Analysis
-
max time kernel
147s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
24-08-2022 10:27
Static task
static1
Behavioral task
behavioral1
Sample
AHMR 4036.exe
Resource
win7-20220812-en
General
-
Target
AHMR 4036.exe
-
Size
1.2MB
-
MD5
086de2ec9b8b5c723d127cbfe35b6d75
-
SHA1
ed87e00093c8051207c91eaeea7b403a120c1202
-
SHA256
6452e7934b058662751322258e57f91a8790ab089a93b17062646080e31ea24a
-
SHA512
2cc91c9d4548d5ba0a03a958caf266563001fda2a5752fa7c65ad7d650ff0fcd1723a5197482466a472f487f58422f620c99d1877568c0548c83f18f05fa0fa0
-
SSDEEP
24576:S1tTG+YvcFi95eunG2SpnfZ/ykidrl0S3kREYV49Nt:AtTmcFi9ijpnfhyFdTPq49r
Malware Config
Extracted
formbook
4.1
ba17
bearwant.com
sdsguanfang.com
steamcommunityvia.top
sugarplumtreasures.com
koronislakefishing.com
jmae.xyz
xhxnqemkiqe.xyz
playzcrew.com
zatwsbq.com
lankofix.com
sh-zhepeng.com
mibodamisxv.online
butterflyjewelry.store
finestrecitalto-spottoday.info
globomateria.com
royalmdarts.com
d4af10836709.com
shepwill.com
67aldrich.info
trustedmakers.club
burdiezholdings.com
facialcoach.com
hunterous.com
carei.xyz
positivityintheworkplace.com
top1productjapan.online
camperrentnovara.com
nostalgiaz.xyz
prepperandsalt.com
platinum-swallow-nest.com
jmdadoag.com
cornerstonesolarconsulting.com
carmelhasit.com
hospitalaurelia.com
epolystars.com
best5psychicreadingsites.com
cbradleyowens.com
cmshelps.com
leclefsdor.com
male-muscle-slave.cloud
eselinchen.com
statesunitedaction.net
goweet.com
hififurniturehouse.info
alphacapitaltrust.online
hotsellmed.com
sunxueling.com
firstclass-poolservice.com
tuveranopelayo.com
wayangslot.net
joseauto.net
consinko.com
pacificoffshorecharters.com
steemboard.xyz
poollife.info
miraihenokoibumi.net
mfh-sa.com
seontra.xyz
openfaders.com
guardianz.online
purse.gold
affaire-chaba.com
rosency.xyz
somethingform.site
digitalpursuitsonline.com
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3432-142-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3432-160-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4812-165-0x0000000000540000-0x000000000056F000-memory.dmp formbook behavioral2/memory/4812-168-0x0000000000540000-0x000000000056F000-memory.dmp formbook -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
AHMR 4036.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation AHMR 4036.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
AHMR 4036.exeRegSvcs.exenetsh.exedescription pid process target process PID 1548 set thread context of 3432 1548 AHMR 4036.exe RegSvcs.exe PID 3432 set thread context of 3060 3432 RegSvcs.exe Explorer.EXE PID 4812 set thread context of 3060 4812 netsh.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 45 IoCs
Processes:
AHMR 4036.exepowershell.exeRegSvcs.exenetsh.exepid process 1548 AHMR 4036.exe 1548 AHMR 4036.exe 3344 powershell.exe 3432 RegSvcs.exe 3432 RegSvcs.exe 3344 powershell.exe 3432 RegSvcs.exe 3432 RegSvcs.exe 4812 netsh.exe 4812 netsh.exe 4812 netsh.exe 4812 netsh.exe 4812 netsh.exe 4812 netsh.exe 4812 netsh.exe 4812 netsh.exe 4812 netsh.exe 4812 netsh.exe 4812 netsh.exe 4812 netsh.exe 4812 netsh.exe 4812 netsh.exe 4812 netsh.exe 4812 netsh.exe 4812 netsh.exe 4812 netsh.exe 4812 netsh.exe 4812 netsh.exe 4812 netsh.exe 4812 netsh.exe 4812 netsh.exe 4812 netsh.exe 4812 netsh.exe 4812 netsh.exe 4812 netsh.exe 4812 netsh.exe 4812 netsh.exe 4812 netsh.exe 4812 netsh.exe 4812 netsh.exe 4812 netsh.exe 4812 netsh.exe 4812 netsh.exe 4812 netsh.exe 4812 netsh.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3060 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.exenetsh.exepid process 3432 RegSvcs.exe 3432 RegSvcs.exe 3432 RegSvcs.exe 4812 netsh.exe 4812 netsh.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
AHMR 4036.exepowershell.exeRegSvcs.exenetsh.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1548 AHMR 4036.exe Token: SeDebugPrivilege 3344 powershell.exe Token: SeDebugPrivilege 3432 RegSvcs.exe Token: SeDebugPrivilege 4812 netsh.exe Token: SeShutdownPrivilege 3060 Explorer.EXE Token: SeCreatePagefilePrivilege 3060 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
AHMR 4036.exeExplorer.EXEnetsh.exedescription pid process target process PID 1548 wrote to memory of 3344 1548 AHMR 4036.exe powershell.exe PID 1548 wrote to memory of 3344 1548 AHMR 4036.exe powershell.exe PID 1548 wrote to memory of 3344 1548 AHMR 4036.exe powershell.exe PID 1548 wrote to memory of 2400 1548 AHMR 4036.exe schtasks.exe PID 1548 wrote to memory of 2400 1548 AHMR 4036.exe schtasks.exe PID 1548 wrote to memory of 2400 1548 AHMR 4036.exe schtasks.exe PID 1548 wrote to memory of 3432 1548 AHMR 4036.exe RegSvcs.exe PID 1548 wrote to memory of 3432 1548 AHMR 4036.exe RegSvcs.exe PID 1548 wrote to memory of 3432 1548 AHMR 4036.exe RegSvcs.exe PID 1548 wrote to memory of 3432 1548 AHMR 4036.exe RegSvcs.exe PID 1548 wrote to memory of 3432 1548 AHMR 4036.exe RegSvcs.exe PID 1548 wrote to memory of 3432 1548 AHMR 4036.exe RegSvcs.exe PID 3060 wrote to memory of 4812 3060 Explorer.EXE netsh.exe PID 3060 wrote to memory of 4812 3060 Explorer.EXE netsh.exe PID 3060 wrote to memory of 4812 3060 Explorer.EXE netsh.exe PID 4812 wrote to memory of 2540 4812 netsh.exe cmd.exe PID 4812 wrote to memory of 2540 4812 netsh.exe cmd.exe PID 4812 wrote to memory of 2540 4812 netsh.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AHMR 4036.exe"C:\Users\Admin\AppData\Local\Temp\AHMR 4036.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\tbURtOkVgPTCd.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tbURtOkVgPTCd" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4AF3.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp4AF3.tmpFilesize
1KB
MD5374008802a60918fa78304109fb22347
SHA11ce55bc5ff85236a3fdc0cc8b310783656cb2fef
SHA256e4c57180978d99a10f17582cb5f64726e2c3d37e7dfb7eece37b64fc44735a26
SHA5126687ad0602539b526f9e4d473db116f3d5158df3f8e0c5e47dae5a55c04b066bf20853014cffc889ac235b0d9d0672d38f09d3e9681e68e05a3ecd882b948c4b
-
memory/1548-133-0x0000000007A90000-0x0000000008034000-memory.dmpFilesize
5.6MB
-
memory/1548-134-0x0000000007580000-0x0000000007612000-memory.dmpFilesize
584KB
-
memory/1548-135-0x0000000007550000-0x000000000755A000-memory.dmpFilesize
40KB
-
memory/1548-136-0x000000000AE40000-0x000000000AEDC000-memory.dmpFilesize
624KB
-
memory/1548-132-0x0000000000590000-0x00000000006C2000-memory.dmpFilesize
1.2MB
-
memory/2400-138-0x0000000000000000-mapping.dmp
-
memory/2540-166-0x0000000000000000-mapping.dmp
-
memory/3060-171-0x0000000002BE0000-0x0000000002D43000-memory.dmpFilesize
1.4MB
-
memory/3060-151-0x00000000027E0000-0x000000000289C000-memory.dmpFilesize
752KB
-
memory/3060-170-0x0000000002BE0000-0x0000000002D43000-memory.dmpFilesize
1.4MB
-
memory/3344-146-0x0000000005FF0000-0x0000000006056000-memory.dmpFilesize
408KB
-
memory/3344-153-0x0000000071210000-0x000000007125C000-memory.dmpFilesize
304KB
-
memory/3344-145-0x0000000005F10000-0x0000000005F76000-memory.dmpFilesize
408KB
-
memory/3344-161-0x0000000007AF0000-0x0000000007AFE000-memory.dmpFilesize
56KB
-
memory/3344-148-0x00000000065B0000-0x00000000065CE000-memory.dmpFilesize
120KB
-
memory/3344-143-0x00000000057F0000-0x0000000005E18000-memory.dmpFilesize
6.2MB
-
memory/3344-167-0x0000000007BE0000-0x0000000007BE8000-memory.dmpFilesize
32KB
-
memory/3344-139-0x0000000002C90000-0x0000000002CC6000-memory.dmpFilesize
216KB
-
memory/3344-152-0x0000000007580000-0x00000000075B2000-memory.dmpFilesize
200KB
-
memory/3344-144-0x0000000005710000-0x0000000005732000-memory.dmpFilesize
136KB
-
memory/3344-154-0x0000000006B60000-0x0000000006B7E000-memory.dmpFilesize
120KB
-
memory/3344-155-0x0000000007FE0000-0x000000000865A000-memory.dmpFilesize
6.5MB
-
memory/3344-156-0x00000000076B0000-0x00000000076CA000-memory.dmpFilesize
104KB
-
memory/3344-157-0x0000000007720000-0x000000000772A000-memory.dmpFilesize
40KB
-
memory/3344-158-0x0000000007B40000-0x0000000007BD6000-memory.dmpFilesize
600KB
-
memory/3344-137-0x0000000000000000-mapping.dmp
-
memory/3344-162-0x0000000007C00000-0x0000000007C1A000-memory.dmpFilesize
104KB
-
memory/3432-141-0x0000000000000000-mapping.dmp
-
memory/3432-160-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3432-150-0x0000000000F80000-0x0000000000F95000-memory.dmpFilesize
84KB
-
memory/3432-149-0x0000000001070000-0x00000000013BA000-memory.dmpFilesize
3.3MB
-
memory/3432-142-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4812-163-0x0000000001160000-0x00000000014AA000-memory.dmpFilesize
3.3MB
-
memory/4812-164-0x0000000001680000-0x000000000169E000-memory.dmpFilesize
120KB
-
memory/4812-159-0x0000000000000000-mapping.dmp
-
memory/4812-165-0x0000000000540000-0x000000000056F000-memory.dmpFilesize
188KB
-
memory/4812-168-0x0000000000540000-0x000000000056F000-memory.dmpFilesize
188KB
-
memory/4812-169-0x0000000000F90000-0x0000000001024000-memory.dmpFilesize
592KB