Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
06-07-2022 14:46
Static task
static1
Behavioral task
behavioral1
Sample
80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe
Resource
win7-20220414-en
General
-
Target
80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe
-
Size
548KB
-
MD5
52b4ab184953eb0206a26c7b6da611f9
-
SHA1
3efe986b907a864ea964fcf82a428dd36ef01b40
-
SHA256
80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386
-
SHA512
edc5200e160898142f436ba8403247501e9c7e0e98a7876797c0e0d3dfc1bcd9cfb5656fd44007c7d5b5ab9aa1ef2550df1d8e677c2d53082dd4b92b404e6a60
Malware Config
Extracted
formbook
4.1
de08
retirecloudyyard.com
fabiyan.xyz
chrisarlyde.com
selapex.com
vivalosgales.com
specialty-medicine.com
contasesolucoes.com
satunusanews.net
allyibc.com
alameda1876.com
artofdala.com
yukoidusp.xyz
steeldrumbandnearme.com
stonewedgetechnology.com
kentonai.com
macquarie-private.com
ddgwy.com
megagreenhousekits.com
descomplicaomarketing.com
inclusiverealtor.com
themummyfront.club
computerfashiondesigns.com
ericparlatore.com
whathappened2me.com
baksomail.xyz
mugupplatform.com
shopsolutely.com
gymcservices.com
qianshunchina.com
zoomsbshab.icu
esrmtech.com
966211.com
stockinsidepr.com
df-wh.com
smartshopapps.com
kayseriadsl.com
acedesserts.com
205qs.com
ei8i.com
aibtly.com
kpviewllc.net
nnehandebol.com
torontonianapparel.ca
therealgoldenganjagang.com
mingxiang99.com
rewkagcompany.xyz
ahmee4.com
valen.info
vacuumfun.parts
fabiyan.xyz
psncareersolutions.com
escobargroups.com
michigandice.com
ey3solutions.com
li-n.info
puingkehancuran.xyz
bilt-green.com
dfysuitetech.xyz
abdoomar.com
actsaka.xyz
justsweatitout.com
axabank.life
billyyaka.com
mypatchtools.com
epulsive.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3052-142-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3052-156-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4492-160-0x0000000000EA0000-0x0000000000ECF000-memory.dmp formbook behavioral2/memory/4492-169-0x0000000000EA0000-0x0000000000ECF000-memory.dmp formbook -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exeRegSvcs.exemstsc.exedescription pid process target process PID 908 set thread context of 3052 908 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe RegSvcs.exe PID 3052 set thread context of 2896 3052 RegSvcs.exe Explorer.EXE PID 4492 set thread context of 2896 4492 mstsc.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 52 IoCs
Processes:
80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exepowershell.exeRegSvcs.exemstsc.exepid process 908 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe 908 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe 2012 powershell.exe 3052 RegSvcs.exe 3052 RegSvcs.exe 3052 RegSvcs.exe 3052 RegSvcs.exe 2012 powershell.exe 4492 mstsc.exe 4492 mstsc.exe 4492 mstsc.exe 4492 mstsc.exe 4492 mstsc.exe 4492 mstsc.exe 4492 mstsc.exe 4492 mstsc.exe 4492 mstsc.exe 4492 mstsc.exe 4492 mstsc.exe 4492 mstsc.exe 4492 mstsc.exe 4492 mstsc.exe 4492 mstsc.exe 4492 mstsc.exe 4492 mstsc.exe 4492 mstsc.exe 4492 mstsc.exe 4492 mstsc.exe 4492 mstsc.exe 4492 mstsc.exe 4492 mstsc.exe 4492 mstsc.exe 4492 mstsc.exe 4492 mstsc.exe 4492 mstsc.exe 4492 mstsc.exe 4492 mstsc.exe 4492 mstsc.exe 4492 mstsc.exe 4492 mstsc.exe 4492 mstsc.exe 4492 mstsc.exe 4492 mstsc.exe 4492 mstsc.exe 4492 mstsc.exe 4492 mstsc.exe 4492 mstsc.exe 4492 mstsc.exe 4492 mstsc.exe 4492 mstsc.exe 4492 mstsc.exe 4492 mstsc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2896 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.exemstsc.exepid process 3052 RegSvcs.exe 3052 RegSvcs.exe 3052 RegSvcs.exe 4492 mstsc.exe 4492 mstsc.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exepowershell.exeRegSvcs.exemstsc.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 908 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe Token: SeDebugPrivilege 2012 powershell.exe Token: SeDebugPrivilege 3052 RegSvcs.exe Token: SeDebugPrivilege 4492 mstsc.exe Token: SeShutdownPrivilege 2896 Explorer.EXE Token: SeCreatePagefilePrivilege 2896 Explorer.EXE -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exeExplorer.EXEmstsc.exedescription pid process target process PID 908 wrote to memory of 2012 908 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe powershell.exe PID 908 wrote to memory of 2012 908 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe powershell.exe PID 908 wrote to memory of 2012 908 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe powershell.exe PID 908 wrote to memory of 1464 908 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe schtasks.exe PID 908 wrote to memory of 1464 908 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe schtasks.exe PID 908 wrote to memory of 1464 908 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe schtasks.exe PID 908 wrote to memory of 1864 908 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe RegSvcs.exe PID 908 wrote to memory of 1864 908 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe RegSvcs.exe PID 908 wrote to memory of 1864 908 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe RegSvcs.exe PID 908 wrote to memory of 3052 908 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe RegSvcs.exe PID 908 wrote to memory of 3052 908 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe RegSvcs.exe PID 908 wrote to memory of 3052 908 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe RegSvcs.exe PID 908 wrote to memory of 3052 908 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe RegSvcs.exe PID 908 wrote to memory of 3052 908 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe RegSvcs.exe PID 908 wrote to memory of 3052 908 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe RegSvcs.exe PID 2896 wrote to memory of 4492 2896 Explorer.EXE mstsc.exe PID 2896 wrote to memory of 4492 2896 Explorer.EXE mstsc.exe PID 2896 wrote to memory of 4492 2896 Explorer.EXE mstsc.exe PID 4492 wrote to memory of 3744 4492 mstsc.exe cmd.exe PID 4492 wrote to memory of 3744 4492 mstsc.exe cmd.exe PID 4492 wrote to memory of 3744 4492 mstsc.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe"C:\Users\Admin\AppData\Local\Temp\80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\msUCFUQkYKOqDO.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\msUCFUQkYKOqDO" /XML "C:\Users\Admin\AppData\Local\Temp\tmp43EE.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp43EE.tmpFilesize
1KB
MD58e795b17ebbc8926830111b5b25f41c2
SHA125fce0a819555eaee0c9250e59c63053448b7d4d
SHA2568acb5b0d0e73e22da206ac470d45d6981778795b2f170f971205d3991dbc6fcf
SHA512634d7bf062d5d80784db4f3f43cb90e4741999a73e96ac004dee94bc55802e53ae7b5c082e2ae35c0f53da335525df19be74a23c28e1deef9c46659a20f22a5e
-
memory/908-131-0x00000000052D0000-0x0000000005874000-memory.dmpFilesize
5.6MB
-
memory/908-132-0x0000000004D20000-0x0000000004DB2000-memory.dmpFilesize
584KB
-
memory/908-133-0x0000000004CE0000-0x0000000004CEA000-memory.dmpFilesize
40KB
-
memory/908-134-0x0000000008840000-0x00000000088DC000-memory.dmpFilesize
624KB
-
memory/908-130-0x00000000002C0000-0x000000000034E000-memory.dmpFilesize
568KB
-
memory/1464-136-0x0000000000000000-mapping.dmp
-
memory/1864-140-0x0000000000000000-mapping.dmp
-
memory/2012-151-0x00000000076D0000-0x0000000007702000-memory.dmpFilesize
200KB
-
memory/2012-152-0x0000000071250000-0x000000007129C000-memory.dmpFilesize
304KB
-
memory/2012-137-0x0000000002E20000-0x0000000002E56000-memory.dmpFilesize
216KB
-
memory/2012-165-0x0000000007D60000-0x0000000007D7A000-memory.dmpFilesize
104KB
-
memory/2012-162-0x0000000007CA0000-0x0000000007D36000-memory.dmpFilesize
600KB
-
memory/2012-143-0x0000000005F80000-0x0000000005FA2000-memory.dmpFilesize
136KB
-
memory/2012-144-0x0000000006020000-0x0000000006086000-memory.dmpFilesize
408KB
-
memory/2012-145-0x0000000006100000-0x0000000006166000-memory.dmpFilesize
408KB
-
memory/2012-147-0x0000000006710000-0x000000000672E000-memory.dmpFilesize
120KB
-
memory/2012-139-0x0000000005910000-0x0000000005F38000-memory.dmpFilesize
6.2MB
-
memory/2012-166-0x0000000007D40000-0x0000000007D48000-memory.dmpFilesize
32KB
-
memory/2012-158-0x0000000007A90000-0x0000000007A9A000-memory.dmpFilesize
40KB
-
memory/2012-135-0x0000000000000000-mapping.dmp
-
memory/2012-164-0x0000000007C50000-0x0000000007C5E000-memory.dmpFilesize
56KB
-
memory/2012-153-0x0000000006CC0000-0x0000000006CDE000-memory.dmpFilesize
120KB
-
memory/2012-157-0x0000000007A20000-0x0000000007A3A000-memory.dmpFilesize
104KB
-
memory/2012-155-0x0000000008060000-0x00000000086DA000-memory.dmpFilesize
6.5MB
-
memory/2896-170-0x0000000002920000-0x0000000002A19000-memory.dmpFilesize
996KB
-
memory/2896-150-0x0000000007EF0000-0x0000000008098000-memory.dmpFilesize
1.7MB
-
memory/2896-168-0x0000000002920000-0x0000000002A19000-memory.dmpFilesize
996KB
-
memory/3052-156-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3052-149-0x00000000012E0000-0x00000000012F4000-memory.dmpFilesize
80KB
-
memory/3052-148-0x0000000001300000-0x000000000164A000-memory.dmpFilesize
3.3MB
-
memory/3052-141-0x0000000000000000-mapping.dmp
-
memory/3052-142-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3744-161-0x0000000000000000-mapping.dmp
-
memory/4492-163-0x0000000002E00000-0x000000000314A000-memory.dmpFilesize
3.3MB
-
memory/4492-160-0x0000000000EA0000-0x0000000000ECF000-memory.dmpFilesize
188KB
-
memory/4492-167-0x0000000002C70000-0x0000000002D03000-memory.dmpFilesize
588KB
-
memory/4492-159-0x0000000000A30000-0x0000000000B6A000-memory.dmpFilesize
1.2MB
-
memory/4492-169-0x0000000000EA0000-0x0000000000ECF000-memory.dmpFilesize
188KB
-
memory/4492-154-0x0000000000000000-mapping.dmp