Analysis
-
max time kernel
150s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03-11-2022 15:39
Static task
static1
Behavioral task
behavioral1
Sample
jetss4321.exe
Resource
win7-20220812-en
General
-
Target
jetss4321.exe
-
Size
213KB
-
MD5
0f558015aea4fab0704f0a81241c95de
-
SHA1
701d1f39fd047f93543d63fa93b7cdf6ef29d1ee
-
SHA256
983fe597e0687a206126a3a25d356b3f30431883e692fb1744c7d655b9b6ee59
-
SHA512
19da1777a225f9d9f59717506758eb448721d1ed534338919a181d1a5471a116560601125e5cda4f75e4720f962dfada522cabcede7a633bf36ea40c8f638425
-
SSDEEP
6144:qweEpTH0JdteiykaUKT3CR+AVTCkTgp3c2n7Zp:bD0JWkICEk2ki3c41p
Malware Config
Extracted
formbook
4.1
je14
innervisionbuildings.com
theenergysocialite.com
565548.com
panghr.com
onlyonesolutions.com
stjohnzone6.com
cnotes.rest
helfeb.online
xixi-s-inc.club
easilyentered.com
theshopx.store
mrclean-ac.com
miamibeachwateradventures.com
jpearce.co.uk
seseragi-bunkou.com
minimaddie.com
commbank-help-849c3.com
segohandelsonderneming.com
namthanhreal.com
fototerapi.online
your-download.com
klindt.one
sellerscourt.com
francoislambert.store
smokedoutvapes.co.uk
rundacg.com
flavors-and-spices-lyon.com
qifengsuo.com
sunnyislesgardens.com
tunneldutransit.com
restorecodes.website
blast4me.com
bingser.space
co-gpco.com
emporioaliwen.com
mr5g.com
abcp666.com
consulvip.net
sagaming168.info
zjpbhsuz.top
socal-labworx.com
arethaglennevents.com
rafiqsiregar.com
esgh2.com
veirdmusic.com
abzcc.xyz
8065yp.com
dronebazar.com
duetpbr.com
apartamentoslaencantada.com
digigold.info
homedecorsuppliers.com
duenorthrm.com
xmmdsy.com
ddstennessee.com
marmeluz.com
ragnallhess.com
methinelli.com
randomlymetheseer.com
magicgrowthproducts.com
shreejistudio.com
mattress-37684.com
yellyfishfilms.com
www1111cpw.com
tigermedlagroup.com
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1644-64-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1644-69-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1528-73-0x0000000000070000-0x000000000009F000-memory.dmp formbook behavioral1/memory/1528-76-0x0000000000070000-0x000000000009F000-memory.dmp formbook -
Executes dropped EXE 2 IoCs
Processes:
dddlirbk.exedddlirbk.exepid process 1968 dddlirbk.exe 1644 dddlirbk.exe -
Loads dropped DLL 2 IoCs
Processes:
jetss4321.exedddlirbk.exepid process 1088 jetss4321.exe 1968 dddlirbk.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
dddlirbk.exedddlirbk.exewscript.exedescription pid process target process PID 1968 set thread context of 1644 1968 dddlirbk.exe dddlirbk.exe PID 1644 set thread context of 1416 1644 dddlirbk.exe Explorer.EXE PID 1528 set thread context of 1416 1528 wscript.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 27 IoCs
Processes:
dddlirbk.exewscript.exepid process 1644 dddlirbk.exe 1644 dddlirbk.exe 1528 wscript.exe 1528 wscript.exe 1528 wscript.exe 1528 wscript.exe 1528 wscript.exe 1528 wscript.exe 1528 wscript.exe 1528 wscript.exe 1528 wscript.exe 1528 wscript.exe 1528 wscript.exe 1528 wscript.exe 1528 wscript.exe 1528 wscript.exe 1528 wscript.exe 1528 wscript.exe 1528 wscript.exe 1528 wscript.exe 1528 wscript.exe 1528 wscript.exe 1528 wscript.exe 1528 wscript.exe 1528 wscript.exe 1528 wscript.exe 1528 wscript.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
dddlirbk.exedddlirbk.exewscript.exepid process 1968 dddlirbk.exe 1644 dddlirbk.exe 1644 dddlirbk.exe 1644 dddlirbk.exe 1528 wscript.exe 1528 wscript.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
dddlirbk.exewscript.exedescription pid process Token: SeDebugPrivilege 1644 dddlirbk.exe Token: SeDebugPrivilege 1528 wscript.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1416 Explorer.EXE 1416 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1416 Explorer.EXE 1416 Explorer.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
jetss4321.exedddlirbk.exeExplorer.EXEwscript.exedescription pid process target process PID 1088 wrote to memory of 1968 1088 jetss4321.exe dddlirbk.exe PID 1088 wrote to memory of 1968 1088 jetss4321.exe dddlirbk.exe PID 1088 wrote to memory of 1968 1088 jetss4321.exe dddlirbk.exe PID 1088 wrote to memory of 1968 1088 jetss4321.exe dddlirbk.exe PID 1968 wrote to memory of 1644 1968 dddlirbk.exe dddlirbk.exe PID 1968 wrote to memory of 1644 1968 dddlirbk.exe dddlirbk.exe PID 1968 wrote to memory of 1644 1968 dddlirbk.exe dddlirbk.exe PID 1968 wrote to memory of 1644 1968 dddlirbk.exe dddlirbk.exe PID 1968 wrote to memory of 1644 1968 dddlirbk.exe dddlirbk.exe PID 1416 wrote to memory of 1528 1416 Explorer.EXE wscript.exe PID 1416 wrote to memory of 1528 1416 Explorer.EXE wscript.exe PID 1416 wrote to memory of 1528 1416 Explorer.EXE wscript.exe PID 1416 wrote to memory of 1528 1416 Explorer.EXE wscript.exe PID 1528 wrote to memory of 1780 1528 wscript.exe cmd.exe PID 1528 wrote to memory of 1780 1528 wscript.exe cmd.exe PID 1528 wrote to memory of 1780 1528 wscript.exe cmd.exe PID 1528 wrote to memory of 1780 1528 wscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\jetss4321.exe"C:\Users\Admin\AppData\Local\Temp\jetss4321.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\dddlirbk.exe"C:\Users\Admin\AppData\Local\Temp\dddlirbk.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\dddlirbk.exe"C:\Users\Admin\AppData\Local\Temp\dddlirbk.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1644 -
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\dddlirbk.exe"3⤵PID:1780
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\bqinymrhxf.ygFilesize
5KB
MD51aaeec34da067db10371ba0d65bd2fdf
SHA1ab511719298e745360040a627d96ddba9f5aa9c5
SHA2561f0a4869a22601f432ba6b2630ee4b7b30d2a924cc18df5dda45ff89734c8931
SHA51222f2a8db2a256d919144a299b49c8f59193255a2ac53eed793cff20996e79ffe26fd0266bce143128d95ca2dc4863e835540068a5e51895025bf664272defca9
-
C:\Users\Admin\AppData\Local\Temp\dddlirbk.exeFilesize
6KB
MD54e60205c6fc0bbcb23c9ca921ec6729a
SHA1a4b6d99ccab3feed7201d12afa33af49fee0375c
SHA25609c8312b73373be5eebddda230dc71540ca14b3ace63e3193410a8cde8e905c4
SHA512688afd27f6f1bef55f4ccb042037015e979e67c4d56a37340f45080ca690a18f9d168a6c4f8653c6e3da253b36e26191b504ee0c7eafd43a43fa2c82f6fa5d8b
-
C:\Users\Admin\AppData\Local\Temp\dddlirbk.exeFilesize
6KB
MD54e60205c6fc0bbcb23c9ca921ec6729a
SHA1a4b6d99ccab3feed7201d12afa33af49fee0375c
SHA25609c8312b73373be5eebddda230dc71540ca14b3ace63e3193410a8cde8e905c4
SHA512688afd27f6f1bef55f4ccb042037015e979e67c4d56a37340f45080ca690a18f9d168a6c4f8653c6e3da253b36e26191b504ee0c7eafd43a43fa2c82f6fa5d8b
-
C:\Users\Admin\AppData\Local\Temp\dddlirbk.exeFilesize
6KB
MD54e60205c6fc0bbcb23c9ca921ec6729a
SHA1a4b6d99ccab3feed7201d12afa33af49fee0375c
SHA25609c8312b73373be5eebddda230dc71540ca14b3ace63e3193410a8cde8e905c4
SHA512688afd27f6f1bef55f4ccb042037015e979e67c4d56a37340f45080ca690a18f9d168a6c4f8653c6e3da253b36e26191b504ee0c7eafd43a43fa2c82f6fa5d8b
-
C:\Users\Admin\AppData\Local\Temp\dzotwnqy.huFilesize
185KB
MD53bea76e24c8cb495dee7e2a748025d30
SHA19f10de59f3dfb639e6fbe4236854fa73d6f78991
SHA256765bed83e6d866446fcd3fe7398f97e889c21a57f6bb4c2bd552c48e1b074a32
SHA5120a05cace5349e733526f51e2db95a794695fe71f8bcb645401a955d66dcd3d0b7af486df3572ad2fc9825d173edd243ffeab33e106abcead508c114c03c22592
-
\Users\Admin\AppData\Local\Temp\dddlirbk.exeFilesize
6KB
MD54e60205c6fc0bbcb23c9ca921ec6729a
SHA1a4b6d99ccab3feed7201d12afa33af49fee0375c
SHA25609c8312b73373be5eebddda230dc71540ca14b3ace63e3193410a8cde8e905c4
SHA512688afd27f6f1bef55f4ccb042037015e979e67c4d56a37340f45080ca690a18f9d168a6c4f8653c6e3da253b36e26191b504ee0c7eafd43a43fa2c82f6fa5d8b
-
\Users\Admin\AppData\Local\Temp\dddlirbk.exeFilesize
6KB
MD54e60205c6fc0bbcb23c9ca921ec6729a
SHA1a4b6d99ccab3feed7201d12afa33af49fee0375c
SHA25609c8312b73373be5eebddda230dc71540ca14b3ace63e3193410a8cde8e905c4
SHA512688afd27f6f1bef55f4ccb042037015e979e67c4d56a37340f45080ca690a18f9d168a6c4f8653c6e3da253b36e26191b504ee0c7eafd43a43fa2c82f6fa5d8b
-
memory/1088-54-0x0000000076681000-0x0000000076683000-memory.dmpFilesize
8KB
-
memory/1416-67-0x00000000041C0000-0x000000000431A000-memory.dmpFilesize
1.4MB
-
memory/1416-77-0x0000000004DE0000-0x0000000004F1A000-memory.dmpFilesize
1.2MB
-
memory/1416-75-0x0000000004DE0000-0x0000000004F1A000-memory.dmpFilesize
1.2MB
-
memory/1528-72-0x0000000002140000-0x0000000002443000-memory.dmpFilesize
3.0MB
-
memory/1528-68-0x0000000000000000-mapping.dmp
-
memory/1528-71-0x0000000000370000-0x0000000000396000-memory.dmpFilesize
152KB
-
memory/1528-73-0x0000000000070000-0x000000000009F000-memory.dmpFilesize
188KB
-
memory/1528-74-0x00000000003A0000-0x0000000000433000-memory.dmpFilesize
588KB
-
memory/1528-76-0x0000000000070000-0x000000000009F000-memory.dmpFilesize
188KB
-
memory/1644-66-0x0000000000190000-0x00000000001A4000-memory.dmpFilesize
80KB
-
memory/1644-65-0x0000000000970000-0x0000000000C73000-memory.dmpFilesize
3.0MB
-
memory/1644-69-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1644-64-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1644-62-0x000000000041F120-mapping.dmp
-
memory/1780-70-0x0000000000000000-mapping.dmp
-
memory/1968-56-0x0000000000000000-mapping.dmp