com
altamahalife.com
jodeeluna.com
familylabsummit.com
oufsfaooqp.com
famaciaonlineveterinaria.com
jadooresurfb.info
yansonlineshop.com
pielearn.com
Signatures
-
Formbook Payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/1472-136-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1472-138-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/520-144-0x0000000000510000-0x000000000053F000-memory.dmp formbook behavioral2/memory/520-149-0x0000000000510000-0x000000000053F000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
triage_dropped_file.exetriage_dropped_file.exechkdsk.exedescription pid process target process PID 392 set thread context of 1472 392 triage_dropped_file.exe triage_dropped_file.exe PID 1472 set thread context of 3152 1472 triage_dropped_file.exe Explorer.EXE PID 520 set thread context of 3152 520 chkdsk.exe Explorer.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 50 IoCs
Processes:
triage_dropped_file.exechkdsk.exepid process 1472 triage_dropped_file.exe 1472 triage_dropped_file.exe 1472 triage_dropped_file.exe 1472 triage_dropped_file.exe 520 chkdsk.exe 520 chkdsk.exe 520 chkdsk.exe 520 chkdsk.exe 520 chkdsk.exe 520 chkdsk.exe 520 chkdsk.exe 520 chkdsk.exe 520 chkdsk.exe 520 chkdsk.exe 520 chkdsk.exe 520 chkdsk.exe 520 chkdsk.exe 520 chkdsk.exe 520 chkdsk.exe 520 chkdsk.exe 520 chkdsk.exe 520 chkdsk.exe 520 chkdsk.exe 520 chkdsk.exe 520 chkdsk.exe 520 chkdsk.exe 520 chkdsk.exe 520 chkdsk.exe 520 chkdsk.exe 520 chkdsk.exe 520 chkdsk.exe 520 chkdsk.exe 520 chkdsk.exe 520 chkdsk.exe 520 chkdsk.exe 520 chkdsk.exe 520 chkdsk.exe 520 chkdsk.exe 520 chkdsk.exe 520 chkdsk.exe 520 chkdsk.exe 520 chkdsk.exe 520 chkdsk.exe 520 chkdsk.exe 520 chkdsk.exe 520 chkdsk.exe 520 chkdsk.exe 520 chkdsk.exe 520 chkdsk.exe 520 chkdsk.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3152 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
triage_dropped_file.exechkdsk.exepid process 1472 triage_dropped_file.exe 1472 triage_dropped_file.exe 1472 triage_dropped_file.exe 520 chkdsk.exe 520 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
triage_dropped_file.exechkdsk.exedescription pid process Token: SeDebugPrivilege 1472 triage_dropped_file.exe Token: SeDebugPrivilege 520 chkdsk.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
triage_dropped_file.exeExplorer.EXEchkdsk.exedescription pid process target process PID 392 wrote to memory of 1472 392 triage_dropped_file.exe triage_dropped_file.exe PID 392 wrote to memory of 1472 392 triage_dropped_file.exe triage_dropped_file.exe PID 392 wrote to memory of 1472 392 triage_dropped_file.exe triage_dropped_file.exe PID 392 wrote to memory of 1472 392 triage_dropped_file.exe triage_dropped_file.exe PID 392 wrote to memory of 1472 392 triage_dropped_file.exe triage_dropped_file.exe PID 392 wrote to memory of 1472 392 triage_dropped_file.exe triage_dropped_file.exe PID 3152 wrote to memory of 520 3152 Explorer.EXE chkdsk.exe PID 3152 wrote to memory of 520 3152 Explorer.EXE chkdsk.exe PID 3152 wrote to memory of 520 3152 Explorer.EXE chkdsk.exe PID 520 wrote to memory of 3000 520 chkdsk.exe cmd.exe PID 520 wrote to memory of 3000 520 chkdsk.exe cmd.exe PID 520 wrote to memory of 3000 520 chkdsk.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.exe"C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.exe"C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/392-131-0x00000000052B0000-0x0000000005854000-memory.dmpFilesize
5.6MB
-
memory/392-132-0x0000000004D00000-0x0000000004D92000-memory.dmpFilesize
584KB
-
memory/392-133-0x0000000004CC0000-0x0000000004CCA000-memory.dmpFilesize
40KB
-
memory/392-134-0x0000000008780000-0x000000000881C000-memory.dmpFilesize
624KB
-
memory/392-130-0x0000000000280000-0x0000000000336000-memory.dmpFilesize
728KB
-
memory/520-142-0x0000000000000000-mapping.dmp
-
memory/520-149-0x0000000000510000-0x000000000053F000-memory.dmpFilesize
188KB
-
memory/520-147-0x0000000000D60000-0x0000000000DF3000-memory.dmpFilesize
588KB
-
memory/520-146-0x0000000000E40000-0x000000000118A000-memory.dmpFilesize
3.3MB
-
memory/520-144-0x0000000000510000-0x000000000053F000-memory.dmpFilesize
188KB
-
memory/520-143-0x0000000000590000-0x000000000059A000-memory.dmpFilesize
40KB
-
memory/1472-135-0x0000000000000000-mapping.dmp
-
memory/1472-140-0x0000000001530000-0x0000000001544000-memory.dmpFilesize
80KB
-
memory/1472-139-0x0000000001A00000-0x0000000001D4A000-memory.dmpFilesize
3.3MB
-
memory/1472-138-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1472-136-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3000-145-0x0000000000000000-mapping.dmp
-
memory/3152-141-0x0000000002B50000-0x0000000002C18000-memory.dmpFilesize
800KB
-
memory/3152-148-0x00000000084D0000-0x00000000085D8000-memory.dmpFilesize
1.0MB
-
memory/3152-150-0x00000000084D0000-0x00000000085D8000-memory.dmpFilesize
1.0MB