Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
03-11-2022 12:59
Static task
static1
Behavioral task
behavioral1
Sample
Specification 5678.exe
Resource
win7-20220812-en
General
-
Target
Specification 5678.exe
-
Size
783KB
-
MD5
10a84bec0fb372b198ef40ca39f55bd8
-
SHA1
3865a090d536a52b9e2625ca4eee5e3b346b74f0
-
SHA256
c85a06161a28fcfcc80891d618c37d37b72e970be0be060fec72925424412044
-
SHA512
fc4f3cb89b437a2e29b95c4b39c8dbc5a3cde31d6b73281d1080c4dc29788f56fe39580eb9498ac8b250fa81602bd4dcc1ea825978f3e06817f8b0ed6886522c
-
SSDEEP
12288:jb7Vnri6k1mS35TcRi1fHlFKIBVKlAhQhngAKEogIYWkejwFGf:jRri6koS35rHbzMnngAKEogIreG
Malware Config
Extracted
formbook
nhg6
FSZGb3Of7ECMIOG9mh1ql/w=
DAPP3Pm63eo+zg==
khOZTuClxYsKQsZALgy3ob9TFAk=
5uWol2f/RF3CAwFd
P70LqPOi2iE9g4vpPH1Lk8E0K6tC
KBRl7TSt3eo+zg==
rqedJWUJXKkDbORa
lpORtIg8lvMKbJ77PQW9kes=
Qinv+gsohAIooqyTcfUYgZ/IVxQ=
J0L2ggPAiE2gxm4=
r/I6qOGI5noJCghf
khJg6HKM6l9okVK+pg==
HRMTK/6p3eo+zg==
HqMiuv2JaKYJCghf
+FzGYtsGTpK46OkKkh5C
BBrOUpUY91R/r8gkPwrcuw==
klWfn2smdNcqog581h6vX7px
t8uvr7+R7IPaHSOH1hqvX7px
bHdghkj64OjzY2hOLa/WObrRkkeJjQ==
s3/smhoylh1J0mPS4aDHBDRyJw==
Eu3Z//8qkb4Pgnxjs7KvX7px
Du/M2tykfsrvKI21BL4=
PSM470DF9TZfxg==
g8+4SOr4WukPPHaaxWhV
Wp6eQXMJ4vcGbPvJGeO4K2cjEQM=
sUu3agUQbwZBjWbTrA==
cD2jpmsR7f74LQOoiG5H
3uWfnmL43kmM0eYKkh5C
D8hIaSK6nOYyvuwKkh5C
2jukR8PuW9opgKsne71aPJfpk2rYfuk6bQ==
8Kn8jxXXsvtDzvYKkh5C
PBS059Wedb7mSnjpPdLzU7s0K6tC
/RMCOf+e9YCnIxQSu2marA==
wkO7TZc1jPoLNcOp4vUglpKzLw==
0IEGMPKlhU2gxm4=
2T8RCBr43vVVaf5I
fljAttGHXHWMq8RIqzxMpxG/r+LsFTk=
/og98Tea9nueONlLQD2egqUdkAs=
DakWt1Bc6TFTzA==
h1O9avS4iE2gxm4=
uu4WRzneVStU1w==
LsZmJl8YeP5Vaf5I
nHdkkYug/oK87Hcp0JSQyxC7qOLsFTk=
2oURQhXaNMIXkEcjayLqQmcjEQM=
NfVyM2uD3eo+zg==
nT20ZP8fheL5IiV4xhqvX7px
dbeCkGH4309r5gp24CCvX7px
72jolSNVrfj/NBu/Bn/evQ==
jGtO0Rey6DhVmKwRUtGvX7px
RPd7qXExmzSGlZHVuw==
X70pwhG0S4qZv2w=
9xPzBiP3SNEaU1KuDFRMtE3fYMons6VE
gXVziEtEmsbg/SeBwQGIoKj8tK01jw==
+B9xAkQQb+wSkhl/T08gEjAs9IugoA9I
KMgonCDitr/U/aiSc/bZdfnSjepK
belockUJb/okrNEwgBdDjsA0K6tC
FGDUFuN9k03/08Ks/bw=
nRGNPr25BpzvAXbgwJJK
7awA/seC0Uhr3dLAHB1ql/w=
glK6Uc2Mzma3/E196bQ=
O4Jwj11Xqv9IjWbTrA==
s++5zMnzj8z2aWY=
eJN2bFImkiB4xOAKkh5C
xsaRhotGVStU1w==
liuhejing.org
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Specification 5678.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Specification 5678.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Specification 5678.exeRegSvcs.execmmon32.exedescription pid process target process PID 3704 set thread context of 2556 3704 Specification 5678.exe RegSvcs.exe PID 2556 set thread context of 2440 2556 RegSvcs.exe Explorer.EXE PID 2200 set thread context of 2440 2200 cmmon32.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Processes:
cmmon32.exedescription ioc process Key created \Registry\User\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 cmmon32.exe -
Suspicious behavior: EnumeratesProcesses 50 IoCs
Processes:
Specification 5678.exepowershell.exeRegSvcs.execmmon32.exepid process 3704 Specification 5678.exe 3704 Specification 5678.exe 3860 powershell.exe 2556 RegSvcs.exe 2556 RegSvcs.exe 2556 RegSvcs.exe 2556 RegSvcs.exe 2556 RegSvcs.exe 2556 RegSvcs.exe 2556 RegSvcs.exe 2556 RegSvcs.exe 3860 powershell.exe 2200 cmmon32.exe 2200 cmmon32.exe 2200 cmmon32.exe 2200 cmmon32.exe 2200 cmmon32.exe 2200 cmmon32.exe 2200 cmmon32.exe 2200 cmmon32.exe 2200 cmmon32.exe 2200 cmmon32.exe 2200 cmmon32.exe 2200 cmmon32.exe 2200 cmmon32.exe 2200 cmmon32.exe 2200 cmmon32.exe 2200 cmmon32.exe 2200 cmmon32.exe 2200 cmmon32.exe 2200 cmmon32.exe 2200 cmmon32.exe 2200 cmmon32.exe 2200 cmmon32.exe 2200 cmmon32.exe 2200 cmmon32.exe 2200 cmmon32.exe 2200 cmmon32.exe 2200 cmmon32.exe 2200 cmmon32.exe 2200 cmmon32.exe 2200 cmmon32.exe 2200 cmmon32.exe 2200 cmmon32.exe 2200 cmmon32.exe 2200 cmmon32.exe 2200 cmmon32.exe 2200 cmmon32.exe 2200 cmmon32.exe 2200 cmmon32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2440 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
RegSvcs.execmmon32.exepid process 2556 RegSvcs.exe 2556 RegSvcs.exe 2556 RegSvcs.exe 2200 cmmon32.exe 2200 cmmon32.exe 2200 cmmon32.exe 2200 cmmon32.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
Specification 5678.exepowershell.exeRegSvcs.execmmon32.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 3704 Specification 5678.exe Token: SeDebugPrivilege 3860 powershell.exe Token: SeDebugPrivilege 2556 RegSvcs.exe Token: SeDebugPrivilege 2200 cmmon32.exe Token: SeShutdownPrivilege 2440 Explorer.EXE Token: SeCreatePagefilePrivilege 2440 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
Specification 5678.exeExplorer.EXEcmmon32.exedescription pid process target process PID 3704 wrote to memory of 3860 3704 Specification 5678.exe powershell.exe PID 3704 wrote to memory of 3860 3704 Specification 5678.exe powershell.exe PID 3704 wrote to memory of 3860 3704 Specification 5678.exe powershell.exe PID 3704 wrote to memory of 4212 3704 Specification 5678.exe schtasks.exe PID 3704 wrote to memory of 4212 3704 Specification 5678.exe schtasks.exe PID 3704 wrote to memory of 4212 3704 Specification 5678.exe schtasks.exe PID 3704 wrote to memory of 2556 3704 Specification 5678.exe RegSvcs.exe PID 3704 wrote to memory of 2556 3704 Specification 5678.exe RegSvcs.exe PID 3704 wrote to memory of 2556 3704 Specification 5678.exe RegSvcs.exe PID 3704 wrote to memory of 2556 3704 Specification 5678.exe RegSvcs.exe PID 3704 wrote to memory of 2556 3704 Specification 5678.exe RegSvcs.exe PID 3704 wrote to memory of 2556 3704 Specification 5678.exe RegSvcs.exe PID 2440 wrote to memory of 2200 2440 Explorer.EXE cmmon32.exe PID 2440 wrote to memory of 2200 2440 Explorer.EXE cmmon32.exe PID 2440 wrote to memory of 2200 2440 Explorer.EXE cmmon32.exe PID 2200 wrote to memory of 4368 2200 cmmon32.exe Firefox.exe PID 2200 wrote to memory of 4368 2200 cmmon32.exe Firefox.exe PID 2200 wrote to memory of 4368 2200 cmmon32.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Specification 5678.exe"C:\Users\Admin\AppData\Local\Temp\Specification 5678.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\pPXFqtKQrbbp.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pPXFqtKQrbbp" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA71D.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpA71D.tmpFilesize
1KB
MD5d7e4d271a54c5fd0a645e90ca59b1546
SHA14af1a6da3cdeb0d64266e7eb151afcbb8d323132
SHA256c4452aa9743a57fda3f6c39ee4a461cbba708f189d6e76b05c0087e1b2f83714
SHA5127c6b53963a43a023741a375849b96b4076d48881a08d68df115e8236e4c07ec546f51b613b30adaabe99e1928e97b61af4b734fa6202d035e0f02814072a1c3f
-
memory/2200-158-0x0000000000000000-mapping.dmp
-
memory/2200-161-0x0000000000C00000-0x0000000000C0C000-memory.dmpFilesize
48KB
-
memory/2200-162-0x0000000001200000-0x000000000122D000-memory.dmpFilesize
180KB
-
memory/2200-165-0x00000000031A0000-0x00000000034EA000-memory.dmpFilesize
3.3MB
-
memory/2200-171-0x0000000001200000-0x000000000122D000-memory.dmpFilesize
180KB
-
memory/2200-169-0x0000000002EF0000-0x0000000002F7F000-memory.dmpFilesize
572KB
-
memory/2440-154-0x0000000007D70000-0x0000000007EFA000-memory.dmpFilesize
1.5MB
-
memory/2440-172-0x0000000002EA0000-0x0000000002F5F000-memory.dmpFilesize
764KB
-
memory/2440-170-0x0000000002EA0000-0x0000000002F5F000-memory.dmpFilesize
764KB
-
memory/2556-142-0x0000000000000000-mapping.dmp
-
memory/2556-143-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2556-148-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2556-149-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2556-150-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/2556-151-0x0000000001B80000-0x0000000001ECA000-memory.dmpFilesize
3.3MB
-
memory/2556-152-0x0000000001700000-0x0000000001710000-memory.dmpFilesize
64KB
-
memory/3704-136-0x0000000007B40000-0x0000000007BDC000-memory.dmpFilesize
624KB
-
memory/3704-135-0x00000000051B0000-0x00000000051BA000-memory.dmpFilesize
40KB
-
memory/3704-134-0x0000000005100000-0x0000000005192000-memory.dmpFilesize
584KB
-
memory/3704-132-0x00000000006C0000-0x000000000078A000-memory.dmpFilesize
808KB
-
memory/3704-133-0x0000000005790000-0x0000000005D34000-memory.dmpFilesize
5.6MB
-
memory/3860-153-0x00000000067A0000-0x00000000067BE000-memory.dmpFilesize
120KB
-
memory/3860-164-0x0000000007D40000-0x0000000007DD6000-memory.dmpFilesize
600KB
-
memory/3860-157-0x0000000006D70000-0x0000000006D8E000-memory.dmpFilesize
120KB
-
memory/3860-155-0x0000000007970000-0x00000000079A2000-memory.dmpFilesize
200KB
-
memory/3860-159-0x0000000008100000-0x000000000877A000-memory.dmpFilesize
6.5MB
-
memory/3860-160-0x0000000007AC0000-0x0000000007ADA000-memory.dmpFilesize
104KB
-
memory/3860-147-0x0000000006150000-0x00000000061B6000-memory.dmpFilesize
408KB
-
memory/3860-146-0x0000000005FA0000-0x0000000006006000-memory.dmpFilesize
408KB
-
memory/3860-163-0x0000000007B30000-0x0000000007B3A000-memory.dmpFilesize
40KB
-
memory/3860-156-0x0000000071A90000-0x0000000071ADC000-memory.dmpFilesize
304KB
-
memory/3860-145-0x00000000057F0000-0x0000000005812000-memory.dmpFilesize
136KB
-
memory/3860-166-0x0000000007CF0000-0x0000000007CFE000-memory.dmpFilesize
56KB
-
memory/3860-167-0x0000000007E00000-0x0000000007E1A000-memory.dmpFilesize
104KB
-
memory/3860-168-0x0000000007DE0000-0x0000000007DE8000-memory.dmpFilesize
32KB
-
memory/3860-141-0x0000000005970000-0x0000000005F98000-memory.dmpFilesize
6.2MB
-
memory/3860-139-0x0000000005210000-0x0000000005246000-memory.dmpFilesize
216KB
-
memory/3860-137-0x0000000000000000-mapping.dmp
-
memory/4212-138-0x0000000000000000-mapping.dmp