Analysis
-
max time kernel
148s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
06-07-2022 14:46
Static task
static1
Behavioral task
behavioral1
Sample
80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe
Resource
win7-20220414-en
General
-
Target
80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe
-
Size
548KB
-
MD5
52b4ab184953eb0206a26c7b6da611f9
-
SHA1
3efe986b907a864ea964fcf82a428dd36ef01b40
-
SHA256
80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386
-
SHA512
edc5200e160898142f436ba8403247501e9c7e0e98a7876797c0e0d3dfc1bcd9cfb5656fd44007c7d5b5ab9aa1ef2550df1d8e677c2d53082dd4b92b404e6a60
Malware Config
Extracted
formbook
4.1
de08
retirecloudyyard.com
fabiyan.xyz
chrisarlyde.com
selapex.com
vivalosgales.com
specialty-medicine.com
contasesolucoes.com
satunusanews.net
allyibc.com
alameda1876.com
artofdala.com
yukoidusp.xyz
steeldrumbandnearme.com
stonewedgetechnology.com
kentonai.com
macquarie-private.com
ddgwy.com
megagreenhousekits.com
descomplicaomarketing.com
inclusiverealtor.com
themummyfront.club
computerfashiondesigns.com
ericparlatore.com
whathappened2me.com
baksomail.xyz
mugupplatform.com
shopsolutely.com
gymcservices.com
qianshunchina.com
zoomsbshab.icu
esrmtech.com
966211.com
stockinsidepr.com
df-wh.com
smartshopapps.com
kayseriadsl.com
acedesserts.com
205qs.com
ei8i.com
aibtly.com
kpviewllc.net
nnehandebol.com
torontonianapparel.ca
therealgoldenganjagang.com
mingxiang99.com
rewkagcompany.xyz
ahmee4.com
valen.info
vacuumfun.parts
fabiyan.xyz
psncareersolutions.com
escobargroups.com
michigandice.com
ey3solutions.com
li-n.info
puingkehancuran.xyz
bilt-green.com
dfysuitetech.xyz
abdoomar.com
actsaka.xyz
justsweatitout.com
axabank.life
billyyaka.com
mypatchtools.com
epulsive.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/2016-141-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2016-157-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3996-160-0x0000000000760000-0x000000000078F000-memory.dmp formbook behavioral2/memory/3996-168-0x0000000000760000-0x000000000078F000-memory.dmp formbook -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exeRegSvcs.exemsdt.exedescription pid process target process PID 4392 set thread context of 2016 4392 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe RegSvcs.exe PID 2016 set thread context of 1880 2016 RegSvcs.exe Explorer.EXE PID 3996 set thread context of 1880 3996 msdt.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry class 3 IoCs
Processes:
Explorer.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 52 IoCs
Processes:
powershell.exeRegSvcs.exemsdt.exepid process 540 powershell.exe 2016 RegSvcs.exe 2016 RegSvcs.exe 540 powershell.exe 2016 RegSvcs.exe 2016 RegSvcs.exe 3996 msdt.exe 3996 msdt.exe 3996 msdt.exe 3996 msdt.exe 3996 msdt.exe 3996 msdt.exe 3996 msdt.exe 3996 msdt.exe 3996 msdt.exe 3996 msdt.exe 3996 msdt.exe 3996 msdt.exe 3996 msdt.exe 3996 msdt.exe 3996 msdt.exe 3996 msdt.exe 3996 msdt.exe 3996 msdt.exe 3996 msdt.exe 3996 msdt.exe 3996 msdt.exe 3996 msdt.exe 3996 msdt.exe 3996 msdt.exe 3996 msdt.exe 3996 msdt.exe 3996 msdt.exe 3996 msdt.exe 3996 msdt.exe 3996 msdt.exe 3996 msdt.exe 3996 msdt.exe 3996 msdt.exe 3996 msdt.exe 3996 msdt.exe 3996 msdt.exe 3996 msdt.exe 3996 msdt.exe 3996 msdt.exe 3996 msdt.exe 3996 msdt.exe 3996 msdt.exe 3996 msdt.exe 3996 msdt.exe 3996 msdt.exe 3996 msdt.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1880 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.exemsdt.exepid process 2016 RegSvcs.exe 2016 RegSvcs.exe 2016 RegSvcs.exe 3996 msdt.exe 3996 msdt.exe -
Suspicious use of AdjustPrivilegeToken 27 IoCs
Processes:
powershell.exeRegSvcs.exemsdt.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 540 powershell.exe Token: SeDebugPrivilege 2016 RegSvcs.exe Token: SeDebugPrivilege 3996 msdt.exe Token: SeShutdownPrivilege 1880 Explorer.EXE Token: SeCreatePagefilePrivilege 1880 Explorer.EXE Token: SeShutdownPrivilege 1880 Explorer.EXE Token: SeCreatePagefilePrivilege 1880 Explorer.EXE Token: SeShutdownPrivilege 1880 Explorer.EXE Token: SeCreatePagefilePrivilege 1880 Explorer.EXE Token: SeShutdownPrivilege 1880 Explorer.EXE Token: SeCreatePagefilePrivilege 1880 Explorer.EXE Token: SeShutdownPrivilege 1880 Explorer.EXE Token: SeCreatePagefilePrivilege 1880 Explorer.EXE Token: SeShutdownPrivilege 1880 Explorer.EXE Token: SeCreatePagefilePrivilege 1880 Explorer.EXE Token: SeShutdownPrivilege 1880 Explorer.EXE Token: SeCreatePagefilePrivilege 1880 Explorer.EXE Token: SeShutdownPrivilege 1880 Explorer.EXE Token: SeCreatePagefilePrivilege 1880 Explorer.EXE Token: SeShutdownPrivilege 1880 Explorer.EXE Token: SeCreatePagefilePrivilege 1880 Explorer.EXE Token: SeShutdownPrivilege 1880 Explorer.EXE Token: SeCreatePagefilePrivilege 1880 Explorer.EXE Token: SeShutdownPrivilege 1880 Explorer.EXE Token: SeCreatePagefilePrivilege 1880 Explorer.EXE Token: SeShutdownPrivilege 1880 Explorer.EXE Token: SeCreatePagefilePrivilege 1880 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1880 Explorer.EXE 1880 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exeExplorer.EXEmsdt.exedescription pid process target process PID 4392 wrote to memory of 540 4392 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe powershell.exe PID 4392 wrote to memory of 540 4392 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe powershell.exe PID 4392 wrote to memory of 540 4392 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe powershell.exe PID 4392 wrote to memory of 3948 4392 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe schtasks.exe PID 4392 wrote to memory of 3948 4392 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe schtasks.exe PID 4392 wrote to memory of 3948 4392 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe schtasks.exe PID 4392 wrote to memory of 2016 4392 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe RegSvcs.exe PID 4392 wrote to memory of 2016 4392 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe RegSvcs.exe PID 4392 wrote to memory of 2016 4392 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe RegSvcs.exe PID 4392 wrote to memory of 2016 4392 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe RegSvcs.exe PID 4392 wrote to memory of 2016 4392 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe RegSvcs.exe PID 4392 wrote to memory of 2016 4392 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe RegSvcs.exe PID 1880 wrote to memory of 3996 1880 Explorer.EXE msdt.exe PID 1880 wrote to memory of 3996 1880 Explorer.EXE msdt.exe PID 1880 wrote to memory of 3996 1880 Explorer.EXE msdt.exe PID 3996 wrote to memory of 2404 3996 msdt.exe cmd.exe PID 3996 wrote to memory of 2404 3996 msdt.exe cmd.exe PID 3996 wrote to memory of 2404 3996 msdt.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe"C:\Users\Admin\AppData\Local\Temp\80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\msUCFUQkYKOqDO.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\msUCFUQkYKOqDO" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEBDC.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpEBDC.tmpFilesize
1KB
MD506d28f1e01c6d4b523faf5da84bc4230
SHA11f72714a15665af77cd51ae79be40a4015a7557d
SHA256ebc4406edb0b7611e815ada8c2860dfa560fee000892aef6a62b509d1257fcac
SHA5129cf8a9e601b3d1f448abb755979c8d194f04fa6ff0d8cebad275d30c780638e46c9575ae57628c4bd0073b51d1f4deee36e397558176d1ffbd31ae1de7049f8d
-
memory/540-158-0x00000000073D0000-0x0000000007466000-memory.dmpFilesize
600KB
-
memory/540-165-0x0000000007480000-0x0000000007488000-memory.dmpFilesize
32KB
-
memory/540-163-0x0000000004B80000-0x0000000004B8E000-memory.dmpFilesize
56KB
-
memory/540-151-0x0000000070CA0000-0x0000000070CEC000-memory.dmpFilesize
304KB
-
memory/540-135-0x0000000000000000-mapping.dmp
-
memory/540-152-0x00000000063F0000-0x000000000640E000-memory.dmpFilesize
120KB
-
memory/540-137-0x0000000002500000-0x0000000002536000-memory.dmpFilesize
216KB
-
memory/540-164-0x0000000007490000-0x00000000074AA000-memory.dmpFilesize
104KB
-
memory/540-150-0x0000000006410000-0x0000000006442000-memory.dmpFilesize
200KB
-
memory/540-155-0x00000000071C0000-0x00000000071CA000-memory.dmpFilesize
40KB
-
memory/540-154-0x0000000007150000-0x000000000716A000-memory.dmpFilesize
104KB
-
memory/540-142-0x0000000005080000-0x00000000050A2000-memory.dmpFilesize
136KB
-
memory/540-143-0x0000000005130000-0x0000000005196000-memory.dmpFilesize
408KB
-
memory/540-144-0x0000000005940000-0x00000000059A6000-memory.dmpFilesize
408KB
-
memory/540-146-0x0000000005E40000-0x0000000005E5E000-memory.dmpFilesize
120KB
-
memory/540-153-0x0000000007790000-0x0000000007E0A000-memory.dmpFilesize
6.5MB
-
memory/540-139-0x00000000051A0000-0x00000000057C8000-memory.dmpFilesize
6.2MB
-
memory/1880-149-0x00000000086A0000-0x00000000087BA000-memory.dmpFilesize
1.1MB
-
memory/1880-167-0x0000000008870000-0x0000000008994000-memory.dmpFilesize
1.1MB
-
memory/1880-169-0x0000000008870000-0x0000000008994000-memory.dmpFilesize
1.1MB
-
memory/2016-148-0x00000000013C0000-0x00000000013D4000-memory.dmpFilesize
80KB
-
memory/2016-157-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2016-147-0x0000000001510000-0x000000000185A000-memory.dmpFilesize
3.3MB
-
memory/2016-141-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2016-140-0x0000000000000000-mapping.dmp
-
memory/2404-161-0x0000000000000000-mapping.dmp
-
memory/3948-136-0x0000000000000000-mapping.dmp
-
memory/3996-168-0x0000000000760000-0x000000000078F000-memory.dmpFilesize
188KB
-
memory/3996-160-0x0000000000760000-0x000000000078F000-memory.dmpFilesize
188KB
-
memory/3996-159-0x0000000000AA0000-0x0000000000AF7000-memory.dmpFilesize
348KB
-
memory/3996-162-0x00000000029B0000-0x0000000002CFA000-memory.dmpFilesize
3.3MB
-
memory/3996-156-0x0000000000000000-mapping.dmp
-
memory/3996-166-0x00000000027E0000-0x0000000002873000-memory.dmpFilesize
588KB
-
memory/4392-130-0x0000000000C70000-0x0000000000CFE000-memory.dmpFilesize
568KB
-
memory/4392-132-0x0000000005700000-0x0000000005792000-memory.dmpFilesize
584KB
-
memory/4392-131-0x0000000005C10000-0x00000000061B4000-memory.dmpFilesize
5.6MB
-
memory/4392-134-0x0000000009170000-0x000000000920C000-memory.dmpFilesize
624KB
-
memory/4392-133-0x0000000005690000-0x000000000569A000-memory.dmpFilesize
40KB