Analysis
-
max time kernel
284s -
max time network
293s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
06-07-2022 05:07
Static task
static1
Behavioral task
behavioral1
Sample
bb57e60238a1f7954433764a77c251f0b6367120592605b04307bf2d3aec446e.exe
Resource
win7-20220414-en
General
-
Target
bb57e60238a1f7954433764a77c251f0b6367120592605b04307bf2d3aec446e.exe
-
Size
623KB
-
MD5
d796106a6798936495f83e5eeb341c90
-
SHA1
671a5437ce4fe56510909a852916a19eaf983dc6
-
SHA256
bb57e60238a1f7954433764a77c251f0b6367120592605b04307bf2d3aec446e
-
SHA512
9cbb995f2d32fef68348d0037ea8b6fac98ba86905b96658bf527961ae04f63ce65a23efcb4dee6e6fe8b3f1e5cf77e40221fd92dff925e0a60c2563eac2a7f7
Malware Config
Extracted
formbook
4.1
jr04
usatotribu.com
jak-omi.xyz
spacemozaic.pro
fordheritagevauly.com
vinted.beauty
gowebinar4u.com
infinixmediapty.com
dingquanjr.com
vahidblog.com
kgav99q.icu
healtyneck.com
assg3cd.icu
airconditionerworld.site
opinkmflotp.site
mineclicker.net
davidsonfessettlement.com
secured-verification.com
kgwjqaj.icu
subtmv.xyz
auntysocialvintage.com
aszg1j1.icu
carereports.site
museundpoet.com
zshl31565.top
conquisteavida.net
captain-america-georgia.com
cbirc.info
groupenoesis.fr
erthadventurer.art
kgtbphw.icu
supersonicwash.com
winlitgroup.com
strongbtie.com
kglnjj6.icu
queromaisbolsa.com
sevenstarprop.com
szshortcut.com
jeikickpuzzle.com
smartkitchensandbedrooms.com
rentacarnigeria.com
true-help.com
teresa-test02.com
asuc4cc.icu
skolahrou.net
calt.cloud
smxc.store
askaqxx.icu
stockstrends.com
theorycash.com
noticiaspiura.com
sese8309.com
virtueos.net
immo-foxo.com
cnskii.com
neuclon.com
propertylogistics.top
coachraerae.com
zhanshejing.com
billboardsworldwide.com
asxonwy.icu
backstorynews.com
workpunctual.com
international.movie
kgb77n6.icu
fomobombs.com
Signatures
-
Formbook Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/764-142-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
bb57e60238a1f7954433764a77c251f0b6367120592605b04307bf2d3aec446e.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation bb57e60238a1f7954433764a77c251f0b6367120592605b04307bf2d3aec446e.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
bb57e60238a1f7954433764a77c251f0b6367120592605b04307bf2d3aec446e.exedescription pid process target process PID 4764 set thread context of 764 4764 bb57e60238a1f7954433764a77c251f0b6367120592605b04307bf2d3aec446e.exe bb57e60238a1f7954433764a77c251f0b6367120592605b04307bf2d3aec446e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry class 1 IoCs
Processes:
cmd.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings cmd.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exebb57e60238a1f7954433764a77c251f0b6367120592605b04307bf2d3aec446e.exetaskmgr.exepid process 644 powershell.exe 764 bb57e60238a1f7954433764a77c251f0b6367120592605b04307bf2d3aec446e.exe 764 bb57e60238a1f7954433764a77c251f0b6367120592605b04307bf2d3aec446e.exe 644 powershell.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
taskmgr.exepid process 4596 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
powershell.exetaskmgr.exedescription pid process Token: SeDebugPrivilege 644 powershell.exe Token: SeDebugPrivilege 4596 taskmgr.exe Token: SeSystemProfilePrivilege 4596 taskmgr.exe Token: SeCreateGlobalPrivilege 4596 taskmgr.exe Token: 33 4596 taskmgr.exe Token: SeIncBasePriorityPrivilege 4596 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
taskmgr.exepid process 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid process 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe 4596 taskmgr.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
bb57e60238a1f7954433764a77c251f0b6367120592605b04307bf2d3aec446e.exedescription pid process target process PID 4764 wrote to memory of 644 4764 bb57e60238a1f7954433764a77c251f0b6367120592605b04307bf2d3aec446e.exe powershell.exe PID 4764 wrote to memory of 644 4764 bb57e60238a1f7954433764a77c251f0b6367120592605b04307bf2d3aec446e.exe powershell.exe PID 4764 wrote to memory of 644 4764 bb57e60238a1f7954433764a77c251f0b6367120592605b04307bf2d3aec446e.exe powershell.exe PID 4764 wrote to memory of 976 4764 bb57e60238a1f7954433764a77c251f0b6367120592605b04307bf2d3aec446e.exe schtasks.exe PID 4764 wrote to memory of 976 4764 bb57e60238a1f7954433764a77c251f0b6367120592605b04307bf2d3aec446e.exe schtasks.exe PID 4764 wrote to memory of 976 4764 bb57e60238a1f7954433764a77c251f0b6367120592605b04307bf2d3aec446e.exe schtasks.exe PID 4764 wrote to memory of 764 4764 bb57e60238a1f7954433764a77c251f0b6367120592605b04307bf2d3aec446e.exe bb57e60238a1f7954433764a77c251f0b6367120592605b04307bf2d3aec446e.exe PID 4764 wrote to memory of 764 4764 bb57e60238a1f7954433764a77c251f0b6367120592605b04307bf2d3aec446e.exe bb57e60238a1f7954433764a77c251f0b6367120592605b04307bf2d3aec446e.exe PID 4764 wrote to memory of 764 4764 bb57e60238a1f7954433764a77c251f0b6367120592605b04307bf2d3aec446e.exe bb57e60238a1f7954433764a77c251f0b6367120592605b04307bf2d3aec446e.exe PID 4764 wrote to memory of 764 4764 bb57e60238a1f7954433764a77c251f0b6367120592605b04307bf2d3aec446e.exe bb57e60238a1f7954433764a77c251f0b6367120592605b04307bf2d3aec446e.exe PID 4764 wrote to memory of 764 4764 bb57e60238a1f7954433764a77c251f0b6367120592605b04307bf2d3aec446e.exe bb57e60238a1f7954433764a77c251f0b6367120592605b04307bf2d3aec446e.exe PID 4764 wrote to memory of 764 4764 bb57e60238a1f7954433764a77c251f0b6367120592605b04307bf2d3aec446e.exe bb57e60238a1f7954433764a77c251f0b6367120592605b04307bf2d3aec446e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bb57e60238a1f7954433764a77c251f0b6367120592605b04307bf2d3aec446e.exe"C:\Users\Admin\AppData\Local\Temp\bb57e60238a1f7954433764a77c251f0b6367120592605b04307bf2d3aec446e.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ruQKqeQx.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ruQKqeQx" /XML "C:\Users\Admin\AppData\Local\Temp\tmp99DE.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\bb57e60238a1f7954433764a77c251f0b6367120592605b04307bf2d3aec446e.exe"C:\Users\Admin\AppData\Local\Temp\bb57e60238a1f7954433764a77c251f0b6367120592605b04307bf2d3aec446e.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"1⤵
- Modifies registry class
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp99DE.tmpFilesize
1KB
MD5acd8c2a84d5bac92c0d6c1ecbcfd4735
SHA1f0e42e15ff794d78de96aea8b0862ace161fe84b
SHA2568008f29d2cc73da5df850dc591becee68a45bc1738c117ac7e5a46ba5cd2445c
SHA512481773d97a5e617d0a0dc5cfbffd1fe576591ed41d28ce177bccd8a1650cbbe3ff6cbf46ecf326f3fdee3245f527dd1ed2f8f3e1b09a385d99b05de460a933de
-
memory/644-148-0x0000000071D20000-0x0000000071D6C000-memory.dmpFilesize
304KB
-
memory/644-150-0x0000000007F70000-0x00000000085EA000-memory.dmpFilesize
6.5MB
-
memory/644-144-0x0000000005F80000-0x0000000005FE6000-memory.dmpFilesize
408KB
-
memory/644-143-0x0000000005750000-0x0000000005772000-memory.dmpFilesize
136KB
-
memory/644-155-0x0000000007C70000-0x0000000007C8A000-memory.dmpFilesize
104KB
-
memory/644-136-0x0000000000000000-mapping.dmp
-
memory/644-154-0x0000000007B60000-0x0000000007B6E000-memory.dmpFilesize
56KB
-
memory/644-138-0x0000000005080000-0x00000000050B6000-memory.dmpFilesize
216KB
-
memory/644-153-0x0000000007BB0000-0x0000000007C46000-memory.dmpFilesize
600KB
-
memory/644-140-0x00000000057E0000-0x0000000005E08000-memory.dmpFilesize
6.2MB
-
memory/644-152-0x00000000079A0000-0x00000000079AA000-memory.dmpFilesize
40KB
-
memory/644-151-0x0000000007930000-0x000000000794A000-memory.dmpFilesize
104KB
-
memory/644-156-0x0000000007C50000-0x0000000007C58000-memory.dmpFilesize
32KB
-
memory/644-149-0x0000000006BD0000-0x0000000006BEE000-memory.dmpFilesize
120KB
-
memory/644-147-0x00000000075D0000-0x0000000007602000-memory.dmpFilesize
200KB
-
memory/644-146-0x0000000006630000-0x000000000664E000-memory.dmpFilesize
120KB
-
memory/764-142-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/764-141-0x0000000000000000-mapping.dmp
-
memory/764-145-0x00000000014B0000-0x00000000017FA000-memory.dmpFilesize
3.3MB
-
memory/976-137-0x0000000000000000-mapping.dmp
-
memory/4764-134-0x0000000009750000-0x00000000097EC000-memory.dmpFilesize
624KB
-
memory/4764-130-0x0000000000DD0000-0x0000000000E72000-memory.dmpFilesize
648KB
-
memory/4764-133-0x0000000005830000-0x000000000583A000-memory.dmpFilesize
40KB
-
memory/4764-132-0x0000000005860000-0x00000000058F2000-memory.dmpFilesize
584KB
-
memory/4764-131-0x0000000005E10000-0x00000000063B4000-memory.dmpFilesize
5.6MB
-
memory/4764-135-0x00000000098A0000-0x0000000009906000-memory.dmpFilesize
408KB