Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
04-08-2022 14:10
Static task
static1
Behavioral task
behavioral1
Sample
NEW_PO.exe
Resource
win7-20220718-en
General
-
Target
NEW_PO.exe
-
Size
703KB
-
MD5
ffe037deca0641fac8353d65db14d3ed
-
SHA1
5324aa903669c0b1417ea69f5fdab01600a37527
-
SHA256
bd14376c2116d73ced555431ec6b80afce2dbb13b36843edea366e897e32c360
-
SHA512
84f0e47107f11c0bf0622598797f216e14f2715cf756473b7ebf8892a8378d62c2a9b88f5582ac40a9e7bb13e4891315fee92607524d057aabed3eedcc9af580
Malware Config
Extracted
formbook
4.1
d27e
lilysbusride.com
cloud-sechs.com
danpro.co.uk
wendoortech.com
playgroundrebellion.com
betventures.xyz
digimediasolution.net
abrahambetrayedus.com
whinefree.com
realeurolicence.com
makelovetrip.com
damediaagency.com
pinaralsan.com
5bobitw.com
shootingkarelia.online
website-staging.pro
manassadhvi.online
bathroomandkitcenking.com
realtormarket.net
dfysupport.com
class-flow.com
migstrip.online
qnacontracting.com
namaste-events.com
yestifications.com
indigoartandclothing.com
resultedu.com
digitalworldp.com
phase7assured.com
hirejar.site
leadstosuccessdental.com
ebooksonline4u.com
prosperbags.com
binarytreetech.com
jenpetronellatattoos.com
purpleduckdesign.net
merceriasen.xyz
shinnadesign.online
perubahantariftransaksi.website
jhanca.site
tacoslawera.com
majorappliancepros.com
kemiandsalam22.com
skipperage.info
tabulose-lust.xyz
wahproducts.com
mcleod.top
acepaintingservice.com
longtaidazong.com
spit2dabeat.com
jthecreator.net
sanhelu00.top
ipcemea.info
uniofilm.com
kitchenbw.space
abiccreats.com
southamptonvac.com
zavodalabda.xyz
mahahills.com
careers01-cxeinc.com
betteryourfinancial.info
buyfarfalla.com
moesoldmine.com
sioreu.com
havehealthybloodsugar.com
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/2804-142-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2804-157-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3424-162-0x0000000000950000-0x000000000097F000-memory.dmp formbook behavioral2/memory/3424-168-0x0000000000950000-0x000000000097F000-memory.dmp formbook -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
NEW_PO.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Control Panel\International\Geo\Nation NEW_PO.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
NEW_PO.exeNEW_PO.execmd.exedescription pid process target process PID 4424 set thread context of 2804 4424 NEW_PO.exe NEW_PO.exe PID 2804 set thread context of 3052 2804 NEW_PO.exe Explorer.EXE PID 3424 set thread context of 3052 3424 cmd.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 44 IoCs
Processes:
powershell.exeNEW_PO.execmd.exepid process 4852 powershell.exe 2804 NEW_PO.exe 2804 NEW_PO.exe 2804 NEW_PO.exe 2804 NEW_PO.exe 4852 powershell.exe 3424 cmd.exe 3424 cmd.exe 3424 cmd.exe 3424 cmd.exe 3424 cmd.exe 3424 cmd.exe 3424 cmd.exe 3424 cmd.exe 3424 cmd.exe 3424 cmd.exe 3424 cmd.exe 3424 cmd.exe 3424 cmd.exe 3424 cmd.exe 3424 cmd.exe 3424 cmd.exe 3424 cmd.exe 3424 cmd.exe 3424 cmd.exe 3424 cmd.exe 3424 cmd.exe 3424 cmd.exe 3424 cmd.exe 3424 cmd.exe 3424 cmd.exe 3424 cmd.exe 3424 cmd.exe 3424 cmd.exe 3424 cmd.exe 3424 cmd.exe 3424 cmd.exe 3424 cmd.exe 3424 cmd.exe 3424 cmd.exe 3424 cmd.exe 3424 cmd.exe 3424 cmd.exe 3424 cmd.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3052 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
NEW_PO.execmd.exepid process 2804 NEW_PO.exe 2804 NEW_PO.exe 2804 NEW_PO.exe 3424 cmd.exe 3424 cmd.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
powershell.exeNEW_PO.execmd.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 4852 powershell.exe Token: SeDebugPrivilege 2804 NEW_PO.exe Token: SeDebugPrivilege 3424 cmd.exe Token: SeShutdownPrivilege 3052 Explorer.EXE Token: SeCreatePagefilePrivilege 3052 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
NEW_PO.exeExplorer.EXEcmd.exedescription pid process target process PID 4424 wrote to memory of 4852 4424 NEW_PO.exe powershell.exe PID 4424 wrote to memory of 4852 4424 NEW_PO.exe powershell.exe PID 4424 wrote to memory of 4852 4424 NEW_PO.exe powershell.exe PID 4424 wrote to memory of 2188 4424 NEW_PO.exe schtasks.exe PID 4424 wrote to memory of 2188 4424 NEW_PO.exe schtasks.exe PID 4424 wrote to memory of 2188 4424 NEW_PO.exe schtasks.exe PID 4424 wrote to memory of 2804 4424 NEW_PO.exe NEW_PO.exe PID 4424 wrote to memory of 2804 4424 NEW_PO.exe NEW_PO.exe PID 4424 wrote to memory of 2804 4424 NEW_PO.exe NEW_PO.exe PID 4424 wrote to memory of 2804 4424 NEW_PO.exe NEW_PO.exe PID 4424 wrote to memory of 2804 4424 NEW_PO.exe NEW_PO.exe PID 4424 wrote to memory of 2804 4424 NEW_PO.exe NEW_PO.exe PID 3052 wrote to memory of 3424 3052 Explorer.EXE cmd.exe PID 3052 wrote to memory of 3424 3052 Explorer.EXE cmd.exe PID 3052 wrote to memory of 3424 3052 Explorer.EXE cmd.exe PID 3424 wrote to memory of 5004 3424 cmd.exe cmd.exe PID 3424 wrote to memory of 5004 3424 cmd.exe cmd.exe PID 3424 wrote to memory of 5004 3424 cmd.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NEW_PO.exe"C:\Users\Admin\AppData\Local\Temp\NEW_PO.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\KnZkGwb.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\KnZkGwb" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1FBD.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\NEW_PO.exe"C:\Users\Admin\AppData\Local\Temp\NEW_PO.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\NEW_PO.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp1FBD.tmpFilesize
1KB
MD544dbcdae1fb80b1eb112cccc03743bf0
SHA12ea407336adcaf9e2c65a482536b85dee57009d2
SHA2561408c6651d28b2fb3ad85abd86ba013799c264fd82dc76689f035c72c4157f75
SHA51276be76e632cc0e101418f83130a98983de1e5f66e3cbfd7dcb384396a40e0fdeda071a809fcd4e593379b6ed88333c1d4dfa8437d9ae0991a1ad9d8e3c438342
-
memory/2188-137-0x0000000000000000-mapping.dmp
-
memory/2804-157-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2804-148-0x0000000000F00000-0x0000000000F15000-memory.dmpFilesize
84KB
-
memory/2804-147-0x00000000010B0000-0x00000000013FA000-memory.dmpFilesize
3.3MB
-
memory/2804-142-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2804-140-0x0000000000000000-mapping.dmp
-
memory/3052-149-0x0000000002B60000-0x0000000002CD3000-memory.dmpFilesize
1.4MB
-
memory/3052-169-0x0000000007EE0000-0x0000000007FD5000-memory.dmpFilesize
980KB
-
memory/3052-167-0x0000000007EE0000-0x0000000007FD5000-memory.dmpFilesize
980KB
-
memory/3424-161-0x0000000001290000-0x00000000015DA000-memory.dmpFilesize
3.3MB
-
memory/3424-168-0x0000000000950000-0x000000000097F000-memory.dmpFilesize
188KB
-
memory/3424-156-0x0000000000000000-mapping.dmp
-
memory/3424-159-0x0000000000250000-0x00000000002AA000-memory.dmpFilesize
360KB
-
memory/3424-166-0x0000000001100000-0x0000000001194000-memory.dmpFilesize
592KB
-
memory/3424-162-0x0000000000950000-0x000000000097F000-memory.dmpFilesize
188KB
-
memory/4424-135-0x000000000B3B0000-0x000000000B416000-memory.dmpFilesize
408KB
-
memory/4424-132-0x00000000052B0000-0x0000000005342000-memory.dmpFilesize
584KB
-
memory/4424-130-0x0000000000860000-0x0000000000914000-memory.dmpFilesize
720KB
-
memory/4424-133-0x0000000005450000-0x000000000545A000-memory.dmpFilesize
40KB
-
memory/4424-134-0x000000000B280000-0x000000000B31C000-memory.dmpFilesize
624KB
-
memory/4424-131-0x0000000005760000-0x0000000005D04000-memory.dmpFilesize
5.6MB
-
memory/4852-153-0x00000000079A0000-0x000000000801A000-memory.dmpFilesize
6.5MB
-
memory/4852-146-0x0000000006050000-0x000000000606E000-memory.dmpFilesize
120KB
-
memory/4852-155-0x00000000073D0000-0x00000000073DA000-memory.dmpFilesize
40KB
-
memory/4852-138-0x0000000002750000-0x0000000002786000-memory.dmpFilesize
216KB
-
memory/4852-152-0x00000000065A0000-0x00000000065BE000-memory.dmpFilesize
120KB
-
memory/4852-158-0x00000000075E0000-0x0000000007676000-memory.dmpFilesize
600KB
-
memory/4852-151-0x0000000070930000-0x000000007097C000-memory.dmpFilesize
304KB
-
memory/4852-136-0x0000000000000000-mapping.dmp
-
memory/4852-150-0x0000000007030000-0x0000000007062000-memory.dmpFilesize
200KB
-
memory/4852-154-0x0000000007350000-0x000000000736A000-memory.dmpFilesize
104KB
-
memory/4852-163-0x0000000007590000-0x000000000759E000-memory.dmpFilesize
56KB
-
memory/4852-164-0x00000000076A0000-0x00000000076BA000-memory.dmpFilesize
104KB
-
memory/4852-165-0x0000000007680000-0x0000000007688000-memory.dmpFilesize
32KB
-
memory/4852-144-0x0000000005950000-0x00000000059B6000-memory.dmpFilesize
408KB
-
memory/4852-143-0x0000000004F70000-0x0000000004F92000-memory.dmpFilesize
136KB
-
memory/4852-141-0x00000000052B0000-0x00000000058D8000-memory.dmpFilesize
6.2MB
-
memory/5004-160-0x0000000000000000-mapping.dmp