Analysis
-
max time kernel
147s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
03-08-2022 03:05
Static task
static1
General
-
Target
dffde60dc2cab7ca3e0f5c7b19c4bc654dc6941dbf3a7e5ef9b312b7c4c1c656.exe
-
Size
289KB
-
MD5
6ee33079ee7b4cf222209c1b8b59343f
-
SHA1
a5d080a864977564aa336acb35fbd27b394d622b
-
SHA256
dffde60dc2cab7ca3e0f5c7b19c4bc654dc6941dbf3a7e5ef9b312b7c4c1c656
-
SHA512
66dfb31df07f822c7daba3c66cc06f900d8b2cd83d6e0224cb079836ca52e17d446788ffae8daa56a369e43f54fd9e3fc7017f9e8a8930293b7640752c839abd
Malware Config
Extracted
formbook
4.1
s4s9
qianyuandianshang.com
bernardklein.com
slhomeservices.com
findasaas.com
janellelancaster.xyz
umkpro.site
nr6949.online
mersquare.club
lanariproperties.com
3rdeyefocused.com
giftexpress8260.xyz
hilleleven.xyz
beajod.com
kosazs.online
ishare.team
mb314.com
xjjinxingda.com
ayekooprojectamazing.com
ballsybanter.com
todayshoppingbd.com
recomdietvl.store
zakladmalarstwa.com
bj-ours.com
hubwealth.com
watchmyreview.com
sallyliddicoat.com
eventiliveitalia.com
worldchannelconference.com
suciptahadi.online
ksht5566.com
topfastcashsystemwebshop.com
eyeiieyetv.com
thewarchannel.net
valorousgamers.com
vip01ytre.xyz
szec.tech
233365.xyz
specialroute.net
eugenachase.com
pikoulas.com
shorter-658423.site
win8856.com
burleyqpersianscom.com
sidetrackedmusic.com
chungketvinhomesspotlight.com
qiange.site
motconsultant.com
yottatic.com
usaprostatecenter.com
putovanjazasve.com
kozykornerpizza.com
hainpore.com
52appmj.com
albanyskylights.com
keropy.xyz
infosecrety.xyz
ethlogo.com
labohack.com
veridiumid.xyz
gaylebong.com
rsmegastore.com
janschlesinger.com
cshong-ya.com
shopevix.com
preciousssllc.net
Signatures
-
Formbook payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/392-144-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/392-146-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/392-154-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/3056-157-0x0000000000690000-0x00000000006BF000-memory.dmp formbook behavioral1/memory/3056-160-0x0000000000690000-0x00000000006BF000-memory.dmp formbook -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
dffde60dc2cab7ca3e0f5c7b19c4bc654dc6941dbf3a7e5ef9b312b7c4c1c656.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Control Panel\International\Geo\Nation dffde60dc2cab7ca3e0f5c7b19c4bc654dc6941dbf3a7e5ef9b312b7c4c1c656.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
dffde60dc2cab7ca3e0f5c7b19c4bc654dc6941dbf3a7e5ef9b312b7c4c1c656.exeMSBuild.exeipconfig.exedescription pid process target process PID 3116 set thread context of 392 3116 dffde60dc2cab7ca3e0f5c7b19c4bc654dc6941dbf3a7e5ef9b312b7c4c1c656.exe MSBuild.exe PID 392 set thread context of 3068 392 MSBuild.exe Explorer.EXE PID 392 set thread context of 3068 392 MSBuild.exe Explorer.EXE PID 3056 set thread context of 3068 3056 ipconfig.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid process 3056 ipconfig.exe -
Modifies registry class 2 IoCs
Processes:
Explorer.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 61 IoCs
Processes:
dffde60dc2cab7ca3e0f5c7b19c4bc654dc6941dbf3a7e5ef9b312b7c4c1c656.exepowershell.exeMSBuild.exeipconfig.exepid process 3116 dffde60dc2cab7ca3e0f5c7b19c4bc654dc6941dbf3a7e5ef9b312b7c4c1c656.exe 2288 powershell.exe 2288 powershell.exe 3116 dffde60dc2cab7ca3e0f5c7b19c4bc654dc6941dbf3a7e5ef9b312b7c4c1c656.exe 3116 dffde60dc2cab7ca3e0f5c7b19c4bc654dc6941dbf3a7e5ef9b312b7c4c1c656.exe 392 MSBuild.exe 392 MSBuild.exe 392 MSBuild.exe 392 MSBuild.exe 392 MSBuild.exe 392 MSBuild.exe 3056 ipconfig.exe 3056 ipconfig.exe 3056 ipconfig.exe 3056 ipconfig.exe 3056 ipconfig.exe 3056 ipconfig.exe 3056 ipconfig.exe 3056 ipconfig.exe 3056 ipconfig.exe 3056 ipconfig.exe 3056 ipconfig.exe 3056 ipconfig.exe 3056 ipconfig.exe 3056 ipconfig.exe 3056 ipconfig.exe 3056 ipconfig.exe 3056 ipconfig.exe 3056 ipconfig.exe 3056 ipconfig.exe 3056 ipconfig.exe 3056 ipconfig.exe 3056 ipconfig.exe 3056 ipconfig.exe 3056 ipconfig.exe 3056 ipconfig.exe 3056 ipconfig.exe 3056 ipconfig.exe 3056 ipconfig.exe 3056 ipconfig.exe 3056 ipconfig.exe 3056 ipconfig.exe 3056 ipconfig.exe 3056 ipconfig.exe 3056 ipconfig.exe 3056 ipconfig.exe 3056 ipconfig.exe 3056 ipconfig.exe 3056 ipconfig.exe 3056 ipconfig.exe 3056 ipconfig.exe 3056 ipconfig.exe 3056 ipconfig.exe 3056 ipconfig.exe 3056 ipconfig.exe 3056 ipconfig.exe 3056 ipconfig.exe 3056 ipconfig.exe 3056 ipconfig.exe 3056 ipconfig.exe 3056 ipconfig.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3068 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
MSBuild.exeipconfig.exepid process 392 MSBuild.exe 392 MSBuild.exe 392 MSBuild.exe 392 MSBuild.exe 3056 ipconfig.exe 3056 ipconfig.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
dffde60dc2cab7ca3e0f5c7b19c4bc654dc6941dbf3a7e5ef9b312b7c4c1c656.exepowershell.exeMSBuild.exeipconfig.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 3116 dffde60dc2cab7ca3e0f5c7b19c4bc654dc6941dbf3a7e5ef9b312b7c4c1c656.exe Token: SeDebugPrivilege 2288 powershell.exe Token: SeDebugPrivilege 392 MSBuild.exe Token: SeDebugPrivilege 3056 ipconfig.exe Token: SeShutdownPrivilege 3068 Explorer.EXE Token: SeCreatePagefilePrivilege 3068 Explorer.EXE Token: SeShutdownPrivilege 3068 Explorer.EXE Token: SeCreatePagefilePrivilege 3068 Explorer.EXE Token: SeShutdownPrivilege 3068 Explorer.EXE Token: SeCreatePagefilePrivilege 3068 Explorer.EXE Token: SeShutdownPrivilege 3068 Explorer.EXE Token: SeCreatePagefilePrivilege 3068 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
dffde60dc2cab7ca3e0f5c7b19c4bc654dc6941dbf3a7e5ef9b312b7c4c1c656.exeExplorer.EXEipconfig.exedescription pid process target process PID 3116 wrote to memory of 2288 3116 dffde60dc2cab7ca3e0f5c7b19c4bc654dc6941dbf3a7e5ef9b312b7c4c1c656.exe powershell.exe PID 3116 wrote to memory of 2288 3116 dffde60dc2cab7ca3e0f5c7b19c4bc654dc6941dbf3a7e5ef9b312b7c4c1c656.exe powershell.exe PID 3116 wrote to memory of 2288 3116 dffde60dc2cab7ca3e0f5c7b19c4bc654dc6941dbf3a7e5ef9b312b7c4c1c656.exe powershell.exe PID 3116 wrote to memory of 392 3116 dffde60dc2cab7ca3e0f5c7b19c4bc654dc6941dbf3a7e5ef9b312b7c4c1c656.exe MSBuild.exe PID 3116 wrote to memory of 392 3116 dffde60dc2cab7ca3e0f5c7b19c4bc654dc6941dbf3a7e5ef9b312b7c4c1c656.exe MSBuild.exe PID 3116 wrote to memory of 392 3116 dffde60dc2cab7ca3e0f5c7b19c4bc654dc6941dbf3a7e5ef9b312b7c4c1c656.exe MSBuild.exe PID 3116 wrote to memory of 392 3116 dffde60dc2cab7ca3e0f5c7b19c4bc654dc6941dbf3a7e5ef9b312b7c4c1c656.exe MSBuild.exe PID 3116 wrote to memory of 392 3116 dffde60dc2cab7ca3e0f5c7b19c4bc654dc6941dbf3a7e5ef9b312b7c4c1c656.exe MSBuild.exe PID 3116 wrote to memory of 392 3116 dffde60dc2cab7ca3e0f5c7b19c4bc654dc6941dbf3a7e5ef9b312b7c4c1c656.exe MSBuild.exe PID 3068 wrote to memory of 3056 3068 Explorer.EXE ipconfig.exe PID 3068 wrote to memory of 3056 3068 Explorer.EXE ipconfig.exe PID 3068 wrote to memory of 3056 3068 Explorer.EXE ipconfig.exe PID 3056 wrote to memory of 1540 3056 ipconfig.exe cmd.exe PID 3056 wrote to memory of 1540 3056 ipconfig.exe cmd.exe PID 3056 wrote to memory of 1540 3056 ipconfig.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dffde60dc2cab7ca3e0f5c7b19c4bc654dc6941dbf3a7e5ef9b312b7c4c1c656.exe"C:\Users\Admin\AppData\Local\Temp\dffde60dc2cab7ca3e0f5c7b19c4bc654dc6941dbf3a7e5ef9b312b7c4c1c656.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgA=3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/392-143-0x0000000000000000-mapping.dmp
-
memory/392-154-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/392-151-0x00000000015A0000-0x00000000015B4000-memory.dmpFilesize
80KB
-
memory/392-148-0x0000000001060000-0x0000000001074000-memory.dmpFilesize
80KB
-
memory/392-147-0x00000000015F0000-0x000000000193A000-memory.dmpFilesize
3.3MB
-
memory/392-146-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/392-144-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1540-158-0x0000000000000000-mapping.dmp
-
memory/2288-137-0x0000000005530000-0x0000000005B58000-memory.dmpFilesize
6.2MB
-
memory/2288-135-0x0000000000000000-mapping.dmp
-
memory/2288-140-0x00000000063C0000-0x00000000063DE000-memory.dmpFilesize
120KB
-
memory/2288-141-0x0000000007A10000-0x000000000808A000-memory.dmpFilesize
6.5MB
-
memory/2288-142-0x00000000068D0000-0x00000000068EA000-memory.dmpFilesize
104KB
-
memory/2288-138-0x00000000054B0000-0x0000000005516000-memory.dmpFilesize
408KB
-
memory/2288-139-0x0000000005C60000-0x0000000005CC6000-memory.dmpFilesize
408KB
-
memory/2288-136-0x0000000004E20000-0x0000000004E56000-memory.dmpFilesize
216KB
-
memory/3056-153-0x0000000000000000-mapping.dmp
-
memory/3056-159-0x0000000000CF0000-0x0000000000D83000-memory.dmpFilesize
588KB
-
memory/3056-160-0x0000000000690000-0x00000000006BF000-memory.dmpFilesize
188KB
-
memory/3056-155-0x0000000000B40000-0x0000000000B4B000-memory.dmpFilesize
44KB
-
memory/3056-156-0x0000000000EB0000-0x00000000011FA000-memory.dmpFilesize
3.3MB
-
memory/3056-157-0x0000000000690000-0x00000000006BF000-memory.dmpFilesize
188KB
-
memory/3068-149-0x00000000033E0000-0x0000000003516000-memory.dmpFilesize
1.2MB
-
memory/3068-162-0x0000000008C30000-0x0000000008CF9000-memory.dmpFilesize
804KB
-
memory/3068-161-0x0000000008C30000-0x0000000008CF9000-memory.dmpFilesize
804KB
-
memory/3068-152-0x0000000008B00000-0x0000000008C2F000-memory.dmpFilesize
1.2MB
-
memory/3116-130-0x0000000000140000-0x000000000018E000-memory.dmpFilesize
312KB
-
memory/3116-131-0x00000000051E0000-0x0000000005784000-memory.dmpFilesize
5.6MB
-
memory/3116-132-0x0000000004CD0000-0x0000000004D62000-memory.dmpFilesize
584KB
-
memory/3116-133-0x0000000005820000-0x000000000582A000-memory.dmpFilesize
40KB
-
memory/3116-134-0x00000000063A0000-0x00000000063C2000-memory.dmpFilesize
136KB