Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
17-10-2022 15:58
Static task
static1
Behavioral task
behavioral1
Sample
jetsoff7785645.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
jetsoff7785645.exe
Resource
win10v2004-20220812-en
General
-
Target
jetsoff7785645.exe
-
Size
1.3MB
-
MD5
e490f6c7cd9da30e00552d99d40a67d5
-
SHA1
303aa4cecd54421ada7ae26d4e226cdd7272bff7
-
SHA256
03df164dae575c2017f7e03af8a2fab8635366e6eca3db93501233ed641d022e
-
SHA512
7094940fa63a295b42d880d1d2badf4f9afad0d95db37f77432124f6d2571f224093603a65e4c81d02ce7cbdf4550b33ab262853e4d259e9d4ec0e26896e341e
-
SSDEEP
24576:iAOcZXp0NBVQVxjvhGYux6V7xRF2UkjPV99npuezy71oporahu:ohHQVVvhJI43YUkj9fZe6GH
Malware Config
Extracted
formbook
4.1
je14
innervisionbuildings.com
theenergysocialite.com
565548.com
panghr.com
onlyonesolutions.com
stjohnzone6.com
cnotes.rest
helfeb.online
xixi-s-inc.club
easilyentered.com
theshopx.store
mrclean-ac.com
miamibeachwateradventures.com
jpearce.co.uk
seseragi-bunkou.com
minimaddie.com
commbank-help-849c3.com
segohandelsonderneming.com
namthanhreal.com
fototerapi.online
your-download.com
klindt.one
sellerscourt.com
francoislambert.store
smokedoutvapes.co.uk
rundacg.com
flavors-and-spices-lyon.com
qifengsuo.com
sunnyislesgardens.com
tunneldutransit.com
restorecodes.website
blast4me.com
bingser.space
co-gpco.com
emporioaliwen.com
mr5g.com
abcp666.com
consulvip.net
sagaming168.info
zjpbhsuz.top
socal-labworx.com
arethaglennevents.com
rafiqsiregar.com
esgh2.com
veirdmusic.com
abzcc.xyz
8065yp.com
dronebazar.com
duetpbr.com
apartamentoslaencantada.com
digigold.info
homedecorsuppliers.com
duenorthrm.com
xmmdsy.com
ddstennessee.com
marmeluz.com
ragnallhess.com
methinelli.com
randomlymetheseer.com
magicgrowthproducts.com
shreejistudio.com
mattress-37684.com
yellyfishfilms.com
www1111cpw.com
tigermedlagroup.com
Signatures
-
Formbook payload 10 IoCs
Processes:
resource yara_rule behavioral1/memory/1996-69-0x000000000041F120-mapping.dmp formbook behavioral1/memory/1996-68-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1724-72-0x0000000000400000-0x0000000000912000-memory.dmp formbook behavioral1/memory/1724-73-0x000000000041F120-mapping.dmp formbook behavioral1/memory/1996-75-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1724-84-0x0000000000400000-0x0000000000912000-memory.dmp formbook behavioral1/memory/1816-88-0x0000000000090000-0x00000000000BF000-memory.dmp formbook behavioral1/memory/1996-94-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/288-97-0x0000000000080000-0x00000000000AF000-memory.dmp formbook behavioral1/memory/1816-100-0x0000000000090000-0x00000000000BF000-memory.dmp formbook -
Executes dropped EXE 1 IoCs
Processes:
lporbpo.pifpid process 916 lporbpo.pif -
Loads dropped DLL 4 IoCs
Processes:
jetsoff7785645.exepid process 1520 jetsoff7785645.exe 1520 jetsoff7785645.exe 1520 jetsoff7785645.exe 1520 jetsoff7785645.exe -
Suspicious use of SetThreadContext 6 IoCs
Processes:
lporbpo.pifRegSvcs.exeRegSvcs.exemsiexec.exedescription pid process target process PID 916 set thread context of 1996 916 lporbpo.pif RegSvcs.exe PID 916 set thread context of 1724 916 lporbpo.pif RegSvcs.exe PID 1996 set thread context of 1272 1996 RegSvcs.exe Explorer.EXE PID 1724 set thread context of 1272 1724 RegSvcs.exe Explorer.EXE PID 1996 set thread context of 1272 1996 RegSvcs.exe Explorer.EXE PID 1816 set thread context of 1272 1816 msiexec.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
RegSvcs.exeRegSvcs.exemsiexec.exewlanext.exepid process 1996 RegSvcs.exe 1996 RegSvcs.exe 1724 RegSvcs.exe 1724 RegSvcs.exe 1816 msiexec.exe 1816 msiexec.exe 1996 RegSvcs.exe 288 wlanext.exe 1816 msiexec.exe 1816 msiexec.exe 1816 msiexec.exe 1816 msiexec.exe 1816 msiexec.exe 1816 msiexec.exe 1816 msiexec.exe 1816 msiexec.exe 1816 msiexec.exe 1816 msiexec.exe 1816 msiexec.exe 1816 msiexec.exe 1816 msiexec.exe 1816 msiexec.exe 1816 msiexec.exe 1816 msiexec.exe 1816 msiexec.exe 1816 msiexec.exe 1816 msiexec.exe 1816 msiexec.exe 1816 msiexec.exe 1816 msiexec.exe -
Suspicious behavior: MapViewOfSection 9 IoCs
Processes:
RegSvcs.exeRegSvcs.exemsiexec.exepid process 1996 RegSvcs.exe 1724 RegSvcs.exe 1724 RegSvcs.exe 1724 RegSvcs.exe 1816 msiexec.exe 1996 RegSvcs.exe 1996 RegSvcs.exe 1996 RegSvcs.exe 1816 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
RegSvcs.exeRegSvcs.exemsiexec.exewlanext.exedescription pid process Token: SeDebugPrivilege 1996 RegSvcs.exe Token: SeDebugPrivilege 1724 RegSvcs.exe Token: SeDebugPrivilege 1816 msiexec.exe Token: SeDebugPrivilege 288 wlanext.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1272 Explorer.EXE 1272 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1272 Explorer.EXE 1272 Explorer.EXE -
Suspicious use of WriteProcessMemory 41 IoCs
Processes:
jetsoff7785645.exelporbpo.pifExplorer.EXEmsiexec.exedescription pid process target process PID 1520 wrote to memory of 916 1520 jetsoff7785645.exe lporbpo.pif PID 1520 wrote to memory of 916 1520 jetsoff7785645.exe lporbpo.pif PID 1520 wrote to memory of 916 1520 jetsoff7785645.exe lporbpo.pif PID 1520 wrote to memory of 916 1520 jetsoff7785645.exe lporbpo.pif PID 1520 wrote to memory of 916 1520 jetsoff7785645.exe lporbpo.pif PID 1520 wrote to memory of 916 1520 jetsoff7785645.exe lporbpo.pif PID 1520 wrote to memory of 916 1520 jetsoff7785645.exe lporbpo.pif PID 916 wrote to memory of 1724 916 lporbpo.pif RegSvcs.exe PID 916 wrote to memory of 1724 916 lporbpo.pif RegSvcs.exe PID 916 wrote to memory of 1724 916 lporbpo.pif RegSvcs.exe PID 916 wrote to memory of 1724 916 lporbpo.pif RegSvcs.exe PID 916 wrote to memory of 1724 916 lporbpo.pif RegSvcs.exe PID 916 wrote to memory of 1724 916 lporbpo.pif RegSvcs.exe PID 916 wrote to memory of 1724 916 lporbpo.pif RegSvcs.exe PID 916 wrote to memory of 1996 916 lporbpo.pif RegSvcs.exe PID 916 wrote to memory of 1996 916 lporbpo.pif RegSvcs.exe PID 916 wrote to memory of 1996 916 lporbpo.pif RegSvcs.exe PID 916 wrote to memory of 1996 916 lporbpo.pif RegSvcs.exe PID 916 wrote to memory of 1996 916 lporbpo.pif RegSvcs.exe PID 916 wrote to memory of 1996 916 lporbpo.pif RegSvcs.exe PID 916 wrote to memory of 1996 916 lporbpo.pif RegSvcs.exe PID 916 wrote to memory of 1996 916 lporbpo.pif RegSvcs.exe PID 916 wrote to memory of 1996 916 lporbpo.pif RegSvcs.exe PID 916 wrote to memory of 1996 916 lporbpo.pif RegSvcs.exe PID 916 wrote to memory of 1724 916 lporbpo.pif RegSvcs.exe PID 916 wrote to memory of 1724 916 lporbpo.pif RegSvcs.exe PID 1272 wrote to memory of 1816 1272 Explorer.EXE msiexec.exe PID 1272 wrote to memory of 1816 1272 Explorer.EXE msiexec.exe PID 1272 wrote to memory of 1816 1272 Explorer.EXE msiexec.exe PID 1272 wrote to memory of 1816 1272 Explorer.EXE msiexec.exe PID 1272 wrote to memory of 1816 1272 Explorer.EXE msiexec.exe PID 1272 wrote to memory of 1816 1272 Explorer.EXE msiexec.exe PID 1272 wrote to memory of 1816 1272 Explorer.EXE msiexec.exe PID 1816 wrote to memory of 1412 1816 msiexec.exe cmd.exe PID 1816 wrote to memory of 1412 1816 msiexec.exe cmd.exe PID 1816 wrote to memory of 1412 1816 msiexec.exe cmd.exe PID 1816 wrote to memory of 1412 1816 msiexec.exe cmd.exe PID 1272 wrote to memory of 288 1272 Explorer.EXE wlanext.exe PID 1272 wrote to memory of 288 1272 Explorer.EXE wlanext.exe PID 1272 wrote to memory of 288 1272 Explorer.EXE wlanext.exe PID 1272 wrote to memory of 288 1272 Explorer.EXE wlanext.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jetsoff7785645.exe"C:\Users\Admin\AppData\Local\Temp\jetsoff7785645.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6_64\lporbpo.pif"C:\Users\Admin\AppData\Local\Temp\6_64\lporbpo.pif" fwouagex.osh3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\6_64\bdoiapgxat.jbvFilesize
370KB
MD5face4060089272f6ae3596e0fd074dfb
SHA17297224ceb6ca4e91eb34c916adc27d78f9fcca4
SHA256d2aba9392dd810d9146f5ddce3c061d59424baf4513aa735c6495564de0fc242
SHA512a4b12e86d964b69c26100382563f936b959b028023629146f5119b6560e34cd4bfdfc1247136466fb348d34c057b7bbc7839d402efac311e8125f3e733537702
-
C:\Users\Admin\AppData\Local\Temp\6_64\fwouagex.oshFilesize
185.3MB
MD5d8f85f88960bad8c833918af514305d5
SHA162cb58d3d7c26e98be9a2d94706ff4e35158948d
SHA256c5fe9515dc7eb87ddb5ec6382ca9ac12f393dff0040bd20e92c060ff07413fe7
SHA5129ddd3cc4f634f8b1c3fb2ffd8671763809106c66a8fbdb96f6b12204970261f8de096ae55aecf44f3888422659c1c01c1c1bcdeb4120fc6c189bafebe2b0f59d
-
C:\Users\Admin\AppData\Local\Temp\6_64\lporbpo.pifFilesize
1.7MB
MD5dd3466f64841cf21fc31f63f03dbfd29
SHA13878c8e52203d792c6f672595f7c78ab27ce3f04
SHA2564fe3004208ed574521992dd1ba3d900b75a0f02f1d63ba1e531d309e85ffa06b
SHA512adf3fe8378f7da5ba278db9a1df4cc7b5cff12398ec39ee7037382ebf57897de8bec72be64b5e7332bdb7ed865788dcb6ef4ceda6654e1153d39fe84b011b057
-
C:\Users\Admin\AppData\Local\Temp\6_64\uuvrscqbfj.xmlFilesize
38KB
MD5e8eeee13ee27e7f90d2b123b85b76e5f
SHA11257f205999b5f5477b43f70cc907c8e629056bf
SHA2566524c5bbb9e2cda587aa3bec11f937b2f1aaa1005c6836d0c858f0e9fbcd55a6
SHA5123e6bf380902e63675de0c20fcbc47cffc508f69caf5dac1390b83b6444d3cbafb5c6af3cd878ad4a6c7e19adbbce66a12cf1b00c6ab496e9cdfd960a6b18e26b
-
\Users\Admin\AppData\Local\Temp\6_64\lporbpo.pifFilesize
1.7MB
MD5dd3466f64841cf21fc31f63f03dbfd29
SHA13878c8e52203d792c6f672595f7c78ab27ce3f04
SHA2564fe3004208ed574521992dd1ba3d900b75a0f02f1d63ba1e531d309e85ffa06b
SHA512adf3fe8378f7da5ba278db9a1df4cc7b5cff12398ec39ee7037382ebf57897de8bec72be64b5e7332bdb7ed865788dcb6ef4ceda6654e1153d39fe84b011b057
-
\Users\Admin\AppData\Local\Temp\6_64\lporbpo.pifFilesize
1.7MB
MD5dd3466f64841cf21fc31f63f03dbfd29
SHA13878c8e52203d792c6f672595f7c78ab27ce3f04
SHA2564fe3004208ed574521992dd1ba3d900b75a0f02f1d63ba1e531d309e85ffa06b
SHA512adf3fe8378f7da5ba278db9a1df4cc7b5cff12398ec39ee7037382ebf57897de8bec72be64b5e7332bdb7ed865788dcb6ef4ceda6654e1153d39fe84b011b057
-
\Users\Admin\AppData\Local\Temp\6_64\lporbpo.pifFilesize
1.7MB
MD5dd3466f64841cf21fc31f63f03dbfd29
SHA13878c8e52203d792c6f672595f7c78ab27ce3f04
SHA2564fe3004208ed574521992dd1ba3d900b75a0f02f1d63ba1e531d309e85ffa06b
SHA512adf3fe8378f7da5ba278db9a1df4cc7b5cff12398ec39ee7037382ebf57897de8bec72be64b5e7332bdb7ed865788dcb6ef4ceda6654e1153d39fe84b011b057
-
\Users\Admin\AppData\Local\Temp\6_64\lporbpo.pifFilesize
1.7MB
MD5dd3466f64841cf21fc31f63f03dbfd29
SHA13878c8e52203d792c6f672595f7c78ab27ce3f04
SHA2564fe3004208ed574521992dd1ba3d900b75a0f02f1d63ba1e531d309e85ffa06b
SHA512adf3fe8378f7da5ba278db9a1df4cc7b5cff12398ec39ee7037382ebf57897de8bec72be64b5e7332bdb7ed865788dcb6ef4ceda6654e1153d39fe84b011b057
-
memory/288-93-0x0000000000000000-mapping.dmp
-
memory/288-97-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/288-95-0x00000000002C0000-0x00000000002D6000-memory.dmpFilesize
88KB
-
memory/288-96-0x00000000020A0000-0x00000000023A3000-memory.dmpFilesize
3.0MB
-
memory/916-59-0x0000000000000000-mapping.dmp
-
memory/1272-101-0x0000000007AC0000-0x0000000007BF2000-memory.dmpFilesize
1.2MB
-
memory/1272-92-0x0000000007AC0000-0x0000000007BF2000-memory.dmpFilesize
1.2MB
-
memory/1272-102-0x0000000007C00000-0x0000000007D3D000-memory.dmpFilesize
1.2MB
-
memory/1272-99-0x0000000007C00000-0x0000000007D3D000-memory.dmpFilesize
1.2MB
-
memory/1272-82-0x0000000006E10000-0x0000000006F64000-memory.dmpFilesize
1.3MB
-
memory/1272-79-0x0000000006CB0000-0x0000000006E03000-memory.dmpFilesize
1.3MB
-
memory/1412-86-0x0000000000000000-mapping.dmp
-
memory/1520-54-0x0000000074D61000-0x0000000074D63000-memory.dmpFilesize
8KB
-
memory/1724-73-0x000000000041F120-mapping.dmp
-
memory/1724-81-0x0000000000220000-0x0000000000234000-memory.dmpFilesize
80KB
-
memory/1724-80-0x0000000000D90000-0x0000000001093000-memory.dmpFilesize
3.0MB
-
memory/1724-84-0x0000000000400000-0x0000000000912000-memory.dmpFilesize
5.1MB
-
memory/1724-72-0x0000000000400000-0x0000000000912000-memory.dmpFilesize
5.1MB
-
memory/1724-70-0x0000000000400000-0x0000000000912000-memory.dmpFilesize
5.1MB
-
memory/1816-83-0x0000000000000000-mapping.dmp
-
memory/1816-98-0x0000000001F80000-0x0000000002013000-memory.dmpFilesize
588KB
-
memory/1816-87-0x00000000006B0000-0x00000000006C4000-memory.dmpFilesize
80KB
-
memory/1816-88-0x0000000000090000-0x00000000000BF000-memory.dmpFilesize
188KB
-
memory/1816-89-0x0000000002210000-0x0000000002513000-memory.dmpFilesize
3.0MB
-
memory/1816-100-0x0000000000090000-0x00000000000BF000-memory.dmpFilesize
188KB
-
memory/1996-65-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1996-94-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1996-91-0x00000000002F0000-0x0000000000304000-memory.dmpFilesize
80KB
-
memory/1996-77-0x00000000002A0000-0x00000000002B4000-memory.dmpFilesize
80KB
-
memory/1996-76-0x0000000000810000-0x0000000000B13000-memory.dmpFilesize
3.0MB
-
memory/1996-75-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1996-68-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1996-69-0x000000000041F120-mapping.dmp
-
memory/1996-66-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB