Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
01-12-2022 07:56
Static task
static1
Behavioral task
behavioral1
Sample
3580ae39b6b33aa67838c5c1ca91b6aebf91e470360fb13072497e85df748871.js
Resource
win7-20220812-en
General
-
Target
3580ae39b6b33aa67838c5c1ca91b6aebf91e470360fb13072497e85df748871.js
-
Size
341KB
-
MD5
59b4d0fb62bea58db86b5f9b82382f21
-
SHA1
57bae158e509b8e23c3347efeaf00553920b8bf6
-
SHA256
3580ae39b6b33aa67838c5c1ca91b6aebf91e470360fb13072497e85df748871
-
SHA512
d09975b8ecf9de689bf7e9cebfa9430940b6f465e00a15b4baeb839c598c61cac380263db96f027ef4328b705a773c3a4543961ba1806cc31c86a2fd82f29e6e
-
SSDEEP
6144:D9w3fOYrR6SInG2u3Wp4cwRDyTlMiAaJ/jpPiWUiSFtroVSSM1tZQfm:YWaR6SInGj3WN6DyhMiASjpPhSFtroVI
Malware Config
Extracted
formbook
4.1
a24e
flormarine.co.uk
theglazingsquad.uk
konarkpharma.com
maxpropertyfinanceuk.co.uk
jackson-ifc.com
yvonneazevedoimoveis.net
baystella.com
arexbaba.online
trihgd.xyz
filth520571.com
cikpkg.cfd
jakesupport.com
8863365.com
duniaslot777.online
lop3a.com
berkut-clan.ru
lernnavigator.com
elenaisaprincess.co.uk
daimadaquan.xyz
mychirocart.net
auroraalerts.uk
dunaphotography.com
netspirit.africa
alborhaneye.com
dwentalplans.com
95878.se
family-doctor-49371.com
grafonord.se
avimpactfit.com
growthlabus.com
kidney-life.com
delightfulappearance.com
valleymistst.co.uk
getasalaryraise.com
hongqiqu.vip
arkadiumstore.com
gaskansaja.click
getv3apparel.com
3888my.com
flaginyard.com
applehci.com
politouniversity.com
health-23.com
asciana.com
estheticdoctorturkey.com
bkes-2023.info
6bitly.com
abopappas.online
faridfabrics.com
td0.online
seosquid.co.uk
0731ye.net
alliotcloud.top
gxin-cn.com
96yz857.xyz
tekniik.co.uk
histarfamily.com
industrailglasstech.com
ioqpht6c.store
dacodig.com
emaliaolkusz1907.com
hjd533.com
dentalblueprints.com
amberdrichardson.com
balloonbanarasdecorator.com
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\BIG BRO.exe formbook C:\Users\Admin\AppData\Local\Temp\BIG BRO.exe formbook behavioral2/memory/2400-142-0x00000000004F0000-0x000000000051F000-memory.dmp formbook behavioral2/memory/2400-147-0x00000000004F0000-0x000000000051F000-memory.dmp formbook -
Blocklisted process makes network request 6 IoCs
Processes:
wscript.exeflow pid process 7 4768 wscript.exe 37 4768 wscript.exe 48 4768 wscript.exe 53 4768 wscript.exe 55 4768 wscript.exe 60 4768 wscript.exe -
Executes dropped EXE 1 IoCs
Processes:
BIG BRO.exepid process 1516 BIG BRO.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wscript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation wscript.exe -
Drops startup file 2 IoCs
Processes:
wscript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SfehVeXIsQ.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SfehVeXIsQ.js wscript.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
BIG BRO.exemsiexec.exedescription pid process target process PID 1516 set thread context of 2756 1516 BIG BRO.exe Explorer.EXE PID 2400 set thread context of 2756 2400 msiexec.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 60 IoCs
Processes:
BIG BRO.exemsiexec.exepid process 1516 BIG BRO.exe 1516 BIG BRO.exe 1516 BIG BRO.exe 1516 BIG BRO.exe 2400 msiexec.exe 2400 msiexec.exe 2400 msiexec.exe 2400 msiexec.exe 2400 msiexec.exe 2400 msiexec.exe 2400 msiexec.exe 2400 msiexec.exe 2400 msiexec.exe 2400 msiexec.exe 2400 msiexec.exe 2400 msiexec.exe 2400 msiexec.exe 2400 msiexec.exe 2400 msiexec.exe 2400 msiexec.exe 2400 msiexec.exe 2400 msiexec.exe 2400 msiexec.exe 2400 msiexec.exe 2400 msiexec.exe 2400 msiexec.exe 2400 msiexec.exe 2400 msiexec.exe 2400 msiexec.exe 2400 msiexec.exe 2400 msiexec.exe 2400 msiexec.exe 2400 msiexec.exe 2400 msiexec.exe 2400 msiexec.exe 2400 msiexec.exe 2400 msiexec.exe 2400 msiexec.exe 2400 msiexec.exe 2400 msiexec.exe 2400 msiexec.exe 2400 msiexec.exe 2400 msiexec.exe 2400 msiexec.exe 2400 msiexec.exe 2400 msiexec.exe 2400 msiexec.exe 2400 msiexec.exe 2400 msiexec.exe 2400 msiexec.exe 2400 msiexec.exe 2400 msiexec.exe 2400 msiexec.exe 2400 msiexec.exe 2400 msiexec.exe 2400 msiexec.exe 2400 msiexec.exe 2400 msiexec.exe 2400 msiexec.exe 2400 msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2756 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
BIG BRO.exemsiexec.exepid process 1516 BIG BRO.exe 1516 BIG BRO.exe 1516 BIG BRO.exe 2400 msiexec.exe 2400 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
BIG BRO.exemsiexec.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1516 BIG BRO.exe Token: SeDebugPrivilege 2400 msiexec.exe Token: SeShutdownPrivilege 2756 Explorer.EXE Token: SeCreatePagefilePrivilege 2756 Explorer.EXE Token: SeShutdownPrivilege 2756 Explorer.EXE Token: SeCreatePagefilePrivilege 2756 Explorer.EXE Token: SeShutdownPrivilege 2756 Explorer.EXE Token: SeCreatePagefilePrivilege 2756 Explorer.EXE Token: SeShutdownPrivilege 2756 Explorer.EXE Token: SeCreatePagefilePrivilege 2756 Explorer.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
wscript.exeExplorer.EXEmsiexec.exedescription pid process target process PID 1368 wrote to memory of 4768 1368 wscript.exe wscript.exe PID 1368 wrote to memory of 4768 1368 wscript.exe wscript.exe PID 1368 wrote to memory of 1516 1368 wscript.exe BIG BRO.exe PID 1368 wrote to memory of 1516 1368 wscript.exe BIG BRO.exe PID 1368 wrote to memory of 1516 1368 wscript.exe BIG BRO.exe PID 2756 wrote to memory of 2400 2756 Explorer.EXE msiexec.exe PID 2756 wrote to memory of 2400 2756 Explorer.EXE msiexec.exe PID 2756 wrote to memory of 2400 2756 Explorer.EXE msiexec.exe PID 2400 wrote to memory of 3408 2400 msiexec.exe cmd.exe PID 2400 wrote to memory of 3408 2400 msiexec.exe cmd.exe PID 2400 wrote to memory of 3408 2400 msiexec.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\3580ae39b6b33aa67838c5c1ca91b6aebf91e470360fb13072497e85df748871.js2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\SfehVeXIsQ.js"3⤵
- Blocklisted process makes network request
- Drops startup file
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\BIG BRO.exe"C:\Users\Admin\AppData\Local\Temp\BIG BRO.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1516 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\BIG BRO.exe"3⤵PID:3408
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\BIG BRO.exeFilesize
185KB
MD5a20ea9350fa5aa4d9641723f3dfc1b31
SHA1c23cf2953ea071eac81740a687473442c66e73de
SHA25601afe1517575e1fd7f60e86702fc11a97cfc74718e520c6016eef42fa164b4ae
SHA512296b4ace0af1f33abb8c3c0262999b07c8ad6e9a4c075959b43335992f1058865581b2c7d362dc824ed787f61dc9c62338778cd28e12add2ac34b086ca62e035
-
C:\Users\Admin\AppData\Local\Temp\BIG BRO.exeFilesize
185KB
MD5a20ea9350fa5aa4d9641723f3dfc1b31
SHA1c23cf2953ea071eac81740a687473442c66e73de
SHA25601afe1517575e1fd7f60e86702fc11a97cfc74718e520c6016eef42fa164b4ae
SHA512296b4ace0af1f33abb8c3c0262999b07c8ad6e9a4c075959b43335992f1058865581b2c7d362dc824ed787f61dc9c62338778cd28e12add2ac34b086ca62e035
-
C:\Users\Admin\AppData\Roaming\SfehVeXIsQ.jsFilesize
5KB
MD5ef7a0bcfc54e28b9a81af747b834c898
SHA147f605a45958a0beab476be0ef3b97434f7b999e
SHA25624fc05651edf06401a27a583f1dbe295881a16f9f98a04321319f3873a8569a4
SHA512c975ac3784e346a0ed4f754177f25d256b41bd0bf707f37f0e04e3d15022db5e6d9bfbe50719b8ac483f9b7406a0a3a2782a28f279a046f61faffb863ec5da31
-
memory/1516-134-0x0000000000000000-mapping.dmp
-
memory/1516-137-0x0000000001050000-0x000000000139A000-memory.dmpFilesize
3.3MB
-
memory/1516-138-0x0000000000FA0000-0x0000000000FB4000-memory.dmpFilesize
80KB
-
memory/2400-147-0x00000000004F0000-0x000000000051F000-memory.dmpFilesize
188KB
-
memory/2400-140-0x0000000000000000-mapping.dmp
-
memory/2400-141-0x0000000000960000-0x0000000000972000-memory.dmpFilesize
72KB
-
memory/2400-142-0x00000000004F0000-0x000000000051F000-memory.dmpFilesize
188KB
-
memory/2400-144-0x0000000002480000-0x00000000027CA000-memory.dmpFilesize
3.3MB
-
memory/2400-145-0x00000000022C0000-0x0000000002353000-memory.dmpFilesize
588KB
-
memory/2756-168-0x0000000003100000-0x0000000003110000-memory.dmpFilesize
64KB
-
memory/2756-175-0x00000000011A0000-0x00000000011B0000-memory.dmpFilesize
64KB
-
memory/2756-148-0x0000000003320000-0x0000000003403000-memory.dmpFilesize
908KB
-
memory/2756-149-0x00000000011A0000-0x00000000011B0000-memory.dmpFilesize
64KB
-
memory/2756-150-0x00000000011A0000-0x00000000011B0000-memory.dmpFilesize
64KB
-
memory/2756-151-0x00000000011A0000-0x00000000011B0000-memory.dmpFilesize
64KB
-
memory/2756-152-0x00000000011A0000-0x00000000011B0000-memory.dmpFilesize
64KB
-
memory/2756-153-0x00000000011A0000-0x00000000011B0000-memory.dmpFilesize
64KB
-
memory/2756-154-0x00000000011A0000-0x00000000011B0000-memory.dmpFilesize
64KB
-
memory/2756-155-0x00000000011A0000-0x00000000011B0000-memory.dmpFilesize
64KB
-
memory/2756-156-0x00000000011A0000-0x00000000011B0000-memory.dmpFilesize
64KB
-
memory/2756-157-0x00000000011A0000-0x00000000011B0000-memory.dmpFilesize
64KB
-
memory/2756-160-0x00000000011A0000-0x00000000011B0000-memory.dmpFilesize
64KB
-
memory/2756-159-0x00000000011A0000-0x00000000011B0000-memory.dmpFilesize
64KB
-
memory/2756-158-0x00000000011A0000-0x00000000011B0000-memory.dmpFilesize
64KB
-
memory/2756-161-0x00000000011A0000-0x00000000011B0000-memory.dmpFilesize
64KB
-
memory/2756-162-0x00000000011A0000-0x00000000011B0000-memory.dmpFilesize
64KB
-
memory/2756-163-0x00000000011A0000-0x00000000011B0000-memory.dmpFilesize
64KB
-
memory/2756-164-0x00000000011A0000-0x00000000011B0000-memory.dmpFilesize
64KB
-
memory/2756-165-0x00000000011A0000-0x00000000011B0000-memory.dmpFilesize
64KB
-
memory/2756-166-0x00000000011B0000-0x00000000011C0000-memory.dmpFilesize
64KB
-
memory/2756-167-0x0000000003100000-0x0000000003110000-memory.dmpFilesize
64KB
-
memory/2756-139-0x0000000002F30000-0x0000000003067000-memory.dmpFilesize
1.2MB
-
memory/2756-169-0x0000000003100000-0x0000000003110000-memory.dmpFilesize
64KB
-
memory/2756-170-0x0000000003100000-0x0000000003110000-memory.dmpFilesize
64KB
-
memory/2756-171-0x0000000003100000-0x0000000003110000-memory.dmpFilesize
64KB
-
memory/2756-172-0x00000000011A0000-0x00000000011B0000-memory.dmpFilesize
64KB
-
memory/2756-173-0x00000000011A0000-0x00000000011B0000-memory.dmpFilesize
64KB
-
memory/2756-176-0x00000000011A0000-0x00000000011B0000-memory.dmpFilesize
64KB
-
memory/2756-146-0x0000000003320000-0x0000000003403000-memory.dmpFilesize
908KB
-
memory/2756-174-0x00000000011A0000-0x00000000011B0000-memory.dmpFilesize
64KB
-
memory/2756-177-0x00000000011A0000-0x00000000011B0000-memory.dmpFilesize
64KB
-
memory/2756-178-0x00000000011A0000-0x00000000011B0000-memory.dmpFilesize
64KB
-
memory/2756-179-0x00000000011A0000-0x00000000011B0000-memory.dmpFilesize
64KB
-
memory/2756-180-0x00000000011A0000-0x00000000011B0000-memory.dmpFilesize
64KB
-
memory/2756-182-0x0000000003100000-0x0000000003110000-memory.dmpFilesize
64KB
-
memory/2756-181-0x00000000011A0000-0x00000000011B0000-memory.dmpFilesize
64KB
-
memory/2756-184-0x00000000011A0000-0x00000000011B0000-memory.dmpFilesize
64KB
-
memory/2756-187-0x00000000011A0000-0x00000000011B0000-memory.dmpFilesize
64KB
-
memory/2756-188-0x00000000011A0000-0x00000000011B0000-memory.dmpFilesize
64KB
-
memory/2756-186-0x00000000011A0000-0x00000000011B0000-memory.dmpFilesize
64KB
-
memory/2756-189-0x00000000011A0000-0x00000000011B0000-memory.dmpFilesize
64KB
-
memory/2756-185-0x00000000011A0000-0x00000000011B0000-memory.dmpFilesize
64KB
-
memory/2756-190-0x00000000011A0000-0x00000000011B0000-memory.dmpFilesize
64KB
-
memory/2756-194-0x00000000011A0000-0x00000000011B0000-memory.dmpFilesize
64KB
-
memory/2756-193-0x00000000011A0000-0x00000000011B0000-memory.dmpFilesize
64KB
-
memory/2756-192-0x00000000011A0000-0x00000000011B0000-memory.dmpFilesize
64KB
-
memory/2756-191-0x0000000003110000-0x0000000003120000-memory.dmpFilesize
64KB
-
memory/2756-195-0x00000000011A0000-0x00000000011B0000-memory.dmpFilesize
64KB
-
memory/2756-196-0x00000000011A0000-0x00000000011B0000-memory.dmpFilesize
64KB
-
memory/2756-197-0x00000000011A0000-0x00000000011B0000-memory.dmpFilesize
64KB
-
memory/2756-198-0x0000000003110000-0x0000000003120000-memory.dmpFilesize
64KB
-
memory/2756-199-0x0000000003100000-0x0000000003110000-memory.dmpFilesize
64KB
-
memory/2756-200-0x0000000003110000-0x0000000003120000-memory.dmpFilesize
64KB
-
memory/2756-201-0x0000000003110000-0x0000000003120000-memory.dmpFilesize
64KB
-
memory/2756-202-0x0000000003110000-0x0000000003120000-memory.dmpFilesize
64KB
-
memory/3408-143-0x0000000000000000-mapping.dmp
-
memory/4768-132-0x0000000000000000-mapping.dmp