Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
05-07-2022 12:31
Static task
static1
Behavioral task
behavioral1
Sample
P.O-119370.QDT.js
Resource
win7-20220414-en
General
-
Target
P.O-119370.QDT.js
-
Size
372KB
-
MD5
2cf2b9a9a03292d7733f06e49cb29e11
-
SHA1
608d9f8a14814a4fabf64b2ee48a0f9b1278bbd2
-
SHA256
d2bdd71059b32be6cdf3fde2ff853b1dcb0f131568e983d625aed7007afd1850
-
SHA512
c7680a9137360da375ad234957a1736634d2b9c68def8bc9223854a0339c961855819de74d9ba05d5c0df36160d20b9fa98885c8d4ed5c9b5017a1df036a54de
Malware Config
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
-
Xloader Payload 6 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\mich.exe xloader C:\Users\Admin\AppData\Local\Temp\mich.exe xloader behavioral2/memory/1904-142-0x0000000000D00000-0x0000000000D2C000-memory.dmp xloader behavioral2/memory/1904-145-0x0000000000D00000-0x0000000000D2C000-memory.dmp xloader C:\Program Files (x86)\A4h7xefg\configelzl0rw.exe xloader C:\Program Files (x86)\A4h7xefg\configelzl0rw.exe xloader -
Executes dropped EXE 2 IoCs
Processes:
mich.execonfigelzl0rw.exepid process 1732 mich.exe 2456 configelzl0rw.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
mich.exewscript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation mich.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation wscript.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
systray.exedescription ioc process Key created \Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run systray.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WJD0JT2XGX = "C:\\Program Files (x86)\\A4h7xefg\\configelzl0rw.exe" systray.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
mich.exesystray.exedescription pid process target process PID 1732 set thread context of 2604 1732 mich.exe Explorer.EXE PID 1904 set thread context of 2604 1904 systray.exe Explorer.EXE -
Drops file in Program Files directory 4 IoCs
Processes:
systray.exeExplorer.EXEdescription ioc process File opened for modification C:\Program Files (x86)\A4h7xefg\configelzl0rw.exe systray.exe File opened for modification C:\Program Files (x86)\A4h7xefg Explorer.EXE File created C:\Program Files (x86)\A4h7xefg\configelzl0rw.exe Explorer.EXE File opened for modification C:\Program Files (x86)\A4h7xefg\configelzl0rw.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
systray.exedescription ioc process Key created \Registry\User\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 systray.exe -
Suspicious behavior: EnumeratesProcesses 60 IoCs
Processes:
mich.exesystray.execonfigelzl0rw.exepid process 1732 mich.exe 1732 mich.exe 1732 mich.exe 1732 mich.exe 1904 systray.exe 1904 systray.exe 1904 systray.exe 1904 systray.exe 1904 systray.exe 1904 systray.exe 1904 systray.exe 1904 systray.exe 1904 systray.exe 1904 systray.exe 1904 systray.exe 1904 systray.exe 1904 systray.exe 1904 systray.exe 1904 systray.exe 1904 systray.exe 1904 systray.exe 1904 systray.exe 1904 systray.exe 1904 systray.exe 1904 systray.exe 1904 systray.exe 1904 systray.exe 1904 systray.exe 1904 systray.exe 1904 systray.exe 1904 systray.exe 1904 systray.exe 1904 systray.exe 1904 systray.exe 1904 systray.exe 1904 systray.exe 1904 systray.exe 1904 systray.exe 1904 systray.exe 1904 systray.exe 1904 systray.exe 1904 systray.exe 1904 systray.exe 1904 systray.exe 1904 systray.exe 1904 systray.exe 1904 systray.exe 1904 systray.exe 1904 systray.exe 1904 systray.exe 1904 systray.exe 1904 systray.exe 1904 systray.exe 1904 systray.exe 1904 systray.exe 1904 systray.exe 2456 configelzl0rw.exe 2456 configelzl0rw.exe 1904 systray.exe 1904 systray.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2604 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
mich.exesystray.exepid process 1732 mich.exe 1732 mich.exe 1732 mich.exe 1904 systray.exe 1904 systray.exe 1904 systray.exe 1904 systray.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
mich.exesystray.execonfigelzl0rw.exedescription pid process Token: SeDebugPrivilege 1732 mich.exe Token: SeDebugPrivilege 1904 systray.exe Token: SeDebugPrivilege 2456 configelzl0rw.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
wscript.exeExplorer.EXEsystray.exedescription pid process target process PID 3804 wrote to memory of 3624 3804 wscript.exe wscript.exe PID 3804 wrote to memory of 3624 3804 wscript.exe wscript.exe PID 3804 wrote to memory of 1732 3804 wscript.exe mich.exe PID 3804 wrote to memory of 1732 3804 wscript.exe mich.exe PID 3804 wrote to memory of 1732 3804 wscript.exe mich.exe PID 2604 wrote to memory of 1904 2604 Explorer.EXE systray.exe PID 2604 wrote to memory of 1904 2604 Explorer.EXE systray.exe PID 2604 wrote to memory of 1904 2604 Explorer.EXE systray.exe PID 1904 wrote to memory of 2868 1904 systray.exe cmd.exe PID 1904 wrote to memory of 2868 1904 systray.exe cmd.exe PID 1904 wrote to memory of 2868 1904 systray.exe cmd.exe PID 1904 wrote to memory of 3560 1904 systray.exe Firefox.exe PID 1904 wrote to memory of 3560 1904 systray.exe Firefox.exe PID 1904 wrote to memory of 3560 1904 systray.exe Firefox.exe PID 2604 wrote to memory of 2456 2604 Explorer.EXE configelzl0rw.exe PID 2604 wrote to memory of 2456 2604 Explorer.EXE configelzl0rw.exe PID 2604 wrote to memory of 2456 2604 Explorer.EXE configelzl0rw.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\P.O-119370.QDT.js1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\FuRyoeswyz.js"2⤵
-
C:\Users\Admin\AppData\Local\Temp\mich.exe"C:\Users\Admin\AppData\Local\Temp\mich.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\mich.exe"3⤵
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
C:\Program Files (x86)\A4h7xefg\configelzl0rw.exe"C:\Program Files (x86)\A4h7xefg\configelzl0rw.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\A4h7xefg\configelzl0rw.exeFilesize
176KB
MD51fc7c4722c38fc29370e0269923e0300
SHA100afe50634a01a27a0d6c016bb2234798b80d0bc
SHA25662a159f3419411b25c59be1648c95f5798c1936a6ab081003c9f60f2bddb6a57
SHA5124445835f602cc6c0a7ad75d7765e95e31e13684129ed67009c8ecb9a01db1e6e6e59c231cd2c53eaa8c5f181323c265a450325069b40d8cb851fb1faa8d1ef62
-
C:\Program Files (x86)\A4h7xefg\configelzl0rw.exeFilesize
176KB
MD51fc7c4722c38fc29370e0269923e0300
SHA100afe50634a01a27a0d6c016bb2234798b80d0bc
SHA25662a159f3419411b25c59be1648c95f5798c1936a6ab081003c9f60f2bddb6a57
SHA5124445835f602cc6c0a7ad75d7765e95e31e13684129ed67009c8ecb9a01db1e6e6e59c231cd2c53eaa8c5f181323c265a450325069b40d8cb851fb1faa8d1ef62
-
C:\Users\Admin\AppData\Local\Temp\mich.exeFilesize
176KB
MD51fc7c4722c38fc29370e0269923e0300
SHA100afe50634a01a27a0d6c016bb2234798b80d0bc
SHA25662a159f3419411b25c59be1648c95f5798c1936a6ab081003c9f60f2bddb6a57
SHA5124445835f602cc6c0a7ad75d7765e95e31e13684129ed67009c8ecb9a01db1e6e6e59c231cd2c53eaa8c5f181323c265a450325069b40d8cb851fb1faa8d1ef62
-
C:\Users\Admin\AppData\Local\Temp\mich.exeFilesize
176KB
MD51fc7c4722c38fc29370e0269923e0300
SHA100afe50634a01a27a0d6c016bb2234798b80d0bc
SHA25662a159f3419411b25c59be1648c95f5798c1936a6ab081003c9f60f2bddb6a57
SHA5124445835f602cc6c0a7ad75d7765e95e31e13684129ed67009c8ecb9a01db1e6e6e59c231cd2c53eaa8c5f181323c265a450325069b40d8cb851fb1faa8d1ef62
-
C:\Users\Admin\AppData\Roaming\FuRyoeswyz.jsFilesize
18KB
MD541236d778eba797fbbee9ccf91ab6867
SHA1438bc929b4a439ec5eda7b897b3356a9dbb73acb
SHA256aebc5a943fee52e41ffbf2aeacb6ad1ab5b16ba4cbea53039f98834e6c25ddeb
SHA51265169a40903876982f1abc4141d39a6c9b5a3f9b3d95091edc9bc19e3ea011077bbebce9447a8ca48b26dd32463a15948ba24d3a773e88d14cdf56feb3191496
-
memory/1732-132-0x0000000000000000-mapping.dmp
-
memory/1732-135-0x00000000010B0000-0x00000000013FA000-memory.dmpFilesize
3.3MB
-
memory/1732-136-0x0000000001070000-0x0000000001081000-memory.dmpFilesize
68KB
-
memory/1904-140-0x0000000000670000-0x0000000000676000-memory.dmpFilesize
24KB
-
memory/1904-141-0x0000000002CA0000-0x0000000002FEA000-memory.dmpFilesize
3.3MB
-
memory/1904-142-0x0000000000D00000-0x0000000000D2C000-memory.dmpFilesize
176KB
-
memory/1904-143-0x0000000002A00000-0x0000000002A90000-memory.dmpFilesize
576KB
-
memory/1904-145-0x0000000000D00000-0x0000000000D2C000-memory.dmpFilesize
176KB
-
memory/1904-138-0x0000000000000000-mapping.dmp
-
memory/2456-147-0x0000000000000000-mapping.dmp
-
memory/2456-150-0x0000000001830000-0x0000000001B7A000-memory.dmpFilesize
3.3MB
-
memory/2604-144-0x0000000002890000-0x000000000296E000-memory.dmpFilesize
888KB
-
memory/2604-146-0x0000000002890000-0x000000000296E000-memory.dmpFilesize
888KB
-
memory/2604-137-0x00000000084E0000-0x000000000867E000-memory.dmpFilesize
1.6MB
-
memory/2868-139-0x0000000000000000-mapping.dmp
-
memory/3624-130-0x0000000000000000-mapping.dmp