Analysis
-
max time kernel
146s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
04-08-2022 14:10
Static task
static1
Behavioral task
behavioral1
Sample
NEW_PO.exe
Resource
win7-20220718-en
General
-
Target
NEW_PO.exe
-
Size
703KB
-
MD5
ffe037deca0641fac8353d65db14d3ed
-
SHA1
5324aa903669c0b1417ea69f5fdab01600a37527
-
SHA256
bd14376c2116d73ced555431ec6b80afce2dbb13b36843edea366e897e32c360
-
SHA512
84f0e47107f11c0bf0622598797f216e14f2715cf756473b7ebf8892a8378d62c2a9b88f5582ac40a9e7bb13e4891315fee92607524d057aabed3eedcc9af580
Malware Config
Extracted
formbook
4.1
d27e
lilysbusride.com
cloud-sechs.com
danpro.co.uk
wendoortech.com
playgroundrebellion.com
betventures.xyz
digimediasolution.net
abrahambetrayedus.com
whinefree.com
realeurolicence.com
makelovetrip.com
damediaagency.com
pinaralsan.com
5bobitw.com
shootingkarelia.online
website-staging.pro
manassadhvi.online
bathroomandkitcenking.com
realtormarket.net
dfysupport.com
class-flow.com
migstrip.online
qnacontracting.com
namaste-events.com
yestifications.com
indigoartandclothing.com
resultedu.com
digitalworldp.com
phase7assured.com
hirejar.site
leadstosuccessdental.com
ebooksonline4u.com
prosperbags.com
binarytreetech.com
jenpetronellatattoos.com
purpleduckdesign.net
merceriasen.xyz
shinnadesign.online
perubahantariftransaksi.website
jhanca.site
tacoslawera.com
majorappliancepros.com
kemiandsalam22.com
skipperage.info
tabulose-lust.xyz
wahproducts.com
mcleod.top
acepaintingservice.com
longtaidazong.com
spit2dabeat.com
jthecreator.net
sanhelu00.top
ipcemea.info
uniofilm.com
kitchenbw.space
abiccreats.com
southamptonvac.com
zavodalabda.xyz
mahahills.com
careers01-cxeinc.com
betteryourfinancial.info
buyfarfalla.com
moesoldmine.com
sioreu.com
havehealthybloodsugar.com
Signatures
-
Formbook payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1780-67-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1780-68-0x000000000041F1A0-mapping.dmp formbook behavioral1/memory/1780-70-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/296-78-0x0000000000080000-0x00000000000AF000-memory.dmp formbook behavioral1/memory/296-82-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1496 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
NEW_PO.exeNEW_PO.execmd.exedescription pid process target process PID 1208 set thread context of 1780 1208 NEW_PO.exe NEW_PO.exe PID 1780 set thread context of 1380 1780 NEW_PO.exe Explorer.EXE PID 296 set thread context of 1380 296 cmd.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 19 IoCs
Processes:
powershell.exeNEW_PO.execmd.exepid process 1108 powershell.exe 1780 NEW_PO.exe 1780 NEW_PO.exe 296 cmd.exe 296 cmd.exe 296 cmd.exe 296 cmd.exe 296 cmd.exe 296 cmd.exe 296 cmd.exe 296 cmd.exe 296 cmd.exe 296 cmd.exe 296 cmd.exe 296 cmd.exe 296 cmd.exe 296 cmd.exe 296 cmd.exe 296 cmd.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
NEW_PO.execmd.exepid process 1780 NEW_PO.exe 1780 NEW_PO.exe 1780 NEW_PO.exe 296 cmd.exe 296 cmd.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exeNEW_PO.execmd.exedescription pid process Token: SeDebugPrivilege 1108 powershell.exe Token: SeDebugPrivilege 1780 NEW_PO.exe Token: SeDebugPrivilege 296 cmd.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1380 Explorer.EXE 1380 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1380 Explorer.EXE 1380 Explorer.EXE -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
NEW_PO.exeExplorer.EXEcmd.exedescription pid process target process PID 1208 wrote to memory of 1108 1208 NEW_PO.exe powershell.exe PID 1208 wrote to memory of 1108 1208 NEW_PO.exe powershell.exe PID 1208 wrote to memory of 1108 1208 NEW_PO.exe powershell.exe PID 1208 wrote to memory of 1108 1208 NEW_PO.exe powershell.exe PID 1208 wrote to memory of 1068 1208 NEW_PO.exe schtasks.exe PID 1208 wrote to memory of 1068 1208 NEW_PO.exe schtasks.exe PID 1208 wrote to memory of 1068 1208 NEW_PO.exe schtasks.exe PID 1208 wrote to memory of 1068 1208 NEW_PO.exe schtasks.exe PID 1208 wrote to memory of 1780 1208 NEW_PO.exe NEW_PO.exe PID 1208 wrote to memory of 1780 1208 NEW_PO.exe NEW_PO.exe PID 1208 wrote to memory of 1780 1208 NEW_PO.exe NEW_PO.exe PID 1208 wrote to memory of 1780 1208 NEW_PO.exe NEW_PO.exe PID 1208 wrote to memory of 1780 1208 NEW_PO.exe NEW_PO.exe PID 1208 wrote to memory of 1780 1208 NEW_PO.exe NEW_PO.exe PID 1208 wrote to memory of 1780 1208 NEW_PO.exe NEW_PO.exe PID 1380 wrote to memory of 296 1380 Explorer.EXE cmd.exe PID 1380 wrote to memory of 296 1380 Explorer.EXE cmd.exe PID 1380 wrote to memory of 296 1380 Explorer.EXE cmd.exe PID 1380 wrote to memory of 296 1380 Explorer.EXE cmd.exe PID 296 wrote to memory of 1496 296 cmd.exe cmd.exe PID 296 wrote to memory of 1496 296 cmd.exe cmd.exe PID 296 wrote to memory of 1496 296 cmd.exe cmd.exe PID 296 wrote to memory of 1496 296 cmd.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\NEW_PO.exe"C:\Users\Admin\AppData\Local\Temp\NEW_PO.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\KnZkGwb.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1108 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\KnZkGwb" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB51D.tmp"3⤵
- Creates scheduled task(s)
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\NEW_PO.exe"C:\Users\Admin\AppData\Local\Temp\NEW_PO.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1780 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:296 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\NEW_PO.exe"3⤵
- Deletes itself
PID:1496
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpB51D.tmpFilesize
1KB
MD520414da9f20a334795e35e21710dc90e
SHA143741352c052b75b0baf7b3980330929c6cc4873
SHA256863757de14e0081cff6601605eaa2b95f4c7195bbe7a435b4a9fcf3769f0186a
SHA51289a1adfb1a2c224d3c02e1fa1192ba65f5359e76b1ce4ffc7d691244551cb678fa102c533e0d34698ca1af64d9b01631de8ab740bc515a95004fdc06cde64d2a
-
memory/296-82-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/296-80-0x0000000001E30000-0x0000000001EC4000-memory.dmpFilesize
592KB
-
memory/296-79-0x0000000001EF0000-0x00000000021F3000-memory.dmpFilesize
3.0MB
-
memory/296-78-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/296-77-0x000000004AB70000-0x000000004ABBC000-memory.dmpFilesize
304KB
-
memory/296-75-0x0000000000000000-mapping.dmp
-
memory/1068-60-0x0000000000000000-mapping.dmp
-
memory/1108-59-0x0000000000000000-mapping.dmp
-
memory/1108-71-0x000000006EAA0000-0x000000006F04B000-memory.dmpFilesize
5.7MB
-
memory/1208-55-0x00000000758D1000-0x00000000758D3000-memory.dmpFilesize
8KB
-
memory/1208-63-0x0000000004240000-0x0000000004276000-memory.dmpFilesize
216KB
-
memory/1208-56-0x00000000003E0000-0x00000000003F6000-memory.dmpFilesize
88KB
-
memory/1208-57-0x00000000005A0000-0x00000000005AA000-memory.dmpFilesize
40KB
-
memory/1208-58-0x0000000005EC0000-0x0000000005F44000-memory.dmpFilesize
528KB
-
memory/1208-54-0x0000000000930000-0x00000000009E4000-memory.dmpFilesize
720KB
-
memory/1380-83-0x0000000006040000-0x0000000006125000-memory.dmpFilesize
916KB
-
memory/1380-81-0x0000000006040000-0x0000000006125000-memory.dmpFilesize
916KB
-
memory/1380-74-0x0000000006B20000-0x0000000006C55000-memory.dmpFilesize
1.2MB
-
memory/1496-76-0x0000000000000000-mapping.dmp
-
memory/1780-68-0x000000000041F1A0-mapping.dmp
-
memory/1780-73-0x0000000000270000-0x0000000000285000-memory.dmpFilesize
84KB
-
memory/1780-72-0x00000000009F0000-0x0000000000CF3000-memory.dmpFilesize
3.0MB
-
memory/1780-70-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1780-67-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1780-65-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1780-64-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB