Analysis
-
max time kernel
152s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
01-08-2022 08:58
Static task
static1
Behavioral task
behavioral1
Sample
Attached TT Payment Copy(USD 198,550.05).exe
Resource
win7-20220715-en
General
-
Target
Attached TT Payment Copy(USD 198,550.05).exe
-
Size
765KB
-
MD5
38aaaf950849630a2a3282b203532d79
-
SHA1
6448bd7ab4c04294020479963e53f0fbbe4ecc28
-
SHA256
a6e702e43965539bad67320474a1abe16545481c599c2200acabe41ec2ce4eb7
-
SHA512
9de881c36367c42c639dc659c2f1565ee264909dd6823e26a97b05acc4c0ed3a30a6ed0d4d58c556d76fa6a2c1e8e29d731a43143df9c5b775f16b7222b4c0f3
Malware Config
Extracted
formbook
4.1
d27e
lilysbusride.com
cloud-sechs.com
danpro.co.uk
wendoortech.com
playgroundrebellion.com
betventures.xyz
digimediasolution.net
abrahambetrayedus.com
whinefree.com
realeurolicence.com
makelovetrip.com
damediaagency.com
pinaralsan.com
5bobitw.com
shootingkarelia.online
website-staging.pro
manassadhvi.online
bathroomandkitcenking.com
realtormarket.net
dfysupport.com
class-flow.com
migstrip.online
qnacontracting.com
namaste-events.com
yestifications.com
indigoartandclothing.com
resultedu.com
digitalworldp.com
phase7assured.com
hirejar.site
leadstosuccessdental.com
ebooksonline4u.com
prosperbags.com
binarytreetech.com
jenpetronellatattoos.com
purpleduckdesign.net
merceriasen.xyz
shinnadesign.online
perubahantariftransaksi.website
jhanca.site
tacoslawera.com
majorappliancepros.com
kemiandsalam22.com
skipperage.info
tabulose-lust.xyz
wahproducts.com
mcleod.top
acepaintingservice.com
longtaidazong.com
spit2dabeat.com
jthecreator.net
sanhelu00.top
ipcemea.info
uniofilm.com
kitchenbw.space
abiccreats.com
southamptonvac.com
zavodalabda.xyz
mahahills.com
careers01-cxeinc.com
betteryourfinancial.info
buyfarfalla.com
moesoldmine.com
sioreu.com
havehealthybloodsugar.com
Signatures
-
Formbook payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/420-142-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/420-153-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/420-160-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4632-162-0x0000000000990000-0x00000000009BF000-memory.dmp formbook behavioral2/memory/4632-169-0x0000000000990000-0x00000000009BF000-memory.dmp formbook -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Attached TT Payment Copy(USD 198,550.05).exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Control Panel\International\Geo\Nation Attached TT Payment Copy(USD 198,550.05).exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Attached TT Payment Copy(USD 198,550.05).exeAttached TT Payment Copy(USD 198,550.05).execmd.exedescription pid process target process PID 3840 set thread context of 420 3840 Attached TT Payment Copy(USD 198,550.05).exe Attached TT Payment Copy(USD 198,550.05).exe PID 420 set thread context of 2120 420 Attached TT Payment Copy(USD 198,550.05).exe Explorer.EXE PID 420 set thread context of 2120 420 Attached TT Payment Copy(USD 198,550.05).exe Explorer.EXE PID 4632 set thread context of 2120 4632 cmd.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 32 IoCs
Processes:
powershell.exeAttached TT Payment Copy(USD 198,550.05).execmd.exepid process 680 powershell.exe 420 Attached TT Payment Copy(USD 198,550.05).exe 420 Attached TT Payment Copy(USD 198,550.05).exe 420 Attached TT Payment Copy(USD 198,550.05).exe 420 Attached TT Payment Copy(USD 198,550.05).exe 680 powershell.exe 420 Attached TT Payment Copy(USD 198,550.05).exe 420 Attached TT Payment Copy(USD 198,550.05).exe 4632 cmd.exe 4632 cmd.exe 4632 cmd.exe 4632 cmd.exe 4632 cmd.exe 4632 cmd.exe 4632 cmd.exe 4632 cmd.exe 4632 cmd.exe 4632 cmd.exe 4632 cmd.exe 4632 cmd.exe 4632 cmd.exe 4632 cmd.exe 4632 cmd.exe 4632 cmd.exe 4632 cmd.exe 4632 cmd.exe 4632 cmd.exe 4632 cmd.exe 4632 cmd.exe 4632 cmd.exe 4632 cmd.exe 4632 cmd.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2120 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
Attached TT Payment Copy(USD 198,550.05).execmd.exepid process 420 Attached TT Payment Copy(USD 198,550.05).exe 420 Attached TT Payment Copy(USD 198,550.05).exe 420 Attached TT Payment Copy(USD 198,550.05).exe 420 Attached TT Payment Copy(USD 198,550.05).exe 4632 cmd.exe 4632 cmd.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
powershell.exeAttached TT Payment Copy(USD 198,550.05).execmd.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 680 powershell.exe Token: SeDebugPrivilege 420 Attached TT Payment Copy(USD 198,550.05).exe Token: SeDebugPrivilege 4632 cmd.exe Token: SeShutdownPrivilege 2120 Explorer.EXE Token: SeCreatePagefilePrivilege 2120 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
Attached TT Payment Copy(USD 198,550.05).exeExplorer.EXEcmd.exedescription pid process target process PID 3840 wrote to memory of 680 3840 Attached TT Payment Copy(USD 198,550.05).exe powershell.exe PID 3840 wrote to memory of 680 3840 Attached TT Payment Copy(USD 198,550.05).exe powershell.exe PID 3840 wrote to memory of 680 3840 Attached TT Payment Copy(USD 198,550.05).exe powershell.exe PID 3840 wrote to memory of 3892 3840 Attached TT Payment Copy(USD 198,550.05).exe schtasks.exe PID 3840 wrote to memory of 3892 3840 Attached TT Payment Copy(USD 198,550.05).exe schtasks.exe PID 3840 wrote to memory of 3892 3840 Attached TT Payment Copy(USD 198,550.05).exe schtasks.exe PID 3840 wrote to memory of 420 3840 Attached TT Payment Copy(USD 198,550.05).exe Attached TT Payment Copy(USD 198,550.05).exe PID 3840 wrote to memory of 420 3840 Attached TT Payment Copy(USD 198,550.05).exe Attached TT Payment Copy(USD 198,550.05).exe PID 3840 wrote to memory of 420 3840 Attached TT Payment Copy(USD 198,550.05).exe Attached TT Payment Copy(USD 198,550.05).exe PID 3840 wrote to memory of 420 3840 Attached TT Payment Copy(USD 198,550.05).exe Attached TT Payment Copy(USD 198,550.05).exe PID 3840 wrote to memory of 420 3840 Attached TT Payment Copy(USD 198,550.05).exe Attached TT Payment Copy(USD 198,550.05).exe PID 3840 wrote to memory of 420 3840 Attached TT Payment Copy(USD 198,550.05).exe Attached TT Payment Copy(USD 198,550.05).exe PID 2120 wrote to memory of 4632 2120 Explorer.EXE cmd.exe PID 2120 wrote to memory of 4632 2120 Explorer.EXE cmd.exe PID 2120 wrote to memory of 4632 2120 Explorer.EXE cmd.exe PID 4632 wrote to memory of 1680 4632 cmd.exe cmd.exe PID 4632 wrote to memory of 1680 4632 cmd.exe cmd.exe PID 4632 wrote to memory of 1680 4632 cmd.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Attached TT Payment Copy(USD 198,550.05).exe"C:\Users\Admin\AppData\Local\Temp\Attached TT Payment Copy(USD 198,550.05).exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\TQHqtqjt.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TQHqtqjt" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9A1D.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Attached TT Payment Copy(USD 198,550.05).exe"C:\Users\Admin\AppData\Local\Temp\Attached TT Payment Copy(USD 198,550.05).exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Attached TT Payment Copy(USD 198,550.05).exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp9A1D.tmpFilesize
1KB
MD55b3cd02ed05922317f6ef1d84fca7a6a
SHA1b6c64c4b283e05e40f78162867ff7bc7b50a5e4d
SHA256e7d3edc5d0862287b33ce6f1bfe988b97f0b83ba290f551b4f13f607987e9999
SHA512024380f6e6f6c2443feb0c7d57441ba933897ecf42562be700caad1afdc0bf68e7556b763c9698d26d2d4fc2204b7042ebece5d6854d3a00cc8dd80d2e5d598a
-
memory/420-160-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/420-156-0x0000000003470000-0x0000000003485000-memory.dmpFilesize
84KB
-
memory/420-153-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/420-147-0x00000000012B0000-0x00000000012C5000-memory.dmpFilesize
84KB
-
memory/420-145-0x0000000001760000-0x0000000001AAA000-memory.dmpFilesize
3.3MB
-
memory/420-141-0x0000000000000000-mapping.dmp
-
memory/420-142-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/680-151-0x00000000711A0000-0x00000000711EC000-memory.dmpFilesize
304KB
-
memory/680-138-0x0000000004C60000-0x0000000004C96000-memory.dmpFilesize
216KB
-
memory/680-140-0x0000000005370000-0x0000000005998000-memory.dmpFilesize
6.2MB
-
memory/680-172-0x0000000007870000-0x0000000007878000-memory.dmpFilesize
32KB
-
memory/680-136-0x0000000000000000-mapping.dmp
-
memory/680-143-0x0000000005170000-0x0000000005192000-memory.dmpFilesize
136KB
-
memory/680-144-0x0000000005A10000-0x0000000005A76000-memory.dmpFilesize
408KB
-
memory/680-171-0x0000000007890000-0x00000000078AA000-memory.dmpFilesize
104KB
-
memory/680-170-0x0000000007790000-0x000000000779E000-memory.dmpFilesize
56KB
-
memory/680-158-0x0000000006200000-0x000000000620A000-memory.dmpFilesize
40KB
-
memory/680-149-0x00000000061C0000-0x00000000061DE000-memory.dmpFilesize
120KB
-
memory/680-150-0x0000000006800000-0x0000000006832000-memory.dmpFilesize
200KB
-
memory/680-163-0x00000000077D0000-0x0000000007866000-memory.dmpFilesize
600KB
-
memory/680-152-0x00000000067E0000-0x00000000067FE000-memory.dmpFilesize
120KB
-
memory/680-155-0x0000000007540000-0x000000000755A000-memory.dmpFilesize
104KB
-
memory/680-154-0x0000000007B90000-0x000000000820A000-memory.dmpFilesize
6.5MB
-
memory/1680-164-0x0000000000000000-mapping.dmp
-
memory/2120-148-0x0000000008A50000-0x0000000008B70000-memory.dmpFilesize
1.1MB
-
memory/2120-173-0x0000000003320000-0x000000000340D000-memory.dmpFilesize
948KB
-
memory/2120-157-0x0000000008B70000-0x0000000008C83000-memory.dmpFilesize
1.1MB
-
memory/2120-165-0x0000000008A50000-0x0000000008B70000-memory.dmpFilesize
1.1MB
-
memory/2120-168-0x0000000003320000-0x000000000340D000-memory.dmpFilesize
948KB
-
memory/3840-134-0x000000000AE10000-0x000000000AEAC000-memory.dmpFilesize
624KB
-
memory/3840-132-0x0000000004F10000-0x0000000004FA2000-memory.dmpFilesize
584KB
-
memory/3840-131-0x00000000054C0000-0x0000000005A64000-memory.dmpFilesize
5.6MB
-
memory/3840-133-0x0000000004EC0000-0x0000000004ECA000-memory.dmpFilesize
40KB
-
memory/3840-130-0x0000000000470000-0x0000000000536000-memory.dmpFilesize
792KB
-
memory/3840-135-0x000000000AEB0000-0x000000000AF16000-memory.dmpFilesize
408KB
-
memory/3892-137-0x0000000000000000-mapping.dmp
-
memory/4632-161-0x00000000007E0000-0x000000000083A000-memory.dmpFilesize
360KB
-
memory/4632-169-0x0000000000990000-0x00000000009BF000-memory.dmpFilesize
188KB
-
memory/4632-167-0x00000000013B0000-0x0000000001444000-memory.dmpFilesize
592KB
-
memory/4632-166-0x0000000001560000-0x00000000018AA000-memory.dmpFilesize
3.3MB
-
memory/4632-162-0x0000000000990000-0x00000000009BF000-memory.dmpFilesize
188KB
-
memory/4632-159-0x0000000000000000-mapping.dmp