Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
12-08-2022 20:34
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.W32.AIDetectNet.01.10877.exe
Resource
win7-20220812-en
General
-
Target
SecuriteInfo.com.W32.AIDetectNet.01.10877.exe
-
Size
919KB
-
MD5
78cce3c1d0cadadd8be8fe9022be5f44
-
SHA1
dd881fdfca2d2dd2a466e49f46811c38a1172327
-
SHA256
6de750cf7e7a9f7a3fced7712ebde1360102bf175362c71e3f304d01eaa59e30
-
SHA512
f2dec41a90a0b52e1354cd75daca5fd7f614c78b8f7a57762548f24ef5ebd78dace3c915307e06ea5d133a3301d12bbf898aec850eb041d8d421c5aa15971a69
Malware Config
Extracted
formbook
4.1
de08
retirecloudyyard.com
fabiyan.xyz
chrisarlyde.com
selapex.com
vivalosgales.com
specialty-medicine.com
contasesolucoes.com
satunusanews.net
allyibc.com
alameda1876.com
artofdala.com
yukoidusp.xyz
steeldrumbandnearme.com
stonewedgetechnology.com
kentonai.com
macquarie-private.com
ddgwy.com
megagreenhousekits.com
descomplicaomarketing.com
inclusiverealtor.com
themummyfront.club
computerfashiondesigns.com
ericparlatore.com
whathappened2me.com
baksomail.xyz
mugupplatform.com
shopsolutely.com
gymcservices.com
qianshunchina.com
zoomsbshab.icu
esrmtech.com
966211.com
stockinsidepr.com
df-wh.com
smartshopapps.com
kayseriadsl.com
acedesserts.com
205qs.com
ei8i.com
aibtly.com
kpviewllc.net
nnehandebol.com
torontonianapparel.ca
therealgoldenganjagang.com
mingxiang99.com
rewkagcompany.xyz
ahmee4.com
valen.info
vacuumfun.parts
fabiyan.xyz
psncareersolutions.com
escobargroups.com
michigandice.com
ey3solutions.com
li-n.info
puingkehancuran.xyz
bilt-green.com
dfysuitetech.xyz
abdoomar.com
actsaka.xyz
justsweatitout.com
axabank.life
billyyaka.com
mypatchtools.com
epulsive.com
Signatures
-
Formbook payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1316-71-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1316-72-0x000000000041F120-mapping.dmp formbook behavioral1/memory/1316-79-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1316-83-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/960-86-0x0000000000190000-0x00000000001BF000-memory.dmp formbook behavioral1/memory/960-90-0x0000000000190000-0x00000000001BF000-memory.dmp formbook -
Suspicious use of SetThreadContext 4 IoCs
Processes:
SecuriteInfo.com.W32.AIDetectNet.01.10877.exeRegSvcs.execmd.exedescription pid process target process PID 2044 set thread context of 1316 2044 SecuriteInfo.com.W32.AIDetectNet.01.10877.exe RegSvcs.exe PID 1316 set thread context of 1192 1316 RegSvcs.exe Explorer.EXE PID 1316 set thread context of 1192 1316 RegSvcs.exe Explorer.EXE PID 960 set thread context of 1192 960 cmd.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 19 IoCs
Processes:
RegSvcs.exepowershell.execmd.exepid process 1316 RegSvcs.exe 1316 RegSvcs.exe 1460 powershell.exe 1316 RegSvcs.exe 960 cmd.exe 960 cmd.exe 960 cmd.exe 960 cmd.exe 960 cmd.exe 960 cmd.exe 960 cmd.exe 960 cmd.exe 960 cmd.exe 960 cmd.exe 960 cmd.exe 960 cmd.exe 960 cmd.exe 960 cmd.exe 960 cmd.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
RegSvcs.execmd.exepid process 1316 RegSvcs.exe 1316 RegSvcs.exe 1316 RegSvcs.exe 1316 RegSvcs.exe 960 cmd.exe 960 cmd.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
RegSvcs.exepowershell.execmd.exedescription pid process Token: SeDebugPrivilege 1316 RegSvcs.exe Token: SeDebugPrivilege 1460 powershell.exe Token: SeDebugPrivilege 960 cmd.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1192 Explorer.EXE 1192 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1192 Explorer.EXE 1192 Explorer.EXE -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
SecuriteInfo.com.W32.AIDetectNet.01.10877.exeRegSvcs.execmd.exedescription pid process target process PID 2044 wrote to memory of 1460 2044 SecuriteInfo.com.W32.AIDetectNet.01.10877.exe powershell.exe PID 2044 wrote to memory of 1460 2044 SecuriteInfo.com.W32.AIDetectNet.01.10877.exe powershell.exe PID 2044 wrote to memory of 1460 2044 SecuriteInfo.com.W32.AIDetectNet.01.10877.exe powershell.exe PID 2044 wrote to memory of 1460 2044 SecuriteInfo.com.W32.AIDetectNet.01.10877.exe powershell.exe PID 2044 wrote to memory of 1556 2044 SecuriteInfo.com.W32.AIDetectNet.01.10877.exe schtasks.exe PID 2044 wrote to memory of 1556 2044 SecuriteInfo.com.W32.AIDetectNet.01.10877.exe schtasks.exe PID 2044 wrote to memory of 1556 2044 SecuriteInfo.com.W32.AIDetectNet.01.10877.exe schtasks.exe PID 2044 wrote to memory of 1556 2044 SecuriteInfo.com.W32.AIDetectNet.01.10877.exe schtasks.exe PID 2044 wrote to memory of 1316 2044 SecuriteInfo.com.W32.AIDetectNet.01.10877.exe RegSvcs.exe PID 2044 wrote to memory of 1316 2044 SecuriteInfo.com.W32.AIDetectNet.01.10877.exe RegSvcs.exe PID 2044 wrote to memory of 1316 2044 SecuriteInfo.com.W32.AIDetectNet.01.10877.exe RegSvcs.exe PID 2044 wrote to memory of 1316 2044 SecuriteInfo.com.W32.AIDetectNet.01.10877.exe RegSvcs.exe PID 2044 wrote to memory of 1316 2044 SecuriteInfo.com.W32.AIDetectNet.01.10877.exe RegSvcs.exe PID 2044 wrote to memory of 1316 2044 SecuriteInfo.com.W32.AIDetectNet.01.10877.exe RegSvcs.exe PID 2044 wrote to memory of 1316 2044 SecuriteInfo.com.W32.AIDetectNet.01.10877.exe RegSvcs.exe PID 2044 wrote to memory of 1316 2044 SecuriteInfo.com.W32.AIDetectNet.01.10877.exe RegSvcs.exe PID 2044 wrote to memory of 1316 2044 SecuriteInfo.com.W32.AIDetectNet.01.10877.exe RegSvcs.exe PID 2044 wrote to memory of 1316 2044 SecuriteInfo.com.W32.AIDetectNet.01.10877.exe RegSvcs.exe PID 1316 wrote to memory of 960 1316 RegSvcs.exe cmd.exe PID 1316 wrote to memory of 960 1316 RegSvcs.exe cmd.exe PID 1316 wrote to memory of 960 1316 RegSvcs.exe cmd.exe PID 1316 wrote to memory of 960 1316 RegSvcs.exe cmd.exe PID 960 wrote to memory of 1348 960 cmd.exe cmd.exe PID 960 wrote to memory of 1348 960 cmd.exe cmd.exe PID 960 wrote to memory of 1348 960 cmd.exe cmd.exe PID 960 wrote to memory of 1348 960 cmd.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.10877.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.10877.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\jQQlGgDoQsDzy.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jQQlGgDoQsDzy" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE216.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpE216.tmpFilesize
1KB
MD5093ef6a64f4d08617f52341734cee073
SHA17c48ea7478d0f94da7a00521d12272462c50b80f
SHA256b5eece50f1455e028bcc1302cdddafbfa7d9de794855c20e2b7e43621352c517
SHA5124ceabec90ee458b9dc686e0508495a1ad7b296213dcd17fa9474efc86adf82600a6cf59a5c25a9d71ca6caafa239d084729bd25230e4f90573319284d917b280
-
memory/960-90-0x0000000000190000-0x00000000001BF000-memory.dmpFilesize
188KB
-
memory/960-88-0x0000000001DF0000-0x0000000001E83000-memory.dmpFilesize
588KB
-
memory/960-87-0x0000000001F60000-0x0000000002263000-memory.dmpFilesize
3.0MB
-
memory/960-86-0x0000000000190000-0x00000000001BF000-memory.dmpFilesize
188KB
-
memory/960-85-0x000000004A650000-0x000000004A69C000-memory.dmpFilesize
304KB
-
memory/960-82-0x0000000000000000-mapping.dmp
-
memory/1192-91-0x0000000004BA0000-0x0000000004C75000-memory.dmpFilesize
852KB
-
memory/1192-89-0x0000000004BA0000-0x0000000004C75000-memory.dmpFilesize
852KB
-
memory/1192-81-0x0000000004DF0000-0x0000000004F33000-memory.dmpFilesize
1.3MB
-
memory/1192-78-0x0000000002AA0000-0x0000000002B79000-memory.dmpFilesize
868KB
-
memory/1316-72-0x000000000041F120-mapping.dmp
-
memory/1316-77-0x0000000000290000-0x00000000002A4000-memory.dmpFilesize
80KB
-
memory/1316-68-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1316-69-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1316-71-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1316-83-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1316-80-0x00000000002F0000-0x0000000000304000-memory.dmpFilesize
80KB
-
memory/1316-79-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1316-76-0x0000000000910000-0x0000000000C13000-memory.dmpFilesize
3.0MB
-
memory/1348-84-0x0000000000000000-mapping.dmp
-
memory/1460-75-0x000000006F010000-0x000000006F5BB000-memory.dmpFilesize
5.7MB
-
memory/1460-73-0x000000006F010000-0x000000006F5BB000-memory.dmpFilesize
5.7MB
-
memory/1460-63-0x0000000000000000-mapping.dmp
-
memory/1556-64-0x0000000000000000-mapping.dmp
-
memory/2044-67-0x0000000005B00000-0x0000000005B34000-memory.dmpFilesize
208KB
-
memory/2044-54-0x0000000000130000-0x000000000021C000-memory.dmpFilesize
944KB
-
memory/2044-62-0x0000000005100000-0x0000000005174000-memory.dmpFilesize
464KB
-
memory/2044-61-0x0000000001F80000-0x0000000001F8C000-memory.dmpFilesize
48KB
-
memory/2044-60-0x00000000022B0000-0x00000000022D4000-memory.dmpFilesize
144KB
-
memory/2044-59-0x0000000002270000-0x0000000002294000-memory.dmpFilesize
144KB
-
memory/2044-58-0x00000000020B0000-0x00000000020D4000-memory.dmpFilesize
144KB
-
memory/2044-57-0x00000000007E0000-0x0000000000804000-memory.dmpFilesize
144KB
-
memory/2044-56-0x0000000000610000-0x0000000000634000-memory.dmpFilesize
144KB
-
memory/2044-55-0x0000000076761000-0x0000000076763000-memory.dmpFilesize
8KB