Analysis
-
max time kernel
297s -
max time network
288s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29-08-2022 05:22
Static task
static1
Behavioral task
behavioral1
Sample
f0520738f5b3e513d729ec8034c934ab84b803b5fb8c06cf328f279b42e89fa0.exe
Resource
win7-20220812-en
General
-
Target
f0520738f5b3e513d729ec8034c934ab84b803b5fb8c06cf328f279b42e89fa0.exe
-
Size
582KB
-
MD5
4347c70ca7302f107a165d6fd272b0e6
-
SHA1
1aa318f816e82fa3a047d61e4f79dd1b1765e89d
-
SHA256
f0520738f5b3e513d729ec8034c934ab84b803b5fb8c06cf328f279b42e89fa0
-
SHA512
071bd1762a28d3a182c588fff09754c9f0bc23fb4cc7d4b8b5b378380161d835d6990ae03281d544a3aab87ed8ed201e4cb88a720275a8fe1427b34b49e6d854
-
SSDEEP
12288:EE+7B92iNmUaevf9nf5fsuqy1ngZ6NfHJld0XTmT:5qz1xvjfdqyPP6X6T
Malware Config
Extracted
formbook
4.1
de08
retirecloudyyard.com
fabiyan.xyz
chrisarlyde.com
selapex.com
vivalosgales.com
specialty-medicine.com
contasesolucoes.com
satunusanews.net
allyibc.com
alameda1876.com
artofdala.com
yukoidusp.xyz
steeldrumbandnearme.com
stonewedgetechnology.com
kentonai.com
macquarie-private.com
ddgwy.com
megagreenhousekits.com
descomplicaomarketing.com
inclusiverealtor.com
themummyfront.club
computerfashiondesigns.com
ericparlatore.com
whathappened2me.com
baksomail.xyz
mugupplatform.com
shopsolutely.com
gymcservices.com
qianshunchina.com
zoomsbshab.icu
esrmtech.com
966211.com
stockinsidepr.com
df-wh.com
smartshopapps.com
kayseriadsl.com
acedesserts.com
205qs.com
ei8i.com
aibtly.com
kpviewllc.net
nnehandebol.com
torontonianapparel.ca
therealgoldenganjagang.com
mingxiang99.com
rewkagcompany.xyz
ahmee4.com
valen.info
vacuumfun.parts
fabiyan.xyz
psncareersolutions.com
escobargroups.com
michigandice.com
ey3solutions.com
li-n.info
puingkehancuran.xyz
bilt-green.com
dfysuitetech.xyz
abdoomar.com
actsaka.xyz
justsweatitout.com
axabank.life
billyyaka.com
mypatchtools.com
epulsive.com
Signatures
-
Formbook payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/568-70-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/568-71-0x000000000041F120-mapping.dmp formbook behavioral1/memory/568-75-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/684-83-0x0000000000080000-0x00000000000AF000-memory.dmp formbook behavioral1/memory/684-88-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
Processes:
f0520738f5b3e513d729ec8034c934ab84b803b5fb8c06cf328f279b42e89fa0.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions f0520738f5b3e513d729ec8034c934ab84b803b5fb8c06cf328f279b42e89fa0.exe -
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
Processes:
f0520738f5b3e513d729ec8034c934ab84b803b5fb8c06cf328f279b42e89fa0.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools f0520738f5b3e513d729ec8034c934ab84b803b5fb8c06cf328f279b42e89fa0.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
f0520738f5b3e513d729ec8034c934ab84b803b5fb8c06cf328f279b42e89fa0.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion f0520738f5b3e513d729ec8034c934ab84b803b5fb8c06cf328f279b42e89fa0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion f0520738f5b3e513d729ec8034c934ab84b803b5fb8c06cf328f279b42e89fa0.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
f0520738f5b3e513d729ec8034c934ab84b803b5fb8c06cf328f279b42e89fa0.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum f0520738f5b3e513d729ec8034c934ab84b803b5fb8c06cf328f279b42e89fa0.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 f0520738f5b3e513d729ec8034c934ab84b803b5fb8c06cf328f279b42e89fa0.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
f0520738f5b3e513d729ec8034c934ab84b803b5fb8c06cf328f279b42e89fa0.exeRegSvcs.exeNAPSTAT.EXEdescription pid process target process PID 1936 set thread context of 568 1936 f0520738f5b3e513d729ec8034c934ab84b803b5fb8c06cf328f279b42e89fa0.exe RegSvcs.exe PID 568 set thread context of 1380 568 RegSvcs.exe Explorer.EXE PID 684 set thread context of 1380 684 NAPSTAT.EXE Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 45 IoCs
Processes:
powershell.exepowershell.exeRegSvcs.exeNAPSTAT.EXEpid process 1692 powershell.exe 624 powershell.exe 568 RegSvcs.exe 568 RegSvcs.exe 684 NAPSTAT.EXE 684 NAPSTAT.EXE 684 NAPSTAT.EXE 684 NAPSTAT.EXE 684 NAPSTAT.EXE 684 NAPSTAT.EXE 684 NAPSTAT.EXE 684 NAPSTAT.EXE 684 NAPSTAT.EXE 684 NAPSTAT.EXE 684 NAPSTAT.EXE 684 NAPSTAT.EXE 684 NAPSTAT.EXE 684 NAPSTAT.EXE 684 NAPSTAT.EXE 684 NAPSTAT.EXE 684 NAPSTAT.EXE 684 NAPSTAT.EXE 684 NAPSTAT.EXE 684 NAPSTAT.EXE 684 NAPSTAT.EXE 684 NAPSTAT.EXE 684 NAPSTAT.EXE 684 NAPSTAT.EXE 684 NAPSTAT.EXE 684 NAPSTAT.EXE 684 NAPSTAT.EXE 684 NAPSTAT.EXE 684 NAPSTAT.EXE 684 NAPSTAT.EXE 684 NAPSTAT.EXE 684 NAPSTAT.EXE 684 NAPSTAT.EXE 684 NAPSTAT.EXE 684 NAPSTAT.EXE 684 NAPSTAT.EXE 684 NAPSTAT.EXE 684 NAPSTAT.EXE 684 NAPSTAT.EXE 684 NAPSTAT.EXE 684 NAPSTAT.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1380 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.exeNAPSTAT.EXEpid process 568 RegSvcs.exe 568 RegSvcs.exe 568 RegSvcs.exe 684 NAPSTAT.EXE 684 NAPSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
powershell.exepowershell.exeRegSvcs.exeNAPSTAT.EXEExplorer.EXEdescription pid process Token: SeDebugPrivilege 624 powershell.exe Token: SeDebugPrivilege 1692 powershell.exe Token: SeDebugPrivilege 568 RegSvcs.exe Token: SeDebugPrivilege 684 NAPSTAT.EXE Token: SeShutdownPrivilege 1380 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1380 Explorer.EXE 1380 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1380 Explorer.EXE 1380 Explorer.EXE -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
f0520738f5b3e513d729ec8034c934ab84b803b5fb8c06cf328f279b42e89fa0.exeExplorer.EXENAPSTAT.EXEdescription pid process target process PID 1936 wrote to memory of 624 1936 f0520738f5b3e513d729ec8034c934ab84b803b5fb8c06cf328f279b42e89fa0.exe powershell.exe PID 1936 wrote to memory of 624 1936 f0520738f5b3e513d729ec8034c934ab84b803b5fb8c06cf328f279b42e89fa0.exe powershell.exe PID 1936 wrote to memory of 624 1936 f0520738f5b3e513d729ec8034c934ab84b803b5fb8c06cf328f279b42e89fa0.exe powershell.exe PID 1936 wrote to memory of 624 1936 f0520738f5b3e513d729ec8034c934ab84b803b5fb8c06cf328f279b42e89fa0.exe powershell.exe PID 1936 wrote to memory of 1692 1936 f0520738f5b3e513d729ec8034c934ab84b803b5fb8c06cf328f279b42e89fa0.exe powershell.exe PID 1936 wrote to memory of 1692 1936 f0520738f5b3e513d729ec8034c934ab84b803b5fb8c06cf328f279b42e89fa0.exe powershell.exe PID 1936 wrote to memory of 1692 1936 f0520738f5b3e513d729ec8034c934ab84b803b5fb8c06cf328f279b42e89fa0.exe powershell.exe PID 1936 wrote to memory of 1692 1936 f0520738f5b3e513d729ec8034c934ab84b803b5fb8c06cf328f279b42e89fa0.exe powershell.exe PID 1936 wrote to memory of 980 1936 f0520738f5b3e513d729ec8034c934ab84b803b5fb8c06cf328f279b42e89fa0.exe schtasks.exe PID 1936 wrote to memory of 980 1936 f0520738f5b3e513d729ec8034c934ab84b803b5fb8c06cf328f279b42e89fa0.exe schtasks.exe PID 1936 wrote to memory of 980 1936 f0520738f5b3e513d729ec8034c934ab84b803b5fb8c06cf328f279b42e89fa0.exe schtasks.exe PID 1936 wrote to memory of 980 1936 f0520738f5b3e513d729ec8034c934ab84b803b5fb8c06cf328f279b42e89fa0.exe schtasks.exe PID 1936 wrote to memory of 568 1936 f0520738f5b3e513d729ec8034c934ab84b803b5fb8c06cf328f279b42e89fa0.exe RegSvcs.exe PID 1936 wrote to memory of 568 1936 f0520738f5b3e513d729ec8034c934ab84b803b5fb8c06cf328f279b42e89fa0.exe RegSvcs.exe PID 1936 wrote to memory of 568 1936 f0520738f5b3e513d729ec8034c934ab84b803b5fb8c06cf328f279b42e89fa0.exe RegSvcs.exe PID 1936 wrote to memory of 568 1936 f0520738f5b3e513d729ec8034c934ab84b803b5fb8c06cf328f279b42e89fa0.exe RegSvcs.exe PID 1936 wrote to memory of 568 1936 f0520738f5b3e513d729ec8034c934ab84b803b5fb8c06cf328f279b42e89fa0.exe RegSvcs.exe PID 1936 wrote to memory of 568 1936 f0520738f5b3e513d729ec8034c934ab84b803b5fb8c06cf328f279b42e89fa0.exe RegSvcs.exe PID 1936 wrote to memory of 568 1936 f0520738f5b3e513d729ec8034c934ab84b803b5fb8c06cf328f279b42e89fa0.exe RegSvcs.exe PID 1936 wrote to memory of 568 1936 f0520738f5b3e513d729ec8034c934ab84b803b5fb8c06cf328f279b42e89fa0.exe RegSvcs.exe PID 1936 wrote to memory of 568 1936 f0520738f5b3e513d729ec8034c934ab84b803b5fb8c06cf328f279b42e89fa0.exe RegSvcs.exe PID 1936 wrote to memory of 568 1936 f0520738f5b3e513d729ec8034c934ab84b803b5fb8c06cf328f279b42e89fa0.exe RegSvcs.exe PID 1380 wrote to memory of 684 1380 Explorer.EXE NAPSTAT.EXE PID 1380 wrote to memory of 684 1380 Explorer.EXE NAPSTAT.EXE PID 1380 wrote to memory of 684 1380 Explorer.EXE NAPSTAT.EXE PID 1380 wrote to memory of 684 1380 Explorer.EXE NAPSTAT.EXE PID 684 wrote to memory of 972 684 NAPSTAT.EXE cmd.exe PID 684 wrote to memory of 972 684 NAPSTAT.EXE cmd.exe PID 684 wrote to memory of 972 684 NAPSTAT.EXE cmd.exe PID 684 wrote to memory of 972 684 NAPSTAT.EXE cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f0520738f5b3e513d729ec8034c934ab84b803b5fb8c06cf328f279b42e89fa0.exe"C:\Users\Admin\AppData\Local\Temp\f0520738f5b3e513d729ec8034c934ab84b803b5fb8c06cf328f279b42e89fa0.exe"2⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\f0520738f5b3e513d729ec8034c934ab84b803b5fb8c06cf328f279b42e89fa0.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\rxvXbVNKsySUf.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rxvXbVNKsySUf" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCC.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\NAPSTAT.EXE"C:\Windows\SysWOW64\NAPSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpCC.tmpFilesize
1KB
MD57c6f9bd218d4c7d4e25ba285848ce65e
SHA1739088bfeb1f4efbf0af356db3b204facc2e1929
SHA256905041f1d035b0ca20bd3360a402a6bcc94ef87762d4dca69883aaeaf6813671
SHA512232fb1d4e908835e4c025107a82786a427d5996480329a8fe4d5fce44c869108b145481843b59d27a6cff1dcf063f1d97708713df67c1a0e3ec356eeac3804ff
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD5c839a3633f17daa039e4fc91b2318226
SHA12966d80543cbc7ce9dc4e9b3b09c7b4bff7c0670
SHA256134c872568c2296634a41abf47044bf7f5c3e2d33cf77869cfe2760e0a93ecf1
SHA5128f460608c97b6bf451fd4048cad54118028cfc9751913b5c56d94524e1ddc59167f77ebda94614c29ab9bc88413a6d4e67e0d2bb0d5f1b4133d08f91d7ad9084
-
memory/568-68-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/568-79-0x00000000002F0000-0x0000000000304000-memory.dmpFilesize
80KB
-
memory/568-78-0x00000000008F0000-0x0000000000BF3000-memory.dmpFilesize
3.0MB
-
memory/568-75-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/568-71-0x000000000041F120-mapping.dmp
-
memory/568-70-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/568-67-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/624-77-0x000000006F1E0000-0x000000006F78B000-memory.dmpFilesize
5.7MB
-
memory/624-59-0x0000000000000000-mapping.dmp
-
memory/624-72-0x000000006F1E0000-0x000000006F78B000-memory.dmpFilesize
5.7MB
-
memory/684-82-0x0000000000720000-0x0000000000766000-memory.dmpFilesize
280KB
-
memory/684-86-0x0000000001D00000-0x0000000001D93000-memory.dmpFilesize
588KB
-
memory/684-83-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/684-85-0x0000000001E90000-0x0000000002193000-memory.dmpFilesize
3.0MB
-
memory/684-81-0x0000000000000000-mapping.dmp
-
memory/684-88-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/972-84-0x0000000000000000-mapping.dmp
-
memory/980-62-0x0000000000000000-mapping.dmp
-
memory/1380-80-0x0000000007020000-0x000000000716D000-memory.dmpFilesize
1.3MB
-
memory/1380-87-0x0000000007170000-0x000000000729F000-memory.dmpFilesize
1.2MB
-
memory/1380-89-0x0000000007170000-0x000000000729F000-memory.dmpFilesize
1.2MB
-
memory/1692-76-0x000000006F1E0000-0x000000006F78B000-memory.dmpFilesize
5.7MB
-
memory/1692-74-0x000000006F1E0000-0x000000006F78B000-memory.dmpFilesize
5.7MB
-
memory/1692-61-0x0000000000000000-mapping.dmp
-
memory/1936-58-0x0000000004DC0000-0x0000000004E2C000-memory.dmpFilesize
432KB
-
memory/1936-54-0x0000000000B20000-0x0000000000BB8000-memory.dmpFilesize
608KB
-
memory/1936-55-0x00000000765F1000-0x00000000765F3000-memory.dmpFilesize
8KB
-
memory/1936-56-0x0000000000430000-0x0000000000446000-memory.dmpFilesize
88KB
-
memory/1936-57-0x0000000000490000-0x000000000049A000-memory.dmpFilesize
40KB
-
memory/1936-66-0x0000000007E10000-0x0000000007E44000-memory.dmpFilesize
208KB