Analysis
-
max time kernel
153s -
max time network
176s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 14:39
Static task
static1
Behavioral task
behavioral1
Sample
jeetss456352.exe
Resource
win7-20221111-en
General
-
Target
jeetss456352.exe
-
Size
214KB
-
MD5
dafccfe6911e74fd47cf1461e3580ed1
-
SHA1
b84783ab8d2c044c9a4cf2765831fd776f220c64
-
SHA256
8d203db46294994fba62e63ddaf99b53c5b8abf2e407f7ee516f5df1d44cc1af
-
SHA512
4093bbdb3f57b7dff3d6f5e699698c303c9a79cb74bba23778241ea3b8bd12e380ab034065a3f1ff306638346fce69dc8dbc4461983b3cc6c6a95e8a2386c4ab
-
SSDEEP
3072:qUJoFfWzzl+cSM9BPmuGky8vtGAxeVbzb0kA5nyq956rosqcqXMZdQLfl7Z2JwQo:qweEp9Nmj84AuTqNvGr3qbXrLX2CO4T
Malware Config
Extracted
formbook
4.1
je14
innervisionbuildings.com
theenergysocialite.com
565548.com
panghr.com
onlyonesolutions.com
stjohnzone6.com
cnotes.rest
helfeb.online
xixi-s-inc.club
easilyentered.com
theshopx.store
mrclean-ac.com
miamibeachwateradventures.com
jpearce.co.uk
seseragi-bunkou.com
minimaddie.com
commbank-help-849c3.com
segohandelsonderneming.com
namthanhreal.com
fototerapi.online
your-download.com
klindt.one
sellerscourt.com
francoislambert.store
smokedoutvapes.co.uk
rundacg.com
flavors-and-spices-lyon.com
qifengsuo.com
sunnyislesgardens.com
tunneldutransit.com
restorecodes.website
blast4me.com
bingser.space
co-gpco.com
emporioaliwen.com
mr5g.com
abcp666.com
consulvip.net
sagaming168.info
zjpbhsuz.top
socal-labworx.com
arethaglennevents.com
rafiqsiregar.com
esgh2.com
veirdmusic.com
abzcc.xyz
8065yp.com
dronebazar.com
duetpbr.com
apartamentoslaencantada.com
digigold.info
homedecorsuppliers.com
duenorthrm.com
xmmdsy.com
ddstennessee.com
marmeluz.com
ragnallhess.com
methinelli.com
randomlymetheseer.com
magicgrowthproducts.com
shreejistudio.com
mattress-37684.com
yellyfishfilms.com
www1111cpw.com
tigermedlagroup.com
Signatures
-
Formbook payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/4776-139-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4776-143-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4776-147-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3564-150-0x0000000000190000-0x00000000001BF000-memory.dmp formbook behavioral2/memory/3564-153-0x0000000000190000-0x00000000001BF000-memory.dmp formbook -
Executes dropped EXE 2 IoCs
Processes:
isktuabvmv.exeisktuabvmv.exepid process 2552 isktuabvmv.exe 4776 isktuabvmv.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
isktuabvmv.exeisktuabvmv.exewlanext.exedescription pid process target process PID 2552 set thread context of 4776 2552 isktuabvmv.exe isktuabvmv.exe PID 4776 set thread context of 704 4776 isktuabvmv.exe Explorer.EXE PID 4776 set thread context of 704 4776 isktuabvmv.exe Explorer.EXE PID 3564 set thread context of 704 3564 wlanext.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
Processes:
Explorer.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 48 IoCs
Processes:
isktuabvmv.exewlanext.exepid process 4776 isktuabvmv.exe 4776 isktuabvmv.exe 4776 isktuabvmv.exe 4776 isktuabvmv.exe 4776 isktuabvmv.exe 4776 isktuabvmv.exe 3564 wlanext.exe 3564 wlanext.exe 3564 wlanext.exe 3564 wlanext.exe 3564 wlanext.exe 3564 wlanext.exe 3564 wlanext.exe 3564 wlanext.exe 3564 wlanext.exe 3564 wlanext.exe 3564 wlanext.exe 3564 wlanext.exe 3564 wlanext.exe 3564 wlanext.exe 3564 wlanext.exe 3564 wlanext.exe 3564 wlanext.exe 3564 wlanext.exe 3564 wlanext.exe 3564 wlanext.exe 3564 wlanext.exe 3564 wlanext.exe 3564 wlanext.exe 3564 wlanext.exe 3564 wlanext.exe 3564 wlanext.exe 3564 wlanext.exe 3564 wlanext.exe 3564 wlanext.exe 3564 wlanext.exe 3564 wlanext.exe 3564 wlanext.exe 3564 wlanext.exe 3564 wlanext.exe 3564 wlanext.exe 3564 wlanext.exe 3564 wlanext.exe 3564 wlanext.exe 3564 wlanext.exe 3564 wlanext.exe 3564 wlanext.exe 3564 wlanext.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 704 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
isktuabvmv.exeisktuabvmv.exewlanext.exepid process 2552 isktuabvmv.exe 4776 isktuabvmv.exe 4776 isktuabvmv.exe 4776 isktuabvmv.exe 4776 isktuabvmv.exe 3564 wlanext.exe 3564 wlanext.exe -
Suspicious use of AdjustPrivilegeToken 14 IoCs
Processes:
isktuabvmv.exewlanext.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 4776 isktuabvmv.exe Token: SeDebugPrivilege 3564 wlanext.exe Token: SeShutdownPrivilege 704 Explorer.EXE Token: SeCreatePagefilePrivilege 704 Explorer.EXE Token: SeShutdownPrivilege 704 Explorer.EXE Token: SeCreatePagefilePrivilege 704 Explorer.EXE Token: SeShutdownPrivilege 704 Explorer.EXE Token: SeCreatePagefilePrivilege 704 Explorer.EXE Token: SeShutdownPrivilege 704 Explorer.EXE Token: SeCreatePagefilePrivilege 704 Explorer.EXE Token: SeShutdownPrivilege 704 Explorer.EXE Token: SeCreatePagefilePrivilege 704 Explorer.EXE Token: SeShutdownPrivilege 704 Explorer.EXE Token: SeCreatePagefilePrivilege 704 Explorer.EXE -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
jeetss456352.exeisktuabvmv.exeExplorer.EXEwlanext.exedescription pid process target process PID 2128 wrote to memory of 2552 2128 jeetss456352.exe isktuabvmv.exe PID 2128 wrote to memory of 2552 2128 jeetss456352.exe isktuabvmv.exe PID 2128 wrote to memory of 2552 2128 jeetss456352.exe isktuabvmv.exe PID 2552 wrote to memory of 4776 2552 isktuabvmv.exe isktuabvmv.exe PID 2552 wrote to memory of 4776 2552 isktuabvmv.exe isktuabvmv.exe PID 2552 wrote to memory of 4776 2552 isktuabvmv.exe isktuabvmv.exe PID 2552 wrote to memory of 4776 2552 isktuabvmv.exe isktuabvmv.exe PID 704 wrote to memory of 3564 704 Explorer.EXE wlanext.exe PID 704 wrote to memory of 3564 704 Explorer.EXE wlanext.exe PID 704 wrote to memory of 3564 704 Explorer.EXE wlanext.exe PID 3564 wrote to memory of 4860 3564 wlanext.exe cmd.exe PID 3564 wrote to memory of 4860 3564 wlanext.exe cmd.exe PID 3564 wrote to memory of 4860 3564 wlanext.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jeetss456352.exe"C:\Users\Admin\AppData\Local\Temp\jeetss456352.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\isktuabvmv.exe"C:\Users\Admin\AppData\Local\Temp\isktuabvmv.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\isktuabvmv.exe"C:\Users\Admin\AppData\Local\Temp\isktuabvmv.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\isktuabvmv.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\isktuabvmv.exeFilesize
6KB
MD54debf3d4be3833c81372eab33bcc8f99
SHA13c01f72309070804bda00f0545ba92dc32635d36
SHA256a5a20c3c5c6a4882e770da52b1a8d498b39fdbf549bffa6b594566d7f26c99a5
SHA5121418bc4717718a6f2fbbf738cde04509b5a8dcefe430b9be0dde97551248551f136e5d7649d8ef415ce67507cbb2c4c7b3ac29824f6abb611a4f658f46a74451
-
C:\Users\Admin\AppData\Local\Temp\isktuabvmv.exeFilesize
6KB
MD54debf3d4be3833c81372eab33bcc8f99
SHA13c01f72309070804bda00f0545ba92dc32635d36
SHA256a5a20c3c5c6a4882e770da52b1a8d498b39fdbf549bffa6b594566d7f26c99a5
SHA5121418bc4717718a6f2fbbf738cde04509b5a8dcefe430b9be0dde97551248551f136e5d7649d8ef415ce67507cbb2c4c7b3ac29824f6abb611a4f658f46a74451
-
C:\Users\Admin\AppData\Local\Temp\isktuabvmv.exeFilesize
6KB
MD54debf3d4be3833c81372eab33bcc8f99
SHA13c01f72309070804bda00f0545ba92dc32635d36
SHA256a5a20c3c5c6a4882e770da52b1a8d498b39fdbf549bffa6b594566d7f26c99a5
SHA5121418bc4717718a6f2fbbf738cde04509b5a8dcefe430b9be0dde97551248551f136e5d7649d8ef415ce67507cbb2c4c7b3ac29824f6abb611a4f658f46a74451
-
C:\Users\Admin\AppData\Local\Temp\lrwrtr.wlFilesize
5KB
MD5b481fd4817e233972e39dd189f695aa6
SHA133c33dec6a53f11990002b97961c3e513e23a0c1
SHA256c955f7c98bf61071eee2393596ff2e9c3555ba31b353daf5fc438b24fae7ad46
SHA51277eb80bd3f63fd3997b934ff97d81124b778fbf1bc9cf45a664912b1289079c38adea8f7f03a98ecdb2dfc8ec3f347ddf90c8b91abdc6bdcae7a770cb0ec076c
-
C:\Users\Admin\AppData\Local\Temp\ovyicohnryx.esFilesize
185KB
MD508367820ada06e975ed56b12d436485e
SHA144508235cd40156d2060bcd53b752e309d5332da
SHA256650167bccb0aab8157bac4ff9553af5b9d75561252c3350eb930fd274f74a935
SHA5120e022b1271ac873b332bf5864664e53e21d592c1c2c949247652d5311e42463a9b03193c3b6948a898bfb42b395ec898b865013322bff58033ff9a67d6a652c0
-
memory/704-145-0x0000000007F20000-0x0000000008054000-memory.dmpFilesize
1.2MB
-
memory/704-156-0x0000000007A60000-0x0000000007B26000-memory.dmpFilesize
792KB
-
memory/704-155-0x0000000007A60000-0x0000000007B26000-memory.dmpFilesize
792KB
-
memory/704-152-0x0000000007F20000-0x0000000008054000-memory.dmpFilesize
1.2MB
-
memory/704-142-0x0000000007860000-0x000000000791B000-memory.dmpFilesize
748KB
-
memory/2552-132-0x0000000000000000-mapping.dmp
-
memory/3564-150-0x0000000000190000-0x00000000001BF000-memory.dmpFilesize
188KB
-
memory/3564-149-0x0000000000A30000-0x0000000000D7A000-memory.dmpFilesize
3.3MB
-
memory/3564-154-0x00000000008E0000-0x0000000000973000-memory.dmpFilesize
588KB
-
memory/3564-146-0x0000000000000000-mapping.dmp
-
memory/3564-153-0x0000000000190000-0x00000000001BF000-memory.dmpFilesize
188KB
-
memory/3564-148-0x0000000000200000-0x0000000000217000-memory.dmpFilesize
92KB
-
memory/4776-147-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4776-141-0x00000000006D0000-0x00000000006E4000-memory.dmpFilesize
80KB
-
memory/4776-140-0x00000000009C0000-0x0000000000D0A000-memory.dmpFilesize
3.3MB
-
memory/4776-144-0x0000000000930000-0x0000000000944000-memory.dmpFilesize
80KB
-
memory/4776-143-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4776-139-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4776-137-0x0000000000000000-mapping.dmp
-
memory/4860-151-0x0000000000000000-mapping.dmp