Analysis
-
max time kernel
52s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
08-08-2022 07:31
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.Olock.1.14774.exe
Resource
win7-20220715-en
General
-
Target
SecuriteInfo.com.Trojan.Olock.1.14774.exe
-
Size
931KB
-
MD5
0aa59b2e00f1b996715e4ad669a1135c
-
SHA1
35663dc7ec41b279993ee233e1592c851d4fb6a7
-
SHA256
9cbdbe876e2abf4c3140f516164d1f2c68f15d10b4c17725249182c50be6d32d
-
SHA512
190b0b1dec2576116a6d3544bda892646f1e694db6dbc09e0582b00be672cafaa85219425f6295b83af449046a133d7acc91621792e38e6534d76601b444886b
Malware Config
Extracted
formbook
4.1
d27e
lilysbusride.com
cloud-sechs.com
danpro.co.uk
wendoortech.com
playgroundrebellion.com
betventures.xyz
digimediasolution.net
abrahambetrayedus.com
whinefree.com
realeurolicence.com
makelovetrip.com
damediaagency.com
pinaralsan.com
5bobitw.com
shootingkarelia.online
website-staging.pro
manassadhvi.online
bathroomandkitcenking.com
realtormarket.net
dfysupport.com
class-flow.com
migstrip.online
qnacontracting.com
namaste-events.com
yestifications.com
indigoartandclothing.com
resultedu.com
digitalworldp.com
phase7assured.com
hirejar.site
leadstosuccessdental.com
ebooksonline4u.com
prosperbags.com
binarytreetech.com
jenpetronellatattoos.com
purpleduckdesign.net
merceriasen.xyz
shinnadesign.online
perubahantariftransaksi.website
jhanca.site
tacoslawera.com
majorappliancepros.com
kemiandsalam22.com
skipperage.info
tabulose-lust.xyz
wahproducts.com
mcleod.top
acepaintingservice.com
longtaidazong.com
spit2dabeat.com
jthecreator.net
sanhelu00.top
ipcemea.info
uniofilm.com
kitchenbw.space
abiccreats.com
southamptonvac.com
zavodalabda.xyz
mahahills.com
careers01-cxeinc.com
betteryourfinancial.info
buyfarfalla.com
moesoldmine.com
sioreu.com
havehealthybloodsugar.com
Signatures
-
Formbook payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1768-67-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1768-68-0x000000000041F1A0-mapping.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SecuriteInfo.com.Trojan.Olock.1.14774.exedescription pid process target process PID 2000 set thread context of 1768 2000 SecuriteInfo.com.Trojan.Olock.1.14774.exe SecuriteInfo.com.Trojan.Olock.1.14774.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
SecuriteInfo.com.Trojan.Olock.1.14774.exepowershell.exeSecuriteInfo.com.Trojan.Olock.1.14774.exepid process 2000 SecuriteInfo.com.Trojan.Olock.1.14774.exe 2000 SecuriteInfo.com.Trojan.Olock.1.14774.exe 1320 powershell.exe 1768 SecuriteInfo.com.Trojan.Olock.1.14774.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
SecuriteInfo.com.Trojan.Olock.1.14774.exepowershell.exedescription pid process Token: SeDebugPrivilege 2000 SecuriteInfo.com.Trojan.Olock.1.14774.exe Token: SeDebugPrivilege 1320 powershell.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
SecuriteInfo.com.Trojan.Olock.1.14774.exepid process 2000 SecuriteInfo.com.Trojan.Olock.1.14774.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
SecuriteInfo.com.Trojan.Olock.1.14774.exepid process 2000 SecuriteInfo.com.Trojan.Olock.1.14774.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
SecuriteInfo.com.Trojan.Olock.1.14774.exedescription pid process target process PID 2000 wrote to memory of 1320 2000 SecuriteInfo.com.Trojan.Olock.1.14774.exe powershell.exe PID 2000 wrote to memory of 1320 2000 SecuriteInfo.com.Trojan.Olock.1.14774.exe powershell.exe PID 2000 wrote to memory of 1320 2000 SecuriteInfo.com.Trojan.Olock.1.14774.exe powershell.exe PID 2000 wrote to memory of 1320 2000 SecuriteInfo.com.Trojan.Olock.1.14774.exe powershell.exe PID 2000 wrote to memory of 1108 2000 SecuriteInfo.com.Trojan.Olock.1.14774.exe schtasks.exe PID 2000 wrote to memory of 1108 2000 SecuriteInfo.com.Trojan.Olock.1.14774.exe schtasks.exe PID 2000 wrote to memory of 1108 2000 SecuriteInfo.com.Trojan.Olock.1.14774.exe schtasks.exe PID 2000 wrote to memory of 1108 2000 SecuriteInfo.com.Trojan.Olock.1.14774.exe schtasks.exe PID 2000 wrote to memory of 472 2000 SecuriteInfo.com.Trojan.Olock.1.14774.exe SecuriteInfo.com.Trojan.Olock.1.14774.exe PID 2000 wrote to memory of 472 2000 SecuriteInfo.com.Trojan.Olock.1.14774.exe SecuriteInfo.com.Trojan.Olock.1.14774.exe PID 2000 wrote to memory of 472 2000 SecuriteInfo.com.Trojan.Olock.1.14774.exe SecuriteInfo.com.Trojan.Olock.1.14774.exe PID 2000 wrote to memory of 472 2000 SecuriteInfo.com.Trojan.Olock.1.14774.exe SecuriteInfo.com.Trojan.Olock.1.14774.exe PID 2000 wrote to memory of 268 2000 SecuriteInfo.com.Trojan.Olock.1.14774.exe SecuriteInfo.com.Trojan.Olock.1.14774.exe PID 2000 wrote to memory of 268 2000 SecuriteInfo.com.Trojan.Olock.1.14774.exe SecuriteInfo.com.Trojan.Olock.1.14774.exe PID 2000 wrote to memory of 268 2000 SecuriteInfo.com.Trojan.Olock.1.14774.exe SecuriteInfo.com.Trojan.Olock.1.14774.exe PID 2000 wrote to memory of 268 2000 SecuriteInfo.com.Trojan.Olock.1.14774.exe SecuriteInfo.com.Trojan.Olock.1.14774.exe PID 2000 wrote to memory of 1768 2000 SecuriteInfo.com.Trojan.Olock.1.14774.exe SecuriteInfo.com.Trojan.Olock.1.14774.exe PID 2000 wrote to memory of 1768 2000 SecuriteInfo.com.Trojan.Olock.1.14774.exe SecuriteInfo.com.Trojan.Olock.1.14774.exe PID 2000 wrote to memory of 1768 2000 SecuriteInfo.com.Trojan.Olock.1.14774.exe SecuriteInfo.com.Trojan.Olock.1.14774.exe PID 2000 wrote to memory of 1768 2000 SecuriteInfo.com.Trojan.Olock.1.14774.exe SecuriteInfo.com.Trojan.Olock.1.14774.exe PID 2000 wrote to memory of 1768 2000 SecuriteInfo.com.Trojan.Olock.1.14774.exe SecuriteInfo.com.Trojan.Olock.1.14774.exe PID 2000 wrote to memory of 1768 2000 SecuriteInfo.com.Trojan.Olock.1.14774.exe SecuriteInfo.com.Trojan.Olock.1.14774.exe PID 2000 wrote to memory of 1768 2000 SecuriteInfo.com.Trojan.Olock.1.14774.exe SecuriteInfo.com.Trojan.Olock.1.14774.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Olock.1.14774.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Olock.1.14774.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\PyTrPJPTfbb.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PyTrPJPTfbb" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC60E.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Olock.1.14774.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Olock.1.14774.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Olock.1.14774.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Olock.1.14774.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Olock.1.14774.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Olock.1.14774.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpC60E.tmpFilesize
1KB
MD5b578a451de3db2caebd399593bb77add
SHA1a518c5ad2c1fa164d3082c0bbefe5f1ab56f9382
SHA256db1267077f27b1bf9343487558109a0d2fd0cd8eab8c58d18a85b885b8892d27
SHA512779e7a575bcf17efffb21b383159116af731f034e094d8f50e3cd6530afcd56c3425f5216882e78dc93539222636f0d4cb9d29a641202fe2f43ced8be0186765
-
memory/1108-60-0x0000000000000000-mapping.dmp
-
memory/1320-72-0x000000006E640000-0x000000006EBEB000-memory.dmpFilesize
5.7MB
-
memory/1320-71-0x000000006E640000-0x000000006EBEB000-memory.dmpFilesize
5.7MB
-
memory/1320-59-0x0000000000000000-mapping.dmp
-
memory/1768-65-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1768-70-0x00000000009C0000-0x0000000000CC3000-memory.dmpFilesize
3.0MB
-
memory/1768-68-0x000000000041F1A0-mapping.dmp
-
memory/1768-67-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1768-64-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2000-58-0x0000000005E70000-0x0000000005EE4000-memory.dmpFilesize
464KB
-
memory/2000-63-0x00000000049D0000-0x0000000004A04000-memory.dmpFilesize
208KB
-
memory/2000-54-0x0000000000040000-0x000000000012E000-memory.dmpFilesize
952KB
-
memory/2000-69-0x0000000004F55000-0x0000000004F66000-memory.dmpFilesize
68KB
-
memory/2000-57-0x00000000005C0000-0x00000000005CC000-memory.dmpFilesize
48KB
-
memory/2000-56-0x0000000001E40000-0x0000000001E60000-memory.dmpFilesize
128KB
-
memory/2000-55-0x0000000076191000-0x0000000076193000-memory.dmpFilesize
8KB