Analysis
-
max time kernel
148s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29-09-2022 08:53
Static task
static1
Behavioral task
behavioral1
Sample
jetsoff665432.exe
Resource
win7-20220812-en
General
-
Target
jetsoff665432.exe
-
Size
1.3MB
-
MD5
dfb1e6c9726254c500fe211973053292
-
SHA1
ce5dd1136d279c35ec575a1928b3cbb06d767ddd
-
SHA256
2f5bfb6d82efab99d275d142f253dec133f478a5f7e22cecc6c7a821ff69bf78
-
SHA512
a0423019185a544a2c0bf9c351be5ca1eeb6863c29db46d29e8543403e00dbb52d292353428e9273bd78e13a27a4de67badeec3d24a6381b9415e77909fa90b3
-
SSDEEP
24576:iAOcZXp0QToITuXx/kzFjPUkjPV99npuezy71oporah+zS:o2KVkJjPUkj9fZe6Gs
Malware Config
Extracted
formbook
4.1
je14
innervisionbuildings.com
theenergysocialite.com
565548.com
panghr.com
onlyonesolutions.com
stjohnzone6.com
cnotes.rest
helfeb.online
xixi-s-inc.club
easilyentered.com
theshopx.store
mrclean-ac.com
miamibeachwateradventures.com
jpearce.co.uk
seseragi-bunkou.com
minimaddie.com
commbank-help-849c3.com
segohandelsonderneming.com
namthanhreal.com
fototerapi.online
your-download.com
klindt.one
sellerscourt.com
francoislambert.store
smokedoutvapes.co.uk
rundacg.com
flavors-and-spices-lyon.com
qifengsuo.com
sunnyislesgardens.com
tunneldutransit.com
restorecodes.website
blast4me.com
bingser.space
co-gpco.com
emporioaliwen.com
mr5g.com
abcp666.com
consulvip.net
sagaming168.info
zjpbhsuz.top
socal-labworx.com
arethaglennevents.com
rafiqsiregar.com
esgh2.com
veirdmusic.com
abzcc.xyz
8065yp.com
dronebazar.com
duetpbr.com
apartamentoslaencantada.com
digigold.info
homedecorsuppliers.com
duenorthrm.com
xmmdsy.com
ddstennessee.com
marmeluz.com
ragnallhess.com
methinelli.com
randomlymetheseer.com
magicgrowthproducts.com
shreejistudio.com
mattress-37684.com
yellyfishfilms.com
www1111cpw.com
tigermedlagroup.com
Signatures
-
Formbook payload 10 IoCs
Processes:
resource yara_rule behavioral1/memory/1280-68-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1280-69-0x000000000041F120-mapping.dmp formbook behavioral1/memory/1320-72-0x0000000000400000-0x0000000000949000-memory.dmp formbook behavioral1/memory/1320-73-0x000000000041F120-mapping.dmp formbook behavioral1/memory/1280-76-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1320-77-0x0000000000400000-0x0000000000949000-memory.dmp formbook behavioral1/memory/1196-87-0x0000000000080000-0x00000000000AF000-memory.dmp formbook behavioral1/memory/1320-95-0x0000000000400000-0x0000000000949000-memory.dmp formbook behavioral1/memory/796-97-0x0000000000080000-0x00000000000AF000-memory.dmp formbook behavioral1/memory/1196-99-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Executes dropped EXE 1 IoCs
Processes:
mifjokxf.pifpid process 1500 mifjokxf.pif -
Loads dropped DLL 4 IoCs
Processes:
jetsoff665432.exepid process 240 jetsoff665432.exe 240 jetsoff665432.exe 240 jetsoff665432.exe 240 jetsoff665432.exe -
Suspicious use of SetThreadContext 6 IoCs
Processes:
mifjokxf.pifRegSvcs.exeRegSvcs.exesystray.exedescription pid process target process PID 1500 set thread context of 1280 1500 mifjokxf.pif RegSvcs.exe PID 1500 set thread context of 1320 1500 mifjokxf.pif RegSvcs.exe PID 1280 set thread context of 1432 1280 RegSvcs.exe Explorer.EXE PID 1320 set thread context of 1432 1320 RegSvcs.exe Explorer.EXE PID 1320 set thread context of 1432 1320 RegSvcs.exe Explorer.EXE PID 1196 set thread context of 1432 1196 systray.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
NETSTAT.EXEpid process 796 NETSTAT.EXE -
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
RegSvcs.exeRegSvcs.exesystray.exeNETSTAT.EXEpid process 1280 RegSvcs.exe 1280 RegSvcs.exe 1320 RegSvcs.exe 1320 RegSvcs.exe 1196 systray.exe 1196 systray.exe 1320 RegSvcs.exe 796 NETSTAT.EXE 1196 systray.exe 1196 systray.exe 1196 systray.exe 1196 systray.exe 1196 systray.exe 1196 systray.exe 1196 systray.exe 1196 systray.exe 1196 systray.exe 1196 systray.exe 1196 systray.exe 1196 systray.exe 1196 systray.exe 1196 systray.exe 1196 systray.exe 1196 systray.exe 1196 systray.exe 1196 systray.exe 1196 systray.exe 1196 systray.exe 1196 systray.exe 1196 systray.exe -
Suspicious behavior: MapViewOfSection 9 IoCs
Processes:
RegSvcs.exeRegSvcs.exesystray.exepid process 1280 RegSvcs.exe 1320 RegSvcs.exe 1280 RegSvcs.exe 1280 RegSvcs.exe 1196 systray.exe 1320 RegSvcs.exe 1196 systray.exe 1320 RegSvcs.exe 1320 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
RegSvcs.exeRegSvcs.exesystray.exeNETSTAT.EXEdescription pid process Token: SeDebugPrivilege 1280 RegSvcs.exe Token: SeDebugPrivilege 1320 RegSvcs.exe Token: SeDebugPrivilege 1196 systray.exe Token: SeDebugPrivilege 796 NETSTAT.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1432 Explorer.EXE 1432 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1432 Explorer.EXE 1432 Explorer.EXE -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
jetsoff665432.exemifjokxf.pifExplorer.EXEsystray.exeRegSvcs.exedescription pid process target process PID 240 wrote to memory of 1500 240 jetsoff665432.exe mifjokxf.pif PID 240 wrote to memory of 1500 240 jetsoff665432.exe mifjokxf.pif PID 240 wrote to memory of 1500 240 jetsoff665432.exe mifjokxf.pif PID 240 wrote to memory of 1500 240 jetsoff665432.exe mifjokxf.pif PID 240 wrote to memory of 1500 240 jetsoff665432.exe mifjokxf.pif PID 240 wrote to memory of 1500 240 jetsoff665432.exe mifjokxf.pif PID 240 wrote to memory of 1500 240 jetsoff665432.exe mifjokxf.pif PID 1500 wrote to memory of 1320 1500 mifjokxf.pif RegSvcs.exe PID 1500 wrote to memory of 1320 1500 mifjokxf.pif RegSvcs.exe PID 1500 wrote to memory of 1320 1500 mifjokxf.pif RegSvcs.exe PID 1500 wrote to memory of 1320 1500 mifjokxf.pif RegSvcs.exe PID 1500 wrote to memory of 1320 1500 mifjokxf.pif RegSvcs.exe PID 1500 wrote to memory of 1320 1500 mifjokxf.pif RegSvcs.exe PID 1500 wrote to memory of 1320 1500 mifjokxf.pif RegSvcs.exe PID 1500 wrote to memory of 1280 1500 mifjokxf.pif RegSvcs.exe PID 1500 wrote to memory of 1280 1500 mifjokxf.pif RegSvcs.exe PID 1500 wrote to memory of 1280 1500 mifjokxf.pif RegSvcs.exe PID 1500 wrote to memory of 1280 1500 mifjokxf.pif RegSvcs.exe PID 1500 wrote to memory of 1280 1500 mifjokxf.pif RegSvcs.exe PID 1500 wrote to memory of 1280 1500 mifjokxf.pif RegSvcs.exe PID 1500 wrote to memory of 1280 1500 mifjokxf.pif RegSvcs.exe PID 1500 wrote to memory of 1280 1500 mifjokxf.pif RegSvcs.exe PID 1500 wrote to memory of 1280 1500 mifjokxf.pif RegSvcs.exe PID 1500 wrote to memory of 1280 1500 mifjokxf.pif RegSvcs.exe PID 1500 wrote to memory of 1320 1500 mifjokxf.pif RegSvcs.exe PID 1500 wrote to memory of 1320 1500 mifjokxf.pif RegSvcs.exe PID 1432 wrote to memory of 1196 1432 Explorer.EXE systray.exe PID 1432 wrote to memory of 1196 1432 Explorer.EXE systray.exe PID 1432 wrote to memory of 1196 1432 Explorer.EXE systray.exe PID 1432 wrote to memory of 1196 1432 Explorer.EXE systray.exe PID 1196 wrote to memory of 1564 1196 systray.exe cmd.exe PID 1196 wrote to memory of 1564 1196 systray.exe cmd.exe PID 1196 wrote to memory of 1564 1196 systray.exe cmd.exe PID 1196 wrote to memory of 1564 1196 systray.exe cmd.exe PID 1320 wrote to memory of 796 1320 RegSvcs.exe NETSTAT.EXE PID 1320 wrote to memory of 796 1320 RegSvcs.exe NETSTAT.EXE PID 1320 wrote to memory of 796 1320 RegSvcs.exe NETSTAT.EXE PID 1320 wrote to memory of 796 1320 RegSvcs.exe NETSTAT.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jetsoff665432.exe"C:\Users\Admin\AppData\Local\Temp\jetsoff665432.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5_42\mifjokxf.pif"C:\Users\Admin\AppData\Local\Temp\5_42\mifjokxf.pif" tsqxmldwxw.igd3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"5⤵
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\5_42\hxoltp.datFilesize
43KB
MD597ab04875c46db4b64e3ad448edde35d
SHA194dc3b3fa6758d85bb8a3c363395b40e7881226d
SHA25680ce687e5415c5815ba75945eed9d9cd2db2e0bc07f21965b9819690ee6c5e73
SHA512ea699dee70cf1d4c956e443f3028b4d3df5c86b82f906029ced040891a2836779446ee452ac04432a0771cd8bd58f41ea332a0fefa1f8a6d77982bee48b64db8
-
C:\Users\Admin\AppData\Local\Temp\5_42\jocecdsibo.xivFilesize
370KB
MD54ede96364be74a54acb2a716ea67bfa8
SHA10319e2cab72d177694cf41fe017700e4e9fe388c
SHA256f55e451e3798d612ce180a8b135158321b3ca15ecc3c76aa7791987cb27104b5
SHA5122a7c3d681cf8e2de75ae2d312a3ceb04178dea9c47a4db3a4545ab4967e8e1c2321285870de50f65eeebddc27e8f225cb3d46e60a37b5f7fc31c03ccb681f2b6
-
C:\Users\Admin\AppData\Local\Temp\5_42\mifjokxf.pifFilesize
1.7MB
MD5dd3466f64841cf21fc31f63f03dbfd29
SHA13878c8e52203d792c6f672595f7c78ab27ce3f04
SHA2564fe3004208ed574521992dd1ba3d900b75a0f02f1d63ba1e531d309e85ffa06b
SHA512adf3fe8378f7da5ba278db9a1df4cc7b5cff12398ec39ee7037382ebf57897de8bec72be64b5e7332bdb7ed865788dcb6ef4ceda6654e1153d39fe84b011b057
-
C:\Users\Admin\AppData\Local\Temp\5_42\tsqxmldwxw.igdFilesize
135.4MB
MD502e7ad3cedbeb9d1758c9e0d9a1ff70e
SHA12a1a66780ef4fcf2d2657eb6fd19a6f1e8f4cba5
SHA25634be4ebe4ab1bfa95b3ecfe7053978359add3ce4a20d88e4cfdee644d8c5888c
SHA51287ccc268fb3ca72aef7cff0053de408e1bc3f45d3c463ce89c001772f9508487dcbcb30980dad385c5c6845280695a26ccb5ee702c45fcd298e2db60b92a5d67
-
\Users\Admin\AppData\Local\Temp\5_42\mifjokxf.pifFilesize
1.7MB
MD5dd3466f64841cf21fc31f63f03dbfd29
SHA13878c8e52203d792c6f672595f7c78ab27ce3f04
SHA2564fe3004208ed574521992dd1ba3d900b75a0f02f1d63ba1e531d309e85ffa06b
SHA512adf3fe8378f7da5ba278db9a1df4cc7b5cff12398ec39ee7037382ebf57897de8bec72be64b5e7332bdb7ed865788dcb6ef4ceda6654e1153d39fe84b011b057
-
\Users\Admin\AppData\Local\Temp\5_42\mifjokxf.pifFilesize
1.7MB
MD5dd3466f64841cf21fc31f63f03dbfd29
SHA13878c8e52203d792c6f672595f7c78ab27ce3f04
SHA2564fe3004208ed574521992dd1ba3d900b75a0f02f1d63ba1e531d309e85ffa06b
SHA512adf3fe8378f7da5ba278db9a1df4cc7b5cff12398ec39ee7037382ebf57897de8bec72be64b5e7332bdb7ed865788dcb6ef4ceda6654e1153d39fe84b011b057
-
\Users\Admin\AppData\Local\Temp\5_42\mifjokxf.pifFilesize
1.7MB
MD5dd3466f64841cf21fc31f63f03dbfd29
SHA13878c8e52203d792c6f672595f7c78ab27ce3f04
SHA2564fe3004208ed574521992dd1ba3d900b75a0f02f1d63ba1e531d309e85ffa06b
SHA512adf3fe8378f7da5ba278db9a1df4cc7b5cff12398ec39ee7037382ebf57897de8bec72be64b5e7332bdb7ed865788dcb6ef4ceda6654e1153d39fe84b011b057
-
\Users\Admin\AppData\Local\Temp\5_42\mifjokxf.pifFilesize
1.7MB
MD5dd3466f64841cf21fc31f63f03dbfd29
SHA13878c8e52203d792c6f672595f7c78ab27ce3f04
SHA2564fe3004208ed574521992dd1ba3d900b75a0f02f1d63ba1e531d309e85ffa06b
SHA512adf3fe8378f7da5ba278db9a1df4cc7b5cff12398ec39ee7037382ebf57897de8bec72be64b5e7332bdb7ed865788dcb6ef4ceda6654e1153d39fe84b011b057
-
memory/240-54-0x0000000075DA1000-0x0000000075DA3000-memory.dmpFilesize
8KB
-
memory/796-98-0x00000000022A0000-0x00000000025A3000-memory.dmpFilesize
3.0MB
-
memory/796-97-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/796-96-0x0000000000740000-0x0000000000749000-memory.dmpFilesize
36KB
-
memory/796-94-0x0000000000000000-mapping.dmp
-
memory/1196-99-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/1196-92-0x0000000001E50000-0x0000000001EE3000-memory.dmpFilesize
588KB
-
memory/1196-88-0x0000000001FB0000-0x00000000022B3000-memory.dmpFilesize
3.0MB
-
memory/1196-87-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/1196-86-0x00000000005B0000-0x00000000005B5000-memory.dmpFilesize
20KB
-
memory/1196-84-0x0000000000000000-mapping.dmp
-
memory/1280-79-0x0000000000150000-0x0000000000164000-memory.dmpFilesize
80KB
-
memory/1280-76-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1280-68-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1280-69-0x000000000041F120-mapping.dmp
-
memory/1280-66-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1280-78-0x0000000000AB0000-0x0000000000DB3000-memory.dmpFilesize
3.0MB
-
memory/1280-65-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1320-90-0x0000000000360000-0x0000000000374000-memory.dmpFilesize
80KB
-
memory/1320-82-0x0000000000130000-0x0000000000144000-memory.dmpFilesize
80KB
-
memory/1320-77-0x0000000000400000-0x0000000000949000-memory.dmpFilesize
5.3MB
-
memory/1320-73-0x000000000041F120-mapping.dmp
-
memory/1320-70-0x0000000000400000-0x0000000000949000-memory.dmpFilesize
5.3MB
-
memory/1320-81-0x0000000000DB0000-0x00000000010B3000-memory.dmpFilesize
3.0MB
-
memory/1320-72-0x0000000000400000-0x0000000000949000-memory.dmpFilesize
5.3MB
-
memory/1320-95-0x0000000000400000-0x0000000000949000-memory.dmpFilesize
5.3MB
-
memory/1432-83-0x0000000007050000-0x00000000071BB000-memory.dmpFilesize
1.4MB
-
memory/1432-93-0x00000000071C0000-0x0000000007319000-memory.dmpFilesize
1.3MB
-
memory/1432-91-0x00000000047E0000-0x00000000048D9000-memory.dmpFilesize
996KB
-
memory/1432-80-0x0000000006920000-0x0000000006A82000-memory.dmpFilesize
1.4MB
-
memory/1432-100-0x00000000071C0000-0x0000000007319000-memory.dmpFilesize
1.3MB
-
memory/1500-59-0x0000000000000000-mapping.dmp
-
memory/1564-85-0x0000000000000000-mapping.dmp