Analysis
-
max time kernel
119s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
01-08-2022 10:56
Static task
static1
Behavioral task
behavioral1
Sample
4717b002bcdf79dfe269e96efd0f0302.exe
Resource
win7-20220718-en
General
-
Target
4717b002bcdf79dfe269e96efd0f0302.exe
-
Size
844KB
-
MD5
4717b002bcdf79dfe269e96efd0f0302
-
SHA1
1ab32e14b40d4647ee7b71afecddbd499a421244
-
SHA256
387d6219bdf75b7bea9272ea9b862aae3a964808469a8489b040b8e2b93b62bc
-
SHA512
899c375e4b5a8999a3a66432facb22aa8da3ce369092620afa15a10b10d22de1e91dbfe0b324dd577a58b4751c58070fbbbe03b7a5f6a7dfc39a0b94276a7234
Malware Config
Extracted
formbook
4.1
d27e
lilysbusride.com
cloud-sechs.com
danpro.co.uk
wendoortech.com
playgroundrebellion.com
betventures.xyz
digimediasolution.net
abrahambetrayedus.com
whinefree.com
realeurolicence.com
makelovetrip.com
damediaagency.com
pinaralsan.com
5bobitw.com
shootingkarelia.online
website-staging.pro
manassadhvi.online
bathroomandkitcenking.com
realtormarket.net
dfysupport.com
class-flow.com
migstrip.online
qnacontracting.com
namaste-events.com
yestifications.com
indigoartandclothing.com
resultedu.com
digitalworldp.com
phase7assured.com
hirejar.site
leadstosuccessdental.com
ebooksonline4u.com
prosperbags.com
binarytreetech.com
jenpetronellatattoos.com
purpleduckdesign.net
merceriasen.xyz
shinnadesign.online
perubahantariftransaksi.website
jhanca.site
tacoslawera.com
majorappliancepros.com
kemiandsalam22.com
skipperage.info
tabulose-lust.xyz
wahproducts.com
mcleod.top
acepaintingservice.com
longtaidazong.com
spit2dabeat.com
jthecreator.net
sanhelu00.top
ipcemea.info
uniofilm.com
kitchenbw.space
abiccreats.com
southamptonvac.com
zavodalabda.xyz
mahahills.com
careers01-cxeinc.com
betteryourfinancial.info
buyfarfalla.com
moesoldmine.com
sioreu.com
havehealthybloodsugar.com
Signatures
-
Formbook payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/608-142-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
4717b002bcdf79dfe269e96efd0f0302.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Control Panel\International\Geo\Nation 4717b002bcdf79dfe269e96efd0f0302.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
4717b002bcdf79dfe269e96efd0f0302.exedescription pid process target process PID 2536 set thread context of 608 2536 4717b002bcdf79dfe269e96efd0f0302.exe 4717b002bcdf79dfe269e96efd0f0302.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exe4717b002bcdf79dfe269e96efd0f0302.exepid process 1460 powershell.exe 608 4717b002bcdf79dfe269e96efd0f0302.exe 608 4717b002bcdf79dfe269e96efd0f0302.exe 1460 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1460 powershell.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
4717b002bcdf79dfe269e96efd0f0302.exedescription pid process target process PID 2536 wrote to memory of 1460 2536 4717b002bcdf79dfe269e96efd0f0302.exe powershell.exe PID 2536 wrote to memory of 1460 2536 4717b002bcdf79dfe269e96efd0f0302.exe powershell.exe PID 2536 wrote to memory of 1460 2536 4717b002bcdf79dfe269e96efd0f0302.exe powershell.exe PID 2536 wrote to memory of 5020 2536 4717b002bcdf79dfe269e96efd0f0302.exe schtasks.exe PID 2536 wrote to memory of 5020 2536 4717b002bcdf79dfe269e96efd0f0302.exe schtasks.exe PID 2536 wrote to memory of 5020 2536 4717b002bcdf79dfe269e96efd0f0302.exe schtasks.exe PID 2536 wrote to memory of 608 2536 4717b002bcdf79dfe269e96efd0f0302.exe 4717b002bcdf79dfe269e96efd0f0302.exe PID 2536 wrote to memory of 608 2536 4717b002bcdf79dfe269e96efd0f0302.exe 4717b002bcdf79dfe269e96efd0f0302.exe PID 2536 wrote to memory of 608 2536 4717b002bcdf79dfe269e96efd0f0302.exe 4717b002bcdf79dfe269e96efd0f0302.exe PID 2536 wrote to memory of 608 2536 4717b002bcdf79dfe269e96efd0f0302.exe 4717b002bcdf79dfe269e96efd0f0302.exe PID 2536 wrote to memory of 608 2536 4717b002bcdf79dfe269e96efd0f0302.exe 4717b002bcdf79dfe269e96efd0f0302.exe PID 2536 wrote to memory of 608 2536 4717b002bcdf79dfe269e96efd0f0302.exe 4717b002bcdf79dfe269e96efd0f0302.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4717b002bcdf79dfe269e96efd0f0302.exe"C:\Users\Admin\AppData\Local\Temp\4717b002bcdf79dfe269e96efd0f0302.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\fkYAfucRRq.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fkYAfucRRq" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2700.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\4717b002bcdf79dfe269e96efd0f0302.exe"C:\Users\Admin\AppData\Local\Temp\4717b002bcdf79dfe269e96efd0f0302.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp2700.tmpFilesize
1KB
MD5f34c655bb48836a92e646e3cf1378d5c
SHA1d474dcd947ee7071cc49b4f2a541e64847f70beb
SHA256003c55fecf61e8d1c4d39aa099de9291b81e2f404ef974200d3745e5f58f5bf3
SHA512dfb4056ef1cdd7ed4e3fcdeca7208cf53b6c0c03bb6a3acbf2afeea5a3ad644fb5be894dfd12ebd5457803d7c916b82193a9aa29872cb9c7ed48913f5cd68b13
-
memory/608-145-0x0000000001840000-0x0000000001B8A000-memory.dmpFilesize
3.3MB
-
memory/608-140-0x0000000000000000-mapping.dmp
-
memory/608-142-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1460-136-0x0000000000000000-mapping.dmp
-
memory/1460-150-0x0000000007A60000-0x00000000080DA000-memory.dmpFilesize
6.5MB
-
memory/1460-156-0x0000000007740000-0x0000000007748000-memory.dmpFilesize
32KB
-
memory/1460-155-0x0000000007760000-0x000000000777A000-memory.dmpFilesize
104KB
-
memory/1460-138-0x0000000004B80000-0x0000000004BB6000-memory.dmpFilesize
216KB
-
memory/1460-154-0x0000000007650000-0x000000000765E000-memory.dmpFilesize
56KB
-
memory/1460-141-0x00000000052A0000-0x00000000058C8000-memory.dmpFilesize
6.2MB
-
memory/1460-153-0x00000000076A0000-0x0000000007736000-memory.dmpFilesize
600KB
-
memory/1460-152-0x0000000007490000-0x000000000749A000-memory.dmpFilesize
40KB
-
memory/1460-143-0x0000000005170000-0x0000000005192000-memory.dmpFilesize
136KB
-
memory/1460-144-0x0000000005940000-0x00000000059A6000-memory.dmpFilesize
408KB
-
memory/1460-151-0x0000000007420000-0x000000000743A000-memory.dmpFilesize
104KB
-
memory/1460-146-0x0000000006110000-0x000000000612E000-memory.dmpFilesize
120KB
-
memory/1460-147-0x00000000066E0000-0x0000000006712000-memory.dmpFilesize
200KB
-
memory/1460-148-0x0000000071930000-0x000000007197C000-memory.dmpFilesize
304KB
-
memory/1460-149-0x00000000066B0000-0x00000000066CE000-memory.dmpFilesize
120KB
-
memory/2536-135-0x000000000B0B0000-0x000000000B116000-memory.dmpFilesize
408KB
-
memory/2536-131-0x0000000005220000-0x00000000057C4000-memory.dmpFilesize
5.6MB
-
memory/2536-132-0x0000000004C70000-0x0000000004D02000-memory.dmpFilesize
584KB
-
memory/2536-133-0x0000000004C30000-0x0000000004C3A000-memory.dmpFilesize
40KB
-
memory/2536-134-0x000000000AEA0000-0x000000000AF3C000-memory.dmpFilesize
624KB
-
memory/2536-130-0x0000000000180000-0x0000000000258000-memory.dmpFilesize
864KB
-
memory/5020-137-0x0000000000000000-mapping.dmp