Analysis
-
max time kernel
57s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
-
submitted
29-11-2022 12:49
General
-
Target
SecuriteInfo.com.Win32.CrypterX-gen.22726.1920.exe
-
Size
915KB
-
MD5
b5678475c3c15fdafff2c5c8b49d5dc1
-
SHA1
7407554011988292b3e3522e19edb5532f21ee4e
-
SHA256
755c44b90198282d2494321b4cb18cab7e4426efd1b7f4a20f2a0793d68a2a1f
-
SHA512
05eb462d04fa52dc64781064305aaf73c960765e35f51ef3eeb87e81e25d2dbdcfe7e2c51840ccc4d25e61a7ffc4d0786232c115a395f5e94eaba9508088aecc
-
SSDEEP
12288:B0dqU+0zR1NqFgVkN3kXsujtKtVrA8RssJk0cDe1Wa33JzysxUi59zDdzoa1cfN:KvFqgVAU8LrLq0vBhyLiTDdEPf
Malware Config
Extracted
formbook
k0ud
KKDeo2UqDEnUCpVOQojSRXBi
2tZJH0HRrIOVDeTfmg==
MKSmj+CZhRhujjE=
s5bXm6Sadg2zBdu7hw==
8mGZiJJg7IwdLLs+pPMOfKhNGytf
ngJVQAUrwkHr
n91w0jH0iJFIpiaP
lWk89cFyI5pIpiaP
3r4L8XkqBgU3dCR30w4ZcMRga0A=
l53c8qJWOTJroVjOHBlgjJs=
y0It19ubd+FIpiaP
9Xqagljz0BeZp7ryuO4I
gxIH4giok36VxknyuO4I
tAZMOEL32FgOEBvnr8gQcg==
w0p+SzTMwKm8BcW1gw==
kxD3oaFJ6xlOeHqH
jp4I7QirduJ8slPyuO4I
LSxuX8BlRh0yWAWTEhlgjJs=
ZrTTvJ49FI8rZ09psvo=
LLSsX0XevItIpiaP
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
-
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 19 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterX-gen.22726.1920.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterX-gen.22726.1920.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterX-gen.22726.1920.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\bVgCuQEDo.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bVgCuQEDo" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF2C8.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterX-gen.22726.1920.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterX-gen.22726.1920.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpF2C8.tmpFilesize
1KB
MD56b963378532103eccf8fb8d2046b4bf4
SHA1e76af99d0a6ae291f9cf683aa5cd8b9dcf49af10
SHA25610fff36cea0bc4ac958741891264fe2ee7ae6366888c772e8bb86db2476cc66b
SHA512cf3647d3f879664d1cfaf807987fd0a8c53519fa8505302e595750b3efb7e83743e629e441fe4d12e3630284b7171dc852d677b290d42ac33477a6143a63fd3d
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD5abaad2c1e17abc7690b005001825a279
SHA1ab7ca3284b9ae7a36ad48d1c0d9ff2d02c41c5e3
SHA2565416e1765331c1cc96fc032588ad15d0f96e3ba34a0e800bf53a9ef3fee8b808
SHA512faab7697d250de662cc3155b863a91e2d0cb6143eebf7490673d14fbafd64fb213856fbabacb8b9aa663da79829934b5a3f45f2fd49777c8651a05b096f4fdf2
-
memory/892-79-0x000000006F5E0000-0x000000006FB8B000-memory.dmpFilesize
5.7MB
-
memory/892-61-0x0000000000000000-mapping.dmp
-
memory/892-77-0x000000006F5E0000-0x000000006FB8B000-memory.dmpFilesize
5.7MB
-
memory/1304-54-0x0000000001330000-0x000000000141A000-memory.dmpFilesize
936KB
-
memory/1304-55-0x00000000762E1000-0x00000000762E3000-memory.dmpFilesize
8KB
-
memory/1304-56-0x00000000009B0000-0x00000000009C6000-memory.dmpFilesize
88KB
-
memory/1304-57-0x00000000009C0000-0x00000000009CE000-memory.dmpFilesize
56KB
-
memory/1304-58-0x0000000005510000-0x00000000055A4000-memory.dmpFilesize
592KB
-
memory/1304-66-0x0000000005760000-0x00000000057BA000-memory.dmpFilesize
360KB
-
memory/1492-73-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1492-68-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1492-70-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1492-71-0x00000000004012B0-mapping.dmp
-
memory/1492-67-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1492-74-0x0000000000401000-0x000000000042E000-memory.dmpFilesize
180KB
-
memory/1492-75-0x0000000000A80000-0x0000000000D83000-memory.dmpFilesize
3.0MB
-
memory/1532-76-0x000000006F5E0000-0x000000006FB8B000-memory.dmpFilesize
5.7MB
-
memory/1532-59-0x0000000000000000-mapping.dmp
-
memory/1532-78-0x000000006F5E0000-0x000000006FB8B000-memory.dmpFilesize
5.7MB
-
memory/1916-62-0x0000000000000000-mapping.dmp