Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
05-07-2022 12:31
Static task
static1
Behavioral task
behavioral1
Sample
P.O-119370.QDT.js
Resource
win7-20220414-en
General
-
Target
P.O-119370.QDT.js
-
Size
372KB
-
MD5
2cf2b9a9a03292d7733f06e49cb29e11
-
SHA1
608d9f8a14814a4fabf64b2ee48a0f9b1278bbd2
-
SHA256
d2bdd71059b32be6cdf3fde2ff853b1dcb0f131568e983d625aed7007afd1850
-
SHA512
c7680a9137360da375ad234957a1736634d2b9c68def8bc9223854a0339c961855819de74d9ba05d5c0df36160d20b9fa98885c8d4ed5c9b5017a1df036a54de
Malware Config
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 6 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\mich.exe xloader C:\Users\Admin\AppData\Local\Temp\mich.exe xloader behavioral1/memory/1792-67-0x0000000000080000-0x00000000000AC000-memory.dmp xloader behavioral1/memory/1792-71-0x0000000000080000-0x00000000000AC000-memory.dmp xloader C:\Program Files (x86)\Xobcpor5\Cookieszpqlgb.exe xloader C:\Program Files (x86)\Xobcpor5\Cookieszpqlgb.exe xloader -
Executes dropped EXE 2 IoCs
Processes:
mich.exeCookieszpqlgb.exepid process 1284 mich.exe 272 Cookieszpqlgb.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
mich.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation mich.exe -
Loads dropped DLL 1 IoCs
Processes:
raserver.exepid process 1792 raserver.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
raserver.exedescription ioc process Key created \Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run raserver.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\XX-DQXUH5L = "C:\\Program Files (x86)\\Xobcpor5\\Cookieszpqlgb.exe" raserver.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
mich.exeraserver.exedescription pid process target process PID 1284 set thread context of 1228 1284 mich.exe Explorer.EXE PID 1792 set thread context of 1228 1792 raserver.exe Explorer.EXE -
Drops file in Program Files directory 2 IoCs
Processes:
raserver.exeExplorer.EXEdescription ioc process File opened for modification C:\Program Files (x86)\Xobcpor5\Cookieszpqlgb.exe raserver.exe File created C:\Program Files (x86)\Xobcpor5\Cookieszpqlgb.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
raserver.exedescription ioc process Key created \Registry\User\S-1-5-21-1083475884-596052423-1669053738-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 raserver.exe -
Suspicious behavior: EnumeratesProcesses 25 IoCs
Processes:
mich.exeraserver.exeCookieszpqlgb.exepid process 1284 mich.exe 1284 mich.exe 1792 raserver.exe 1792 raserver.exe 1792 raserver.exe 1792 raserver.exe 1792 raserver.exe 1792 raserver.exe 1792 raserver.exe 1792 raserver.exe 1792 raserver.exe 1792 raserver.exe 1792 raserver.exe 1792 raserver.exe 1792 raserver.exe 1792 raserver.exe 1792 raserver.exe 1792 raserver.exe 1792 raserver.exe 1792 raserver.exe 1792 raserver.exe 272 Cookieszpqlgb.exe 1792 raserver.exe 1792 raserver.exe 1792 raserver.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
mich.exeraserver.exepid process 1284 mich.exe 1284 mich.exe 1284 mich.exe 1792 raserver.exe 1792 raserver.exe 1792 raserver.exe 1792 raserver.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
mich.exeraserver.exeCookieszpqlgb.exedescription pid process Token: SeDebugPrivilege 1284 mich.exe Token: SeDebugPrivilege 1792 raserver.exe Token: SeDebugPrivilege 272 Cookieszpqlgb.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1228 Explorer.EXE 1228 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1228 Explorer.EXE 1228 Explorer.EXE -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
wscript.exeExplorer.EXEraserver.exedescription pid process target process PID 1620 wrote to memory of 1280 1620 wscript.exe wscript.exe PID 1620 wrote to memory of 1280 1620 wscript.exe wscript.exe PID 1620 wrote to memory of 1280 1620 wscript.exe wscript.exe PID 1620 wrote to memory of 1284 1620 wscript.exe mich.exe PID 1620 wrote to memory of 1284 1620 wscript.exe mich.exe PID 1620 wrote to memory of 1284 1620 wscript.exe mich.exe PID 1620 wrote to memory of 1284 1620 wscript.exe mich.exe PID 1228 wrote to memory of 1792 1228 Explorer.EXE raserver.exe PID 1228 wrote to memory of 1792 1228 Explorer.EXE raserver.exe PID 1228 wrote to memory of 1792 1228 Explorer.EXE raserver.exe PID 1228 wrote to memory of 1792 1228 Explorer.EXE raserver.exe PID 1792 wrote to memory of 1832 1792 raserver.exe cmd.exe PID 1792 wrote to memory of 1832 1792 raserver.exe cmd.exe PID 1792 wrote to memory of 1832 1792 raserver.exe cmd.exe PID 1792 wrote to memory of 1832 1792 raserver.exe cmd.exe PID 1792 wrote to memory of 1992 1792 raserver.exe Firefox.exe PID 1792 wrote to memory of 1992 1792 raserver.exe Firefox.exe PID 1792 wrote to memory of 1992 1792 raserver.exe Firefox.exe PID 1792 wrote to memory of 1992 1792 raserver.exe Firefox.exe PID 1792 wrote to memory of 1992 1792 raserver.exe Firefox.exe PID 1228 wrote to memory of 272 1228 Explorer.EXE Cookieszpqlgb.exe PID 1228 wrote to memory of 272 1228 Explorer.EXE Cookieszpqlgb.exe PID 1228 wrote to memory of 272 1228 Explorer.EXE Cookieszpqlgb.exe PID 1228 wrote to memory of 272 1228 Explorer.EXE Cookieszpqlgb.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\P.O-119370.QDT.js2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\FuRyoeswyz.js"3⤵
-
C:\Users\Admin\AppData\Local\Temp\mich.exe"C:\Users\Admin\AppData\Local\Temp\mich.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\mich.exe"3⤵
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
C:\Program Files (x86)\Xobcpor5\Cookieszpqlgb.exe"C:\Program Files (x86)\Xobcpor5\Cookieszpqlgb.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Xobcpor5\Cookieszpqlgb.exeFilesize
176KB
MD51fc7c4722c38fc29370e0269923e0300
SHA100afe50634a01a27a0d6c016bb2234798b80d0bc
SHA25662a159f3419411b25c59be1648c95f5798c1936a6ab081003c9f60f2bddb6a57
SHA5124445835f602cc6c0a7ad75d7765e95e31e13684129ed67009c8ecb9a01db1e6e6e59c231cd2c53eaa8c5f181323c265a450325069b40d8cb851fb1faa8d1ef62
-
C:\Program Files (x86)\Xobcpor5\Cookieszpqlgb.exeFilesize
176KB
MD51fc7c4722c38fc29370e0269923e0300
SHA100afe50634a01a27a0d6c016bb2234798b80d0bc
SHA25662a159f3419411b25c59be1648c95f5798c1936a6ab081003c9f60f2bddb6a57
SHA5124445835f602cc6c0a7ad75d7765e95e31e13684129ed67009c8ecb9a01db1e6e6e59c231cd2c53eaa8c5f181323c265a450325069b40d8cb851fb1faa8d1ef62
-
C:\Users\Admin\AppData\Local\Temp\mich.exeFilesize
176KB
MD51fc7c4722c38fc29370e0269923e0300
SHA100afe50634a01a27a0d6c016bb2234798b80d0bc
SHA25662a159f3419411b25c59be1648c95f5798c1936a6ab081003c9f60f2bddb6a57
SHA5124445835f602cc6c0a7ad75d7765e95e31e13684129ed67009c8ecb9a01db1e6e6e59c231cd2c53eaa8c5f181323c265a450325069b40d8cb851fb1faa8d1ef62
-
C:\Users\Admin\AppData\Local\Temp\mich.exeFilesize
176KB
MD51fc7c4722c38fc29370e0269923e0300
SHA100afe50634a01a27a0d6c016bb2234798b80d0bc
SHA25662a159f3419411b25c59be1648c95f5798c1936a6ab081003c9f60f2bddb6a57
SHA5124445835f602cc6c0a7ad75d7765e95e31e13684129ed67009c8ecb9a01db1e6e6e59c231cd2c53eaa8c5f181323c265a450325069b40d8cb851fb1faa8d1ef62
-
C:\Users\Admin\AppData\Roaming\FuRyoeswyz.jsFilesize
18KB
MD541236d778eba797fbbee9ccf91ab6867
SHA1438bc929b4a439ec5eda7b897b3356a9dbb73acb
SHA256aebc5a943fee52e41ffbf2aeacb6ad1ab5b16ba4cbea53039f98834e6c25ddeb
SHA51265169a40903876982f1abc4141d39a6c9b5a3f9b3d95091edc9bc19e3ea011077bbebce9447a8ca48b26dd32463a15948ba24d3a773e88d14cdf56feb3191496
-
\Users\Admin\AppData\Local\Temp\sqlite3.dllFilesize
630KB
MD506b455698aba68f911c2f6d17bbefc6a
SHA14116e1345134012a0fc8a84b4bbf6c681621a266
SHA2566d81a69544457d3db38f97932869e0589feed4d7249462cce7aa8b15c6c00bd2
SHA512d64c0219933a0600702d54ca158e794b2784b1040e15d4657d87f46c091ed7ed1addcf3c46859e87c811f5c1543928596990103ae5de29a00eab7999ba7a1b3e
-
memory/272-76-0x0000000000950000-0x0000000000C53000-memory.dmpFilesize
3.0MB
-
memory/272-74-0x0000000000000000-mapping.dmp
-
memory/1228-70-0x0000000006140000-0x000000000629F000-memory.dmpFilesize
1.4MB
-
memory/1228-61-0x0000000006020000-0x0000000006131000-memory.dmpFilesize
1.1MB
-
memory/1228-72-0x0000000006140000-0x000000000629F000-memory.dmpFilesize
1.4MB
-
memory/1280-55-0x0000000000000000-mapping.dmp
-
memory/1284-60-0x0000000000170000-0x0000000000181000-memory.dmpFilesize
68KB
-
memory/1284-59-0x0000000000800000-0x0000000000B03000-memory.dmpFilesize
3.0MB
-
memory/1284-57-0x0000000000000000-mapping.dmp
-
memory/1620-54-0x000007FEFB871000-0x000007FEFB873000-memory.dmpFilesize
8KB
-
memory/1792-67-0x0000000000080000-0x00000000000AC000-memory.dmpFilesize
176KB
-
memory/1792-68-0x0000000001FF0000-0x00000000022F3000-memory.dmpFilesize
3.0MB
-
memory/1792-69-0x00000000008A0000-0x0000000000930000-memory.dmpFilesize
576KB
-
memory/1792-66-0x0000000000BD0000-0x0000000000BEC000-memory.dmpFilesize
112KB
-
memory/1792-71-0x0000000000080000-0x00000000000AC000-memory.dmpFilesize
176KB
-
memory/1792-63-0x0000000075A61000-0x0000000075A63000-memory.dmpFilesize
8KB
-
memory/1792-62-0x0000000000000000-mapping.dmp
-
memory/1832-65-0x0000000000000000-mapping.dmp