Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-08-2022 19:06
Static task
static1
Behavioral task
behavioral1
Sample
HSBC_MT 103 COPY.pdf.exe
Resource
win7-20220812-en
General
-
Target
HSBC_MT 103 COPY.pdf.exe
-
Size
859KB
-
MD5
98df186174c94d00f0eed173263428ed
-
SHA1
4c5f773f3ed70d64b6a43866ef805027db4ec2e7
-
SHA256
756a40a8fc86bb54ff4ead8e9d9c173b3051f4d77a60530b471a7be752f8bad6
-
SHA512
51344f4807e696c62dbd6b4692358d4ce6941a494a0e4afc1f1a6a0b63581512e516c7520aabcc470a4ffc6310338a818d2f40d18586dd86e19896b4fb5ec869
-
SSDEEP
24576:GT/0shbH1oT/0shbOYAeqJTVaO225hukD5WKoCuY:M5M5AeqJTw25eCu
Malware Config
Extracted
formbook
4.1
ba17
bearwant.com
sdsguanfang.com
steamcommunityvia.top
sugarplumtreasures.com
koronislakefishing.com
jmae.xyz
xhxnqemkiqe.xyz
playzcrew.com
zatwsbq.com
lankofix.com
sh-zhepeng.com
mibodamisxv.online
butterflyjewelry.store
finestrecitalto-spottoday.info
globomateria.com
royalmdarts.com
d4af10836709.com
shepwill.com
67aldrich.info
trustedmakers.club
burdiezholdings.com
facialcoach.com
hunterous.com
carei.xyz
positivityintheworkplace.com
top1productjapan.online
camperrentnovara.com
nostalgiaz.xyz
prepperandsalt.com
platinum-swallow-nest.com
jmdadoag.com
cornerstonesolarconsulting.com
carmelhasit.com
hospitalaurelia.com
epolystars.com
best5psychicreadingsites.com
cbradleyowens.com
cmshelps.com
leclefsdor.com
male-muscle-slave.cloud
eselinchen.com
statesunitedaction.net
goweet.com
hififurniturehouse.info
alphacapitaltrust.online
hotsellmed.com
sunxueling.com
firstclass-poolservice.com
tuveranopelayo.com
wayangslot.net
joseauto.net
consinko.com
pacificoffshorecharters.com
steemboard.xyz
poollife.info
miraihenokoibumi.net
mfh-sa.com
seontra.xyz
openfaders.com
guardianz.online
purse.gold
affaire-chaba.com
rosency.xyz
somethingform.site
digitalpursuitsonline.com
Signatures
-
Formbook payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/992-67-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/992-68-0x000000000041F1E0-mapping.dmp formbook behavioral1/memory/992-70-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1052-79-0x0000000000080000-0x00000000000AF000-memory.dmp formbook behavioral1/memory/1052-83-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 768 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
HSBC_MT 103 COPY.pdf.exeHSBC_MT 103 COPY.pdf.exewlanext.exedescription pid process target process PID 1356 set thread context of 992 1356 HSBC_MT 103 COPY.pdf.exe HSBC_MT 103 COPY.pdf.exe PID 992 set thread context of 1232 992 HSBC_MT 103 COPY.pdf.exe Explorer.EXE PID 1052 set thread context of 1232 1052 wlanext.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
HSBC_MT 103 COPY.pdf.exeHSBC_MT 103 COPY.pdf.exepowershell.exewlanext.exepid process 1356 HSBC_MT 103 COPY.pdf.exe 1356 HSBC_MT 103 COPY.pdf.exe 1356 HSBC_MT 103 COPY.pdf.exe 1356 HSBC_MT 103 COPY.pdf.exe 1356 HSBC_MT 103 COPY.pdf.exe 1356 HSBC_MT 103 COPY.pdf.exe 1356 HSBC_MT 103 COPY.pdf.exe 1356 HSBC_MT 103 COPY.pdf.exe 1356 HSBC_MT 103 COPY.pdf.exe 992 HSBC_MT 103 COPY.pdf.exe 992 HSBC_MT 103 COPY.pdf.exe 1704 powershell.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
HSBC_MT 103 COPY.pdf.exewlanext.exepid process 992 HSBC_MT 103 COPY.pdf.exe 992 HSBC_MT 103 COPY.pdf.exe 992 HSBC_MT 103 COPY.pdf.exe 1052 wlanext.exe 1052 wlanext.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
HSBC_MT 103 COPY.pdf.exeHSBC_MT 103 COPY.pdf.exepowershell.exewlanext.exedescription pid process Token: SeDebugPrivilege 1356 HSBC_MT 103 COPY.pdf.exe Token: SeDebugPrivilege 992 HSBC_MT 103 COPY.pdf.exe Token: SeDebugPrivilege 1704 powershell.exe Token: SeDebugPrivilege 1052 wlanext.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1232 Explorer.EXE 1232 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1232 Explorer.EXE 1232 Explorer.EXE -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
HSBC_MT 103 COPY.pdf.exeExplorer.EXEwlanext.exedescription pid process target process PID 1356 wrote to memory of 1704 1356 HSBC_MT 103 COPY.pdf.exe powershell.exe PID 1356 wrote to memory of 1704 1356 HSBC_MT 103 COPY.pdf.exe powershell.exe PID 1356 wrote to memory of 1704 1356 HSBC_MT 103 COPY.pdf.exe powershell.exe PID 1356 wrote to memory of 1704 1356 HSBC_MT 103 COPY.pdf.exe powershell.exe PID 1356 wrote to memory of 1592 1356 HSBC_MT 103 COPY.pdf.exe schtasks.exe PID 1356 wrote to memory of 1592 1356 HSBC_MT 103 COPY.pdf.exe schtasks.exe PID 1356 wrote to memory of 1592 1356 HSBC_MT 103 COPY.pdf.exe schtasks.exe PID 1356 wrote to memory of 1592 1356 HSBC_MT 103 COPY.pdf.exe schtasks.exe PID 1356 wrote to memory of 992 1356 HSBC_MT 103 COPY.pdf.exe HSBC_MT 103 COPY.pdf.exe PID 1356 wrote to memory of 992 1356 HSBC_MT 103 COPY.pdf.exe HSBC_MT 103 COPY.pdf.exe PID 1356 wrote to memory of 992 1356 HSBC_MT 103 COPY.pdf.exe HSBC_MT 103 COPY.pdf.exe PID 1356 wrote to memory of 992 1356 HSBC_MT 103 COPY.pdf.exe HSBC_MT 103 COPY.pdf.exe PID 1356 wrote to memory of 992 1356 HSBC_MT 103 COPY.pdf.exe HSBC_MT 103 COPY.pdf.exe PID 1356 wrote to memory of 992 1356 HSBC_MT 103 COPY.pdf.exe HSBC_MT 103 COPY.pdf.exe PID 1356 wrote to memory of 992 1356 HSBC_MT 103 COPY.pdf.exe HSBC_MT 103 COPY.pdf.exe PID 1232 wrote to memory of 1052 1232 Explorer.EXE wlanext.exe PID 1232 wrote to memory of 1052 1232 Explorer.EXE wlanext.exe PID 1232 wrote to memory of 1052 1232 Explorer.EXE wlanext.exe PID 1232 wrote to memory of 1052 1232 Explorer.EXE wlanext.exe PID 1052 wrote to memory of 768 1052 wlanext.exe cmd.exe PID 1052 wrote to memory of 768 1052 wlanext.exe cmd.exe PID 1052 wrote to memory of 768 1052 wlanext.exe cmd.exe PID 1052 wrote to memory of 768 1052 wlanext.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\HSBC_MT 103 COPY.pdf.exe"C:\Users\Admin\AppData\Local\Temp\HSBC_MT 103 COPY.pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\hSeyTCuDxScTPG.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hSeyTCuDxScTPG" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE4C4.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\HSBC_MT 103 COPY.pdf.exe"C:\Users\Admin\AppData\Local\Temp\HSBC_MT 103 COPY.pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\HSBC_MT 103 COPY.pdf.exe"3⤵
- Deletes itself
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpE4C4.tmpFilesize
1KB
MD59542592a3475ad63d54dbd5c87df233c
SHA15dadc56b77e373d389add0a83b34abecb0962b0d
SHA256c2da26379842d076f65979cea63b502dc96d060f54ad82d4b0564295c35fb3ab
SHA51270d5c583854dcab52389903fdc9483bcc10a9cc1229699d6c2c59f544e29b5617f52db69b05dcaf3f62cc38036bf5401b3548841734b81202066c1f5dd5d44b6
-
memory/768-77-0x0000000000000000-mapping.dmp
-
memory/992-64-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/992-73-0x0000000000140000-0x0000000000155000-memory.dmpFilesize
84KB
-
memory/992-72-0x0000000000D90000-0x0000000001093000-memory.dmpFilesize
3.0MB
-
memory/992-70-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/992-68-0x000000000041F1E0-mapping.dmp
-
memory/992-67-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/992-65-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1052-78-0x0000000000B20000-0x0000000000B36000-memory.dmpFilesize
88KB
-
memory/1052-83-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/1052-81-0x00000000003B0000-0x0000000000444000-memory.dmpFilesize
592KB
-
memory/1052-80-0x00000000020D0000-0x00000000023D3000-memory.dmpFilesize
3.0MB
-
memory/1052-79-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/1052-76-0x0000000000000000-mapping.dmp
-
memory/1232-84-0x0000000003EC0000-0x0000000003F74000-memory.dmpFilesize
720KB
-
memory/1232-82-0x0000000003EC0000-0x0000000003F74000-memory.dmpFilesize
720KB
-
memory/1232-74-0x0000000004790000-0x00000000048FD000-memory.dmpFilesize
1.4MB
-
memory/1356-58-0x0000000007DB0000-0x0000000007E34000-memory.dmpFilesize
528KB
-
memory/1356-56-0x0000000000290000-0x00000000002AA000-memory.dmpFilesize
104KB
-
memory/1356-55-0x0000000076711000-0x0000000076713000-memory.dmpFilesize
8KB
-
memory/1356-54-0x0000000000CB0000-0x0000000000D8E000-memory.dmpFilesize
888KB
-
memory/1356-57-0x0000000000590000-0x000000000059C000-memory.dmpFilesize
48KB
-
memory/1356-63-0x0000000002280000-0x00000000022B4000-memory.dmpFilesize
208KB
-
memory/1592-60-0x0000000000000000-mapping.dmp
-
memory/1704-71-0x000000006F150000-0x000000006F6FB000-memory.dmpFilesize
5.7MB
-
memory/1704-75-0x000000006F150000-0x000000006F6FB000-memory.dmpFilesize
5.7MB
-
memory/1704-59-0x0000000000000000-mapping.dmp