Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
02-12-2022 08:50
Static task
static1
General
-
Target
3cfd81b824673a6ba23d472bd09d5e7610a3346cce6f23956507af5eab63c012.exe
-
Size
257KB
-
MD5
db34b27822c1c7d80e7e59ed743ce22c
-
SHA1
f888efab5bfd957947b95877b4c5c73067dad197
-
SHA256
3cfd81b824673a6ba23d472bd09d5e7610a3346cce6f23956507af5eab63c012
-
SHA512
860a92c61d02b1429853c529234ca0885cc37065503a14918ddfd722fd3281f1179fa036315a867eb36475e93db391307255e214b78733d8fd4ce7c93ed7a066
-
SSDEEP
6144:QBn1+chufZq/1wTiFDMwMBUvosOPuoXK+qvcAYzy/:g+ciAyeUavOha+nAYI
Malware Config
Extracted
formbook
4.1
pr28
huaxinimg.com
baorungas.com
comercializadoramultimus.com
blr-batipro.com
wantagedfas.uk
1thingplan.one
cweilin.com
lorienconsultingllc.com
jdzsjwx.com
casafacil.site
hkacgt.com
hasid.africa
92dgr97k4hr9.com
cvbiop.xyz
1wbskm.top
fantasticmobility.com
goodchoice2022.com
hafizpower.com
familiajoya.com
fundscrahelp.info
654-jp.com
locksmithexpressny.com
daniellelaurenhealth.com
65062.site
globallogisticsairline.com
livingdisabilitybenfits.com
cyprusposte.com
gladyshelps.click
letv.one
59963y.com
cre8tstudio.com
expandintofreedom.com
czechpeniche.com
windkind.net
cash4.cash
h9qblfpaog.one
growhthair.com
dmukpropertysolutions.co.uk
esd-protection.com
eqweqwewqewqewq.com
jovehome.com
dibujoart.com
fuy3.com
hthg172.com
crovv-creek.com
cannyok.online
inlook24.com
minionenterprises.net
doralfoundationssale.com
higgyspianobar.com
abundantproduction.com
agriseats.tech
diwolei.com
enwaav.tech
combienes.com
josiil.com
zweniprojects.africa
criplogistic.online
nerroir.com
blurockindustry.com
imaginaitonlibrary.com
ahavahfn.com
dougrushinglistings.com
leadsintolistings.com
alpheusmangale.com
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/4768-139-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/4768-144-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/4316-146-0x0000000000460000-0x000000000048F000-memory.dmp formbook behavioral1/memory/4316-150-0x0000000000460000-0x000000000048F000-memory.dmp formbook -
Executes dropped EXE 2 IoCs
Processes:
rzjxgj.exerzjxgj.exepid process 3956 rzjxgj.exe 4768 rzjxgj.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
rzjxgj.exerzjxgj.execontrol.exedescription pid process target process PID 3956 set thread context of 4768 3956 rzjxgj.exe rzjxgj.exe PID 4768 set thread context of 2056 4768 rzjxgj.exe Explorer.EXE PID 4316 set thread context of 2056 4316 control.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 58 IoCs
Processes:
rzjxgj.execontrol.exepid process 4768 rzjxgj.exe 4768 rzjxgj.exe 4768 rzjxgj.exe 4768 rzjxgj.exe 4316 control.exe 4316 control.exe 4316 control.exe 4316 control.exe 4316 control.exe 4316 control.exe 4316 control.exe 4316 control.exe 4316 control.exe 4316 control.exe 4316 control.exe 4316 control.exe 4316 control.exe 4316 control.exe 4316 control.exe 4316 control.exe 4316 control.exe 4316 control.exe 4316 control.exe 4316 control.exe 4316 control.exe 4316 control.exe 4316 control.exe 4316 control.exe 4316 control.exe 4316 control.exe 4316 control.exe 4316 control.exe 4316 control.exe 4316 control.exe 4316 control.exe 4316 control.exe 4316 control.exe 4316 control.exe 4316 control.exe 4316 control.exe 4316 control.exe 4316 control.exe 4316 control.exe 4316 control.exe 4316 control.exe 4316 control.exe 4316 control.exe 4316 control.exe 4316 control.exe 4316 control.exe 4316 control.exe 4316 control.exe 4316 control.exe 4316 control.exe 4316 control.exe 4316 control.exe 4316 control.exe 4316 control.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2056 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
rzjxgj.exerzjxgj.execontrol.exepid process 3956 rzjxgj.exe 4768 rzjxgj.exe 4768 rzjxgj.exe 4768 rzjxgj.exe 4316 control.exe 4316 control.exe -
Suspicious use of AdjustPrivilegeToken 14 IoCs
Processes:
rzjxgj.execontrol.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 4768 rzjxgj.exe Token: SeDebugPrivilege 4316 control.exe Token: SeShutdownPrivilege 2056 Explorer.EXE Token: SeCreatePagefilePrivilege 2056 Explorer.EXE Token: SeShutdownPrivilege 2056 Explorer.EXE Token: SeCreatePagefilePrivilege 2056 Explorer.EXE Token: SeShutdownPrivilege 2056 Explorer.EXE Token: SeCreatePagefilePrivilege 2056 Explorer.EXE Token: SeShutdownPrivilege 2056 Explorer.EXE Token: SeCreatePagefilePrivilege 2056 Explorer.EXE Token: SeShutdownPrivilege 2056 Explorer.EXE Token: SeCreatePagefilePrivilege 2056 Explorer.EXE Token: SeShutdownPrivilege 2056 Explorer.EXE Token: SeCreatePagefilePrivilege 2056 Explorer.EXE -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
3cfd81b824673a6ba23d472bd09d5e7610a3346cce6f23956507af5eab63c012.exerzjxgj.exeExplorer.EXEcontrol.exedescription pid process target process PID 1848 wrote to memory of 3956 1848 3cfd81b824673a6ba23d472bd09d5e7610a3346cce6f23956507af5eab63c012.exe rzjxgj.exe PID 1848 wrote to memory of 3956 1848 3cfd81b824673a6ba23d472bd09d5e7610a3346cce6f23956507af5eab63c012.exe rzjxgj.exe PID 1848 wrote to memory of 3956 1848 3cfd81b824673a6ba23d472bd09d5e7610a3346cce6f23956507af5eab63c012.exe rzjxgj.exe PID 3956 wrote to memory of 4768 3956 rzjxgj.exe rzjxgj.exe PID 3956 wrote to memory of 4768 3956 rzjxgj.exe rzjxgj.exe PID 3956 wrote to memory of 4768 3956 rzjxgj.exe rzjxgj.exe PID 3956 wrote to memory of 4768 3956 rzjxgj.exe rzjxgj.exe PID 2056 wrote to memory of 4316 2056 Explorer.EXE control.exe PID 2056 wrote to memory of 4316 2056 Explorer.EXE control.exe PID 2056 wrote to memory of 4316 2056 Explorer.EXE control.exe PID 4316 wrote to memory of 4528 4316 control.exe cmd.exe PID 4316 wrote to memory of 4528 4316 control.exe cmd.exe PID 4316 wrote to memory of 4528 4316 control.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\3cfd81b824673a6ba23d472bd09d5e7610a3346cce6f23956507af5eab63c012.exe"C:\Users\Admin\AppData\Local\Temp\3cfd81b824673a6ba23d472bd09d5e7610a3346cce6f23956507af5eab63c012.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\rzjxgj.exe"C:\Users\Admin\AppData\Local\Temp\rzjxgj.exe" C:\Users\Admin\AppData\Local\Temp\okwqyzbx.uc3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\rzjxgj.exe"C:\Users\Admin\AppData\Local\Temp\rzjxgj.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4768 -
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\rzjxgj.exe"3⤵PID:4528
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\jbenz.mFilesize
185KB
MD54b4ce519a534f3436dbbc48d123b6e83
SHA1d10796875fffdebd65a4fec5de8dda497d2fc981
SHA256552b1709acc1df6fed2544cad9f85c7f715c8c7e1e48c94c6ee6607b24a1b114
SHA512b8f38ee58c66bd4b982d26aba7ec7967cd0a96a9b58c7661ffe1835c0b9f2f4c55d1484c2a79ed67eed23cc412607bfb9f77bfc4276727d94fecf917aacd7225
-
C:\Users\Admin\AppData\Local\Temp\okwqyzbx.ucFilesize
5KB
MD5e22f33b90450537ae0e9df382a3c87d2
SHA1876eacd3ee12b0223c6c0564371f0e49ce5e5f29
SHA256b9e9dcefcabf28d10c0a5cc8225b17444567e77a52bfd5b32f8f33a314129fc8
SHA51216f3130d76b6df093022d6842e86136291bd7b28c87f8cd4ec8c903996b3823595f7df69d034f459b9cc26acff8d63c68dc002a7728bbeaf86a7892219a1ad14
-
C:\Users\Admin\AppData\Local\Temp\rzjxgj.exeFilesize
104KB
MD59d249d3a0088dd3e3b7cdc0068bcb9dc
SHA11a3e0934278243d4e7c82f69f77271426c18d23d
SHA256292de2987a1b943bbfec1025d9bb571a8c8aa59dd0662565147952f8a2d3dc06
SHA51214c48fffcca018aa32a2f98ef793b28084c1691d78aa7cd2de88f7f568a2b3340920c8eef0372bccd7167a3edd333fa78cdb37ce48b62657a5cb975c8fa7a2a8
-
C:\Users\Admin\AppData\Local\Temp\rzjxgj.exeFilesize
104KB
MD59d249d3a0088dd3e3b7cdc0068bcb9dc
SHA11a3e0934278243d4e7c82f69f77271426c18d23d
SHA256292de2987a1b943bbfec1025d9bb571a8c8aa59dd0662565147952f8a2d3dc06
SHA51214c48fffcca018aa32a2f98ef793b28084c1691d78aa7cd2de88f7f568a2b3340920c8eef0372bccd7167a3edd333fa78cdb37ce48b62657a5cb975c8fa7a2a8
-
C:\Users\Admin\AppData\Local\Temp\rzjxgj.exeFilesize
104KB
MD59d249d3a0088dd3e3b7cdc0068bcb9dc
SHA11a3e0934278243d4e7c82f69f77271426c18d23d
SHA256292de2987a1b943bbfec1025d9bb571a8c8aa59dd0662565147952f8a2d3dc06
SHA51214c48fffcca018aa32a2f98ef793b28084c1691d78aa7cd2de88f7f568a2b3340920c8eef0372bccd7167a3edd333fa78cdb37ce48b62657a5cb975c8fa7a2a8
-
memory/2056-179-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-161-0x0000000007C00000-0x0000000007C10000-memory.dmpFilesize
64KB
-
memory/2056-226-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-225-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-224-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-223-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-221-0x0000000002A90000-0x0000000002AA0000-memory.dmpFilesize
64KB
-
memory/2056-222-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-220-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-216-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-218-0x0000000002330000-0x0000000002340000-memory.dmpFilesize
64KB
-
memory/2056-219-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-149-0x0000000002970000-0x0000000002A8F000-memory.dmpFilesize
1.1MB
-
memory/2056-217-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-215-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-152-0x00000000081B0000-0x0000000008319000-memory.dmpFilesize
1.4MB
-
memory/2056-153-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-154-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-155-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-156-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-157-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-158-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-159-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-160-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-184-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-162-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-164-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-166-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-167-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-165-0x0000000007C00000-0x0000000007C10000-memory.dmpFilesize
64KB
-
memory/2056-168-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-169-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-170-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-171-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-172-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-173-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-174-0x0000000007C00000-0x0000000007C10000-memory.dmpFilesize
64KB
-
memory/2056-175-0x00000000081B0000-0x0000000008319000-memory.dmpFilesize
1.4MB
-
memory/2056-182-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-183-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-178-0x0000000007C00000-0x0000000007C10000-memory.dmpFilesize
64KB
-
memory/2056-142-0x0000000002970000-0x0000000002A8F000-memory.dmpFilesize
1.1MB
-
memory/2056-180-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-181-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-176-0x0000000007C00000-0x0000000007C10000-memory.dmpFilesize
64KB
-
memory/2056-214-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-177-0x0000000007C00000-0x0000000007C10000-memory.dmpFilesize
64KB
-
memory/2056-185-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-186-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-187-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-188-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-189-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-190-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-191-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-192-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-193-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-194-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-195-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-196-0x0000000002390000-0x00000000023A0000-memory.dmpFilesize
64KB
-
memory/2056-197-0x00000000023A0000-0x00000000023B0000-memory.dmpFilesize
64KB
-
memory/2056-198-0x00000000023A0000-0x00000000023B0000-memory.dmpFilesize
64KB
-
memory/2056-199-0x00000000023A0000-0x00000000023B0000-memory.dmpFilesize
64KB
-
memory/2056-200-0x0000000002390000-0x00000000023A0000-memory.dmpFilesize
64KB
-
memory/2056-201-0x00000000023A0000-0x00000000023B0000-memory.dmpFilesize
64KB
-
memory/2056-202-0x00000000023A0000-0x00000000023B0000-memory.dmpFilesize
64KB
-
memory/2056-203-0x00000000023A0000-0x00000000023B0000-memory.dmpFilesize
64KB
-
memory/2056-204-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-205-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-206-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-207-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-208-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-209-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-210-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-211-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-212-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-213-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/3956-132-0x0000000000000000-mapping.dmp
-
memory/4316-146-0x0000000000460000-0x000000000048F000-memory.dmpFilesize
188KB
-
memory/4316-150-0x0000000000460000-0x000000000048F000-memory.dmpFilesize
188KB
-
memory/4316-148-0x0000000002660000-0x00000000029AA000-memory.dmpFilesize
3.3MB
-
memory/4316-151-0x0000000002400000-0x0000000002493000-memory.dmpFilesize
588KB
-
memory/4316-145-0x00000000004F0000-0x0000000000517000-memory.dmpFilesize
156KB
-
memory/4316-143-0x0000000000000000-mapping.dmp
-
memory/4528-147-0x0000000000000000-mapping.dmp
-
memory/4768-141-0x00000000006D0000-0x00000000006E4000-memory.dmpFilesize
80KB
-
memory/4768-144-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4768-140-0x0000000000B60000-0x0000000000EAA000-memory.dmpFilesize
3.3MB
-
memory/4768-139-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4768-137-0x0000000000000000-mapping.dmp