Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
03-12-2022 22:23
Static task
static1
Behavioral task
behavioral1
Sample
Confirmation transfer Ref No_00101334632192.exe
Resource
win7-20220901-en
General
-
Target
Confirmation transfer Ref No_00101334632192.exe
-
Size
954KB
-
MD5
8ecc522f8617adaf469f173400806dcf
-
SHA1
19aff3a1b435064dade4cc095f9d10a5b6ba9859
-
SHA256
b0e5e12bea8386e6e06c82e4e25257b22649a608b2ef2a599332879983a000b0
-
SHA512
8109fd4157101064a8d4f73f438aed7f39202ebff2ab539a11434c625661cdc2c88509e9ef3a5f616d3e8136e20dd3f386fd94009b9e7f9e1344a9167d65b542
-
SSDEEP
24576:ukqTTiwAAgEEY4olXoFZ6toHqwjwv0E6:ITQpo9aUvt
Malware Config
Extracted
formbook
q4k5
ZXN4RZ1db9JIzC7mhQ==
5+KpXZWys/DewpGQbChh6uPT5SNzFQ==
A8YuEKESXrzBhw==
uYH/9+Amwe1ZMkaR
KAusoWlA4I1Rt0P0jA==
AgIBy9IHiq8cdo4h47hB
PsX/0DrQRr+0hQ==
3z4v9UwXBjNTf48h47hB
bySPUkT+SFuT
VsQK5NkDks06l5z+TUG3eetd/twx2Mcjlg==
3+DcnQWuXG84sOphj5LEHIv/hA==
TOZXSDkjSHDoLk/pl2HYpOXJ
q7GGZ9KJrss/oTNwyxI=
2+O/k7y22Qo=
Joatk/qnSoO3q48h47hB
KT1UQcQ9yxWFQzCI
onRBEIHmYIl9XzhAIMtPLFAh5SNzFQ==
a8IY/+/oCDOj2TuM4Ohc
UlIOzyniF1sRnTNwyxI=
8UJiR6gijbvt+exXo7oCvdNV4BE=
Urjip46/QFqY3IbL49JI
JfhnyyWmRr+0hQ==
NQ/x1kqxFzdlZxj77D50BA==
s8KGT8F9hORX0PpkwQ0=
YSzTpB3S8xCI8ULHIqGXNgY=
sh5wMyQZI1vLJmwH6iCYYhs=
btoWw6OWyfyFQzCI
K5bFl4HSibSwnJIh47hB
5sRZGfCxukuFQzCI
4jiHORQB/0EDbaGQl2ilFw==
Ts7ysROSFE3HrOnU8EqBDg==
2z9tHQD6Gjl3YUCJh1vLdcrTwRt+Hw==
w91HMRoJOmeYopkN49VL
a1ga8Wf5Bx9fUzPDjUWJEw==
rBpOLYYTzP++KoBH2XWmbB8=
JZPo4OETkqGrdBDliw+PrW4Zmg==
PYzy1tDDx/96nYLpl2HYpOXJ
p/M0Ef80rdYbFfcO4p7irW4Zmg==
6YhhQS0qE0+O
rT4fBVXCf+hb2xM=
pwQDw8H/dewWOzpxb1HPt0gcMA9t
P6X8tCGrSmWZLbWjgQ==
wrCGfm2dv+KgNsISa42zHM+BOgxl
GXjQw6Xfj8VBF9/mng==
x6WEd+1T0d6iSdb9jA+DOQQ=
v5Y09doqE0+O
e7Kvto6ClseFgnKzlA==
PAAwEG/mkb2xgvobt0+ADA==
ddEnEwXzDyZodU9dK7/prW4Zmg==
hmTOmXa3PWqtq9PR1dRY
d3ZqOq8XkK635xo=
sf1cMQ5W4RhWZE52h5nbZNOAgFKsUS7B
b4hMHaBbU3d5twfgmg==
wNLg11vUbqOUPNLH3mmtLxE=
9D5oSLllFkJugkZbVThn404IIRl0
LaEqCfmuAyFwVPLwnQ==
ryEt5D/BRWVRKvgL53n30PG/Rb8M9pMXlQ==
alIsGunV8xlUdI4h47hB
yCI/OqUUpcHxdgrymg==
6FJ1QUNw7x5hf44h47hB
/f4T9lO+KIVF2Rk=
etr639YLfJni1+vy8sFD
DWvuYbw2NEmZ
1ndLKAERBY9kUkKt3fRdXdGFAAlv
qkbe4.xyz
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Confirmation transfer Ref No_00101334632192.exeConfirmation transfer Ref No_00101334632192.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Confirmation transfer Ref No_00101334632192.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Confirmation transfer Ref No_00101334632192.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Confirmation transfer Ref No_00101334632192.exeConfirmation transfer Ref No_00101334632192.exeraserver.exedescription pid process target process PID 5064 set thread context of 4804 5064 Confirmation transfer Ref No_00101334632192.exe Confirmation transfer Ref No_00101334632192.exe PID 4804 set thread context of 3056 4804 Confirmation transfer Ref No_00101334632192.exe Explorer.EXE PID 4636 set thread context of 3056 4636 raserver.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Processes:
raserver.exedescription ioc process Key created \Registry\User\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 raserver.exe -
Suspicious behavior: EnumeratesProcesses 50 IoCs
Processes:
Confirmation transfer Ref No_00101334632192.exepowershell.exeConfirmation transfer Ref No_00101334632192.exeraserver.exepid process 5064 Confirmation transfer Ref No_00101334632192.exe 5064 Confirmation transfer Ref No_00101334632192.exe 4224 powershell.exe 4224 powershell.exe 4804 Confirmation transfer Ref No_00101334632192.exe 4804 Confirmation transfer Ref No_00101334632192.exe 4804 Confirmation transfer Ref No_00101334632192.exe 4804 Confirmation transfer Ref No_00101334632192.exe 4804 Confirmation transfer Ref No_00101334632192.exe 4804 Confirmation transfer Ref No_00101334632192.exe 4804 Confirmation transfer Ref No_00101334632192.exe 4804 Confirmation transfer Ref No_00101334632192.exe 4636 raserver.exe 4636 raserver.exe 4636 raserver.exe 4636 raserver.exe 4636 raserver.exe 4636 raserver.exe 4636 raserver.exe 4636 raserver.exe 4636 raserver.exe 4636 raserver.exe 4636 raserver.exe 4636 raserver.exe 4636 raserver.exe 4636 raserver.exe 4636 raserver.exe 4636 raserver.exe 4636 raserver.exe 4636 raserver.exe 4636 raserver.exe 4636 raserver.exe 4636 raserver.exe 4636 raserver.exe 4636 raserver.exe 4636 raserver.exe 4636 raserver.exe 4636 raserver.exe 4636 raserver.exe 4636 raserver.exe 4636 raserver.exe 4636 raserver.exe 4636 raserver.exe 4636 raserver.exe 4636 raserver.exe 4636 raserver.exe 4636 raserver.exe 4636 raserver.exe 4636 raserver.exe 4636 raserver.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3056 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
Confirmation transfer Ref No_00101334632192.exeraserver.exepid process 4804 Confirmation transfer Ref No_00101334632192.exe 4804 Confirmation transfer Ref No_00101334632192.exe 4804 Confirmation transfer Ref No_00101334632192.exe 4636 raserver.exe 4636 raserver.exe 4636 raserver.exe 4636 raserver.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
Confirmation transfer Ref No_00101334632192.exepowershell.exeConfirmation transfer Ref No_00101334632192.exeraserver.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 5064 Confirmation transfer Ref No_00101334632192.exe Token: SeDebugPrivilege 4224 powershell.exe Token: SeDebugPrivilege 4804 Confirmation transfer Ref No_00101334632192.exe Token: SeDebugPrivilege 4636 raserver.exe Token: SeShutdownPrivilege 3056 Explorer.EXE Token: SeCreatePagefilePrivilege 3056 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
Confirmation transfer Ref No_00101334632192.exeExplorer.EXEraserver.exedescription pid process target process PID 5064 wrote to memory of 4224 5064 Confirmation transfer Ref No_00101334632192.exe powershell.exe PID 5064 wrote to memory of 4224 5064 Confirmation transfer Ref No_00101334632192.exe powershell.exe PID 5064 wrote to memory of 4224 5064 Confirmation transfer Ref No_00101334632192.exe powershell.exe PID 5064 wrote to memory of 2244 5064 Confirmation transfer Ref No_00101334632192.exe schtasks.exe PID 5064 wrote to memory of 2244 5064 Confirmation transfer Ref No_00101334632192.exe schtasks.exe PID 5064 wrote to memory of 2244 5064 Confirmation transfer Ref No_00101334632192.exe schtasks.exe PID 5064 wrote to memory of 4804 5064 Confirmation transfer Ref No_00101334632192.exe Confirmation transfer Ref No_00101334632192.exe PID 5064 wrote to memory of 4804 5064 Confirmation transfer Ref No_00101334632192.exe Confirmation transfer Ref No_00101334632192.exe PID 5064 wrote to memory of 4804 5064 Confirmation transfer Ref No_00101334632192.exe Confirmation transfer Ref No_00101334632192.exe PID 5064 wrote to memory of 4804 5064 Confirmation transfer Ref No_00101334632192.exe Confirmation transfer Ref No_00101334632192.exe PID 5064 wrote to memory of 4804 5064 Confirmation transfer Ref No_00101334632192.exe Confirmation transfer Ref No_00101334632192.exe PID 5064 wrote to memory of 4804 5064 Confirmation transfer Ref No_00101334632192.exe Confirmation transfer Ref No_00101334632192.exe PID 3056 wrote to memory of 4636 3056 Explorer.EXE raserver.exe PID 3056 wrote to memory of 4636 3056 Explorer.EXE raserver.exe PID 3056 wrote to memory of 4636 3056 Explorer.EXE raserver.exe PID 4636 wrote to memory of 3728 4636 raserver.exe Firefox.exe PID 4636 wrote to memory of 3728 4636 raserver.exe Firefox.exe PID 4636 wrote to memory of 3728 4636 raserver.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\Confirmation transfer Ref No_00101334632192.exe"C:\Users\Admin\AppData\Local\Temp\Confirmation transfer Ref No_00101334632192.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\PuscvCO.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4224 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PuscvCO" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6580.tmp"3⤵
- Creates scheduled task(s)
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\Confirmation transfer Ref No_00101334632192.exe"C:\Users\Admin\AppData\Local\Temp\Confirmation transfer Ref No_00101334632192.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4804 -
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:3728
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp6580.tmpFilesize
1KB
MD5561bd03c580afb5acba1e853cc976872
SHA1e7066246a4c1b0d66326a1d84642b22cb0d7bdcf
SHA2567605430d27f7d602a8c6a86c71d1bf018b30250ee953d13282d8fd7d0ea04482
SHA5129294ac5a04fa6bfd76d65dd44389171c8084a05298870289f51a53fc74de07a373920beddfddd2b5e2eff9f8996f24fe8e708dcf3d15ef6bcf3b8859c70a6b2f
-
memory/2244-138-0x0000000000000000-mapping.dmp
-
memory/3056-173-0x0000000008540000-0x00000000086B1000-memory.dmpFilesize
1.4MB
-
memory/3056-171-0x0000000008540000-0x00000000086B1000-memory.dmpFilesize
1.4MB
-
memory/3056-155-0x0000000007530000-0x00000000075EC000-memory.dmpFilesize
752KB
-
memory/4224-142-0x0000000004D40000-0x0000000005368000-memory.dmpFilesize
6.2MB
-
memory/4224-147-0x0000000005610000-0x0000000005676000-memory.dmpFilesize
408KB
-
memory/4224-139-0x00000000046D0000-0x0000000004706000-memory.dmpFilesize
216KB
-
memory/4224-167-0x00000000072B0000-0x00000000072CA000-memory.dmpFilesize
104KB
-
memory/4224-166-0x00000000071A0000-0x00000000071AE000-memory.dmpFilesize
56KB
-
memory/4224-169-0x0000000007290000-0x0000000007298000-memory.dmpFilesize
32KB
-
memory/4224-165-0x00000000071F0000-0x0000000007286000-memory.dmpFilesize
600KB
-
memory/4224-145-0x0000000004CA0000-0x0000000004CC2000-memory.dmpFilesize
136KB
-
memory/4224-146-0x0000000005370000-0x00000000053D6000-memory.dmpFilesize
408KB
-
memory/4224-137-0x0000000000000000-mapping.dmp
-
memory/4224-148-0x0000000005C70000-0x0000000005C8E000-memory.dmpFilesize
120KB
-
memory/4224-162-0x0000000006FE0000-0x0000000006FEA000-memory.dmpFilesize
40KB
-
memory/4224-160-0x0000000006F70000-0x0000000006F8A000-memory.dmpFilesize
104KB
-
memory/4224-159-0x00000000075B0000-0x0000000007C2A000-memory.dmpFilesize
6.5MB
-
memory/4224-158-0x0000000006200000-0x000000000621E000-memory.dmpFilesize
120KB
-
memory/4224-157-0x00000000719F0000-0x0000000071A3C000-memory.dmpFilesize
304KB
-
memory/4224-156-0x0000000006230000-0x0000000006262000-memory.dmpFilesize
200KB
-
memory/4636-163-0x0000000000940000-0x000000000095F000-memory.dmpFilesize
124KB
-
memory/4636-161-0x0000000000000000-mapping.dmp
-
memory/4636-172-0x00000000007B0000-0x00000000007DD000-memory.dmpFilesize
180KB
-
memory/4636-170-0x0000000002BA0000-0x0000000002C2F000-memory.dmpFilesize
572KB
-
memory/4636-168-0x0000000002850000-0x0000000002B9A000-memory.dmpFilesize
3.3MB
-
memory/4636-164-0x00000000007B0000-0x00000000007DD000-memory.dmpFilesize
180KB
-
memory/4804-150-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4804-149-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4804-143-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4804-154-0x0000000001340000-0x0000000001350000-memory.dmpFilesize
64KB
-
memory/4804-141-0x0000000000000000-mapping.dmp
-
memory/4804-151-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/4804-152-0x0000000001370000-0x00000000016BA000-memory.dmpFilesize
3.3MB
-
memory/4804-153-0x0000000000422000-0x0000000000424000-memory.dmpFilesize
8KB
-
memory/5064-132-0x00000000001E0000-0x00000000002D6000-memory.dmpFilesize
984KB
-
memory/5064-136-0x0000000008A30000-0x0000000008ACC000-memory.dmpFilesize
624KB
-
memory/5064-135-0x0000000004D10000-0x0000000004D1A000-memory.dmpFilesize
40KB
-
memory/5064-134-0x0000000004C60000-0x0000000004CF2000-memory.dmpFilesize
584KB
-
memory/5064-133-0x00000000052E0000-0x0000000005884000-memory.dmpFilesize
5.6MB