Analysis
-
max time kernel
147s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29-09-2022 08:53
Static task
static1
Behavioral task
behavioral1
Sample
jetsoff665432.exe
Resource
win7-20220812-en
General
-
Target
jetsoff665432.exe
-
Size
1.3MB
-
MD5
dfb1e6c9726254c500fe211973053292
-
SHA1
ce5dd1136d279c35ec575a1928b3cbb06d767ddd
-
SHA256
2f5bfb6d82efab99d275d142f253dec133f478a5f7e22cecc6c7a821ff69bf78
-
SHA512
a0423019185a544a2c0bf9c351be5ca1eeb6863c29db46d29e8543403e00dbb52d292353428e9273bd78e13a27a4de67badeec3d24a6381b9415e77909fa90b3
-
SSDEEP
24576:iAOcZXp0QToITuXx/kzFjPUkjPV99npuezy71oporah+zS:o2KVkJjPUkj9fZe6Gs
Malware Config
Extracted
formbook
4.1
je14
innervisionbuildings.com
theenergysocialite.com
565548.com
panghr.com
onlyonesolutions.com
stjohnzone6.com
cnotes.rest
helfeb.online
xixi-s-inc.club
easilyentered.com
theshopx.store
mrclean-ac.com
miamibeachwateradventures.com
jpearce.co.uk
seseragi-bunkou.com
minimaddie.com
commbank-help-849c3.com
segohandelsonderneming.com
namthanhreal.com
fototerapi.online
your-download.com
klindt.one
sellerscourt.com
francoislambert.store
smokedoutvapes.co.uk
rundacg.com
flavors-and-spices-lyon.com
qifengsuo.com
sunnyislesgardens.com
tunneldutransit.com
restorecodes.website
blast4me.com
bingser.space
co-gpco.com
emporioaliwen.com
mr5g.com
abcp666.com
consulvip.net
sagaming168.info
zjpbhsuz.top
socal-labworx.com
arethaglennevents.com
rafiqsiregar.com
esgh2.com
veirdmusic.com
abzcc.xyz
8065yp.com
dronebazar.com
duetpbr.com
apartamentoslaencantada.com
digigold.info
homedecorsuppliers.com
duenorthrm.com
xmmdsy.com
ddstennessee.com
marmeluz.com
ragnallhess.com
methinelli.com
randomlymetheseer.com
magicgrowthproducts.com
shreejistudio.com
mattress-37684.com
yellyfishfilms.com
www1111cpw.com
tigermedlagroup.com
Signatures
-
Formbook payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/32-139-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/32-138-0x0000000000000000-mapping.dmp formbook behavioral2/memory/32-145-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3648-147-0x0000000000940000-0x000000000096F000-memory.dmp formbook behavioral2/memory/3648-151-0x0000000000940000-0x000000000096F000-memory.dmp formbook -
Executes dropped EXE 1 IoCs
Processes:
mifjokxf.pifpid process 3408 mifjokxf.pif -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
jetsoff665432.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation jetsoff665432.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
mifjokxf.pifRegSvcs.execolorcpl.exedescription pid process target process PID 3408 set thread context of 32 3408 mifjokxf.pif RegSvcs.exe PID 32 set thread context of 3064 32 RegSvcs.exe Explorer.EXE PID 3648 set thread context of 3064 3648 colorcpl.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 58 IoCs
Processes:
RegSvcs.execolorcpl.exepid process 32 RegSvcs.exe 32 RegSvcs.exe 32 RegSvcs.exe 32 RegSvcs.exe 3648 colorcpl.exe 3648 colorcpl.exe 3648 colorcpl.exe 3648 colorcpl.exe 3648 colorcpl.exe 3648 colorcpl.exe 3648 colorcpl.exe 3648 colorcpl.exe 3648 colorcpl.exe 3648 colorcpl.exe 3648 colorcpl.exe 3648 colorcpl.exe 3648 colorcpl.exe 3648 colorcpl.exe 3648 colorcpl.exe 3648 colorcpl.exe 3648 colorcpl.exe 3648 colorcpl.exe 3648 colorcpl.exe 3648 colorcpl.exe 3648 colorcpl.exe 3648 colorcpl.exe 3648 colorcpl.exe 3648 colorcpl.exe 3648 colorcpl.exe 3648 colorcpl.exe 3648 colorcpl.exe 3648 colorcpl.exe 3648 colorcpl.exe 3648 colorcpl.exe 3648 colorcpl.exe 3648 colorcpl.exe 3648 colorcpl.exe 3648 colorcpl.exe 3648 colorcpl.exe 3648 colorcpl.exe 3648 colorcpl.exe 3648 colorcpl.exe 3648 colorcpl.exe 3648 colorcpl.exe 3648 colorcpl.exe 3648 colorcpl.exe 3648 colorcpl.exe 3648 colorcpl.exe 3648 colorcpl.exe 3648 colorcpl.exe 3648 colorcpl.exe 3648 colorcpl.exe 3648 colorcpl.exe 3648 colorcpl.exe 3648 colorcpl.exe 3648 colorcpl.exe 3648 colorcpl.exe 3648 colorcpl.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3064 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.execolorcpl.exepid process 32 RegSvcs.exe 32 RegSvcs.exe 32 RegSvcs.exe 3648 colorcpl.exe 3648 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
RegSvcs.exeExplorer.EXEcolorcpl.exedescription pid process Token: SeDebugPrivilege 32 RegSvcs.exe Token: SeShutdownPrivilege 3064 Explorer.EXE Token: SeCreatePagefilePrivilege 3064 Explorer.EXE Token: SeShutdownPrivilege 3064 Explorer.EXE Token: SeCreatePagefilePrivilege 3064 Explorer.EXE Token: SeDebugPrivilege 3648 colorcpl.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
jetsoff665432.exemifjokxf.pifExplorer.EXEcolorcpl.exedescription pid process target process PID 4972 wrote to memory of 3408 4972 jetsoff665432.exe mifjokxf.pif PID 4972 wrote to memory of 3408 4972 jetsoff665432.exe mifjokxf.pif PID 4972 wrote to memory of 3408 4972 jetsoff665432.exe mifjokxf.pif PID 3408 wrote to memory of 1996 3408 mifjokxf.pif RegSvcs.exe PID 3408 wrote to memory of 1996 3408 mifjokxf.pif RegSvcs.exe PID 3408 wrote to memory of 1996 3408 mifjokxf.pif RegSvcs.exe PID 3408 wrote to memory of 32 3408 mifjokxf.pif RegSvcs.exe PID 3408 wrote to memory of 32 3408 mifjokxf.pif RegSvcs.exe PID 3408 wrote to memory of 32 3408 mifjokxf.pif RegSvcs.exe PID 3408 wrote to memory of 32 3408 mifjokxf.pif RegSvcs.exe PID 3408 wrote to memory of 32 3408 mifjokxf.pif RegSvcs.exe PID 3408 wrote to memory of 32 3408 mifjokxf.pif RegSvcs.exe PID 3064 wrote to memory of 3648 3064 Explorer.EXE colorcpl.exe PID 3064 wrote to memory of 3648 3064 Explorer.EXE colorcpl.exe PID 3064 wrote to memory of 3648 3064 Explorer.EXE colorcpl.exe PID 3648 wrote to memory of 4316 3648 colorcpl.exe cmd.exe PID 3648 wrote to memory of 4316 3648 colorcpl.exe cmd.exe PID 3648 wrote to memory of 4316 3648 colorcpl.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jetsoff665432.exe"C:\Users\Admin\AppData\Local\Temp\jetsoff665432.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5_42\mifjokxf.pif"C:\Users\Admin\AppData\Local\Temp\5_42\mifjokxf.pif" tsqxmldwxw.igd3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\5_42\hxoltp.datFilesize
43KB
MD597ab04875c46db4b64e3ad448edde35d
SHA194dc3b3fa6758d85bb8a3c363395b40e7881226d
SHA25680ce687e5415c5815ba75945eed9d9cd2db2e0bc07f21965b9819690ee6c5e73
SHA512ea699dee70cf1d4c956e443f3028b4d3df5c86b82f906029ced040891a2836779446ee452ac04432a0771cd8bd58f41ea332a0fefa1f8a6d77982bee48b64db8
-
C:\Users\Admin\AppData\Local\Temp\5_42\jocecdsibo.xivFilesize
370KB
MD54ede96364be74a54acb2a716ea67bfa8
SHA10319e2cab72d177694cf41fe017700e4e9fe388c
SHA256f55e451e3798d612ce180a8b135158321b3ca15ecc3c76aa7791987cb27104b5
SHA5122a7c3d681cf8e2de75ae2d312a3ceb04178dea9c47a4db3a4545ab4967e8e1c2321285870de50f65eeebddc27e8f225cb3d46e60a37b5f7fc31c03ccb681f2b6
-
C:\Users\Admin\AppData\Local\Temp\5_42\mifjokxf.pifFilesize
1.7MB
MD5dd3466f64841cf21fc31f63f03dbfd29
SHA13878c8e52203d792c6f672595f7c78ab27ce3f04
SHA2564fe3004208ed574521992dd1ba3d900b75a0f02f1d63ba1e531d309e85ffa06b
SHA512adf3fe8378f7da5ba278db9a1df4cc7b5cff12398ec39ee7037382ebf57897de8bec72be64b5e7332bdb7ed865788dcb6ef4ceda6654e1153d39fe84b011b057
-
C:\Users\Admin\AppData\Local\Temp\5_42\mifjokxf.pifFilesize
1.7MB
MD5dd3466f64841cf21fc31f63f03dbfd29
SHA13878c8e52203d792c6f672595f7c78ab27ce3f04
SHA2564fe3004208ed574521992dd1ba3d900b75a0f02f1d63ba1e531d309e85ffa06b
SHA512adf3fe8378f7da5ba278db9a1df4cc7b5cff12398ec39ee7037382ebf57897de8bec72be64b5e7332bdb7ed865788dcb6ef4ceda6654e1153d39fe84b011b057
-
C:\Users\Admin\AppData\Local\Temp\5_42\tsqxmldwxw.igdFilesize
135.4MB
MD502e7ad3cedbeb9d1758c9e0d9a1ff70e
SHA12a1a66780ef4fcf2d2657eb6fd19a6f1e8f4cba5
SHA25634be4ebe4ab1bfa95b3ecfe7053978359add3ce4a20d88e4cfdee644d8c5888c
SHA51287ccc268fb3ca72aef7cff0053de408e1bc3f45d3c463ce89c001772f9508487dcbcb30980dad385c5c6845280695a26ccb5ee702c45fcd298e2db60b92a5d67
-
memory/32-145-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/32-139-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/32-138-0x0000000000000000-mapping.dmp
-
memory/32-141-0x00000000012C0000-0x000000000160A000-memory.dmpFilesize
3.3MB
-
memory/32-142-0x0000000001270000-0x0000000001284000-memory.dmpFilesize
80KB
-
memory/3064-143-0x0000000007AF0000-0x0000000007C65000-memory.dmpFilesize
1.5MB
-
memory/3064-152-0x0000000008090000-0x00000000081D6000-memory.dmpFilesize
1.3MB
-
memory/3064-153-0x0000000008090000-0x00000000081D6000-memory.dmpFilesize
1.3MB
-
memory/3408-132-0x0000000000000000-mapping.dmp
-
memory/3648-144-0x0000000000000000-mapping.dmp
-
memory/3648-146-0x00000000004F0000-0x0000000000509000-memory.dmpFilesize
100KB
-
memory/3648-147-0x0000000000940000-0x000000000096F000-memory.dmpFilesize
188KB
-
memory/3648-148-0x0000000002AA0000-0x0000000002DEA000-memory.dmpFilesize
3.3MB
-
memory/3648-150-0x0000000002910000-0x00000000029A3000-memory.dmpFilesize
588KB
-
memory/3648-151-0x0000000000940000-0x000000000096F000-memory.dmpFilesize
188KB
-
memory/4316-149-0x0000000000000000-mapping.dmp