Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
19-07-2022 10:15
Static task
static1
Behavioral task
behavioral1
Sample
New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe
Resource
win7-20220718-en
General
-
Target
New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe
-
Size
709KB
-
MD5
32613271f1feb2834ac33ea16807496f
-
SHA1
40cde9168a856b0b0b05727cffb6977a641b2274
-
SHA256
fca8d992734405f7ad3c622fa1f990f7b0e1b3949b6a174ad5b1f8a929f93dc9
-
SHA512
52fb48e81672996925385d681c30aca3d59e9f29b6737caf440461cdf181d7f384bc62b56759bf08be1fa875fd756437e511c39408a8477516422cb4859c0170
Malware Config
Extracted
formbook
4.1
t19g
playstationspiele.com
cakesbyannal.com
racepin.space
anti-offender.com
magnetque.com
farragorealtybrokerage.com
khuludmohammed.com
v33696.com
84ggg.com
d440.com
soccersmarthome.com
ofthis.world
fivestaryardcards.com
lusyard.com
gghft.com
viajesfortur.com
rationalirrationality.com
hanaramenrestaurant.com
exactlycleanse.com
martensenargentina.com
michellesellsvt.com
pupsloveandlondon.com
kfhym.world
makeuphoje.com
ebookrise.com
flesherbrothers.com
doonaudio.com
doanet.xyz
wrghintlian.com
davidchristl.com
domaintch.com
quotereflection.com
eroptikblog.xyz
iranianinvestmentclub.com
cp200motorola.com
vsenq.com
theamazonmovement.com
aspiteksoln.com
perkebunannews.com
myreverie.life
hrddf.com
gblaincreative.com
lipsstreet.com
xxf76.top
dureluxx.com
heldelicioso.com
taskconsulting.com
dongcunzhengfu.com
itohpe.com
abundantskill.com
fernhutco.com
hairgrowthxpert.com
intelligentreportscloud.com
maybesupply.com
7156.world
cr-marcelo.com
shequipamentos.com
villeenvie.net
robbyscreations.com
mpaohead.com
nailsa.biz
accoladesandmore.com
preppers.pro
pinpinduo2.xyz
allsofttech.com
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1780-67-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1780-68-0x000000000041F1B0-mapping.dmp formbook behavioral1/memory/1780-70-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1820-79-0x00000000000D0000-0x00000000000FF000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
New Order WID-12874 (VT-10622)_SCHW_Juni 22.exeNew Order WID-12874 (VT-10622)_SCHW_Juni 22.exemsiexec.exedescription pid process target process PID 2020 set thread context of 1780 2020 New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe PID 1780 set thread context of 1384 1780 New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe Explorer.EXE PID 1820 set thread context of 1384 1820 msiexec.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Processes:
msiexec.exedescription ioc process Key created \Registry\User\S-1-5-21-3762437355-3468409815-1164039494-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 msiexec.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
New Order WID-12874 (VT-10622)_SCHW_Juni 22.exepowershell.exemsiexec.exepid process 1780 New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe 1780 New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe 1332 powershell.exe 1820 msiexec.exe 1820 msiexec.exe 1820 msiexec.exe 1820 msiexec.exe 1820 msiexec.exe 1820 msiexec.exe 1820 msiexec.exe 1820 msiexec.exe 1820 msiexec.exe 1820 msiexec.exe 1820 msiexec.exe 1820 msiexec.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
New Order WID-12874 (VT-10622)_SCHW_Juni 22.exemsiexec.exepid process 1780 New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe 1780 New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe 1780 New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe 1820 msiexec.exe 1820 msiexec.exe 1820 msiexec.exe 1820 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
New Order WID-12874 (VT-10622)_SCHW_Juni 22.exepowershell.exemsiexec.exedescription pid process Token: SeDebugPrivilege 1780 New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe Token: SeDebugPrivilege 1332 powershell.exe Token: SeDebugPrivilege 1820 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1384 Explorer.EXE 1384 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1384 Explorer.EXE 1384 Explorer.EXE -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
New Order WID-12874 (VT-10622)_SCHW_Juni 22.exeExplorer.EXEmsiexec.exedescription pid process target process PID 2020 wrote to memory of 1332 2020 New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe powershell.exe PID 2020 wrote to memory of 1332 2020 New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe powershell.exe PID 2020 wrote to memory of 1332 2020 New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe powershell.exe PID 2020 wrote to memory of 1332 2020 New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe powershell.exe PID 2020 wrote to memory of 1548 2020 New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe schtasks.exe PID 2020 wrote to memory of 1548 2020 New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe schtasks.exe PID 2020 wrote to memory of 1548 2020 New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe schtasks.exe PID 2020 wrote to memory of 1548 2020 New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe schtasks.exe PID 2020 wrote to memory of 1780 2020 New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe PID 2020 wrote to memory of 1780 2020 New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe PID 2020 wrote to memory of 1780 2020 New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe PID 2020 wrote to memory of 1780 2020 New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe PID 2020 wrote to memory of 1780 2020 New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe PID 2020 wrote to memory of 1780 2020 New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe PID 2020 wrote to memory of 1780 2020 New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe PID 1384 wrote to memory of 1820 1384 Explorer.EXE msiexec.exe PID 1384 wrote to memory of 1820 1384 Explorer.EXE msiexec.exe PID 1384 wrote to memory of 1820 1384 Explorer.EXE msiexec.exe PID 1384 wrote to memory of 1820 1384 Explorer.EXE msiexec.exe PID 1384 wrote to memory of 1820 1384 Explorer.EXE msiexec.exe PID 1384 wrote to memory of 1820 1384 Explorer.EXE msiexec.exe PID 1384 wrote to memory of 1820 1384 Explorer.EXE msiexec.exe PID 1820 wrote to memory of 1980 1820 msiexec.exe Firefox.exe PID 1820 wrote to memory of 1980 1820 msiexec.exe Firefox.exe PID 1820 wrote to memory of 1980 1820 msiexec.exe Firefox.exe PID 1820 wrote to memory of 1980 1820 msiexec.exe Firefox.exe PID 1820 wrote to memory of 1980 1820 msiexec.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe"C:\Users\Admin\AppData\Local\Temp\New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\SZHsAIbw.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SZHsAIbw" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE5AE.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe"C:\Users\Admin\AppData\Local\Temp\New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpE5AE.tmpFilesize
1KB
MD50b361faebb6ef32344434e149b66a7b3
SHA18603b450558a976e0a19f53287314cfeea5eb373
SHA25602221f5f529f94bf4d8555c47fab76bc3cf01716e3163203cb5c8e1a7a7a3cb8
SHA512c5bb9083662df0a8eb76fefad908dbaabba9f5f7923fd2fa18a5f3e058b474d3553fd3ad23d23eceb1742dcc5b84816f590e66b676a5528681bc3d8e22043178
-
C:\Users\Admin\AppData\Roaming\269N2RT7\269logim.jpegFilesize
61KB
MD530d5cf4843bd18b061f76b85cc014f17
SHA16070b0823c2fd78b0c185e89b040f870c4009435
SHA25692cf8012b08ddd92387f9cdb24c2523580fccbf4e9470f132087c38f159675b1
SHA5129f0821d23694dc9fcbf0b3f251c352a6a38bb7fa75e9fda9a551b550aaa5cae6aaef70a9f826fa429a152efd49198dd2fbff6191b602de4cc25ada0f651d7e7d
-
C:\Users\Admin\AppData\Roaming\269N2RT7\269logrf.iniFilesize
40B
MD52f245469795b865bdd1b956c23d7893d
SHA16ad80b974d3808f5a20ea1e766c7d2f88b9e5895
SHA2561662d01a2d47b875a34fc7a8cd92e78cb2ba7f34023c7fd2639cbb10b8d94361
SHA512909f189846a5d2db208a5eb2e7cb3042c0f164caf437e2b1b6de608c0a70e4f3510b81b85753dbeec1e211e6a83e6ea8c96aff896e9b6e8ed42014473a54dc4f
-
C:\Users\Admin\AppData\Roaming\269N2RT7\269logri.iniFilesize
40B
MD5d63a82e5d81e02e399090af26db0b9cb
SHA191d0014c8f54743bba141fd60c9d963f869d76c9
SHA256eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae
SHA51238afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad
-
C:\Users\Admin\AppData\Roaming\269N2RT7\269logrv.iniFilesize
40B
MD5ba3b6bc807d4f76794c4b81b09bb9ba5
SHA124cb89501f0212ff3095ecc0aba97dd563718fb1
SHA2566eebf968962745b2e9de2ca969af7c424916d4e3fe3cc0bb9b3d414abfce9507
SHA512ecd07e601fc9e3cfc39addd7bd6f3d7f7ff3253afb40bf536e9eaac5a4c243e5ec40fbfd7b216cb0ea29f2517419601e335e33ba19dea4a46f65e38694d465bf
-
memory/1332-71-0x000000006E710000-0x000000006ECBB000-memory.dmpFilesize
5.7MB
-
memory/1332-75-0x000000006E710000-0x000000006ECBB000-memory.dmpFilesize
5.7MB
-
memory/1332-59-0x0000000000000000-mapping.dmp
-
memory/1384-82-0x0000000006890000-0x00000000069CE000-memory.dmpFilesize
1.2MB
-
memory/1384-84-0x0000000006890000-0x00000000069CE000-memory.dmpFilesize
1.2MB
-
memory/1384-74-0x0000000004190000-0x0000000004261000-memory.dmpFilesize
836KB
-
memory/1548-60-0x0000000000000000-mapping.dmp
-
memory/1780-67-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1780-68-0x000000000041F1B0-mapping.dmp
-
memory/1780-70-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1780-64-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1780-72-0x0000000000990000-0x0000000000C93000-memory.dmpFilesize
3.0MB
-
memory/1780-73-0x0000000000200000-0x0000000000215000-memory.dmpFilesize
84KB
-
memory/1780-65-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1820-78-0x00000000009E0000-0x00000000009F4000-memory.dmpFilesize
80KB
-
memory/1820-83-0x0000000001F50000-0x0000000001FE4000-memory.dmpFilesize
592KB
-
memory/1820-79-0x00000000000D0000-0x00000000000FF000-memory.dmpFilesize
188KB
-
memory/1820-80-0x00000000020E0000-0x00000000023E3000-memory.dmpFilesize
3.0MB
-
memory/1820-81-0x0000000001F50000-0x0000000001FE4000-memory.dmpFilesize
592KB
-
memory/1820-76-0x0000000000000000-mapping.dmp
-
memory/2020-54-0x0000000000290000-0x0000000000348000-memory.dmpFilesize
736KB
-
memory/2020-55-0x0000000075731000-0x0000000075733000-memory.dmpFilesize
8KB
-
memory/2020-58-0x0000000005030000-0x000000000509C000-memory.dmpFilesize
432KB
-
memory/2020-57-0x0000000000280000-0x000000000028A000-memory.dmpFilesize
40KB
-
memory/2020-56-0x0000000000250000-0x0000000000264000-memory.dmpFilesize
80KB
-
memory/2020-63-0x0000000004880000-0x00000000048B4000-memory.dmpFilesize
208KB