Analysis
-
max time kernel
186s -
max time network
195s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 14:41
Static task
static1
Behavioral task
behavioral1
Sample
jetsoff887453.exe
Resource
win7-20221111-en
General
-
Target
jetsoff887453.exe
-
Size
226KB
-
MD5
1eea2dfdae7eb894956ca1c1640f68c5
-
SHA1
d84785baefe3f1fce5bbd9cf93c03bb09d8a20e8
-
SHA256
45b23c325946154b6990adf193926f99019ccc14f815a9768c208494197d3208
-
SHA512
64efce3783fd512b03cff3e3c3b93bda7ddf793f199e64809a13c64b948e91deb68dddb1394e5a24353ab42012df88e4a7f0a213b29e9ae3f006bff19755572d
-
SSDEEP
6144:MEa0NOhe6ib7DKeu/cIJyJJnJCDTRn5lAAfh:XONibPeOJnJY9Dh
Malware Config
Extracted
formbook
4.1
je14
innervisionbuildings.com
theenergysocialite.com
565548.com
panghr.com
onlyonesolutions.com
stjohnzone6.com
cnotes.rest
helfeb.online
xixi-s-inc.club
easilyentered.com
theshopx.store
mrclean-ac.com
miamibeachwateradventures.com
jpearce.co.uk
seseragi-bunkou.com
minimaddie.com
commbank-help-849c3.com
segohandelsonderneming.com
namthanhreal.com
fototerapi.online
your-download.com
klindt.one
sellerscourt.com
francoislambert.store
smokedoutvapes.co.uk
rundacg.com
flavors-and-spices-lyon.com
qifengsuo.com
sunnyislesgardens.com
tunneldutransit.com
restorecodes.website
blast4me.com
bingser.space
co-gpco.com
emporioaliwen.com
mr5g.com
abcp666.com
consulvip.net
sagaming168.info
zjpbhsuz.top
socal-labworx.com
arethaglennevents.com
rafiqsiregar.com
esgh2.com
veirdmusic.com
abzcc.xyz
8065yp.com
dronebazar.com
duetpbr.com
apartamentoslaencantada.com
digigold.info
homedecorsuppliers.com
duenorthrm.com
xmmdsy.com
ddstennessee.com
marmeluz.com
ragnallhess.com
methinelli.com
randomlymetheseer.com
magicgrowthproducts.com
shreejistudio.com
mattress-37684.com
yellyfishfilms.com
www1111cpw.com
tigermedlagroup.com
Signatures
-
Formbook payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1300-64-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/528-70-0x0000000000080000-0x00000000000AF000-memory.dmp formbook behavioral1/memory/528-75-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Executes dropped EXE 2 IoCs
Processes:
krwcwm.exekrwcwm.exepid process 1264 krwcwm.exe 1300 krwcwm.exe -
Loads dropped DLL 2 IoCs
Processes:
jetsoff887453.exekrwcwm.exepid process 1648 jetsoff887453.exe 1264 krwcwm.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
krwcwm.exekrwcwm.exehelp.exedescription pid process target process PID 1264 set thread context of 1300 1264 krwcwm.exe krwcwm.exe PID 1300 set thread context of 1244 1300 krwcwm.exe Explorer.EXE PID 528 set thread context of 1244 528 help.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
Processes:
krwcwm.exehelp.exepid process 1300 krwcwm.exe 1300 krwcwm.exe 528 help.exe 528 help.exe 528 help.exe 528 help.exe 528 help.exe 528 help.exe 528 help.exe 528 help.exe 528 help.exe 528 help.exe 528 help.exe 528 help.exe 528 help.exe 528 help.exe 528 help.exe 528 help.exe 528 help.exe 528 help.exe 528 help.exe 528 help.exe 528 help.exe 528 help.exe 528 help.exe 528 help.exe 528 help.exe 528 help.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1244 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
krwcwm.exekrwcwm.exehelp.exepid process 1264 krwcwm.exe 1300 krwcwm.exe 1300 krwcwm.exe 1300 krwcwm.exe 528 help.exe 528 help.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
krwcwm.exehelp.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1300 krwcwm.exe Token: SeDebugPrivilege 528 help.exe Token: SeShutdownPrivilege 1244 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1244 Explorer.EXE 1244 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1244 Explorer.EXE 1244 Explorer.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
jetsoff887453.exekrwcwm.exeExplorer.EXEhelp.exedescription pid process target process PID 1648 wrote to memory of 1264 1648 jetsoff887453.exe krwcwm.exe PID 1648 wrote to memory of 1264 1648 jetsoff887453.exe krwcwm.exe PID 1648 wrote to memory of 1264 1648 jetsoff887453.exe krwcwm.exe PID 1648 wrote to memory of 1264 1648 jetsoff887453.exe krwcwm.exe PID 1264 wrote to memory of 1300 1264 krwcwm.exe krwcwm.exe PID 1264 wrote to memory of 1300 1264 krwcwm.exe krwcwm.exe PID 1264 wrote to memory of 1300 1264 krwcwm.exe krwcwm.exe PID 1264 wrote to memory of 1300 1264 krwcwm.exe krwcwm.exe PID 1264 wrote to memory of 1300 1264 krwcwm.exe krwcwm.exe PID 1244 wrote to memory of 528 1244 Explorer.EXE help.exe PID 1244 wrote to memory of 528 1244 Explorer.EXE help.exe PID 1244 wrote to memory of 528 1244 Explorer.EXE help.exe PID 1244 wrote to memory of 528 1244 Explorer.EXE help.exe PID 528 wrote to memory of 1176 528 help.exe cmd.exe PID 528 wrote to memory of 1176 528 help.exe cmd.exe PID 528 wrote to memory of 1176 528 help.exe cmd.exe PID 528 wrote to memory of 1176 528 help.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\jetsoff887453.exe"C:\Users\Admin\AppData\Local\Temp\jetsoff887453.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\krwcwm.exe"C:\Users\Admin\AppData\Local\Temp\krwcwm.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\krwcwm.exe"C:\Users\Admin\AppData\Local\Temp\krwcwm.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1300 -
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:320
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:528 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\krwcwm.exe"3⤵PID:1176
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\cmxapzchjh.mfgFilesize
185KB
MD5e0393404e1db74cc34660a5a4cdf44b9
SHA188c7398ff382baee47b03705c8fe9cae33b5c66d
SHA256da3381d0f783bf287a0a7e4cf558732b4f3f6b952599463eb91e05a0993b78ad
SHA512bb74b2ccfaf07ca73325b324af0beb344ac2244d2d09f3e4673efc9e7becc5b219ead7870be10332f82061d2e1c5bb793660837b9f8a9aedd1c1d34724377936
-
C:\Users\Admin\AppData\Local\Temp\hwwsjbg.eFilesize
5KB
MD5fd5f4d91c7778d694137a815bbb14292
SHA16b3f4a6b14ccd69b3ff959376106876aaa5141df
SHA256c6633251a0126effcad26a968b952b49d041105192fb212506162d95ec114722
SHA51298d2ad43b1857894103702c8379dd672221d898c660bd4659cc46aaa5a8a3da321c85123464ab0cf626754973bc0b9e5f3a1941f80266bff91fe40aae9fb87d7
-
C:\Users\Admin\AppData\Local\Temp\krwcwm.exeFilesize
13KB
MD589cb047bc134ce369ad1005598404480
SHA1e662924b6095d90662fb01c22fc0546c72630feb
SHA256ee792f2d3d5c85a9474eaf46db3f087594d427e2bd30bdfb0f6ff97d6ee734cd
SHA51203648b80279202d5a6ba83244758e9be7e16b581c2eb0fc43bec886e59570d4db8cdbc942273b02c21184dd37a6b7c04636d459a3a8515b49e707c6530586f23
-
C:\Users\Admin\AppData\Local\Temp\krwcwm.exeFilesize
13KB
MD589cb047bc134ce369ad1005598404480
SHA1e662924b6095d90662fb01c22fc0546c72630feb
SHA256ee792f2d3d5c85a9474eaf46db3f087594d427e2bd30bdfb0f6ff97d6ee734cd
SHA51203648b80279202d5a6ba83244758e9be7e16b581c2eb0fc43bec886e59570d4db8cdbc942273b02c21184dd37a6b7c04636d459a3a8515b49e707c6530586f23
-
C:\Users\Admin\AppData\Local\Temp\krwcwm.exeFilesize
13KB
MD589cb047bc134ce369ad1005598404480
SHA1e662924b6095d90662fb01c22fc0546c72630feb
SHA256ee792f2d3d5c85a9474eaf46db3f087594d427e2bd30bdfb0f6ff97d6ee734cd
SHA51203648b80279202d5a6ba83244758e9be7e16b581c2eb0fc43bec886e59570d4db8cdbc942273b02c21184dd37a6b7c04636d459a3a8515b49e707c6530586f23
-
\Users\Admin\AppData\Local\Temp\krwcwm.exeFilesize
13KB
MD589cb047bc134ce369ad1005598404480
SHA1e662924b6095d90662fb01c22fc0546c72630feb
SHA256ee792f2d3d5c85a9474eaf46db3f087594d427e2bd30bdfb0f6ff97d6ee734cd
SHA51203648b80279202d5a6ba83244758e9be7e16b581c2eb0fc43bec886e59570d4db8cdbc942273b02c21184dd37a6b7c04636d459a3a8515b49e707c6530586f23
-
\Users\Admin\AppData\Local\Temp\krwcwm.exeFilesize
13KB
MD589cb047bc134ce369ad1005598404480
SHA1e662924b6095d90662fb01c22fc0546c72630feb
SHA256ee792f2d3d5c85a9474eaf46db3f087594d427e2bd30bdfb0f6ff97d6ee734cd
SHA51203648b80279202d5a6ba83244758e9be7e16b581c2eb0fc43bec886e59570d4db8cdbc942273b02c21184dd37a6b7c04636d459a3a8515b49e707c6530586f23
-
memory/528-70-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/528-68-0x0000000000000000-mapping.dmp
-
memory/528-75-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/528-73-0x0000000000560000-0x00000000005F3000-memory.dmpFilesize
588KB
-
memory/528-72-0x00000000007B0000-0x0000000000AB3000-memory.dmpFilesize
3.0MB
-
memory/528-69-0x00000000007A0000-0x00000000007A6000-memory.dmpFilesize
24KB
-
memory/1176-71-0x0000000000000000-mapping.dmp
-
memory/1244-67-0x0000000005DC0000-0x0000000005E78000-memory.dmpFilesize
736KB
-
memory/1244-74-0x0000000005F40000-0x00000000060B1000-memory.dmpFilesize
1.4MB
-
memory/1244-76-0x0000000005F40000-0x00000000060B1000-memory.dmpFilesize
1.4MB
-
memory/1264-56-0x0000000000000000-mapping.dmp
-
memory/1300-66-0x0000000000290000-0x00000000002A4000-memory.dmpFilesize
80KB
-
memory/1300-62-0x000000000041F120-mapping.dmp
-
memory/1300-65-0x0000000000820000-0x0000000000B23000-memory.dmpFilesize
3.0MB
-
memory/1300-64-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1648-54-0x00000000757B1000-0x00000000757B3000-memory.dmpFilesize
8KB