Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
08-08-2022 07:31
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.Olock.1.14774.exe
Resource
win7-20220715-en
General
-
Target
SecuriteInfo.com.Trojan.Olock.1.14774.exe
-
Size
931KB
-
MD5
0aa59b2e00f1b996715e4ad669a1135c
-
SHA1
35663dc7ec41b279993ee233e1592c851d4fb6a7
-
SHA256
9cbdbe876e2abf4c3140f516164d1f2c68f15d10b4c17725249182c50be6d32d
-
SHA512
190b0b1dec2576116a6d3544bda892646f1e694db6dbc09e0582b00be672cafaa85219425f6295b83af449046a133d7acc91621792e38e6534d76601b444886b
Malware Config
Extracted
formbook
4.1
d27e
lilysbusride.com
cloud-sechs.com
danpro.co.uk
wendoortech.com
playgroundrebellion.com
betventures.xyz
digimediasolution.net
abrahambetrayedus.com
whinefree.com
realeurolicence.com
makelovetrip.com
damediaagency.com
pinaralsan.com
5bobitw.com
shootingkarelia.online
website-staging.pro
manassadhvi.online
bathroomandkitcenking.com
realtormarket.net
dfysupport.com
class-flow.com
migstrip.online
qnacontracting.com
namaste-events.com
yestifications.com
indigoartandclothing.com
resultedu.com
digitalworldp.com
phase7assured.com
hirejar.site
leadstosuccessdental.com
ebooksonline4u.com
prosperbags.com
binarytreetech.com
jenpetronellatattoos.com
purpleduckdesign.net
merceriasen.xyz
shinnadesign.online
perubahantariftransaksi.website
jhanca.site
tacoslawera.com
majorappliancepros.com
kemiandsalam22.com
skipperage.info
tabulose-lust.xyz
wahproducts.com
mcleod.top
acepaintingservice.com
longtaidazong.com
spit2dabeat.com
jthecreator.net
sanhelu00.top
ipcemea.info
uniofilm.com
kitchenbw.space
abiccreats.com
southamptonvac.com
zavodalabda.xyz
mahahills.com
careers01-cxeinc.com
betteryourfinancial.info
buyfarfalla.com
moesoldmine.com
sioreu.com
havehealthybloodsugar.com
Signatures
-
Formbook payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/5076-142-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
SecuriteInfo.com.Trojan.Olock.1.14774.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Control Panel\International\Geo\Nation SecuriteInfo.com.Trojan.Olock.1.14774.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SecuriteInfo.com.Trojan.Olock.1.14774.exedescription pid process target process PID 536 set thread context of 5076 536 SecuriteInfo.com.Trojan.Olock.1.14774.exe SecuriteInfo.com.Trojan.Olock.1.14774.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exeSecuriteInfo.com.Trojan.Olock.1.14774.exepid process 1744 powershell.exe 5076 SecuriteInfo.com.Trojan.Olock.1.14774.exe 5076 SecuriteInfo.com.Trojan.Olock.1.14774.exe 1744 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1744 powershell.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
SecuriteInfo.com.Trojan.Olock.1.14774.exepid process 536 SecuriteInfo.com.Trojan.Olock.1.14774.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
SecuriteInfo.com.Trojan.Olock.1.14774.exepid process 536 SecuriteInfo.com.Trojan.Olock.1.14774.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
SecuriteInfo.com.Trojan.Olock.1.14774.exedescription pid process target process PID 536 wrote to memory of 1744 536 SecuriteInfo.com.Trojan.Olock.1.14774.exe powershell.exe PID 536 wrote to memory of 1744 536 SecuriteInfo.com.Trojan.Olock.1.14774.exe powershell.exe PID 536 wrote to memory of 1744 536 SecuriteInfo.com.Trojan.Olock.1.14774.exe powershell.exe PID 536 wrote to memory of 2992 536 SecuriteInfo.com.Trojan.Olock.1.14774.exe schtasks.exe PID 536 wrote to memory of 2992 536 SecuriteInfo.com.Trojan.Olock.1.14774.exe schtasks.exe PID 536 wrote to memory of 2992 536 SecuriteInfo.com.Trojan.Olock.1.14774.exe schtasks.exe PID 536 wrote to memory of 5076 536 SecuriteInfo.com.Trojan.Olock.1.14774.exe SecuriteInfo.com.Trojan.Olock.1.14774.exe PID 536 wrote to memory of 5076 536 SecuriteInfo.com.Trojan.Olock.1.14774.exe SecuriteInfo.com.Trojan.Olock.1.14774.exe PID 536 wrote to memory of 5076 536 SecuriteInfo.com.Trojan.Olock.1.14774.exe SecuriteInfo.com.Trojan.Olock.1.14774.exe PID 536 wrote to memory of 5076 536 SecuriteInfo.com.Trojan.Olock.1.14774.exe SecuriteInfo.com.Trojan.Olock.1.14774.exe PID 536 wrote to memory of 5076 536 SecuriteInfo.com.Trojan.Olock.1.14774.exe SecuriteInfo.com.Trojan.Olock.1.14774.exe PID 536 wrote to memory of 5076 536 SecuriteInfo.com.Trojan.Olock.1.14774.exe SecuriteInfo.com.Trojan.Olock.1.14774.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Olock.1.14774.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Olock.1.14774.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\PyTrPJPTfbb.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PyTrPJPTfbb" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2F8C.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Olock.1.14774.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Olock.1.14774.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp2F8C.tmpFilesize
1KB
MD5161ceb63f94ede27c088ec70453c18b6
SHA18120a48129646b297d7d53a6fab4a14cc390dc72
SHA256b1e3c105d8180485ff06eaefe4a73ab8737f8ddea4fd87077f398d54ad3c68c2
SHA51294f2f7dbbf41a00e575ebf04d36dba510ce6400a3565e8331d8d8ddc200a61bfb6f37488e2a00ee80583bf5e63abcb11c184c5bf15b36174d38c53db164c037c
-
memory/536-131-0x0000000005B60000-0x0000000006104000-memory.dmpFilesize
5.6MB
-
memory/536-132-0x0000000005670000-0x0000000005702000-memory.dmpFilesize
584KB
-
memory/536-133-0x0000000005810000-0x000000000581A000-memory.dmpFilesize
40KB
-
memory/536-134-0x00000000090A0000-0x000000000913C000-memory.dmpFilesize
624KB
-
memory/536-135-0x00000000091E0000-0x0000000009246000-memory.dmpFilesize
408KB
-
memory/536-130-0x0000000000BE0000-0x0000000000CCE000-memory.dmpFilesize
952KB
-
memory/1744-141-0x0000000004F40000-0x0000000005568000-memory.dmpFilesize
6.2MB
-
memory/1744-146-0x0000000005C80000-0x0000000005C9E000-memory.dmpFilesize
120KB
-
memory/1744-156-0x00000000072B0000-0x00000000072B8000-memory.dmpFilesize
32KB
-
memory/1744-155-0x00000000072D0000-0x00000000072EA000-memory.dmpFilesize
104KB
-
memory/1744-154-0x00000000071C0000-0x00000000071CE000-memory.dmpFilesize
56KB
-
memory/1744-136-0x0000000000000000-mapping.dmp
-
memory/1744-143-0x0000000004CE0000-0x0000000004D02000-memory.dmpFilesize
136KB
-
memory/1744-144-0x00000000055E0000-0x0000000005646000-memory.dmpFilesize
408KB
-
memory/1744-153-0x0000000007210000-0x00000000072A6000-memory.dmpFilesize
600KB
-
memory/1744-138-0x0000000002350000-0x0000000002386000-memory.dmpFilesize
216KB
-
memory/1744-147-0x0000000006250000-0x0000000006282000-memory.dmpFilesize
200KB
-
memory/1744-148-0x0000000070EE0000-0x0000000070F2C000-memory.dmpFilesize
304KB
-
memory/1744-149-0x0000000006210000-0x000000000622E000-memory.dmpFilesize
120KB
-
memory/1744-150-0x0000000007630000-0x0000000007CAA000-memory.dmpFilesize
6.5MB
-
memory/1744-151-0x0000000006FB0000-0x0000000006FCA000-memory.dmpFilesize
104KB
-
memory/1744-152-0x0000000007000000-0x000000000700A000-memory.dmpFilesize
40KB
-
memory/2992-137-0x0000000000000000-mapping.dmp
-
memory/5076-145-0x0000000001100000-0x000000000144A000-memory.dmpFilesize
3.3MB
-
memory/5076-140-0x0000000000000000-mapping.dmp
-
memory/5076-142-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB