Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
03-12-2022 22:23
Static task
static1
Behavioral task
behavioral1
Sample
Confirmation transfer Ref No_00101334632192.exe
Resource
win7-20220901-en
General
-
Target
Confirmation transfer Ref No_00101334632192.exe
-
Size
954KB
-
MD5
8ecc522f8617adaf469f173400806dcf
-
SHA1
19aff3a1b435064dade4cc095f9d10a5b6ba9859
-
SHA256
b0e5e12bea8386e6e06c82e4e25257b22649a608b2ef2a599332879983a000b0
-
SHA512
8109fd4157101064a8d4f73f438aed7f39202ebff2ab539a11434c625661cdc2c88509e9ef3a5f616d3e8136e20dd3f386fd94009b9e7f9e1344a9167d65b542
-
SSDEEP
24576:ukqTTiwAAgEEY4olXoFZ6toHqwjwv0E6:ITQpo9aUvt
Malware Config
Extracted
formbook
q4k5
ZXN4RZ1db9JIzC7mhQ==
5+KpXZWys/DewpGQbChh6uPT5SNzFQ==
A8YuEKESXrzBhw==
uYH/9+Amwe1ZMkaR
KAusoWlA4I1Rt0P0jA==
AgIBy9IHiq8cdo4h47hB
PsX/0DrQRr+0hQ==
3z4v9UwXBjNTf48h47hB
bySPUkT+SFuT
VsQK5NkDks06l5z+TUG3eetd/twx2Mcjlg==
3+DcnQWuXG84sOphj5LEHIv/hA==
TOZXSDkjSHDoLk/pl2HYpOXJ
q7GGZ9KJrss/oTNwyxI=
2+O/k7y22Qo=
Joatk/qnSoO3q48h47hB
KT1UQcQ9yxWFQzCI
onRBEIHmYIl9XzhAIMtPLFAh5SNzFQ==
a8IY/+/oCDOj2TuM4Ohc
UlIOzyniF1sRnTNwyxI=
8UJiR6gijbvt+exXo7oCvdNV4BE=
Urjip46/QFqY3IbL49JI
JfhnyyWmRr+0hQ==
NQ/x1kqxFzdlZxj77D50BA==
s8KGT8F9hORX0PpkwQ0=
YSzTpB3S8xCI8ULHIqGXNgY=
sh5wMyQZI1vLJmwH6iCYYhs=
btoWw6OWyfyFQzCI
K5bFl4HSibSwnJIh47hB
5sRZGfCxukuFQzCI
4jiHORQB/0EDbaGQl2ilFw==
Ts7ysROSFE3HrOnU8EqBDg==
2z9tHQD6Gjl3YUCJh1vLdcrTwRt+Hw==
w91HMRoJOmeYopkN49VL
a1ga8Wf5Bx9fUzPDjUWJEw==
rBpOLYYTzP++KoBH2XWmbB8=
JZPo4OETkqGrdBDliw+PrW4Zmg==
PYzy1tDDx/96nYLpl2HYpOXJ
p/M0Ef80rdYbFfcO4p7irW4Zmg==
6YhhQS0qE0+O
rT4fBVXCf+hb2xM=
pwQDw8H/dewWOzpxb1HPt0gcMA9t
P6X8tCGrSmWZLbWjgQ==
wrCGfm2dv+KgNsISa42zHM+BOgxl
GXjQw6Xfj8VBF9/mng==
x6WEd+1T0d6iSdb9jA+DOQQ=
v5Y09doqE0+O
e7Kvto6ClseFgnKzlA==
PAAwEG/mkb2xgvobt0+ADA==
ddEnEwXzDyZodU9dK7/prW4Zmg==
hmTOmXa3PWqtq9PR1dRY
d3ZqOq8XkK635xo=
sf1cMQ5W4RhWZE52h5nbZNOAgFKsUS7B
b4hMHaBbU3d5twfgmg==
wNLg11vUbqOUPNLH3mmtLxE=
9D5oSLllFkJugkZbVThn404IIRl0
LaEqCfmuAyFwVPLwnQ==
ryEt5D/BRWVRKvgL53n30PG/Rb8M9pMXlQ==
alIsGunV8xlUdI4h47hB
yCI/OqUUpcHxdgrymg==
6FJ1QUNw7x5hf44h47hB
/f4T9lO+KIVF2Rk=
etr639YLfJni1+vy8sFD
DWvuYbw2NEmZ
1ndLKAERBY9kUkKt3fRdXdGFAAlv
qkbe4.xyz
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Confirmation transfer Ref No_00101334632192.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\Geo\Nation Confirmation transfer Ref No_00101334632192.exe -
Loads dropped DLL 1 IoCs
Processes:
chkdsk.exepid process 2028 chkdsk.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Confirmation transfer Ref No_00101334632192.exeConfirmation transfer Ref No_00101334632192.exechkdsk.exedescription pid process target process PID 1752 set thread context of 1480 1752 Confirmation transfer Ref No_00101334632192.exe Confirmation transfer Ref No_00101334632192.exe PID 1480 set thread context of 1236 1480 Confirmation transfer Ref No_00101334632192.exe Explorer.EXE PID 2028 set thread context of 1236 2028 chkdsk.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Processes:
chkdsk.exedescription ioc process Key created \Registry\User\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
Confirmation transfer Ref No_00101334632192.exepowershell.exeConfirmation transfer Ref No_00101334632192.exechkdsk.exepid process 1752 Confirmation transfer Ref No_00101334632192.exe 1752 Confirmation transfer Ref No_00101334632192.exe 1932 powershell.exe 1480 Confirmation transfer Ref No_00101334632192.exe 1480 Confirmation transfer Ref No_00101334632192.exe 1480 Confirmation transfer Ref No_00101334632192.exe 1480 Confirmation transfer Ref No_00101334632192.exe 2028 chkdsk.exe 2028 chkdsk.exe 2028 chkdsk.exe 2028 chkdsk.exe 2028 chkdsk.exe 2028 chkdsk.exe 2028 chkdsk.exe 2028 chkdsk.exe 2028 chkdsk.exe 2028 chkdsk.exe 2028 chkdsk.exe 2028 chkdsk.exe 2028 chkdsk.exe 2028 chkdsk.exe 2028 chkdsk.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1236 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
Confirmation transfer Ref No_00101334632192.exechkdsk.exepid process 1480 Confirmation transfer Ref No_00101334632192.exe 1480 Confirmation transfer Ref No_00101334632192.exe 1480 Confirmation transfer Ref No_00101334632192.exe 2028 chkdsk.exe 2028 chkdsk.exe 2028 chkdsk.exe 2028 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
Confirmation transfer Ref No_00101334632192.exepowershell.exeConfirmation transfer Ref No_00101334632192.exechkdsk.exedescription pid process Token: SeDebugPrivilege 1752 Confirmation transfer Ref No_00101334632192.exe Token: SeDebugPrivilege 1932 powershell.exe Token: SeDebugPrivilege 1480 Confirmation transfer Ref No_00101334632192.exe Token: SeDebugPrivilege 2028 chkdsk.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1236 Explorer.EXE 1236 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1236 Explorer.EXE 1236 Explorer.EXE -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
Confirmation transfer Ref No_00101334632192.exeExplorer.EXEchkdsk.exedescription pid process target process PID 1752 wrote to memory of 1932 1752 Confirmation transfer Ref No_00101334632192.exe powershell.exe PID 1752 wrote to memory of 1932 1752 Confirmation transfer Ref No_00101334632192.exe powershell.exe PID 1752 wrote to memory of 1932 1752 Confirmation transfer Ref No_00101334632192.exe powershell.exe PID 1752 wrote to memory of 1932 1752 Confirmation transfer Ref No_00101334632192.exe powershell.exe PID 1752 wrote to memory of 1928 1752 Confirmation transfer Ref No_00101334632192.exe schtasks.exe PID 1752 wrote to memory of 1928 1752 Confirmation transfer Ref No_00101334632192.exe schtasks.exe PID 1752 wrote to memory of 1928 1752 Confirmation transfer Ref No_00101334632192.exe schtasks.exe PID 1752 wrote to memory of 1928 1752 Confirmation transfer Ref No_00101334632192.exe schtasks.exe PID 1752 wrote to memory of 1480 1752 Confirmation transfer Ref No_00101334632192.exe Confirmation transfer Ref No_00101334632192.exe PID 1752 wrote to memory of 1480 1752 Confirmation transfer Ref No_00101334632192.exe Confirmation transfer Ref No_00101334632192.exe PID 1752 wrote to memory of 1480 1752 Confirmation transfer Ref No_00101334632192.exe Confirmation transfer Ref No_00101334632192.exe PID 1752 wrote to memory of 1480 1752 Confirmation transfer Ref No_00101334632192.exe Confirmation transfer Ref No_00101334632192.exe PID 1752 wrote to memory of 1480 1752 Confirmation transfer Ref No_00101334632192.exe Confirmation transfer Ref No_00101334632192.exe PID 1752 wrote to memory of 1480 1752 Confirmation transfer Ref No_00101334632192.exe Confirmation transfer Ref No_00101334632192.exe PID 1752 wrote to memory of 1480 1752 Confirmation transfer Ref No_00101334632192.exe Confirmation transfer Ref No_00101334632192.exe PID 1236 wrote to memory of 2028 1236 Explorer.EXE chkdsk.exe PID 1236 wrote to memory of 2028 1236 Explorer.EXE chkdsk.exe PID 1236 wrote to memory of 2028 1236 Explorer.EXE chkdsk.exe PID 1236 wrote to memory of 2028 1236 Explorer.EXE chkdsk.exe PID 2028 wrote to memory of 1252 2028 chkdsk.exe Firefox.exe PID 2028 wrote to memory of 1252 2028 chkdsk.exe Firefox.exe PID 2028 wrote to memory of 1252 2028 chkdsk.exe Firefox.exe PID 2028 wrote to memory of 1252 2028 chkdsk.exe Firefox.exe PID 2028 wrote to memory of 1252 2028 chkdsk.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\Confirmation transfer Ref No_00101334632192.exe"C:\Users\Admin\AppData\Local\Temp\Confirmation transfer Ref No_00101334632192.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\PuscvCO.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1932 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PuscvCO" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBEED.tmp"3⤵
- Creates scheduled task(s)
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\Confirmation transfer Ref No_00101334632192.exe"C:\Users\Admin\AppData\Local\Temp\Confirmation transfer Ref No_00101334632192.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1480 -
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:1252
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpBEED.tmpFilesize
1KB
MD50f9a4e4ca93149baf63ee1cc186821f4
SHA19835115ee0b47a64112ef19ad772bfebcb464a38
SHA25689ff05b30d030bd8f2acc15fc40fbf187a59ff739d829ebf898f441c42c93d08
SHA5125068493b18fe6f93138894f3384819b07d7d2f761eda99d0af8f76688cc5fcc7e0bab1716ee597a58d3accdb068999ee648dfe4227ae677a62fbe98d37992966
-
\Users\Admin\AppData\Local\Temp\sqlite3.dllFilesize
1.0MB
MD5ce5c15b5092877974d5b6476ad1cb2d7
SHA176a6fc307d1524081cba1886d312df97c9dd658f
SHA2561f1a186ea26bd2462ea2a9cf35a816b92caf0897fdf332af3a61569e0ba97b24
SHA512bb9ced38c63d2a29e18c38f60020cfdf0161384cd4ad6328352626643becdf49f6b4bef47012391720344fdd8ad520aa802dcbbed15b5026d27eb93b0a839c90
-
memory/1236-87-0x0000000005F50000-0x000000000602B000-memory.dmpFilesize
876KB
-
memory/1236-84-0x0000000005F50000-0x000000000602B000-memory.dmpFilesize
876KB
-
memory/1236-77-0x0000000005DF0000-0x0000000005F4B000-memory.dmpFilesize
1.4MB
-
memory/1480-72-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/1480-75-0x0000000000422000-0x0000000000424000-memory.dmpFilesize
8KB
-
memory/1480-76-0x00000000001B0000-0x00000000001C0000-memory.dmpFilesize
64KB
-
memory/1480-74-0x0000000000990000-0x0000000000C93000-memory.dmpFilesize
3.0MB
-
memory/1480-65-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1480-64-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1480-68-0x00000000004012B0-mapping.dmp
-
memory/1480-67-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1480-70-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1480-71-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1752-57-0x00000000004B0000-0x00000000004BE000-memory.dmpFilesize
56KB
-
memory/1752-55-0x0000000075111000-0x0000000075113000-memory.dmpFilesize
8KB
-
memory/1752-63-0x0000000004CD0000-0x0000000004D26000-memory.dmpFilesize
344KB
-
memory/1752-54-0x0000000000080000-0x0000000000176000-memory.dmpFilesize
984KB
-
memory/1752-58-0x0000000007F50000-0x0000000007FE0000-memory.dmpFilesize
576KB
-
memory/1752-56-0x0000000000490000-0x00000000004A6000-memory.dmpFilesize
88KB
-
memory/1928-60-0x0000000000000000-mapping.dmp
-
memory/1932-59-0x0000000000000000-mapping.dmp
-
memory/1932-78-0x000000006E400000-0x000000006E9AB000-memory.dmpFilesize
5.7MB
-
memory/1932-73-0x000000006E400000-0x000000006E9AB000-memory.dmpFilesize
5.7MB
-
memory/2028-80-0x0000000000820000-0x0000000000827000-memory.dmpFilesize
28KB
-
memory/2028-81-0x00000000000D0000-0x00000000000FD000-memory.dmpFilesize
180KB
-
memory/2028-82-0x0000000002090000-0x0000000002393000-memory.dmpFilesize
3.0MB
-
memory/2028-83-0x0000000001EB0000-0x0000000001F3F000-memory.dmpFilesize
572KB
-
memory/2028-79-0x0000000000000000-mapping.dmp
-
memory/2028-85-0x00000000000D0000-0x00000000000FD000-memory.dmpFilesize
180KB