Analysis
-
max time kernel
158s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
28-09-2022 06:36
Static task
static1
Behavioral task
behavioral1
Sample
jets4431.exe
Resource
win7-20220812-en
General
-
Target
jets4431.exe
-
Size
1.1MB
-
MD5
71415d61dd3a653e017514280a4e05c4
-
SHA1
89bed5f613401c5816f3b22816f84d5f8067db3b
-
SHA256
3ab1cc60bd5dca00fc6cad5cf3c0a7cccea610b20027c9db6b45f0b41860fba5
-
SHA512
971407b4327c3a9fe1ff76f0ec84874522865ae08f338ec0985a1ef78066a59412d323a4a2731d33dec129c89355b7aa95fe36f4425db8ad6ea1151f5b9c2098
-
SSDEEP
24576:UAOcZXcxP61ptWw+avL8pnp3qY7daGAuvZG31RMaas/xmR:CH+tWw+S8D3r70QA3XM9n
Malware Config
Extracted
formbook
4.1
je14
innervisionbuildings.com
theenergysocialite.com
565548.com
panghr.com
onlyonesolutions.com
stjohnzone6.com
cnotes.rest
helfeb.online
xixi-s-inc.club
easilyentered.com
theshopx.store
mrclean-ac.com
miamibeachwateradventures.com
jpearce.co.uk
seseragi-bunkou.com
minimaddie.com
commbank-help-849c3.com
segohandelsonderneming.com
namthanhreal.com
fototerapi.online
your-download.com
klindt.one
sellerscourt.com
francoislambert.store
smokedoutvapes.co.uk
rundacg.com
flavors-and-spices-lyon.com
qifengsuo.com
sunnyislesgardens.com
tunneldutransit.com
restorecodes.website
blast4me.com
bingser.space
co-gpco.com
emporioaliwen.com
mr5g.com
abcp666.com
consulvip.net
sagaming168.info
zjpbhsuz.top
socal-labworx.com
arethaglennevents.com
rafiqsiregar.com
esgh2.com
veirdmusic.com
abzcc.xyz
8065yp.com
dronebazar.com
duetpbr.com
apartamentoslaencantada.com
digigold.info
homedecorsuppliers.com
duenorthrm.com
xmmdsy.com
ddstennessee.com
marmeluz.com
ragnallhess.com
methinelli.com
randomlymetheseer.com
magicgrowthproducts.com
shreejistudio.com
mattress-37684.com
yellyfishfilms.com
www1111cpw.com
tigermedlagroup.com
Signatures
-
Formbook payload 12 IoCs
Processes:
resource yara_rule behavioral2/memory/4136-139-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4136-138-0x0000000000000000-mapping.dmp formbook behavioral2/memory/4084-141-0x000000000041F120-mapping.dmp formbook behavioral2/memory/4084-140-0x0000000000400000-0x0000000000ABA000-memory.dmp formbook behavioral2/memory/4136-144-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4084-145-0x0000000000400000-0x0000000000ABA000-memory.dmp formbook behavioral2/memory/4212-154-0x0000000000590000-0x00000000005BF000-memory.dmp formbook behavioral2/memory/4136-160-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4212-161-0x0000000003870000-0x0000000003A06000-memory.dmp formbook behavioral2/memory/4212-165-0x0000000000590000-0x00000000005BF000-memory.dmp formbook behavioral2/memory/4552-167-0x0000000000D50000-0x0000000000D7F000-memory.dmp formbook behavioral2/memory/4552-169-0x0000000000D50000-0x0000000000D7F000-memory.dmp formbook -
Executes dropped EXE 1 IoCs
Processes:
estrlf.pifpid process 384 estrlf.pif -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
jets4431.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation jets4431.exe -
Suspicious use of SetThreadContext 7 IoCs
Processes:
estrlf.pifRegSvcs.exeRegSvcs.exeexplorer.exedescription pid process target process PID 384 set thread context of 4136 384 estrlf.pif RegSvcs.exe PID 384 set thread context of 4084 384 estrlf.pif RegSvcs.exe PID 4136 set thread context of 600 4136 RegSvcs.exe Explorer.EXE PID 4084 set thread context of 600 4084 RegSvcs.exe Explorer.EXE PID 4136 set thread context of 600 4136 RegSvcs.exe Explorer.EXE PID 4136 set thread context of 4212 4136 RegSvcs.exe explorer.exe PID 4212 set thread context of 600 4212 explorer.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
RegSvcs.exeRegSvcs.exeexplorer.exewlanext.exepid process 4136 RegSvcs.exe 4136 RegSvcs.exe 4136 RegSvcs.exe 4136 RegSvcs.exe 4084 RegSvcs.exe 4084 RegSvcs.exe 4084 RegSvcs.exe 4084 RegSvcs.exe 4212 explorer.exe 4212 explorer.exe 4136 RegSvcs.exe 4136 RegSvcs.exe 4212 explorer.exe 4212 explorer.exe 4552 wlanext.exe 4552 wlanext.exe 4212 explorer.exe 4212 explorer.exe 4212 explorer.exe 4212 explorer.exe 4212 explorer.exe 4212 explorer.exe 4212 explorer.exe 4212 explorer.exe 4212 explorer.exe 4212 explorer.exe 4212 explorer.exe 4212 explorer.exe 4212 explorer.exe 4212 explorer.exe 4212 explorer.exe 4212 explorer.exe 4212 explorer.exe 4212 explorer.exe 4212 explorer.exe 4212 explorer.exe 4212 explorer.exe 4212 explorer.exe 4212 explorer.exe 4212 explorer.exe 4212 explorer.exe 4212 explorer.exe 4212 explorer.exe 4212 explorer.exe 4212 explorer.exe 4212 explorer.exe 4212 explorer.exe 4212 explorer.exe 4212 explorer.exe 4212 explorer.exe 4212 explorer.exe 4212 explorer.exe 4212 explorer.exe 4212 explorer.exe 4212 explorer.exe 4212 explorer.exe 4212 explorer.exe 4212 explorer.exe 4212 explorer.exe 4212 explorer.exe 4212 explorer.exe 4212 explorer.exe 4212 explorer.exe 4212 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 600 Explorer.EXE -
Suspicious behavior: MapViewOfSection 10 IoCs
Processes:
RegSvcs.exeRegSvcs.exeexplorer.exepid process 4136 RegSvcs.exe 4084 RegSvcs.exe 4084 RegSvcs.exe 4084 RegSvcs.exe 4136 RegSvcs.exe 4212 explorer.exe 4136 RegSvcs.exe 4212 explorer.exe 4136 RegSvcs.exe 4136 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
RegSvcs.exeRegSvcs.exeExplorer.EXEexplorer.exewlanext.exedescription pid process Token: SeDebugPrivilege 4136 RegSvcs.exe Token: SeDebugPrivilege 4084 RegSvcs.exe Token: SeShutdownPrivilege 600 Explorer.EXE Token: SeCreatePagefilePrivilege 600 Explorer.EXE Token: SeShutdownPrivilege 600 Explorer.EXE Token: SeCreatePagefilePrivilege 600 Explorer.EXE Token: SeDebugPrivilege 4212 explorer.exe Token: SeDebugPrivilege 4552 wlanext.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
jets4431.exeestrlf.pifExplorer.EXEexplorer.exedescription pid process target process PID 4076 wrote to memory of 384 4076 jets4431.exe estrlf.pif PID 4076 wrote to memory of 384 4076 jets4431.exe estrlf.pif PID 4076 wrote to memory of 384 4076 jets4431.exe estrlf.pif PID 384 wrote to memory of 4084 384 estrlf.pif RegSvcs.exe PID 384 wrote to memory of 4084 384 estrlf.pif RegSvcs.exe PID 384 wrote to memory of 4084 384 estrlf.pif RegSvcs.exe PID 384 wrote to memory of 4136 384 estrlf.pif RegSvcs.exe PID 384 wrote to memory of 4136 384 estrlf.pif RegSvcs.exe PID 384 wrote to memory of 4136 384 estrlf.pif RegSvcs.exe PID 384 wrote to memory of 4136 384 estrlf.pif RegSvcs.exe PID 384 wrote to memory of 4136 384 estrlf.pif RegSvcs.exe PID 384 wrote to memory of 4136 384 estrlf.pif RegSvcs.exe PID 384 wrote to memory of 4084 384 estrlf.pif RegSvcs.exe PID 384 wrote to memory of 4084 384 estrlf.pif RegSvcs.exe PID 600 wrote to memory of 4212 600 Explorer.EXE explorer.exe PID 600 wrote to memory of 4212 600 Explorer.EXE explorer.exe PID 600 wrote to memory of 4212 600 Explorer.EXE explorer.exe PID 4212 wrote to memory of 4060 4212 explorer.exe cmd.exe PID 4212 wrote to memory of 4060 4212 explorer.exe cmd.exe PID 4212 wrote to memory of 4060 4212 explorer.exe cmd.exe PID 4212 wrote to memory of 4552 4212 explorer.exe wlanext.exe PID 4212 wrote to memory of 4552 4212 explorer.exe wlanext.exe PID 4212 wrote to memory of 4552 4212 explorer.exe wlanext.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:600 -
C:\Users\Admin\AppData\Local\Temp\jets4431.exe"C:\Users\Admin\AppData\Local\Temp\jets4431.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Users\Admin\AppData\Roaming\5_29\estrlf.pif"C:\Users\Admin\AppData\Roaming\5_29\estrlf.pif" tvsgb.tls3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:384 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4084 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4136 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵PID:4060
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4552 -
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:3432
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\5_29\estrlf.pifFilesize
794KB
MD518e404787e9c044105f5c4bec4600bd8
SHA19f1015bd7f33a6f3c1cc12c0971f51b1adee1939
SHA256e15984dc8ea9627d370c40178676490129427e2dc23499f68c9c65c4386fea12
SHA512c6a1faae524968351b4841665bfe1c5255f7e6c115b7a81a4b6c65626f23f7f15e4bb856914fce15225c33a2e2b6166b3f1f87698895fe0ce4cb084b630c2a5f
-
C:\Users\Admin\AppData\Roaming\5_29\estrlf.pifFilesize
794KB
MD518e404787e9c044105f5c4bec4600bd8
SHA19f1015bd7f33a6f3c1cc12c0971f51b1adee1939
SHA256e15984dc8ea9627d370c40178676490129427e2dc23499f68c9c65c4386fea12
SHA512c6a1faae524968351b4841665bfe1c5255f7e6c115b7a81a4b6c65626f23f7f15e4bb856914fce15225c33a2e2b6166b3f1f87698895fe0ce4cb084b630c2a5f
-
C:\Users\Admin\AppData\Roaming\5_29\gdrqa.icmFilesize
41KB
MD5285afea69a2e1f8aae59a0c748aa2bd8
SHA18a087a497757b6beccf483687fb0d1edec45d3fa
SHA25686aeb596d5962ca2389b1dcc252d0ae7b869b9e6ec319e76a387b0bb16baa910
SHA5122ef2acb9b6377e85e2cf73db99555c91456ecd29dc842dc75f414ff2fbad6667c2c8d0af38a0ffd7a23c7c6a0bb28889671eeb42f61777a0dea85cbfe2cf4404
-
C:\Users\Admin\AppData\Roaming\5_29\tvsgb.tlsFilesize
163.3MB
MD55ad0013bd9927682146d60065da2cc2b
SHA1a3954227b0b6e7d9ca4a8107219eb01b81e5697e
SHA256ee9872a43ecb872238e1bcca27df64b90071816f121d1f1685beec0e01cd5c39
SHA512f931e9cd85481537f2ca25b7aa4ec435a81a9d98beff46b16e2408a84caf2aeeca4cfab1d6b0bd3fdb97a7cbc14186c3afee9935d66915c27a1b26b1739e0ad5
-
C:\Users\Admin\AppData\Roaming\5_29\xaguexgkmu.xvkFilesize
370KB
MD556f43e5edcbdfcf4a7e9b8c09c0d2ba2
SHA11d47312b6eacbf63b04f83a9b4cd2dad238ae17a
SHA256a26e71e81529a9cb7aa276618d014c5275cf3f7c356efb0e6b2308e30727a0fb
SHA5128dd0f07a966aaf0c76fbdbed51184c2d765611128ce9b6e978229dc4954357c78cabef185e636e59827ffb7841913a0d543d60231e1f70aea2d62b0f917eba8a
-
memory/384-132-0x0000000000000000-mapping.dmp
-
memory/600-149-0x0000000008EC0000-0x0000000009056000-memory.dmpFilesize
1.6MB
-
memory/600-159-0x0000000007D10000-0x0000000007E0E000-memory.dmpFilesize
1016KB
-
memory/600-163-0x0000000008D80000-0x0000000008EA2000-memory.dmpFilesize
1.1MB
-
memory/600-170-0x0000000008D80000-0x0000000008EA2000-memory.dmpFilesize
1.1MB
-
memory/600-151-0x00000000037E0000-0x000000000389C000-memory.dmpFilesize
752KB
-
memory/4060-155-0x0000000000000000-mapping.dmp
-
memory/4084-147-0x00000000016C0000-0x0000000001A0A000-memory.dmpFilesize
3.3MB
-
memory/4084-145-0x0000000000400000-0x0000000000ABA000-memory.dmpFilesize
6.7MB
-
memory/4084-150-0x0000000001A30000-0x0000000001A44000-memory.dmpFilesize
80KB
-
memory/4084-140-0x0000000000400000-0x0000000000ABA000-memory.dmpFilesize
6.7MB
-
memory/4084-141-0x000000000041F120-mapping.dmp
-
memory/4136-148-0x00000000011E0000-0x00000000011F4000-memory.dmpFilesize
80KB
-
memory/4136-158-0x0000000001550000-0x0000000001564000-memory.dmpFilesize
80KB
-
memory/4136-146-0x0000000001670000-0x00000000019BA000-memory.dmpFilesize
3.3MB
-
memory/4136-144-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4136-160-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4136-138-0x0000000000000000-mapping.dmp
-
memory/4136-139-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4212-152-0x0000000000000000-mapping.dmp
-
memory/4212-156-0x0000000002750000-0x0000000002A9A000-memory.dmpFilesize
3.3MB
-
memory/4212-161-0x0000000003870000-0x0000000003A06000-memory.dmpFilesize
1.6MB
-
memory/4212-162-0x0000000002590000-0x0000000002623000-memory.dmpFilesize
588KB
-
memory/4212-154-0x0000000000590000-0x00000000005BF000-memory.dmpFilesize
188KB
-
memory/4212-165-0x0000000000590000-0x00000000005BF000-memory.dmpFilesize
188KB
-
memory/4212-153-0x0000000000050000-0x0000000000483000-memory.dmpFilesize
4.2MB
-
memory/4552-164-0x0000000000000000-mapping.dmp
-
memory/4552-167-0x0000000000D50000-0x0000000000D7F000-memory.dmpFilesize
188KB
-
memory/4552-166-0x0000000000FC0000-0x0000000000FD7000-memory.dmpFilesize
92KB
-
memory/4552-168-0x00000000016C0000-0x0000000001A0A000-memory.dmpFilesize
3.3MB
-
memory/4552-169-0x0000000000D50000-0x0000000000D7F000-memory.dmpFilesize
188KB