Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-08-2022 19:06
Static task
static1
Behavioral task
behavioral1
Sample
HSBC_MT 103 COPY.pdf.exe
Resource
win7-20220812-en
General
-
Target
HSBC_MT 103 COPY.pdf.exe
-
Size
857KB
-
MD5
3dfd937682599beaeb0ba57dcabe4638
-
SHA1
6e65a4de334ececb97add5e15ce6b55e1edf7ae9
-
SHA256
1f364b54ed1d03b1f87fe2bf0d7a376029298c3250611dab92dcba2d210afe1d
-
SHA512
9300f3bc9eeefc972a35189ffb85e6a28465f77d3a4ece17db5492f73dfca6b2f771f373b623e082d3b4b077ed9dfeec10ab50a0119d145984fccfbe3b35488d
-
SSDEEP
24576:ADCaT/0shbH1RT/0shb+M1X2S3plUdMW+1JhpuVerBG:al5x4GjsdMTn6eF
Malware Config
Extracted
formbook
4.1
ba17
bearwant.com
sdsguanfang.com
steamcommunityvia.top
sugarplumtreasures.com
koronislakefishing.com
jmae.xyz
xhxnqemkiqe.xyz
playzcrew.com
zatwsbq.com
lankofix.com
sh-zhepeng.com
mibodamisxv.online
butterflyjewelry.store
finestrecitalto-spottoday.info
globomateria.com
royalmdarts.com
d4af10836709.com
shepwill.com
67aldrich.info
trustedmakers.club
burdiezholdings.com
facialcoach.com
hunterous.com
carei.xyz
positivityintheworkplace.com
top1productjapan.online
camperrentnovara.com
nostalgiaz.xyz
prepperandsalt.com
platinum-swallow-nest.com
jmdadoag.com
cornerstonesolarconsulting.com
carmelhasit.com
hospitalaurelia.com
epolystars.com
best5psychicreadingsites.com
cbradleyowens.com
cmshelps.com
leclefsdor.com
male-muscle-slave.cloud
eselinchen.com
statesunitedaction.net
goweet.com
hififurniturehouse.info
alphacapitaltrust.online
hotsellmed.com
sunxueling.com
firstclass-poolservice.com
tuveranopelayo.com
wayangslot.net
joseauto.net
consinko.com
pacificoffshorecharters.com
steemboard.xyz
poollife.info
miraihenokoibumi.net
mfh-sa.com
seontra.xyz
openfaders.com
guardianz.online
purse.gold
affaire-chaba.com
rosency.xyz
somethingform.site
digitalpursuitsonline.com
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/2616-143-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2616-146-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/8-154-0x0000000000FC0000-0x0000000000FEF000-memory.dmp formbook behavioral2/memory/8-161-0x0000000000FC0000-0x0000000000FEF000-memory.dmp formbook -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
HSBC_MT 103 COPY.pdf.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation HSBC_MT 103 COPY.pdf.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
HSBC_MT 103 COPY.pdf.exeHSBC_MT 103 COPY.pdf.exeWWAHost.exedescription pid process target process PID 1824 set thread context of 2616 1824 HSBC_MT 103 COPY.pdf.exe HSBC_MT 103 COPY.pdf.exe PID 2616 set thread context of 2520 2616 HSBC_MT 103 COPY.pdf.exe Explorer.EXE PID 8 set thread context of 2520 8 WWAHost.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
HSBC_MT 103 COPY.pdf.exeHSBC_MT 103 COPY.pdf.exepowershell.exeWWAHost.exepid process 1824 HSBC_MT 103 COPY.pdf.exe 1824 HSBC_MT 103 COPY.pdf.exe 1824 HSBC_MT 103 COPY.pdf.exe 1824 HSBC_MT 103 COPY.pdf.exe 1824 HSBC_MT 103 COPY.pdf.exe 1824 HSBC_MT 103 COPY.pdf.exe 2616 HSBC_MT 103 COPY.pdf.exe 2616 HSBC_MT 103 COPY.pdf.exe 2616 HSBC_MT 103 COPY.pdf.exe 2616 HSBC_MT 103 COPY.pdf.exe 4556 powershell.exe 8 WWAHost.exe 8 WWAHost.exe 8 WWAHost.exe 8 WWAHost.exe 4556 powershell.exe 8 WWAHost.exe 8 WWAHost.exe 8 WWAHost.exe 8 WWAHost.exe 8 WWAHost.exe 8 WWAHost.exe 8 WWAHost.exe 8 WWAHost.exe 8 WWAHost.exe 8 WWAHost.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
HSBC_MT 103 COPY.pdf.exeWWAHost.exepid process 2616 HSBC_MT 103 COPY.pdf.exe 2616 HSBC_MT 103 COPY.pdf.exe 2616 HSBC_MT 103 COPY.pdf.exe 8 WWAHost.exe 8 WWAHost.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
HSBC_MT 103 COPY.pdf.exepowershell.exeHSBC_MT 103 COPY.pdf.exeWWAHost.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1824 HSBC_MT 103 COPY.pdf.exe Token: SeDebugPrivilege 4556 powershell.exe Token: SeDebugPrivilege 2616 HSBC_MT 103 COPY.pdf.exe Token: SeDebugPrivilege 8 WWAHost.exe Token: SeShutdownPrivilege 2520 Explorer.EXE Token: SeCreatePagefilePrivilege 2520 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
HSBC_MT 103 COPY.pdf.exeExplorer.EXEWWAHost.exedescription pid process target process PID 1824 wrote to memory of 4556 1824 HSBC_MT 103 COPY.pdf.exe powershell.exe PID 1824 wrote to memory of 4556 1824 HSBC_MT 103 COPY.pdf.exe powershell.exe PID 1824 wrote to memory of 4556 1824 HSBC_MT 103 COPY.pdf.exe powershell.exe PID 1824 wrote to memory of 4600 1824 HSBC_MT 103 COPY.pdf.exe schtasks.exe PID 1824 wrote to memory of 4600 1824 HSBC_MT 103 COPY.pdf.exe schtasks.exe PID 1824 wrote to memory of 4600 1824 HSBC_MT 103 COPY.pdf.exe schtasks.exe PID 1824 wrote to memory of 2616 1824 HSBC_MT 103 COPY.pdf.exe HSBC_MT 103 COPY.pdf.exe PID 1824 wrote to memory of 2616 1824 HSBC_MT 103 COPY.pdf.exe HSBC_MT 103 COPY.pdf.exe PID 1824 wrote to memory of 2616 1824 HSBC_MT 103 COPY.pdf.exe HSBC_MT 103 COPY.pdf.exe PID 1824 wrote to memory of 2616 1824 HSBC_MT 103 COPY.pdf.exe HSBC_MT 103 COPY.pdf.exe PID 1824 wrote to memory of 2616 1824 HSBC_MT 103 COPY.pdf.exe HSBC_MT 103 COPY.pdf.exe PID 1824 wrote to memory of 2616 1824 HSBC_MT 103 COPY.pdf.exe HSBC_MT 103 COPY.pdf.exe PID 2520 wrote to memory of 8 2520 Explorer.EXE WWAHost.exe PID 2520 wrote to memory of 8 2520 Explorer.EXE WWAHost.exe PID 2520 wrote to memory of 8 2520 Explorer.EXE WWAHost.exe PID 8 wrote to memory of 1728 8 WWAHost.exe cmd.exe PID 8 wrote to memory of 1728 8 WWAHost.exe cmd.exe PID 8 wrote to memory of 1728 8 WWAHost.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\HSBC_MT 103 COPY.pdf.exe"C:\Users\Admin\AppData\Local\Temp\HSBC_MT 103 COPY.pdf.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\fkjsDNq.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fkjsDNq" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBAFE.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\HSBC_MT 103 COPY.pdf.exe"C:\Users\Admin\AppData\Local\Temp\HSBC_MT 103 COPY.pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WWAHost.exe"C:\Windows\SysWOW64\WWAHost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\HSBC_MT 103 COPY.pdf.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpBAFE.tmpFilesize
1KB
MD5061445caa6e02ba42c9c264ec62dd3e5
SHA1f2c72f6fe6bce7cb46cf294530f3d0019d35215a
SHA25659227a09210c468d82203bbadf36bb154d8ce00202925132b6a10f6f05e7772b
SHA512ab45e98bc0287fc44e600852c8f1e36422614a42a0bfbc6df100927705cdf30cc6f55c790e82e633481c2373241e0fc7504cf31e19ebbe46971022ef5d142f38
-
memory/8-156-0x0000000001E20000-0x000000000216A000-memory.dmpFilesize
3.3MB
-
memory/8-161-0x0000000000FC0000-0x0000000000FEF000-memory.dmpFilesize
188KB
-
memory/8-159-0x0000000002170000-0x0000000002204000-memory.dmpFilesize
592KB
-
memory/8-152-0x0000000000000000-mapping.dmp
-
memory/8-153-0x0000000000260000-0x000000000033C000-memory.dmpFilesize
880KB
-
memory/8-154-0x0000000000FC0000-0x0000000000FEF000-memory.dmpFilesize
188KB
-
memory/1728-155-0x0000000000000000-mapping.dmp
-
memory/1824-135-0x0000000005770000-0x000000000577A000-memory.dmpFilesize
40KB
-
memory/1824-136-0x0000000001710000-0x00000000017AC000-memory.dmpFilesize
624KB
-
memory/1824-133-0x0000000005CE0000-0x0000000006284000-memory.dmpFilesize
5.6MB
-
memory/1824-134-0x00000000057D0000-0x0000000005862000-memory.dmpFilesize
584KB
-
memory/1824-132-0x0000000000CF0000-0x0000000000DCC000-memory.dmpFilesize
880KB
-
memory/2520-160-0x0000000008810000-0x0000000008927000-memory.dmpFilesize
1.1MB
-
memory/2520-149-0x00000000082D0000-0x0000000008415000-memory.dmpFilesize
1.3MB
-
memory/2520-158-0x00000000082D0000-0x0000000008415000-memory.dmpFilesize
1.3MB
-
memory/2520-168-0x0000000008810000-0x0000000008927000-memory.dmpFilesize
1.1MB
-
memory/2616-142-0x0000000000000000-mapping.dmp
-
memory/2616-146-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2616-143-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2616-148-0x00000000010C0000-0x00000000010D5000-memory.dmpFilesize
84KB
-
memory/2616-147-0x0000000001590000-0x00000000018DA000-memory.dmpFilesize
3.3MB
-
memory/4556-166-0x0000000006FE0000-0x0000000006FFA000-memory.dmpFilesize
104KB
-
memory/4556-164-0x0000000006EF0000-0x0000000006F0E000-memory.dmpFilesize
120KB
-
memory/4556-157-0x0000000006840000-0x000000000685E000-memory.dmpFilesize
120KB
-
memory/4556-150-0x0000000005A10000-0x0000000005A76000-memory.dmpFilesize
408KB
-
memory/4556-141-0x0000000005B20000-0x0000000006148000-memory.dmpFilesize
6.2MB
-
memory/4556-139-0x0000000003040000-0x0000000003076000-memory.dmpFilesize
216KB
-
memory/4556-172-0x0000000007ED0000-0x0000000007ED8000-memory.dmpFilesize
32KB
-
memory/4556-162-0x0000000006F10000-0x0000000006F42000-memory.dmpFilesize
200KB
-
memory/4556-163-0x00000000709A0000-0x00000000709EC000-memory.dmpFilesize
304KB
-
memory/4556-145-0x0000000005870000-0x0000000005892000-memory.dmpFilesize
136KB
-
memory/4556-165-0x00000000082F0000-0x000000000896A000-memory.dmpFilesize
6.5MB
-
memory/4556-151-0x0000000006300000-0x0000000006366000-memory.dmpFilesize
408KB
-
memory/4556-167-0x0000000007CC0000-0x0000000007CCA000-memory.dmpFilesize
40KB
-
memory/4556-137-0x0000000000000000-mapping.dmp
-
memory/4556-169-0x0000000007EF0000-0x0000000007F86000-memory.dmpFilesize
600KB
-
memory/4556-170-0x0000000006F90000-0x0000000006F9E000-memory.dmpFilesize
56KB
-
memory/4556-171-0x0000000007F90000-0x0000000007FAA000-memory.dmpFilesize
104KB
-
memory/4600-138-0x0000000000000000-mapping.dmp