Analysis
-
max time kernel
158s -
max time network
187s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 14:40
Static task
static1
Behavioral task
behavioral1
Sample
jetss46635.exe
Resource
win7-20221111-en
General
-
Target
jetss46635.exe
-
Size
261KB
-
MD5
62cc148705cfa7c981bdb823de72bb93
-
SHA1
1b47fd2f7535f55d44abaea0ce85d685841c6ef4
-
SHA256
f79c3a8f98d47aab53d03bce09d51bc17c25b9cb051a69f040b0ada6fc6abb88
-
SHA512
0c86c17dcbd338db984b3765e489510e90b71cae33746da75c2310c4722f35e878d01e94834d444e3a28e3012a2631dacfed55e69561edba44212711622475c3
-
SSDEEP
6144:MEa0NXK2m0R1Ic0wsf08mIm2+vARvuR5UKMUgfkmoLv24T:XXXRL0Pf0TIm2+IliGcLvV
Malware Config
Extracted
formbook
4.1
je14
innervisionbuildings.com
theenergysocialite.com
565548.com
panghr.com
onlyonesolutions.com
stjohnzone6.com
cnotes.rest
helfeb.online
xixi-s-inc.club
easilyentered.com
theshopx.store
mrclean-ac.com
miamibeachwateradventures.com
jpearce.co.uk
seseragi-bunkou.com
minimaddie.com
commbank-help-849c3.com
segohandelsonderneming.com
namthanhreal.com
fototerapi.online
your-download.com
klindt.one
sellerscourt.com
francoislambert.store
smokedoutvapes.co.uk
rundacg.com
flavors-and-spices-lyon.com
qifengsuo.com
sunnyislesgardens.com
tunneldutransit.com
restorecodes.website
blast4me.com
bingser.space
co-gpco.com
emporioaliwen.com
mr5g.com
abcp666.com
consulvip.net
sagaming168.info
zjpbhsuz.top
socal-labworx.com
arethaglennevents.com
rafiqsiregar.com
esgh2.com
veirdmusic.com
abzcc.xyz
8065yp.com
dronebazar.com
duetpbr.com
apartamentoslaencantada.com
digigold.info
homedecorsuppliers.com
duenorthrm.com
xmmdsy.com
ddstennessee.com
marmeluz.com
ragnallhess.com
methinelli.com
randomlymetheseer.com
magicgrowthproducts.com
shreejistudio.com
mattress-37684.com
yellyfishfilms.com
www1111cpw.com
tigermedlagroup.com
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/676-64-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/676-71-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/584-75-0x0000000000090000-0x00000000000BF000-memory.dmp formbook behavioral1/memory/584-80-0x0000000000090000-0x00000000000BF000-memory.dmp formbook -
Executes dropped EXE 2 IoCs
Processes:
pnowxpr.exepnowxpr.exepid process 1656 pnowxpr.exe 676 pnowxpr.exe -
Loads dropped DLL 2 IoCs
Processes:
jetss46635.exepnowxpr.exepid process 868 jetss46635.exe 1656 pnowxpr.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
pnowxpr.exepnowxpr.execmstp.exedescription pid process target process PID 1656 set thread context of 676 1656 pnowxpr.exe pnowxpr.exe PID 676 set thread context of 1288 676 pnowxpr.exe Explorer.EXE PID 676 set thread context of 1288 676 pnowxpr.exe Explorer.EXE PID 584 set thread context of 1288 584 cmstp.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
Processes:
pnowxpr.execmstp.exepid process 676 pnowxpr.exe 676 pnowxpr.exe 676 pnowxpr.exe 584 cmstp.exe 584 cmstp.exe 584 cmstp.exe 584 cmstp.exe 584 cmstp.exe 584 cmstp.exe 584 cmstp.exe 584 cmstp.exe 584 cmstp.exe 584 cmstp.exe 584 cmstp.exe 584 cmstp.exe 584 cmstp.exe 584 cmstp.exe 584 cmstp.exe 584 cmstp.exe 584 cmstp.exe 584 cmstp.exe 584 cmstp.exe 584 cmstp.exe 584 cmstp.exe 584 cmstp.exe 584 cmstp.exe 584 cmstp.exe 584 cmstp.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1288 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
pnowxpr.exepnowxpr.execmstp.exepid process 1656 pnowxpr.exe 676 pnowxpr.exe 676 pnowxpr.exe 676 pnowxpr.exe 676 pnowxpr.exe 584 cmstp.exe 584 cmstp.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pnowxpr.execmstp.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 676 pnowxpr.exe Token: SeDebugPrivilege 584 cmstp.exe Token: SeShutdownPrivilege 1288 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1288 Explorer.EXE 1288 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1288 Explorer.EXE 1288 Explorer.EXE -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
jetss46635.exepnowxpr.exeExplorer.EXEcmstp.exedescription pid process target process PID 868 wrote to memory of 1656 868 jetss46635.exe pnowxpr.exe PID 868 wrote to memory of 1656 868 jetss46635.exe pnowxpr.exe PID 868 wrote to memory of 1656 868 jetss46635.exe pnowxpr.exe PID 868 wrote to memory of 1656 868 jetss46635.exe pnowxpr.exe PID 1656 wrote to memory of 676 1656 pnowxpr.exe pnowxpr.exe PID 1656 wrote to memory of 676 1656 pnowxpr.exe pnowxpr.exe PID 1656 wrote to memory of 676 1656 pnowxpr.exe pnowxpr.exe PID 1656 wrote to memory of 676 1656 pnowxpr.exe pnowxpr.exe PID 1656 wrote to memory of 676 1656 pnowxpr.exe pnowxpr.exe PID 1288 wrote to memory of 584 1288 Explorer.EXE cmstp.exe PID 1288 wrote to memory of 584 1288 Explorer.EXE cmstp.exe PID 1288 wrote to memory of 584 1288 Explorer.EXE cmstp.exe PID 1288 wrote to memory of 584 1288 Explorer.EXE cmstp.exe PID 1288 wrote to memory of 584 1288 Explorer.EXE cmstp.exe PID 1288 wrote to memory of 584 1288 Explorer.EXE cmstp.exe PID 1288 wrote to memory of 584 1288 Explorer.EXE cmstp.exe PID 584 wrote to memory of 1296 584 cmstp.exe cmd.exe PID 584 wrote to memory of 1296 584 cmstp.exe cmd.exe PID 584 wrote to memory of 1296 584 cmstp.exe cmd.exe PID 584 wrote to memory of 1296 584 cmstp.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jetss46635.exe"C:\Users\Admin\AppData\Local\Temp\jetss46635.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\pnowxpr.exe"C:\Users\Admin\AppData\Local\Temp\pnowxpr.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\pnowxpr.exe"C:\Users\Admin\AppData\Local\Temp\pnowxpr.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\pnowxpr.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\aewdt.dFilesize
5KB
MD5dd27f576cb0ceb724998aa7f63897fbc
SHA1be3e2c774e6b75520fb413cefa01e4bde2dde92d
SHA2568a42cacf9193740b218a9855c72cf3a3c12daee3410958ef934d09ee3b49df7a
SHA5128035fedd42beca60c010fa69eaec2ae1c6691f1a1fa90cd07fbdfb05ebc7ce648e80c1cff11e6dd1c006f971d782054974718eabac3369584005d1fe84292006
-
C:\Users\Admin\AppData\Local\Temp\pnowxpr.exeFilesize
73KB
MD5c3d1520595c08a392fe0df9a14a9e611
SHA1b0f8176f6b68a572b5b4f9212ab51597afb17cfd
SHA256400c153d2ce5ec6408769a9b12b87a1f138d0fe69166d080913d865d605608ab
SHA5125d473a9a473ea61c67b1d9b1e00509168ff2b7245df8679323ffd6f9032e726e5963afbc523da663ed5d39c8d49e841211a0c49534c70afbb589023f34ac10dd
-
C:\Users\Admin\AppData\Local\Temp\pnowxpr.exeFilesize
73KB
MD5c3d1520595c08a392fe0df9a14a9e611
SHA1b0f8176f6b68a572b5b4f9212ab51597afb17cfd
SHA256400c153d2ce5ec6408769a9b12b87a1f138d0fe69166d080913d865d605608ab
SHA5125d473a9a473ea61c67b1d9b1e00509168ff2b7245df8679323ffd6f9032e726e5963afbc523da663ed5d39c8d49e841211a0c49534c70afbb589023f34ac10dd
-
C:\Users\Admin\AppData\Local\Temp\pnowxpr.exeFilesize
73KB
MD5c3d1520595c08a392fe0df9a14a9e611
SHA1b0f8176f6b68a572b5b4f9212ab51597afb17cfd
SHA256400c153d2ce5ec6408769a9b12b87a1f138d0fe69166d080913d865d605608ab
SHA5125d473a9a473ea61c67b1d9b1e00509168ff2b7245df8679323ffd6f9032e726e5963afbc523da663ed5d39c8d49e841211a0c49534c70afbb589023f34ac10dd
-
C:\Users\Admin\AppData\Local\Temp\zxykqdfeho.klFilesize
185KB
MD5ad084fb23e4d42b35a182e01abcbc654
SHA1e06b7ec6a5cc037a6aec7c22351fb1752c6e5477
SHA2563350c35339de981bf8eae8bd39e0ea907976042b342bd76cbef5e8f6eb74af21
SHA512de3600c48a73c28bfdb581fc30e2d3e35ab321fba5067ffceb7f1c60f48e790a3958ba228e2d61942e50acd7c93f4a5b4c815c02881753c7b7a9a5e0d4b92ee8
-
\Users\Admin\AppData\Local\Temp\pnowxpr.exeFilesize
73KB
MD5c3d1520595c08a392fe0df9a14a9e611
SHA1b0f8176f6b68a572b5b4f9212ab51597afb17cfd
SHA256400c153d2ce5ec6408769a9b12b87a1f138d0fe69166d080913d865d605608ab
SHA5125d473a9a473ea61c67b1d9b1e00509168ff2b7245df8679323ffd6f9032e726e5963afbc523da663ed5d39c8d49e841211a0c49534c70afbb589023f34ac10dd
-
\Users\Admin\AppData\Local\Temp\pnowxpr.exeFilesize
73KB
MD5c3d1520595c08a392fe0df9a14a9e611
SHA1b0f8176f6b68a572b5b4f9212ab51597afb17cfd
SHA256400c153d2ce5ec6408769a9b12b87a1f138d0fe69166d080913d865d605608ab
SHA5125d473a9a473ea61c67b1d9b1e00509168ff2b7245df8679323ffd6f9032e726e5963afbc523da663ed5d39c8d49e841211a0c49534c70afbb589023f34ac10dd
-
memory/584-80-0x0000000000090000-0x00000000000BF000-memory.dmpFilesize
188KB
-
memory/584-70-0x0000000000000000-mapping.dmp
-
memory/584-77-0x0000000000410000-0x00000000004A3000-memory.dmpFilesize
588KB
-
memory/584-76-0x0000000002160000-0x0000000002463000-memory.dmpFilesize
3.0MB
-
memory/584-74-0x0000000000BB0000-0x0000000000BC8000-memory.dmpFilesize
96KB
-
memory/584-75-0x0000000000090000-0x00000000000BF000-memory.dmpFilesize
188KB
-
memory/676-66-0x0000000000280000-0x0000000000294000-memory.dmpFilesize
80KB
-
memory/676-65-0x00000000009E0000-0x0000000000CE3000-memory.dmpFilesize
3.0MB
-
memory/676-62-0x000000000041F120-mapping.dmp
-
memory/676-64-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/676-71-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/676-68-0x00000000002F0000-0x0000000000304000-memory.dmpFilesize
80KB
-
memory/868-54-0x00000000753D1000-0x00000000753D3000-memory.dmpFilesize
8KB
-
memory/1288-67-0x00000000065C0000-0x00000000066B5000-memory.dmpFilesize
980KB
-
memory/1288-69-0x00000000068B0000-0x000000000699D000-memory.dmpFilesize
948KB
-
memory/1288-78-0x00000000049E0000-0x0000000004A89000-memory.dmpFilesize
676KB
-
memory/1288-79-0x00000000068B0000-0x000000000699D000-memory.dmpFilesize
948KB
-
memory/1288-81-0x00000000049E0000-0x0000000004A89000-memory.dmpFilesize
676KB
-
memory/1296-73-0x0000000000000000-mapping.dmp
-
memory/1656-56-0x0000000000000000-mapping.dmp