Analysis
-
max time kernel
186s -
max time network
187s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-08-2022 19:06
Static task
static1
Behavioral task
behavioral1
Sample
HSBC_MT 103 COPY.pdf.exe
Resource
win7-20220812-en
General
-
Target
HSBC_MT 103 COPY.pdf.exe
-
Size
859KB
-
MD5
98df186174c94d00f0eed173263428ed
-
SHA1
4c5f773f3ed70d64b6a43866ef805027db4ec2e7
-
SHA256
756a40a8fc86bb54ff4ead8e9d9c173b3051f4d77a60530b471a7be752f8bad6
-
SHA512
51344f4807e696c62dbd6b4692358d4ce6941a494a0e4afc1f1a6a0b63581512e516c7520aabcc470a4ffc6310338a818d2f40d18586dd86e19896b4fb5ec869
-
SSDEEP
24576:GT/0shbH1oT/0shbOYAeqJTVaO225hukD5WKoCuY:M5M5AeqJTw25eCu
Malware Config
Extracted
formbook
4.1
ba17
bearwant.com
sdsguanfang.com
steamcommunityvia.top
sugarplumtreasures.com
koronislakefishing.com
jmae.xyz
xhxnqemkiqe.xyz
playzcrew.com
zatwsbq.com
lankofix.com
sh-zhepeng.com
mibodamisxv.online
butterflyjewelry.store
finestrecitalto-spottoday.info
globomateria.com
royalmdarts.com
d4af10836709.com
shepwill.com
67aldrich.info
trustedmakers.club
burdiezholdings.com
facialcoach.com
hunterous.com
carei.xyz
positivityintheworkplace.com
top1productjapan.online
camperrentnovara.com
nostalgiaz.xyz
prepperandsalt.com
platinum-swallow-nest.com
jmdadoag.com
cornerstonesolarconsulting.com
carmelhasit.com
hospitalaurelia.com
epolystars.com
best5psychicreadingsites.com
cbradleyowens.com
cmshelps.com
leclefsdor.com
male-muscle-slave.cloud
eselinchen.com
statesunitedaction.net
goweet.com
hififurniturehouse.info
alphacapitaltrust.online
hotsellmed.com
sunxueling.com
firstclass-poolservice.com
tuveranopelayo.com
wayangslot.net
joseauto.net
consinko.com
pacificoffshorecharters.com
steemboard.xyz
poollife.info
miraihenokoibumi.net
mfh-sa.com
seontra.xyz
openfaders.com
guardianz.online
purse.gold
affaire-chaba.com
rosency.xyz
somethingform.site
digitalpursuitsonline.com
Signatures
-
Formbook payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3680-146-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3680-153-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1844-157-0x0000000000F20000-0x0000000000F4F000-memory.dmp formbook -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
HSBC_MT 103 COPY.pdf.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation HSBC_MT 103 COPY.pdf.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
HSBC_MT 103 COPY.pdf.exeHSBC_MT 103 COPY.pdf.execmd.exedescription pid process target process PID 4016 set thread context of 3680 4016 HSBC_MT 103 COPY.pdf.exe HSBC_MT 103 COPY.pdf.exe PID 3680 set thread context of 2740 3680 HSBC_MT 103 COPY.pdf.exe Explorer.EXE PID 1844 set thread context of 2740 1844 cmd.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 40 IoCs
Processes:
HSBC_MT 103 COPY.pdf.exepowershell.exeHSBC_MT 103 COPY.pdf.execmd.exepid process 4016 HSBC_MT 103 COPY.pdf.exe 4016 HSBC_MT 103 COPY.pdf.exe 4016 HSBC_MT 103 COPY.pdf.exe 4016 HSBC_MT 103 COPY.pdf.exe 4016 HSBC_MT 103 COPY.pdf.exe 3456 powershell.exe 4016 HSBC_MT 103 COPY.pdf.exe 3680 HSBC_MT 103 COPY.pdf.exe 3680 HSBC_MT 103 COPY.pdf.exe 3680 HSBC_MT 103 COPY.pdf.exe 3680 HSBC_MT 103 COPY.pdf.exe 3456 powershell.exe 1844 cmd.exe 1844 cmd.exe 1844 cmd.exe 1844 cmd.exe 1844 cmd.exe 1844 cmd.exe 1844 cmd.exe 1844 cmd.exe 1844 cmd.exe 1844 cmd.exe 1844 cmd.exe 1844 cmd.exe 1844 cmd.exe 1844 cmd.exe 1844 cmd.exe 1844 cmd.exe 1844 cmd.exe 1844 cmd.exe 1844 cmd.exe 1844 cmd.exe 1844 cmd.exe 1844 cmd.exe 1844 cmd.exe 1844 cmd.exe 1844 cmd.exe 1844 cmd.exe 1844 cmd.exe 1844 cmd.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2740 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
HSBC_MT 103 COPY.pdf.execmd.exepid process 3680 HSBC_MT 103 COPY.pdf.exe 3680 HSBC_MT 103 COPY.pdf.exe 3680 HSBC_MT 103 COPY.pdf.exe 1844 cmd.exe 1844 cmd.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
HSBC_MT 103 COPY.pdf.exepowershell.exeHSBC_MT 103 COPY.pdf.execmd.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 4016 HSBC_MT 103 COPY.pdf.exe Token: SeDebugPrivilege 3456 powershell.exe Token: SeDebugPrivilege 3680 HSBC_MT 103 COPY.pdf.exe Token: SeDebugPrivilege 1844 cmd.exe Token: SeShutdownPrivilege 2740 Explorer.EXE Token: SeCreatePagefilePrivilege 2740 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
HSBC_MT 103 COPY.pdf.exeExplorer.EXEcmd.exedescription pid process target process PID 4016 wrote to memory of 3456 4016 HSBC_MT 103 COPY.pdf.exe powershell.exe PID 4016 wrote to memory of 3456 4016 HSBC_MT 103 COPY.pdf.exe powershell.exe PID 4016 wrote to memory of 3456 4016 HSBC_MT 103 COPY.pdf.exe powershell.exe PID 4016 wrote to memory of 840 4016 HSBC_MT 103 COPY.pdf.exe schtasks.exe PID 4016 wrote to memory of 840 4016 HSBC_MT 103 COPY.pdf.exe schtasks.exe PID 4016 wrote to memory of 840 4016 HSBC_MT 103 COPY.pdf.exe schtasks.exe PID 4016 wrote to memory of 3680 4016 HSBC_MT 103 COPY.pdf.exe HSBC_MT 103 COPY.pdf.exe PID 4016 wrote to memory of 3680 4016 HSBC_MT 103 COPY.pdf.exe HSBC_MT 103 COPY.pdf.exe PID 4016 wrote to memory of 3680 4016 HSBC_MT 103 COPY.pdf.exe HSBC_MT 103 COPY.pdf.exe PID 4016 wrote to memory of 3680 4016 HSBC_MT 103 COPY.pdf.exe HSBC_MT 103 COPY.pdf.exe PID 4016 wrote to memory of 3680 4016 HSBC_MT 103 COPY.pdf.exe HSBC_MT 103 COPY.pdf.exe PID 4016 wrote to memory of 3680 4016 HSBC_MT 103 COPY.pdf.exe HSBC_MT 103 COPY.pdf.exe PID 2740 wrote to memory of 1844 2740 Explorer.EXE cmd.exe PID 2740 wrote to memory of 1844 2740 Explorer.EXE cmd.exe PID 2740 wrote to memory of 1844 2740 Explorer.EXE cmd.exe PID 1844 wrote to memory of 4260 1844 cmd.exe cmd.exe PID 1844 wrote to memory of 4260 1844 cmd.exe cmd.exe PID 1844 wrote to memory of 4260 1844 cmd.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\HSBC_MT 103 COPY.pdf.exe"C:\Users\Admin\AppData\Local\Temp\HSBC_MT 103 COPY.pdf.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\hSeyTCuDxScTPG.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hSeyTCuDxScTPG" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBCA9.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\HSBC_MT 103 COPY.pdf.exe"C:\Users\Admin\AppData\Local\Temp\HSBC_MT 103 COPY.pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\HSBC_MT 103 COPY.pdf.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpBCA9.tmpFilesize
1KB
MD50f077bc5d1d0a7fcd0b864433b38ded2
SHA12c2a25cbfb18cb9bc7c3022af077754b201a02f9
SHA256ab196c9fb26b2703fd1c58943176f23c6bfed4e6c3eea0b3563826710f81872b
SHA5127f65a0bc707de2840d60e5492d85da98a8d269d6893125b19087a591b371daac81372d30c717d12383a34766680857c068ed77a1eb424e7ec8e196711da1f06a
-
memory/840-138-0x0000000000000000-mapping.dmp
-
memory/1844-158-0x00000000016F0000-0x0000000001784000-memory.dmpFilesize
592KB
-
memory/1844-157-0x0000000000F20000-0x0000000000F4F000-memory.dmpFilesize
188KB
-
memory/1844-156-0x00000000017C0000-0x0000000001B0A000-memory.dmpFilesize
3.3MB
-
memory/1844-155-0x0000000000B00000-0x0000000000B5A000-memory.dmpFilesize
360KB
-
memory/1844-152-0x0000000000000000-mapping.dmp
-
memory/2740-151-0x00000000032B0000-0x0000000003386000-memory.dmpFilesize
856KB
-
memory/2740-159-0x0000000003660000-0x00000000036FF000-memory.dmpFilesize
636KB
-
memory/2740-170-0x0000000003660000-0x00000000036FF000-memory.dmpFilesize
636KB
-
memory/3456-162-0x00000000076A0000-0x00000000076BE000-memory.dmpFilesize
120KB
-
memory/3456-140-0x0000000005720000-0x0000000005D48000-memory.dmpFilesize
6.2MB
-
memory/3456-145-0x0000000005F00000-0x0000000005F66000-memory.dmpFilesize
408KB
-
memory/3456-169-0x0000000007AD0000-0x0000000007AD8000-memory.dmpFilesize
32KB
-
memory/3456-167-0x0000000007A90000-0x0000000007A9E000-memory.dmpFilesize
56KB
-
memory/3456-148-0x00000000065B0000-0x00000000065CE000-memory.dmpFilesize
120KB
-
memory/3456-166-0x0000000007AE0000-0x0000000007B76000-memory.dmpFilesize
600KB
-
memory/3456-165-0x00000000078B0000-0x00000000078BA000-memory.dmpFilesize
40KB
-
memory/3456-164-0x0000000007850000-0x000000000786A000-memory.dmpFilesize
104KB
-
memory/3456-137-0x0000000000000000-mapping.dmp
-
memory/3456-163-0x0000000007E90000-0x000000000850A000-memory.dmpFilesize
6.5MB
-
memory/3456-143-0x0000000005610000-0x0000000005676000-memory.dmpFilesize
408KB
-
memory/3456-139-0x0000000004F60000-0x0000000004F96000-memory.dmpFilesize
216KB
-
memory/3456-168-0x0000000007B80000-0x0000000007B9A000-memory.dmpFilesize
104KB
-
memory/3456-161-0x00000000706C0000-0x000000007070C000-memory.dmpFilesize
304KB
-
memory/3456-142-0x0000000005570000-0x0000000005592000-memory.dmpFilesize
136KB
-
memory/3456-160-0x00000000076E0000-0x0000000007712000-memory.dmpFilesize
200KB
-
memory/3680-153-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3680-150-0x0000000000E30000-0x0000000000E45000-memory.dmpFilesize
84KB
-
memory/3680-149-0x00000000012F0000-0x000000000163A000-memory.dmpFilesize
3.3MB
-
memory/3680-146-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3680-144-0x0000000000000000-mapping.dmp
-
memory/4016-133-0x0000000005210000-0x00000000057B4000-memory.dmpFilesize
5.6MB
-
memory/4016-134-0x0000000004B80000-0x0000000004C12000-memory.dmpFilesize
584KB
-
memory/4016-132-0x0000000000110000-0x00000000001EE000-memory.dmpFilesize
888KB
-
memory/4016-135-0x0000000004C20000-0x0000000004C2A000-memory.dmpFilesize
40KB
-
memory/4016-136-0x0000000008630000-0x00000000086CC000-memory.dmpFilesize
624KB
-
memory/4260-154-0x0000000000000000-mapping.dmp