Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
01-08-2022 08:58
Static task
static1
Behavioral task
behavioral1
Sample
Attached TT Payment Copy(USD 198,550.05).exe
Resource
win7-20220715-en
General
-
Target
Attached TT Payment Copy(USD 198,550.05).exe
-
Size
765KB
-
MD5
38aaaf950849630a2a3282b203532d79
-
SHA1
6448bd7ab4c04294020479963e53f0fbbe4ecc28
-
SHA256
a6e702e43965539bad67320474a1abe16545481c599c2200acabe41ec2ce4eb7
-
SHA512
9de881c36367c42c639dc659c2f1565ee264909dd6823e26a97b05acc4c0ed3a30a6ed0d4d58c556d76fa6a2c1e8e29d731a43143df9c5b775f16b7222b4c0f3
Malware Config
Extracted
formbook
4.1
d27e
lilysbusride.com
cloud-sechs.com
danpro.co.uk
wendoortech.com
playgroundrebellion.com
betventures.xyz
digimediasolution.net
abrahambetrayedus.com
whinefree.com
realeurolicence.com
makelovetrip.com
damediaagency.com
pinaralsan.com
5bobitw.com
shootingkarelia.online
website-staging.pro
manassadhvi.online
bathroomandkitcenking.com
realtormarket.net
dfysupport.com
class-flow.com
migstrip.online
qnacontracting.com
namaste-events.com
yestifications.com
indigoartandclothing.com
resultedu.com
digitalworldp.com
phase7assured.com
hirejar.site
leadstosuccessdental.com
ebooksonline4u.com
prosperbags.com
binarytreetech.com
jenpetronellatattoos.com
purpleduckdesign.net
merceriasen.xyz
shinnadesign.online
perubahantariftransaksi.website
jhanca.site
tacoslawera.com
majorappliancepros.com
kemiandsalam22.com
skipperage.info
tabulose-lust.xyz
wahproducts.com
mcleod.top
acepaintingservice.com
longtaidazong.com
spit2dabeat.com
jthecreator.net
sanhelu00.top
ipcemea.info
uniofilm.com
kitchenbw.space
abiccreats.com
southamptonvac.com
zavodalabda.xyz
mahahills.com
careers01-cxeinc.com
betteryourfinancial.info
buyfarfalla.com
moesoldmine.com
sioreu.com
havehealthybloodsugar.com
Signatures
-
Formbook payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1772-67-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1772-68-0x000000000041F1A0-mapping.dmp formbook behavioral1/memory/1772-71-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1772-79-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1256-81-0x0000000000090000-0x00000000000BF000-memory.dmp formbook behavioral1/memory/1256-88-0x0000000000090000-0x00000000000BF000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 868 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Attached TT Payment Copy(USD 198,550.05).exeAttached TT Payment Copy(USD 198,550.05).exewuapp.exedescription pid process target process PID 1932 set thread context of 1772 1932 Attached TT Payment Copy(USD 198,550.05).exe Attached TT Payment Copy(USD 198,550.05).exe PID 1772 set thread context of 1200 1772 Attached TT Payment Copy(USD 198,550.05).exe Explorer.EXE PID 1772 set thread context of 1200 1772 Attached TT Payment Copy(USD 198,550.05).exe Explorer.EXE PID 1256 set thread context of 1200 1256 wuapp.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
Attached TT Payment Copy(USD 198,550.05).exepowershell.exewuapp.exepid process 1772 Attached TT Payment Copy(USD 198,550.05).exe 1772 Attached TT Payment Copy(USD 198,550.05).exe 836 powershell.exe 1772 Attached TT Payment Copy(USD 198,550.05).exe 1256 wuapp.exe 1256 wuapp.exe 1256 wuapp.exe 1256 wuapp.exe 1256 wuapp.exe 1256 wuapp.exe 1256 wuapp.exe 1256 wuapp.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
Attached TT Payment Copy(USD 198,550.05).exewuapp.exepid process 1772 Attached TT Payment Copy(USD 198,550.05).exe 1772 Attached TT Payment Copy(USD 198,550.05).exe 1772 Attached TT Payment Copy(USD 198,550.05).exe 1772 Attached TT Payment Copy(USD 198,550.05).exe 1256 wuapp.exe 1256 wuapp.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Attached TT Payment Copy(USD 198,550.05).exepowershell.exewuapp.exedescription pid process Token: SeDebugPrivilege 1772 Attached TT Payment Copy(USD 198,550.05).exe Token: SeDebugPrivilege 836 powershell.exe Token: SeDebugPrivilege 1256 wuapp.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1200 Explorer.EXE 1200 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1200 Explorer.EXE 1200 Explorer.EXE -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
Attached TT Payment Copy(USD 198,550.05).exeExplorer.EXEwuapp.exedescription pid process target process PID 1932 wrote to memory of 836 1932 Attached TT Payment Copy(USD 198,550.05).exe powershell.exe PID 1932 wrote to memory of 836 1932 Attached TT Payment Copy(USD 198,550.05).exe powershell.exe PID 1932 wrote to memory of 836 1932 Attached TT Payment Copy(USD 198,550.05).exe powershell.exe PID 1932 wrote to memory of 836 1932 Attached TT Payment Copy(USD 198,550.05).exe powershell.exe PID 1932 wrote to memory of 1192 1932 Attached TT Payment Copy(USD 198,550.05).exe schtasks.exe PID 1932 wrote to memory of 1192 1932 Attached TT Payment Copy(USD 198,550.05).exe schtasks.exe PID 1932 wrote to memory of 1192 1932 Attached TT Payment Copy(USD 198,550.05).exe schtasks.exe PID 1932 wrote to memory of 1192 1932 Attached TT Payment Copy(USD 198,550.05).exe schtasks.exe PID 1932 wrote to memory of 1772 1932 Attached TT Payment Copy(USD 198,550.05).exe Attached TT Payment Copy(USD 198,550.05).exe PID 1932 wrote to memory of 1772 1932 Attached TT Payment Copy(USD 198,550.05).exe Attached TT Payment Copy(USD 198,550.05).exe PID 1932 wrote to memory of 1772 1932 Attached TT Payment Copy(USD 198,550.05).exe Attached TT Payment Copy(USD 198,550.05).exe PID 1932 wrote to memory of 1772 1932 Attached TT Payment Copy(USD 198,550.05).exe Attached TT Payment Copy(USD 198,550.05).exe PID 1932 wrote to memory of 1772 1932 Attached TT Payment Copy(USD 198,550.05).exe Attached TT Payment Copy(USD 198,550.05).exe PID 1932 wrote to memory of 1772 1932 Attached TT Payment Copy(USD 198,550.05).exe Attached TT Payment Copy(USD 198,550.05).exe PID 1932 wrote to memory of 1772 1932 Attached TT Payment Copy(USD 198,550.05).exe Attached TT Payment Copy(USD 198,550.05).exe PID 1200 wrote to memory of 1256 1200 Explorer.EXE wuapp.exe PID 1200 wrote to memory of 1256 1200 Explorer.EXE wuapp.exe PID 1200 wrote to memory of 1256 1200 Explorer.EXE wuapp.exe PID 1200 wrote to memory of 1256 1200 Explorer.EXE wuapp.exe PID 1200 wrote to memory of 1256 1200 Explorer.EXE wuapp.exe PID 1200 wrote to memory of 1256 1200 Explorer.EXE wuapp.exe PID 1200 wrote to memory of 1256 1200 Explorer.EXE wuapp.exe PID 1256 wrote to memory of 868 1256 wuapp.exe cmd.exe PID 1256 wrote to memory of 868 1256 wuapp.exe cmd.exe PID 1256 wrote to memory of 868 1256 wuapp.exe cmd.exe PID 1256 wrote to memory of 868 1256 wuapp.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Attached TT Payment Copy(USD 198,550.05).exe"C:\Users\Admin\AppData\Local\Temp\Attached TT Payment Copy(USD 198,550.05).exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\TQHqtqjt.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TQHqtqjt" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAAA2.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Attached TT Payment Copy(USD 198,550.05).exe"C:\Users\Admin\AppData\Local\Temp\Attached TT Payment Copy(USD 198,550.05).exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wuapp.exe"C:\Windows\SysWOW64\wuapp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Attached TT Payment Copy(USD 198,550.05).exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpAAA2.tmpFilesize
1KB
MD51211d22c39370b84cb682c61dfddf9d9
SHA1053268a4140421cb52386e1193cfb1be29946e6a
SHA256a69f944f3a4f0e249ce6355be574070bb8b9834bb5cfa95585a0bf709e2d8d5f
SHA5129bac55b3ca64ea67243ea9568c76ddd34593b170b409b1cc5ec0702122d9b24a8cfe0bb08565b463de2a1ed2bf8a2d1ea1bd3fffc70fd833623c7120e036c2b6
-
memory/836-59-0x0000000000000000-mapping.dmp
-
memory/836-84-0x000000006F0C0000-0x000000006F66B000-memory.dmpFilesize
5.7MB
-
memory/836-70-0x000000006F0C0000-0x000000006F66B000-memory.dmpFilesize
5.7MB
-
memory/868-82-0x0000000000000000-mapping.dmp
-
memory/1192-60-0x0000000000000000-mapping.dmp
-
memory/1200-89-0x0000000004AA0000-0x0000000004B43000-memory.dmpFilesize
652KB
-
memory/1200-77-0x0000000006540000-0x0000000006653000-memory.dmpFilesize
1.1MB
-
memory/1200-87-0x0000000006540000-0x0000000006653000-memory.dmpFilesize
1.1MB
-
memory/1200-74-0x0000000006250000-0x0000000006362000-memory.dmpFilesize
1.1MB
-
memory/1200-86-0x0000000004AA0000-0x0000000004B43000-memory.dmpFilesize
652KB
-
memory/1256-85-0x00000000009B0000-0x0000000000A44000-memory.dmpFilesize
592KB
-
memory/1256-81-0x0000000000090000-0x00000000000BF000-memory.dmpFilesize
188KB
-
memory/1256-83-0x0000000000A50000-0x0000000000D53000-memory.dmpFilesize
3.0MB
-
memory/1256-80-0x00000000010E0000-0x00000000010EB000-memory.dmpFilesize
44KB
-
memory/1256-78-0x0000000000000000-mapping.dmp
-
memory/1256-88-0x0000000000090000-0x00000000000BF000-memory.dmpFilesize
188KB
-
memory/1772-73-0x0000000000140000-0x0000000000155000-memory.dmpFilesize
84KB
-
memory/1772-67-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1772-64-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1772-72-0x00000000009E0000-0x0000000000CE3000-memory.dmpFilesize
3.0MB
-
memory/1772-79-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1772-71-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1772-68-0x000000000041F1A0-mapping.dmp
-
memory/1772-76-0x0000000000310000-0x0000000000325000-memory.dmpFilesize
84KB
-
memory/1772-65-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1932-54-0x00000000011A0000-0x0000000001266000-memory.dmpFilesize
792KB
-
memory/1932-63-0x0000000004E40000-0x0000000004E76000-memory.dmpFilesize
216KB
-
memory/1932-58-0x0000000005F80000-0x0000000006004000-memory.dmpFilesize
528KB
-
memory/1932-57-0x0000000000970000-0x000000000097A000-memory.dmpFilesize
40KB
-
memory/1932-56-0x0000000000960000-0x0000000000976000-memory.dmpFilesize
88KB
-
memory/1932-55-0x0000000076281000-0x0000000076283000-memory.dmpFilesize
8KB