Analysis
-
max time kernel
148s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
06-07-2022 14:46
Static task
static1
Behavioral task
behavioral1
Sample
80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe
Resource
win7-20220414-en
General
-
Target
80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe
-
Size
548KB
-
MD5
52b4ab184953eb0206a26c7b6da611f9
-
SHA1
3efe986b907a864ea964fcf82a428dd36ef01b40
-
SHA256
80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386
-
SHA512
edc5200e160898142f436ba8403247501e9c7e0e98a7876797c0e0d3dfc1bcd9cfb5656fd44007c7d5b5ab9aa1ef2550df1d8e677c2d53082dd4b92b404e6a60
Malware Config
Extracted
formbook
4.1
de08
retirecloudyyard.com
fabiyan.xyz
chrisarlyde.com
selapex.com
vivalosgales.com
specialty-medicine.com
contasesolucoes.com
satunusanews.net
allyibc.com
alameda1876.com
artofdala.com
yukoidusp.xyz
steeldrumbandnearme.com
stonewedgetechnology.com
kentonai.com
macquarie-private.com
ddgwy.com
megagreenhousekits.com
descomplicaomarketing.com
inclusiverealtor.com
themummyfront.club
computerfashiondesigns.com
ericparlatore.com
whathappened2me.com
baksomail.xyz
mugupplatform.com
shopsolutely.com
gymcservices.com
qianshunchina.com
zoomsbshab.icu
esrmtech.com
966211.com
stockinsidepr.com
df-wh.com
smartshopapps.com
kayseriadsl.com
acedesserts.com
205qs.com
ei8i.com
aibtly.com
kpviewllc.net
nnehandebol.com
torontonianapparel.ca
therealgoldenganjagang.com
mingxiang99.com
rewkagcompany.xyz
ahmee4.com
valen.info
vacuumfun.parts
fabiyan.xyz
psncareersolutions.com
escobargroups.com
michigandice.com
ey3solutions.com
li-n.info
puingkehancuran.xyz
bilt-green.com
dfysuitetech.xyz
abdoomar.com
actsaka.xyz
justsweatitout.com
axabank.life
billyyaka.com
mypatchtools.com
epulsive.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1300-68-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1300-69-0x000000000041F120-mapping.dmp formbook behavioral1/memory/1300-72-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/872-80-0x0000000000090000-0x00000000000BF000-memory.dmp formbook behavioral1/memory/872-84-0x0000000000090000-0x00000000000BF000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exeRegSvcs.exehelp.exedescription pid process target process PID 1652 set thread context of 1300 1652 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe RegSvcs.exe PID 1300 set thread context of 1204 1300 RegSvcs.exe Explorer.EXE PID 872 set thread context of 1204 872 help.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
powershell.exeRegSvcs.exehelp.exepid process 1060 powershell.exe 1300 RegSvcs.exe 1300 RegSvcs.exe 872 help.exe 872 help.exe 872 help.exe 872 help.exe 872 help.exe 872 help.exe 872 help.exe 872 help.exe 872 help.exe 872 help.exe 872 help.exe 872 help.exe 872 help.exe 872 help.exe 872 help.exe 872 help.exe 872 help.exe 872 help.exe 872 help.exe 872 help.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.exehelp.exepid process 1300 RegSvcs.exe 1300 RegSvcs.exe 1300 RegSvcs.exe 872 help.exe 872 help.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exeRegSvcs.exehelp.exedescription pid process Token: SeDebugPrivilege 1060 powershell.exe Token: SeDebugPrivilege 1300 RegSvcs.exe Token: SeDebugPrivilege 872 help.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1204 Explorer.EXE 1204 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1204 Explorer.EXE 1204 Explorer.EXE -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exeExplorer.EXEhelp.exedescription pid process target process PID 1652 wrote to memory of 1060 1652 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe powershell.exe PID 1652 wrote to memory of 1060 1652 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe powershell.exe PID 1652 wrote to memory of 1060 1652 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe powershell.exe PID 1652 wrote to memory of 1060 1652 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe powershell.exe PID 1652 wrote to memory of 944 1652 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe schtasks.exe PID 1652 wrote to memory of 944 1652 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe schtasks.exe PID 1652 wrote to memory of 944 1652 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe schtasks.exe PID 1652 wrote to memory of 944 1652 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe schtasks.exe PID 1652 wrote to memory of 1300 1652 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe RegSvcs.exe PID 1652 wrote to memory of 1300 1652 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe RegSvcs.exe PID 1652 wrote to memory of 1300 1652 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe RegSvcs.exe PID 1652 wrote to memory of 1300 1652 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe RegSvcs.exe PID 1652 wrote to memory of 1300 1652 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe RegSvcs.exe PID 1652 wrote to memory of 1300 1652 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe RegSvcs.exe PID 1652 wrote to memory of 1300 1652 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe RegSvcs.exe PID 1652 wrote to memory of 1300 1652 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe RegSvcs.exe PID 1652 wrote to memory of 1300 1652 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe RegSvcs.exe PID 1652 wrote to memory of 1300 1652 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe RegSvcs.exe PID 1204 wrote to memory of 872 1204 Explorer.EXE help.exe PID 1204 wrote to memory of 872 1204 Explorer.EXE help.exe PID 1204 wrote to memory of 872 1204 Explorer.EXE help.exe PID 1204 wrote to memory of 872 1204 Explorer.EXE help.exe PID 872 wrote to memory of 1804 872 help.exe cmd.exe PID 872 wrote to memory of 1804 872 help.exe cmd.exe PID 872 wrote to memory of 1804 872 help.exe cmd.exe PID 872 wrote to memory of 1804 872 help.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe"C:\Users\Admin\AppData\Local\Temp\80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\msUCFUQkYKOqDO.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\msUCFUQkYKOqDO" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5B89.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp5B89.tmpFilesize
1KB
MD5bd61bfcbc9aa23966bbe1c286653e769
SHA1dc67a0278fad240d797ac6696df18c514f541acc
SHA256d44f8cf2b810e826dac15fffbc6346905c45fc7b25e4b68d6088e384faaab60e
SHA512f4123fc5245f49e28c5f43ba83a597ce5b8be5afd5246c50321765795ed288eb58b7a3571ddf2a94a7effe748dfbe9fbd36456509180882e7a2a3281b5c42fd6
-
memory/872-84-0x0000000000090000-0x00000000000BF000-memory.dmpFilesize
188KB
-
memory/872-82-0x00000000004B0000-0x0000000000543000-memory.dmpFilesize
588KB
-
memory/872-80-0x0000000000090000-0x00000000000BF000-memory.dmpFilesize
188KB
-
memory/872-81-0x0000000000820000-0x0000000000B23000-memory.dmpFilesize
3.0MB
-
memory/872-79-0x0000000000070000-0x0000000000076000-memory.dmpFilesize
24KB
-
memory/872-77-0x0000000000000000-mapping.dmp
-
memory/944-61-0x0000000000000000-mapping.dmp
-
memory/1060-71-0x000000006F260000-0x000000006F80B000-memory.dmpFilesize
5.7MB
-
memory/1060-76-0x000000006F260000-0x000000006F80B000-memory.dmpFilesize
5.7MB
-
memory/1060-60-0x0000000000000000-mapping.dmp
-
memory/1204-83-0x00000000074D0000-0x0000000007639000-memory.dmpFilesize
1.4MB
-
memory/1204-85-0x00000000074D0000-0x0000000007639000-memory.dmpFilesize
1.4MB
-
memory/1204-75-0x00000000068D0000-0x00000000069EC000-memory.dmpFilesize
1.1MB
-
memory/1300-65-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1300-66-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1300-68-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1300-69-0x000000000041F120-mapping.dmp
-
memory/1300-72-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1300-73-0x0000000000AE0000-0x0000000000DE3000-memory.dmpFilesize
3.0MB
-
memory/1300-74-0x0000000000120000-0x0000000000134000-memory.dmpFilesize
80KB
-
memory/1652-54-0x0000000001070000-0x00000000010FE000-memory.dmpFilesize
568KB
-
memory/1652-59-0x0000000005D20000-0x0000000005D8E000-memory.dmpFilesize
440KB
-
memory/1652-58-0x0000000000940000-0x000000000094A000-memory.dmpFilesize
40KB
-
memory/1652-57-0x0000000000920000-0x000000000093C000-memory.dmpFilesize
112KB
-
memory/1652-56-0x0000000005060000-0x00000000050DA000-memory.dmpFilesize
488KB
-
memory/1652-55-0x0000000076461000-0x0000000076463000-memory.dmpFilesize
8KB
-
memory/1652-64-0x0000000004B90000-0x0000000004BC4000-memory.dmpFilesize
208KB
-
memory/1804-78-0x0000000000000000-mapping.dmp