Analysis
-
max time kernel
181s -
max time network
187s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03-10-2022 07:00
Static task
static1
Behavioral task
behavioral1
Sample
TDD500000000000000000000000000000000000000.exe
Resource
win7-20220812-en
General
-
Target
TDD500000000000000000000000000000000000000.exe
-
Size
713KB
-
MD5
813890550ca56d37b0a986bf8cdde0b1
-
SHA1
88c1c4caca723a71c3f308fc8d66a44eb4a0230f
-
SHA256
3b56d7fd728103d3269e18e272e22d521d7c6c2304a2665217b1000631dded9d
-
SHA512
b29a49c5a17c2e91eeeb07816f39b0445a638452dde9841762c6a6130ee357320183f3cd68a299dc31f534d6c5dcf8839218fdbf49aca8a51d49bc4a247043e7
-
SSDEEP
12288:8ToPWBv/cpGrU3yH7mtstmTHIoELSbcV1W4WdV0zJPx:8TbBv5rUsmymTo7LSYxPx
Malware Config
Extracted
formbook
qqci
QetTqZClp7wFVN7CUjvCiA==
3ZTYDLbtEiw+OynhJ9HGmQ==
ZyJunbSaaekF
OOwyczoCsSvKuI0H
S/FAZYtKY2vVzCc5qIiU
axVWijjhaCVDmZpGTt3RUxGrgZIZjcapEw==
1oHQ73CAnJntuX8=
Huo0LA3V+0JZHgONI/JPQ8UJ
BKzl63IkrnSA5W41XFM=
yoHbAS7smafIszYSGkQ=
iTyFttfzdTBbmGkOV67Mjg==
KcwIME5r+IeTEv+4PVTMOV2tqTzT3w==
FLXq6sZddO4Fm4VR95ScwqT66yI=
u2SjgGoNCB0lHuGBpskelaT66yI=
0YrQwnYjYNF2v3sQ
l0O9vrjpiyM91b54/JPPguMe
P+BLw9L68iIY
AZQeZo+7cXLIRN2gtg==
K94UQ2snUJC3gl45qIiU
vlewBydLxlB05sOKHzbPguMe
wYLuH5hQAwIbHM98onCzs29Agw==
5Hq72YtB6ajKRN2gtg==
pDx/w1UENO8fiA==
fIWzS5v++bQLVd7CUjvCiA==
pFih7EPyEWeBNC3bXDvCiA==
C70OREb3+jVaq4Ya
7p7eI9z9+tbqNwzITGy2s29Agw==
9Z/sErp2LzHKuI0H
hTh5xRLT80CQmjYSGkQ=
43/ZF+Jz/M7dPzDvlm2FrFDmGB3GwA==
ymylAjz+IjpUVU0B9pP4dknYxDsoBQk=
qUSBqT1bZnCHhVQQV67Mjg==
m0CHu1lvZTlYlTYSGkQ=
AKruCrpK3K72kUw/djyR
NtIwo/qx3mO49eCbLkmc
x27C4WuRuQUh8sRaCKM8sIM=
7ZPi1iboixp2v3sQ
JdoHJZ8aAw1gnQ==
ymrKFDRQ7+H/RN2gtg==
VuFAcAgwMz1hWyG1YgZPQ8UJ
RtAviy1ej5ntuX8=
It8uRdP/InDIEqNET10=
hDd3swzH7mqLDNlhbBIZlKT66yI=
x26qw0t+ren/1rNM4YjPguMe
8HvAxWwYy9U0+uu0sw==
kUej2FoNw8zg/dZwncgYkaT66yI=
D8g1eZvHRIvvcVwY
K9EhCeiGi5ntuX8=
xXKo874S7O7+RN2gtg==
n02i44k3qwZNak8OV67Mjg==
K7D5NP7JZPZBFOesvaM8sIM=
/aTvH8Hd3en/RN2gtg==
vVnA7Wwqy5/398V+9o3o4SEYmNcCzg==
SuIwiiA6UZfr8r5U+IvLksrjaxNO
mTRvYcBwFfFG5W41XFM=
r0ioHNyiSA4tpCW1vA==
L9JMewEdHCx2wbRufxwl4Pa2vjsoBQk=
+6zwQJ9BNk5oXTD+A5eys29Agw==
cQdbRaA5y8vw78FbDKM8sIM=
izZsoFcBi1LfKR/UB67As29Agw==
uG6w4gQftoLWVzLqfVr2IObscw1O
ArcJMU6FLPERXjc5qIiU
C6ry8EcUt+U=
FLvvQnctVp64nk5DUF0=
dn8bmxv4vfcl67x.xyz
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
frqcewggrhw.exepid process 1184 frqcewggrhw.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
frqcewggrhw.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\Geo\Nation frqcewggrhw.exe -
Loads dropped DLL 12 IoCs
Processes:
TDD500000000000000000000000000000000000000.exefrqcewggrhw.exefrqcewggrhw.exeWerFault.exewuapp.exepid process 888 TDD500000000000000000000000000000000000000.exe 888 TDD500000000000000000000000000000000000000.exe 888 TDD500000000000000000000000000000000000000.exe 888 TDD500000000000000000000000000000000000000.exe 1184 frqcewggrhw.exe 2044 frqcewggrhw.exe 2000 WerFault.exe 2000 WerFault.exe 2000 WerFault.exe 2000 WerFault.exe 2000 WerFault.exe 1904 wuapp.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
frqcewggrhw.exefrqcewggrhw.exewuapp.exedescription pid process target process PID 1184 set thread context of 2044 1184 frqcewggrhw.exe frqcewggrhw.exe PID 2044 set thread context of 1244 2044 frqcewggrhw.exe Explorer.EXE PID 1904 set thread context of 1244 1904 wuapp.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2000 1184 WerFault.exe frqcewggrhw.exe -
Processes:
wuapp.exedescription ioc process Key created \Registry\User\S-1-5-21-2292972927-2705560509-2768824231-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 wuapp.exe -
Suspicious behavior: EnumeratesProcesses 25 IoCs
Processes:
frqcewggrhw.exewuapp.exepid process 2044 frqcewggrhw.exe 2044 frqcewggrhw.exe 2044 frqcewggrhw.exe 2044 frqcewggrhw.exe 1904 wuapp.exe 1904 wuapp.exe 1904 wuapp.exe 1904 wuapp.exe 1904 wuapp.exe 1904 wuapp.exe 1904 wuapp.exe 1904 wuapp.exe 1904 wuapp.exe 1904 wuapp.exe 1904 wuapp.exe 1904 wuapp.exe 1904 wuapp.exe 1904 wuapp.exe 1904 wuapp.exe 1904 wuapp.exe 1904 wuapp.exe 1904 wuapp.exe 1904 wuapp.exe 1904 wuapp.exe 1904 wuapp.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
frqcewggrhw.exewuapp.exepid process 2044 frqcewggrhw.exe 2044 frqcewggrhw.exe 2044 frqcewggrhw.exe 1904 wuapp.exe 1904 wuapp.exe 1904 wuapp.exe 1904 wuapp.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
frqcewggrhw.exeExplorer.EXEwuapp.exedescription pid process Token: SeDebugPrivilege 2044 frqcewggrhw.exe Token: SeShutdownPrivilege 1244 Explorer.EXE Token: SeDebugPrivilege 1904 wuapp.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1244 Explorer.EXE 1244 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1244 Explorer.EXE 1244 Explorer.EXE -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
TDD500000000000000000000000000000000000000.exefrqcewggrhw.exeExplorer.EXEwuapp.exedescription pid process target process PID 888 wrote to memory of 1184 888 TDD500000000000000000000000000000000000000.exe frqcewggrhw.exe PID 888 wrote to memory of 1184 888 TDD500000000000000000000000000000000000000.exe frqcewggrhw.exe PID 888 wrote to memory of 1184 888 TDD500000000000000000000000000000000000000.exe frqcewggrhw.exe PID 888 wrote to memory of 1184 888 TDD500000000000000000000000000000000000000.exe frqcewggrhw.exe PID 1184 wrote to memory of 2044 1184 frqcewggrhw.exe frqcewggrhw.exe PID 1184 wrote to memory of 2044 1184 frqcewggrhw.exe frqcewggrhw.exe PID 1184 wrote to memory of 2044 1184 frqcewggrhw.exe frqcewggrhw.exe PID 1184 wrote to memory of 2044 1184 frqcewggrhw.exe frqcewggrhw.exe PID 1184 wrote to memory of 2044 1184 frqcewggrhw.exe frqcewggrhw.exe PID 1184 wrote to memory of 2000 1184 frqcewggrhw.exe WerFault.exe PID 1184 wrote to memory of 2000 1184 frqcewggrhw.exe WerFault.exe PID 1184 wrote to memory of 2000 1184 frqcewggrhw.exe WerFault.exe PID 1184 wrote to memory of 2000 1184 frqcewggrhw.exe WerFault.exe PID 1244 wrote to memory of 1904 1244 Explorer.EXE wuapp.exe PID 1244 wrote to memory of 1904 1244 Explorer.EXE wuapp.exe PID 1244 wrote to memory of 1904 1244 Explorer.EXE wuapp.exe PID 1244 wrote to memory of 1904 1244 Explorer.EXE wuapp.exe PID 1244 wrote to memory of 1904 1244 Explorer.EXE wuapp.exe PID 1244 wrote to memory of 1904 1244 Explorer.EXE wuapp.exe PID 1244 wrote to memory of 1904 1244 Explorer.EXE wuapp.exe PID 1904 wrote to memory of 972 1904 wuapp.exe Firefox.exe PID 1904 wrote to memory of 972 1904 wuapp.exe Firefox.exe PID 1904 wrote to memory of 972 1904 wuapp.exe Firefox.exe PID 1904 wrote to memory of 972 1904 wuapp.exe Firefox.exe PID 1904 wrote to memory of 972 1904 wuapp.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TDD500000000000000000000000000000000000000.exe"C:\Users\Admin\AppData\Local\Temp\TDD500000000000000000000000000000000000000.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\frqcewggrhw.exe"C:\Users\Admin\AppData\Local\Temp\frqcewggrhw.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\frqcewggrhw.exe"C:\Users\Admin\AppData\Local\Temp\frqcewggrhw.exe"4⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1184 -s 2444⤵
- Loads dropped DLL
- Program crash
-
C:\Windows\SysWOW64\wuapp.exe"C:\Windows\SysWOW64\wuapp.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\frqcewggrhw.exeFilesize
56KB
MD5d0e90c275950aa6655921911057a9b8e
SHA156f2a2c421510e2772edee874e146196a5409597
SHA256ff1bc96bcef0db6b933fefa041e8e38fbec9192d4ea53b309e5ba95ffb8b1ec8
SHA512486fcfc96b28e20b6532fdf5ef6a986f25a3729b2c5331fd09291f999f841e820a52302ff3ff612873414aa683176b942eadac5c35605f70d7f7d9ed736df549
-
C:\Users\Admin\AppData\Local\Temp\frqcewggrhw.exeFilesize
56KB
MD5d0e90c275950aa6655921911057a9b8e
SHA156f2a2c421510e2772edee874e146196a5409597
SHA256ff1bc96bcef0db6b933fefa041e8e38fbec9192d4ea53b309e5ba95ffb8b1ec8
SHA512486fcfc96b28e20b6532fdf5ef6a986f25a3729b2c5331fd09291f999f841e820a52302ff3ff612873414aa683176b942eadac5c35605f70d7f7d9ed736df549
-
C:\Users\Admin\AppData\Local\Temp\frqcewggrhw.exeFilesize
56KB
MD5d0e90c275950aa6655921911057a9b8e
SHA156f2a2c421510e2772edee874e146196a5409597
SHA256ff1bc96bcef0db6b933fefa041e8e38fbec9192d4ea53b309e5ba95ffb8b1ec8
SHA512486fcfc96b28e20b6532fdf5ef6a986f25a3729b2c5331fd09291f999f841e820a52302ff3ff612873414aa683176b942eadac5c35605f70d7f7d9ed736df549
-
C:\Users\Admin\AppData\Local\Temp\qnzrnm.mwxFilesize
4KB
MD554c2259abdb49f848bdba460ed858024
SHA17e655cb9bda0b43fc00e60615a3a87582f2c55f8
SHA2562998820c59e87763d0106ff04418db0ddd5623590dd97f5e9de4ad42bc7c6148
SHA5126a317219345a48639912dfa4d080f22e2d070f7c3d2f286dc38414b91ede67ca421d8fa29e65f7fbd019ba2ce0dd92cca4fa6bd4346f6d15909b5e8e0b1cf9f8
-
C:\Users\Admin\AppData\Local\Temp\wxqklo.lgyFilesize
185KB
MD55a21846043f65aeaab1a75e456fea017
SHA129af7fc55f4e3e3a98f4f298c062dab4f4c3ad47
SHA256af680a037c85b1bff053ad6a4d5b4bf919fcd55230f0cd719a2a473c4ffe2f92
SHA512d7dbb860b99dc34a2156934277fce9507cae2b59da2e2eb06d61c60001610dfebc189e2ce4e9fe491b05e4f0ce9225142b8849a26b0a12b27c612c230bb97738
-
\Users\Admin\AppData\Local\Temp\frqcewggrhw.exeFilesize
56KB
MD5d0e90c275950aa6655921911057a9b8e
SHA156f2a2c421510e2772edee874e146196a5409597
SHA256ff1bc96bcef0db6b933fefa041e8e38fbec9192d4ea53b309e5ba95ffb8b1ec8
SHA512486fcfc96b28e20b6532fdf5ef6a986f25a3729b2c5331fd09291f999f841e820a52302ff3ff612873414aa683176b942eadac5c35605f70d7f7d9ed736df549
-
\Users\Admin\AppData\Local\Temp\frqcewggrhw.exeFilesize
56KB
MD5d0e90c275950aa6655921911057a9b8e
SHA156f2a2c421510e2772edee874e146196a5409597
SHA256ff1bc96bcef0db6b933fefa041e8e38fbec9192d4ea53b309e5ba95ffb8b1ec8
SHA512486fcfc96b28e20b6532fdf5ef6a986f25a3729b2c5331fd09291f999f841e820a52302ff3ff612873414aa683176b942eadac5c35605f70d7f7d9ed736df549
-
\Users\Admin\AppData\Local\Temp\frqcewggrhw.exeFilesize
56KB
MD5d0e90c275950aa6655921911057a9b8e
SHA156f2a2c421510e2772edee874e146196a5409597
SHA256ff1bc96bcef0db6b933fefa041e8e38fbec9192d4ea53b309e5ba95ffb8b1ec8
SHA512486fcfc96b28e20b6532fdf5ef6a986f25a3729b2c5331fd09291f999f841e820a52302ff3ff612873414aa683176b942eadac5c35605f70d7f7d9ed736df549
-
\Users\Admin\AppData\Local\Temp\frqcewggrhw.exeFilesize
56KB
MD5d0e90c275950aa6655921911057a9b8e
SHA156f2a2c421510e2772edee874e146196a5409597
SHA256ff1bc96bcef0db6b933fefa041e8e38fbec9192d4ea53b309e5ba95ffb8b1ec8
SHA512486fcfc96b28e20b6532fdf5ef6a986f25a3729b2c5331fd09291f999f841e820a52302ff3ff612873414aa683176b942eadac5c35605f70d7f7d9ed736df549
-
\Users\Admin\AppData\Local\Temp\frqcewggrhw.exeFilesize
56KB
MD5d0e90c275950aa6655921911057a9b8e
SHA156f2a2c421510e2772edee874e146196a5409597
SHA256ff1bc96bcef0db6b933fefa041e8e38fbec9192d4ea53b309e5ba95ffb8b1ec8
SHA512486fcfc96b28e20b6532fdf5ef6a986f25a3729b2c5331fd09291f999f841e820a52302ff3ff612873414aa683176b942eadac5c35605f70d7f7d9ed736df549
-
\Users\Admin\AppData\Local\Temp\frqcewggrhw.exeFilesize
56KB
MD5d0e90c275950aa6655921911057a9b8e
SHA156f2a2c421510e2772edee874e146196a5409597
SHA256ff1bc96bcef0db6b933fefa041e8e38fbec9192d4ea53b309e5ba95ffb8b1ec8
SHA512486fcfc96b28e20b6532fdf5ef6a986f25a3729b2c5331fd09291f999f841e820a52302ff3ff612873414aa683176b942eadac5c35605f70d7f7d9ed736df549
-
\Users\Admin\AppData\Local\Temp\frqcewggrhw.exeFilesize
56KB
MD5d0e90c275950aa6655921911057a9b8e
SHA156f2a2c421510e2772edee874e146196a5409597
SHA256ff1bc96bcef0db6b933fefa041e8e38fbec9192d4ea53b309e5ba95ffb8b1ec8
SHA512486fcfc96b28e20b6532fdf5ef6a986f25a3729b2c5331fd09291f999f841e820a52302ff3ff612873414aa683176b942eadac5c35605f70d7f7d9ed736df549
-
\Users\Admin\AppData\Local\Temp\frqcewggrhw.exeFilesize
56KB
MD5d0e90c275950aa6655921911057a9b8e
SHA156f2a2c421510e2772edee874e146196a5409597
SHA256ff1bc96bcef0db6b933fefa041e8e38fbec9192d4ea53b309e5ba95ffb8b1ec8
SHA512486fcfc96b28e20b6532fdf5ef6a986f25a3729b2c5331fd09291f999f841e820a52302ff3ff612873414aa683176b942eadac5c35605f70d7f7d9ed736df549
-
\Users\Admin\AppData\Local\Temp\frqcewggrhw.exeFilesize
56KB
MD5d0e90c275950aa6655921911057a9b8e
SHA156f2a2c421510e2772edee874e146196a5409597
SHA256ff1bc96bcef0db6b933fefa041e8e38fbec9192d4ea53b309e5ba95ffb8b1ec8
SHA512486fcfc96b28e20b6532fdf5ef6a986f25a3729b2c5331fd09291f999f841e820a52302ff3ff612873414aa683176b942eadac5c35605f70d7f7d9ed736df549
-
\Users\Admin\AppData\Local\Temp\frqcewggrhw.exeFilesize
56KB
MD5d0e90c275950aa6655921911057a9b8e
SHA156f2a2c421510e2772edee874e146196a5409597
SHA256ff1bc96bcef0db6b933fefa041e8e38fbec9192d4ea53b309e5ba95ffb8b1ec8
SHA512486fcfc96b28e20b6532fdf5ef6a986f25a3729b2c5331fd09291f999f841e820a52302ff3ff612873414aa683176b942eadac5c35605f70d7f7d9ed736df549
-
\Users\Admin\AppData\Local\Temp\sqlite3.dllFilesize
910KB
MD5d79258c5189103d69502eac786addb04
SHA1f34b33681cfe8ce649218173a7f58b237821c1ef
SHA25657d89a52061d70d87e40281f1196d53273f87860c4d707d667a8c7d9573da675
SHA512da797f4dd1ad628aa4e8004b2e00b7c278facbc57a313f56b70dc8fcfbdb0050ea8b025b3475098223cce96ea53537d678273656d46c2d33d81b496d90da34b2
-
memory/888-54-0x0000000075021000-0x0000000075023000-memory.dmpFilesize
8KB
-
memory/1184-59-0x0000000000000000-mapping.dmp
-
memory/1244-77-0x0000000006610000-0x0000000006754000-memory.dmpFilesize
1.3MB
-
memory/1244-86-0x0000000006C70000-0x0000000006D7D000-memory.dmpFilesize
1.1MB
-
memory/1244-83-0x0000000006C70000-0x0000000006D7D000-memory.dmpFilesize
1.1MB
-
memory/1904-80-0x0000000000090000-0x00000000000BD000-memory.dmpFilesize
180KB
-
memory/1904-78-0x0000000000000000-mapping.dmp
-
memory/1904-79-0x0000000000950000-0x000000000095B000-memory.dmpFilesize
44KB
-
memory/1904-81-0x0000000002030000-0x0000000002333000-memory.dmpFilesize
3.0MB
-
memory/1904-82-0x0000000001D60000-0x0000000001DEF000-memory.dmpFilesize
572KB
-
memory/1904-84-0x0000000000090000-0x00000000000BD000-memory.dmpFilesize
180KB
-
memory/2000-68-0x0000000000000000-mapping.dmp
-
memory/2044-76-0x00000000000F0000-0x0000000000100000-memory.dmpFilesize
64KB
-
memory/2044-75-0x0000000000850000-0x0000000000B53000-memory.dmpFilesize
3.0MB
-
memory/2044-74-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2044-66-0x00000000004012B0-mapping.dmp