Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
03-11-2022 15:34
Static task
static1
Behavioral task
behavioral1
Sample
jetsoff6543.exe
Resource
win7-20220812-en
General
-
Target
jetsoff6543.exe
-
Size
214KB
-
MD5
3052597dc463bafa0c102a204dbf58fc
-
SHA1
bc083a8e34abfc24ea8b94b1325354ea2f4a08bb
-
SHA256
84a150ec171d193dbd5738ade685f3225716b6945e59625ce458f0a9069860b8
-
SHA512
9925797cf5061017bcfbf37ab968c0ddeda7e7abd6d2db8abb62aeb6ca0a711672b1cfd9c8a3ef7af07cedc9b7a4d8d0071a2371caabaacd9323d270ab6d4246
-
SSDEEP
6144:qweEpoJiPJhQxjr858KG3NLsJrdtvUlAg:boJi0xnYUaJpx5g
Malware Config
Extracted
formbook
4.1
je14
innervisionbuildings.com
theenergysocialite.com
565548.com
panghr.com
onlyonesolutions.com
stjohnzone6.com
cnotes.rest
helfeb.online
xixi-s-inc.club
easilyentered.com
theshopx.store
mrclean-ac.com
miamibeachwateradventures.com
jpearce.co.uk
seseragi-bunkou.com
minimaddie.com
commbank-help-849c3.com
segohandelsonderneming.com
namthanhreal.com
fototerapi.online
your-download.com
klindt.one
sellerscourt.com
francoislambert.store
smokedoutvapes.co.uk
rundacg.com
flavors-and-spices-lyon.com
qifengsuo.com
sunnyislesgardens.com
tunneldutransit.com
restorecodes.website
blast4me.com
bingser.space
co-gpco.com
emporioaliwen.com
mr5g.com
abcp666.com
consulvip.net
sagaming168.info
zjpbhsuz.top
socal-labworx.com
arethaglennevents.com
rafiqsiregar.com
esgh2.com
veirdmusic.com
abzcc.xyz
8065yp.com
dronebazar.com
duetpbr.com
apartamentoslaencantada.com
digigold.info
homedecorsuppliers.com
duenorthrm.com
xmmdsy.com
ddstennessee.com
marmeluz.com
ragnallhess.com
methinelli.com
randomlymetheseer.com
magicgrowthproducts.com
shreejistudio.com
mattress-37684.com
yellyfishfilms.com
www1111cpw.com
tigermedlagroup.com
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/2076-139-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2076-144-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1672-146-0x0000000000C30000-0x0000000000C5F000-memory.dmp formbook behavioral2/memory/1672-149-0x0000000000C30000-0x0000000000C5F000-memory.dmp formbook -
Executes dropped EXE 2 IoCs
Processes:
qfaeenx.exeqfaeenx.exepid process 2900 qfaeenx.exe 2076 qfaeenx.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
qfaeenx.exeqfaeenx.exechkdsk.exedescription pid process target process PID 2900 set thread context of 2076 2900 qfaeenx.exe qfaeenx.exe PID 2076 set thread context of 2948 2076 qfaeenx.exe Explorer.EXE PID 1672 set thread context of 2948 1672 chkdsk.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 60 IoCs
Processes:
qfaeenx.exechkdsk.exepid process 2076 qfaeenx.exe 2076 qfaeenx.exe 2076 qfaeenx.exe 2076 qfaeenx.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2948 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
qfaeenx.exeqfaeenx.exechkdsk.exepid process 2900 qfaeenx.exe 2076 qfaeenx.exe 2076 qfaeenx.exe 2076 qfaeenx.exe 1672 chkdsk.exe 1672 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 14 IoCs
Processes:
qfaeenx.exechkdsk.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 2076 qfaeenx.exe Token: SeDebugPrivilege 1672 chkdsk.exe Token: SeShutdownPrivilege 2948 Explorer.EXE Token: SeCreatePagefilePrivilege 2948 Explorer.EXE Token: SeShutdownPrivilege 2948 Explorer.EXE Token: SeCreatePagefilePrivilege 2948 Explorer.EXE Token: SeShutdownPrivilege 2948 Explorer.EXE Token: SeCreatePagefilePrivilege 2948 Explorer.EXE Token: SeShutdownPrivilege 2948 Explorer.EXE Token: SeCreatePagefilePrivilege 2948 Explorer.EXE Token: SeShutdownPrivilege 2948 Explorer.EXE Token: SeCreatePagefilePrivilege 2948 Explorer.EXE Token: SeShutdownPrivilege 2948 Explorer.EXE Token: SeCreatePagefilePrivilege 2948 Explorer.EXE -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
jetsoff6543.exeqfaeenx.exeExplorer.EXEchkdsk.exedescription pid process target process PID 4868 wrote to memory of 2900 4868 jetsoff6543.exe qfaeenx.exe PID 4868 wrote to memory of 2900 4868 jetsoff6543.exe qfaeenx.exe PID 4868 wrote to memory of 2900 4868 jetsoff6543.exe qfaeenx.exe PID 2900 wrote to memory of 2076 2900 qfaeenx.exe qfaeenx.exe PID 2900 wrote to memory of 2076 2900 qfaeenx.exe qfaeenx.exe PID 2900 wrote to memory of 2076 2900 qfaeenx.exe qfaeenx.exe PID 2900 wrote to memory of 2076 2900 qfaeenx.exe qfaeenx.exe PID 2948 wrote to memory of 1672 2948 Explorer.EXE chkdsk.exe PID 2948 wrote to memory of 1672 2948 Explorer.EXE chkdsk.exe PID 2948 wrote to memory of 1672 2948 Explorer.EXE chkdsk.exe PID 1672 wrote to memory of 1804 1672 chkdsk.exe cmd.exe PID 1672 wrote to memory of 1804 1672 chkdsk.exe cmd.exe PID 1672 wrote to memory of 1804 1672 chkdsk.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jetsoff6543.exe"C:\Users\Admin\AppData\Local\Temp\jetsoff6543.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\qfaeenx.exe"C:\Users\Admin\AppData\Local\Temp\qfaeenx.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\qfaeenx.exe"C:\Users\Admin\AppData\Local\Temp\qfaeenx.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\qfaeenx.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\qfaeenx.exeFilesize
8KB
MD51c76048e3b5258e026fd31e7d3cc1530
SHA125bef57a5eda44f8bd59e6aecd7cf8f681bc66b8
SHA256a067079fe15e9c86bea9eaa38a258d77129195eb585e17e90ff01bf981b9d3ac
SHA512fb1f76d24fd2800348b7b179beb06728a30e7142c13feb55174a99414a435d4200483b255773befcad22e1fbbb180b0cf52e0f7e9160df8cb0084614cd7df2cf
-
C:\Users\Admin\AppData\Local\Temp\qfaeenx.exeFilesize
8KB
MD51c76048e3b5258e026fd31e7d3cc1530
SHA125bef57a5eda44f8bd59e6aecd7cf8f681bc66b8
SHA256a067079fe15e9c86bea9eaa38a258d77129195eb585e17e90ff01bf981b9d3ac
SHA512fb1f76d24fd2800348b7b179beb06728a30e7142c13feb55174a99414a435d4200483b255773befcad22e1fbbb180b0cf52e0f7e9160df8cb0084614cd7df2cf
-
C:\Users\Admin\AppData\Local\Temp\qfaeenx.exeFilesize
8KB
MD51c76048e3b5258e026fd31e7d3cc1530
SHA125bef57a5eda44f8bd59e6aecd7cf8f681bc66b8
SHA256a067079fe15e9c86bea9eaa38a258d77129195eb585e17e90ff01bf981b9d3ac
SHA512fb1f76d24fd2800348b7b179beb06728a30e7142c13feb55174a99414a435d4200483b255773befcad22e1fbbb180b0cf52e0f7e9160df8cb0084614cd7df2cf
-
C:\Users\Admin\AppData\Local\Temp\wygurjb.zFilesize
185KB
MD59474ef9cd3b0e642db9b2eb53949a6ad
SHA1cf0d057435c123e0cebe651907365a6d56c3f328
SHA256fe8c90ecfacda561029d39d7356811db9df051e0edecc01e845a5da6396d836c
SHA512e9aed14f30fbfb904289f89f16243906381718a5fcddb67b4d9ba3b3713cb49495dafa6834290787d96b3b83e8c56a649132042916300b5bbb58429479dbffcc
-
C:\Users\Admin\AppData\Local\Temp\xtmqeadsglh.mFilesize
5KB
MD5fa296506bdb3a5f9aefa7144420a40a1
SHA1010f9af53e8030a4586fa038c847432e5639dcbd
SHA256bc8ab2be1593c8888b52515ad970855a40ed469138f34b5b4e17998f9682ba43
SHA512441941fd51f1be98c37cb169f86d8c82f2ab17cdfacb7bcd728becf80974796e37720cffc71c9052cc36618d11401aa928c39e9e9e266d17e148044a6d5bb331
-
memory/1672-145-0x0000000000C90000-0x0000000000C9A000-memory.dmpFilesize
40KB
-
memory/1672-143-0x0000000000000000-mapping.dmp
-
memory/1672-146-0x0000000000C30000-0x0000000000C5F000-memory.dmpFilesize
188KB
-
memory/1672-148-0x0000000001480000-0x00000000017CA000-memory.dmpFilesize
3.3MB
-
memory/1672-149-0x0000000000C30000-0x0000000000C5F000-memory.dmpFilesize
188KB
-
memory/1672-150-0x0000000001220000-0x00000000012B3000-memory.dmpFilesize
588KB
-
memory/1804-147-0x0000000000000000-mapping.dmp
-
memory/2076-139-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2076-140-0x00000000015E0000-0x000000000192A000-memory.dmpFilesize
3.3MB
-
memory/2076-141-0x0000000001140000-0x0000000001154000-memory.dmpFilesize
80KB
-
memory/2076-144-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2076-137-0x0000000000000000-mapping.dmp
-
memory/2900-132-0x0000000000000000-mapping.dmp
-
memory/2948-174-0x0000000007480000-0x0000000007490000-memory.dmpFilesize
64KB
-
memory/2948-183-0x0000000000B20000-0x0000000000B30000-memory.dmpFilesize
64KB
-
memory/2948-152-0x0000000000B20000-0x0000000000B30000-memory.dmpFilesize
64KB
-
memory/2948-153-0x0000000000B20000-0x0000000000B30000-memory.dmpFilesize
64KB
-
memory/2948-154-0x0000000000B20000-0x0000000000B30000-memory.dmpFilesize
64KB
-
memory/2948-155-0x0000000000B20000-0x0000000000B30000-memory.dmpFilesize
64KB
-
memory/2948-156-0x0000000000B20000-0x0000000000B30000-memory.dmpFilesize
64KB
-
memory/2948-157-0x0000000000B20000-0x0000000000B30000-memory.dmpFilesize
64KB
-
memory/2948-158-0x0000000000B20000-0x0000000000B30000-memory.dmpFilesize
64KB
-
memory/2948-159-0x0000000000B20000-0x0000000000B30000-memory.dmpFilesize
64KB
-
memory/2948-160-0x0000000000B20000-0x0000000000B30000-memory.dmpFilesize
64KB
-
memory/2948-161-0x0000000000B20000-0x0000000000B30000-memory.dmpFilesize
64KB
-
memory/2948-162-0x0000000000B20000-0x0000000000B30000-memory.dmpFilesize
64KB
-
memory/2948-163-0x0000000000B20000-0x0000000000B30000-memory.dmpFilesize
64KB
-
memory/2948-164-0x0000000000B20000-0x0000000000B30000-memory.dmpFilesize
64KB
-
memory/2948-165-0x0000000000B20000-0x0000000000B30000-memory.dmpFilesize
64KB
-
memory/2948-166-0x0000000000B20000-0x0000000000B30000-memory.dmpFilesize
64KB
-
memory/2948-167-0x0000000000B20000-0x0000000000B30000-memory.dmpFilesize
64KB
-
memory/2948-168-0x0000000000B20000-0x0000000000B30000-memory.dmpFilesize
64KB
-
memory/2948-169-0x0000000002AF0000-0x0000000002B00000-memory.dmpFilesize
64KB
-
memory/2948-170-0x0000000007480000-0x0000000007490000-memory.dmpFilesize
64KB
-
memory/2948-171-0x0000000007480000-0x0000000007490000-memory.dmpFilesize
64KB
-
memory/2948-172-0x0000000007480000-0x0000000007490000-memory.dmpFilesize
64KB
-
memory/2948-173-0x0000000002D90000-0x0000000002E52000-memory.dmpFilesize
776KB
-
memory/2948-142-0x00000000028E0000-0x00000000029DB000-memory.dmpFilesize
1004KB
-
memory/2948-175-0x0000000007480000-0x0000000007490000-memory.dmpFilesize
64KB
-
memory/2948-176-0x0000000007480000-0x0000000007490000-memory.dmpFilesize
64KB
-
memory/2948-177-0x0000000000B20000-0x0000000000B30000-memory.dmpFilesize
64KB
-
memory/2948-178-0x0000000000B20000-0x0000000000B30000-memory.dmpFilesize
64KB
-
memory/2948-179-0x0000000000B20000-0x0000000000B30000-memory.dmpFilesize
64KB
-
memory/2948-180-0x0000000000B20000-0x0000000000B30000-memory.dmpFilesize
64KB
-
memory/2948-181-0x0000000000B20000-0x0000000000B30000-memory.dmpFilesize
64KB
-
memory/2948-182-0x0000000000B20000-0x0000000000B30000-memory.dmpFilesize
64KB
-
memory/2948-151-0x0000000002D90000-0x0000000002E52000-memory.dmpFilesize
776KB
-
memory/2948-184-0x0000000000B20000-0x0000000000B30000-memory.dmpFilesize
64KB
-
memory/2948-185-0x0000000000B20000-0x0000000000B30000-memory.dmpFilesize
64KB
-
memory/2948-186-0x0000000000B20000-0x0000000000B30000-memory.dmpFilesize
64KB
-
memory/2948-187-0x0000000000B20000-0x0000000000B30000-memory.dmpFilesize
64KB
-
memory/2948-188-0x0000000000B20000-0x0000000000B30000-memory.dmpFilesize
64KB
-
memory/2948-189-0x0000000000B20000-0x0000000000B30000-memory.dmpFilesize
64KB
-
memory/2948-190-0x0000000000B20000-0x0000000000B30000-memory.dmpFilesize
64KB
-
memory/2948-191-0x0000000000B20000-0x0000000000B30000-memory.dmpFilesize
64KB
-
memory/2948-192-0x0000000000B20000-0x0000000000B30000-memory.dmpFilesize
64KB
-
memory/2948-193-0x0000000000B20000-0x0000000000B30000-memory.dmpFilesize
64KB
-
memory/2948-194-0x0000000002810000-0x0000000002820000-memory.dmpFilesize
64KB
-
memory/2948-195-0x0000000002820000-0x0000000002830000-memory.dmpFilesize
64KB
-
memory/2948-196-0x0000000002820000-0x0000000002830000-memory.dmpFilesize
64KB
-
memory/2948-197-0x0000000002810000-0x0000000002820000-memory.dmpFilesize
64KB
-
memory/2948-198-0x0000000002820000-0x0000000002830000-memory.dmpFilesize
64KB
-
memory/2948-199-0x0000000002820000-0x0000000002830000-memory.dmpFilesize
64KB
-
memory/2948-200-0x0000000002820000-0x0000000002830000-memory.dmpFilesize
64KB
-
memory/2948-201-0x0000000000B20000-0x0000000000B30000-memory.dmpFilesize
64KB
-
memory/2948-202-0x0000000000B20000-0x0000000000B30000-memory.dmpFilesize
64KB
-
memory/2948-203-0x0000000000B20000-0x0000000000B30000-memory.dmpFilesize
64KB
-
memory/2948-204-0x0000000000B20000-0x0000000000B30000-memory.dmpFilesize
64KB
-
memory/2948-205-0x0000000000B20000-0x0000000000B30000-memory.dmpFilesize
64KB
-
memory/2948-206-0x0000000000B20000-0x0000000000B30000-memory.dmpFilesize
64KB
-
memory/2948-207-0x0000000000B20000-0x0000000000B30000-memory.dmpFilesize
64KB
-
memory/2948-208-0x0000000000B20000-0x0000000000B30000-memory.dmpFilesize
64KB
-
memory/2948-209-0x0000000000B20000-0x0000000000B30000-memory.dmpFilesize
64KB
-
memory/2948-210-0x0000000000B20000-0x0000000000B30000-memory.dmpFilesize
64KB
-
memory/2948-211-0x0000000000B20000-0x0000000000B30000-memory.dmpFilesize
64KB
-
memory/2948-212-0x0000000000B20000-0x0000000000B30000-memory.dmpFilesize
64KB
-
memory/2948-213-0x0000000000B20000-0x0000000000B30000-memory.dmpFilesize
64KB
-
memory/2948-214-0x0000000000B20000-0x0000000000B30000-memory.dmpFilesize
64KB
-
memory/2948-215-0x0000000000B20000-0x0000000000B30000-memory.dmpFilesize
64KB
-
memory/2948-216-0x0000000000B20000-0x0000000000B30000-memory.dmpFilesize
64KB