Resubmissions
06-07-2022 16:55
220706-ve9wxsfafp 10Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
06-07-2022 16:55
Static task
static1
Behavioral task
behavioral1
Sample
400000.InstallUtil.exe
Resource
win7-20220414-en
General
-
Target
400000.InstallUtil.exe
-
Size
180KB
-
MD5
fe24b17cba6092bd2da1e5a172a33846
-
SHA1
df46ed6222eee121dd697e4ff6c7bab3d077c4cf
-
SHA256
cd375b3eeffbdb97aaaaa7d568e04c92ecb76d99c43894c291c31c24dd0f4e98
-
SHA512
ba8852dbf1cdb30fcc84b97e12b629f3229d83f2d1217ba172917059bc33e9c4227067e13e42346248f33f047cb04632599d2cdcbb96c4fff36aca028553c40b
Malware Config
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
-
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
chkdsk.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run chkdsk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\UFIPH8LHPJ = "C:\\Program Files (x86)\\Qqz74lloh\\rrd0pllhizx.exe" chkdsk.exe -
Executes dropped EXE 1 IoCs
Processes:
rrd0pllhizx.exepid process 4712 rrd0pllhizx.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
400000.InstallUtil.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation 400000.InstallUtil.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
400000.InstallUtil.exechkdsk.exedescription pid process target process PID 3296 set thread context of 384 3296 400000.InstallUtil.exe Explorer.EXE PID 4136 set thread context of 384 4136 chkdsk.exe Explorer.EXE -
Drops file in Program Files directory 4 IoCs
Processes:
chkdsk.exeExplorer.EXEdescription ioc process File opened for modification C:\Program Files (x86)\Qqz74lloh\rrd0pllhizx.exe chkdsk.exe File opened for modification C:\Program Files (x86)\Qqz74lloh Explorer.EXE File created C:\Program Files (x86)\Qqz74lloh\rrd0pllhizx.exe Explorer.EXE File opened for modification C:\Program Files (x86)\Qqz74lloh\rrd0pllhizx.exe Explorer.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Processes:
chkdsk.exedescription ioc process Key created \Registry\User\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
400000.InstallUtil.exechkdsk.exerrd0pllhizx.exepid process 3296 400000.InstallUtil.exe 3296 400000.InstallUtil.exe 3296 400000.InstallUtil.exe 3296 400000.InstallUtil.exe 3296 400000.InstallUtil.exe 3296 400000.InstallUtil.exe 3296 400000.InstallUtil.exe 3296 400000.InstallUtil.exe 4136 chkdsk.exe 4136 chkdsk.exe 4136 chkdsk.exe 4136 chkdsk.exe 4136 chkdsk.exe 4136 chkdsk.exe 4136 chkdsk.exe 4136 chkdsk.exe 4136 chkdsk.exe 4136 chkdsk.exe 4136 chkdsk.exe 4136 chkdsk.exe 4136 chkdsk.exe 4136 chkdsk.exe 4136 chkdsk.exe 4136 chkdsk.exe 4136 chkdsk.exe 4136 chkdsk.exe 4136 chkdsk.exe 4136 chkdsk.exe 4136 chkdsk.exe 4136 chkdsk.exe 4136 chkdsk.exe 4136 chkdsk.exe 4136 chkdsk.exe 4136 chkdsk.exe 4136 chkdsk.exe 4136 chkdsk.exe 4136 chkdsk.exe 4136 chkdsk.exe 4136 chkdsk.exe 4136 chkdsk.exe 4136 chkdsk.exe 4136 chkdsk.exe 4136 chkdsk.exe 4136 chkdsk.exe 4136 chkdsk.exe 4136 chkdsk.exe 4136 chkdsk.exe 4136 chkdsk.exe 4136 chkdsk.exe 4136 chkdsk.exe 4136 chkdsk.exe 4136 chkdsk.exe 4712 rrd0pllhizx.exe 4712 rrd0pllhizx.exe 4136 chkdsk.exe 4136 chkdsk.exe 4136 chkdsk.exe 4136 chkdsk.exe 4136 chkdsk.exe 4136 chkdsk.exe 4136 chkdsk.exe 4136 chkdsk.exe 4136 chkdsk.exe 4136 chkdsk.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 384 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
400000.InstallUtil.exechkdsk.exepid process 3296 400000.InstallUtil.exe 3296 400000.InstallUtil.exe 3296 400000.InstallUtil.exe 4136 chkdsk.exe 4136 chkdsk.exe 4136 chkdsk.exe 4136 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
400000.InstallUtil.exechkdsk.exerrd0pllhizx.exedescription pid process Token: SeDebugPrivilege 3296 400000.InstallUtil.exe Token: SeDebugPrivilege 4136 chkdsk.exe Token: SeDebugPrivilege 4712 rrd0pllhizx.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Explorer.EXEchkdsk.exedescription pid process target process PID 384 wrote to memory of 4136 384 Explorer.EXE chkdsk.exe PID 384 wrote to memory of 4136 384 Explorer.EXE chkdsk.exe PID 384 wrote to memory of 4136 384 Explorer.EXE chkdsk.exe PID 4136 wrote to memory of 3020 4136 chkdsk.exe cmd.exe PID 4136 wrote to memory of 3020 4136 chkdsk.exe cmd.exe PID 4136 wrote to memory of 3020 4136 chkdsk.exe cmd.exe PID 4136 wrote to memory of 2972 4136 chkdsk.exe Firefox.exe PID 4136 wrote to memory of 2972 4136 chkdsk.exe Firefox.exe PID 4136 wrote to memory of 2972 4136 chkdsk.exe Firefox.exe PID 384 wrote to memory of 4712 384 Explorer.EXE rrd0pllhizx.exe PID 384 wrote to memory of 4712 384 Explorer.EXE rrd0pllhizx.exe PID 384 wrote to memory of 4712 384 Explorer.EXE rrd0pllhizx.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\400000.InstallUtil.exe"C:\Users\Admin\AppData\Local\Temp\400000.InstallUtil.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Adds policy Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\400000.InstallUtil.exe"3⤵
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
C:\Program Files (x86)\Qqz74lloh\rrd0pllhizx.exe"C:\Program Files (x86)\Qqz74lloh\rrd0pllhizx.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Qqz74lloh\rrd0pllhizx.exeFilesize
180KB
MD5fe24b17cba6092bd2da1e5a172a33846
SHA1df46ed6222eee121dd697e4ff6c7bab3d077c4cf
SHA256cd375b3eeffbdb97aaaaa7d568e04c92ecb76d99c43894c291c31c24dd0f4e98
SHA512ba8852dbf1cdb30fcc84b97e12b629f3229d83f2d1217ba172917059bc33e9c4227067e13e42346248f33f047cb04632599d2cdcbb96c4fff36aca028553c40b
-
C:\Program Files (x86)\Qqz74lloh\rrd0pllhizx.exeFilesize
180KB
MD5fe24b17cba6092bd2da1e5a172a33846
SHA1df46ed6222eee121dd697e4ff6c7bab3d077c4cf
SHA256cd375b3eeffbdb97aaaaa7d568e04c92ecb76d99c43894c291c31c24dd0f4e98
SHA512ba8852dbf1cdb30fcc84b97e12b629f3229d83f2d1217ba172917059bc33e9c4227067e13e42346248f33f047cb04632599d2cdcbb96c4fff36aca028553c40b
-
memory/384-132-0x0000000002B40000-0x0000000002C22000-memory.dmpFilesize
904KB
-
memory/384-141-0x0000000008370000-0x000000000844B000-memory.dmpFilesize
876KB
-
memory/384-140-0x0000000008370000-0x000000000844B000-memory.dmpFilesize
876KB
-
memory/3020-134-0x0000000000000000-mapping.dmp
-
memory/3296-130-0x0000000000FB0000-0x00000000012FA000-memory.dmpFilesize
3.3MB
-
memory/3296-131-0x0000000000910000-0x0000000000921000-memory.dmpFilesize
68KB
-
memory/4136-138-0x0000000001830000-0x00000000018C0000-memory.dmpFilesize
576KB
-
memory/4136-139-0x00000000012E0000-0x000000000130D000-memory.dmpFilesize
180KB
-
memory/4136-137-0x0000000001AE0000-0x0000000001E2A000-memory.dmpFilesize
3.3MB
-
memory/4136-135-0x0000000000E90000-0x0000000000E9A000-memory.dmpFilesize
40KB
-
memory/4136-136-0x00000000012E0000-0x000000000130D000-memory.dmpFilesize
180KB
-
memory/4136-133-0x0000000000000000-mapping.dmp
-
memory/4712-142-0x0000000000000000-mapping.dmp
-
memory/4712-145-0x00000000018D0000-0x0000000001C1A000-memory.dmpFilesize
3.3MB