Analysis
-
max time kernel
147s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01-12-2022 18:19
Static task
static1
Behavioral task
behavioral1
Sample
608aed0c05c0bd3ff091e559c92093440f659cc8b6f98865ce907cd9d6885ba3.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
608aed0c05c0bd3ff091e559c92093440f659cc8b6f98865ce907cd9d6885ba3.exe
Resource
win10v2004-20221111-en
General
-
Target
608aed0c05c0bd3ff091e559c92093440f659cc8b6f98865ce907cd9d6885ba3.exe
-
Size
894KB
-
MD5
973a94d5f2fb8e7d4da718d074dfd9eb
-
SHA1
707f58e7972ed3493b0bd62480e4ed9538eba93f
-
SHA256
608aed0c05c0bd3ff091e559c92093440f659cc8b6f98865ce907cd9d6885ba3
-
SHA512
9b5dac4e93ff472550e557b9ea6e3bc4ccdcefd861886403a4c3729b9070de30d507ce3d4dc341d671416b1f4bd6e1a7a3624e5f9cd0f9935b3c375b89595250
-
SSDEEP
24576:EHryn040Nznszfdf0DYkmybe7hxtcPuDdEPf:6mp0SZfsgyOT6vP
Malware Config
Extracted
formbook
4.1
cy28
100049723423.review
lovehealthcare.online
immuniversity.info
ihproductions.net
originatorsu.mobi
shxwjn.top
fivemeters.com
planettiki.site
berantaspinjol.online
oregonusedtrucks.com
darkstarkoi.com
izmirhaberci.world
41014.top
georgiaspanishgoats.com
dealstopstartups.click
ravmodeling.center
unsundayjesus.world
initialslash.site
shubaola.top
caserevision.com
tstak.us
jmessickconstructionllc.com
bluemagicmusique.com
laspirale.site
tugarujisyo.com
privatizestagnant.top
udqwxzfy.site
forami.xyz
lkougd.com
october-zodiac-sign.info
peppervalue.com
miladarentacar.com
englishcontinue.com
lainhavenohair.icu
587250.biz
acaskill.com
signworldtv.com
cuflyfishing.com
joelthomson.shop
1wwsf.top
232521.info
swiftenginereconditioning.store
kfcva4.tech
alejand-gomez.com
adimarketplace.online
thenewusalon.com
17877.top
toukoukai.site
pvalbedo.com
entrylogs.com
instantarms.com
ellicottcitymd.info
pontificals-stumblingstone.biz
vickers.store
financier.pro
tecfloors.online
onearani.store
eleganciacliniclucknow.com
fishphon.com
toxidosie3d.store
allcitytowingnow.com
linkc88.com
ky4150.com
themetaversewire.com
toxicboneyard.net
Signatures
-
Formbook payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1764-67-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1764-68-0x000000000041F140-mapping.dmp formbook behavioral1/memory/1764-75-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1020-78-0x0000000000080000-0x00000000000AF000-memory.dmp formbook behavioral1/memory/1020-83-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
608aed0c05c0bd3ff091e559c92093440f659cc8b6f98865ce907cd9d6885ba3.exeRegSvcs.execmmon32.exedescription pid process target process PID 1548 set thread context of 1764 1548 608aed0c05c0bd3ff091e559c92093440f659cc8b6f98865ce907cd9d6885ba3.exe RegSvcs.exe PID 1764 set thread context of 1268 1764 RegSvcs.exe Explorer.EXE PID 1020 set thread context of 1268 1020 cmmon32.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
RegSvcs.exepowershell.execmmon32.exepid process 1764 RegSvcs.exe 1764 RegSvcs.exe 904 powershell.exe 1020 cmmon32.exe 1020 cmmon32.exe 1020 cmmon32.exe 1020 cmmon32.exe 1020 cmmon32.exe 1020 cmmon32.exe 1020 cmmon32.exe 1020 cmmon32.exe 1020 cmmon32.exe 1020 cmmon32.exe 1020 cmmon32.exe 1020 cmmon32.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.execmmon32.exepid process 1764 RegSvcs.exe 1764 RegSvcs.exe 1764 RegSvcs.exe 1020 cmmon32.exe 1020 cmmon32.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
RegSvcs.exepowershell.execmmon32.exedescription pid process Token: SeDebugPrivilege 1764 RegSvcs.exe Token: SeDebugPrivilege 904 powershell.exe Token: SeDebugPrivilege 1020 cmmon32.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
608aed0c05c0bd3ff091e559c92093440f659cc8b6f98865ce907cd9d6885ba3.exeExplorer.EXEcmmon32.exedescription pid process target process PID 1548 wrote to memory of 904 1548 608aed0c05c0bd3ff091e559c92093440f659cc8b6f98865ce907cd9d6885ba3.exe powershell.exe PID 1548 wrote to memory of 904 1548 608aed0c05c0bd3ff091e559c92093440f659cc8b6f98865ce907cd9d6885ba3.exe powershell.exe PID 1548 wrote to memory of 904 1548 608aed0c05c0bd3ff091e559c92093440f659cc8b6f98865ce907cd9d6885ba3.exe powershell.exe PID 1548 wrote to memory of 904 1548 608aed0c05c0bd3ff091e559c92093440f659cc8b6f98865ce907cd9d6885ba3.exe powershell.exe PID 1548 wrote to memory of 456 1548 608aed0c05c0bd3ff091e559c92093440f659cc8b6f98865ce907cd9d6885ba3.exe schtasks.exe PID 1548 wrote to memory of 456 1548 608aed0c05c0bd3ff091e559c92093440f659cc8b6f98865ce907cd9d6885ba3.exe schtasks.exe PID 1548 wrote to memory of 456 1548 608aed0c05c0bd3ff091e559c92093440f659cc8b6f98865ce907cd9d6885ba3.exe schtasks.exe PID 1548 wrote to memory of 456 1548 608aed0c05c0bd3ff091e559c92093440f659cc8b6f98865ce907cd9d6885ba3.exe schtasks.exe PID 1548 wrote to memory of 1764 1548 608aed0c05c0bd3ff091e559c92093440f659cc8b6f98865ce907cd9d6885ba3.exe RegSvcs.exe PID 1548 wrote to memory of 1764 1548 608aed0c05c0bd3ff091e559c92093440f659cc8b6f98865ce907cd9d6885ba3.exe RegSvcs.exe PID 1548 wrote to memory of 1764 1548 608aed0c05c0bd3ff091e559c92093440f659cc8b6f98865ce907cd9d6885ba3.exe RegSvcs.exe PID 1548 wrote to memory of 1764 1548 608aed0c05c0bd3ff091e559c92093440f659cc8b6f98865ce907cd9d6885ba3.exe RegSvcs.exe PID 1548 wrote to memory of 1764 1548 608aed0c05c0bd3ff091e559c92093440f659cc8b6f98865ce907cd9d6885ba3.exe RegSvcs.exe PID 1548 wrote to memory of 1764 1548 608aed0c05c0bd3ff091e559c92093440f659cc8b6f98865ce907cd9d6885ba3.exe RegSvcs.exe PID 1548 wrote to memory of 1764 1548 608aed0c05c0bd3ff091e559c92093440f659cc8b6f98865ce907cd9d6885ba3.exe RegSvcs.exe PID 1548 wrote to memory of 1764 1548 608aed0c05c0bd3ff091e559c92093440f659cc8b6f98865ce907cd9d6885ba3.exe RegSvcs.exe PID 1548 wrote to memory of 1764 1548 608aed0c05c0bd3ff091e559c92093440f659cc8b6f98865ce907cd9d6885ba3.exe RegSvcs.exe PID 1548 wrote to memory of 1764 1548 608aed0c05c0bd3ff091e559c92093440f659cc8b6f98865ce907cd9d6885ba3.exe RegSvcs.exe PID 1268 wrote to memory of 1020 1268 Explorer.EXE cmmon32.exe PID 1268 wrote to memory of 1020 1268 Explorer.EXE cmmon32.exe PID 1268 wrote to memory of 1020 1268 Explorer.EXE cmmon32.exe PID 1268 wrote to memory of 1020 1268 Explorer.EXE cmmon32.exe PID 1020 wrote to memory of 1736 1020 cmmon32.exe cmd.exe PID 1020 wrote to memory of 1736 1020 cmmon32.exe cmd.exe PID 1020 wrote to memory of 1736 1020 cmmon32.exe cmd.exe PID 1020 wrote to memory of 1736 1020 cmmon32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\608aed0c05c0bd3ff091e559c92093440f659cc8b6f98865ce907cd9d6885ba3.exe"C:\Users\Admin\AppData\Local\Temp\608aed0c05c0bd3ff091e559c92093440f659cc8b6f98865ce907cd9d6885ba3.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\IAFLNzOdgRR.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:904 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IAFLNzOdgRR" /XML "C:\Users\Admin\AppData\Local\Temp\tmp870C.tmp"3⤵
- Creates scheduled task(s)
PID:456 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1764 -
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵PID:1736
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp870C.tmpFilesize
1KB
MD51894041f3a6d5074981138dd964194fb
SHA1eb62a6627028facc6057da0f4de640a2a2170d10
SHA256e48004346f999e1513d826b09ea3c7bbd9f4ee97e21ad1210cf7e5ee98138018
SHA51275002f8ba1a6a6ba52f18868e4a4766171682f01636011e19a674128d1e432ec8bb178c9ee5ed628f0139b4a15d3501d0f68d876b07aacb11a7cf1939b8b3b5a
-
memory/456-60-0x0000000000000000-mapping.dmp
-
memory/904-59-0x0000000000000000-mapping.dmp
-
memory/904-80-0x000000006EAA0000-0x000000006F04B000-memory.dmpFilesize
5.7MB
-
memory/904-70-0x000000006EAA0000-0x000000006F04B000-memory.dmpFilesize
5.7MB
-
memory/1020-78-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/1020-83-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/1020-81-0x0000000001D60000-0x0000000001DF3000-memory.dmpFilesize
588KB
-
memory/1020-79-0x0000000001F60000-0x0000000002263000-memory.dmpFilesize
3.0MB
-
memory/1020-77-0x0000000000470000-0x000000000047D000-memory.dmpFilesize
52KB
-
memory/1020-74-0x0000000000000000-mapping.dmp
-
memory/1268-73-0x0000000004590000-0x000000000467C000-memory.dmpFilesize
944KB
-
memory/1268-84-0x0000000004AB0000-0x0000000004BB5000-memory.dmpFilesize
1.0MB
-
memory/1268-82-0x0000000004AB0000-0x0000000004BB5000-memory.dmpFilesize
1.0MB
-
memory/1548-54-0x0000000000030000-0x0000000000116000-memory.dmpFilesize
920KB
-
memory/1548-58-0x0000000005730000-0x00000000057D6000-memory.dmpFilesize
664KB
-
memory/1548-57-0x0000000001E50000-0x0000000001E5E000-memory.dmpFilesize
56KB
-
memory/1548-63-0x00000000057D0000-0x000000000583C000-memory.dmpFilesize
432KB
-
memory/1548-56-0x0000000000710000-0x0000000000726000-memory.dmpFilesize
88KB
-
memory/1548-55-0x0000000075041000-0x0000000075043000-memory.dmpFilesize
8KB
-
memory/1736-76-0x0000000000000000-mapping.dmp
-
memory/1764-68-0x000000000041F140-mapping.dmp
-
memory/1764-72-0x0000000000390000-0x00000000003A4000-memory.dmpFilesize
80KB
-
memory/1764-67-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1764-65-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1764-64-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1764-75-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1764-71-0x0000000000A20000-0x0000000000D23000-memory.dmpFilesize
3.0MB