Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
05-12-2022 12:47
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win32.PWSX-gen.7158.12123.exe
Resource
win7-20220812-en
General
-
Target
SecuriteInfo.com.Win32.PWSX-gen.7158.12123.exe
-
Size
660KB
-
MD5
4456d023908ebca5034b01ae809d6e62
-
SHA1
99272ab4f217276228ab68eaae72abfc4242a746
-
SHA256
11990c08ba3e1eb0f464d9850bb76696a89f95c0368e3634488139f25b96bf42
-
SHA512
ecde1fb31000b7ef0cf02e995106d236c3aa23e6821da106f69f9bd22744184a53fa1b5671770a5bfb1e2137d4bb0d7581ad664685dde0b8ead994c168dc40ad
-
SSDEEP
12288:6PuYd+V6b1momPZefeKrsUTkx8S0VP+P1ATnVsgIu3fV6Tx0TBf+v0PuYd+V6b:6PuYd+V6bIomxieMwx8ZBT2/0cxWBf+y
Malware Config
Extracted
formbook
4.1
f9r5
teknotimur.com
zuliboo.com
remmingtoncampbell.com
vehicletitleloansphoenix.com
sen-computer.com
98731.biz
shelikesblu.com
canis-totem.com
metaversemedianetwork.com
adsdu.com
vanishmediasystems.com
astewaykebede.com
wszhongxue.com
gacha-animator-free.com
papatyadekorasyon.com
mqc168.top
simplebrilliantsolutions.com
jubileehawkesprairie.com
ridflab.com
conboysfilm.com
iseemerit.world
airhbb.com
haveyourshare.com
qcstcsz.com
attorneykarinaramirez.com
patriziabartelle.com
dcc.coop
hdzz.top
treesandstarsoracle.com
rebarunikont.com
achivego.site
baipiao100.com
menslibwrty.com
insulationtraining.online
horseflix.club
suxyqyu.xyz
sqoki.com
ffbsjhvbsjhbvsajv.xyz
beapest.cfd
4892166.com
dvdmediastar.com
hotwomensearching4u.site
cupompetlover.com
terrapretasales.com
joinsequene.com
powerkitap.com
jonjene.com
wqcwgl.com
utahexotics.com
ballerboutique.com
cftronline.com
gettidaladvance.site
anagladstonedesign.com
bunsi-figura.store
ttvip-13.net
cmjysx-uqps.website
ifealafia.com
carlospainter.com
elitetrio.xyz
inggridangelia.com
leporebaq.com
youpinhang.com
palm3d.net
wo567567.com
shinecleaningasheville.com
Signatures
-
Formbook payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4988-144-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
SecuriteInfo.com.Win32.PWSX-gen.7158.12123.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SecuriteInfo.com.Win32.PWSX-gen.7158.12123.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SecuriteInfo.com.Win32.PWSX-gen.7158.12123.exedescription pid process target process PID 4656 set thread context of 4988 4656 SecuriteInfo.com.Win32.PWSX-gen.7158.12123.exe SecuriteInfo.com.Win32.PWSX-gen.7158.12123.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
SecuriteInfo.com.Win32.PWSX-gen.7158.12123.exepowershell.exeSecuriteInfo.com.Win32.PWSX-gen.7158.12123.exepid process 4656 SecuriteInfo.com.Win32.PWSX-gen.7158.12123.exe 4656 SecuriteInfo.com.Win32.PWSX-gen.7158.12123.exe 4336 powershell.exe 4988 SecuriteInfo.com.Win32.PWSX-gen.7158.12123.exe 4988 SecuriteInfo.com.Win32.PWSX-gen.7158.12123.exe 4336 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exeSecuriteInfo.com.Win32.PWSX-gen.7158.12123.exedescription pid process Token: SeDebugPrivilege 4336 powershell.exe Token: SeDebugPrivilege 4656 SecuriteInfo.com.Win32.PWSX-gen.7158.12123.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
SecuriteInfo.com.Win32.PWSX-gen.7158.12123.exedescription pid process target process PID 4656 wrote to memory of 4336 4656 SecuriteInfo.com.Win32.PWSX-gen.7158.12123.exe powershell.exe PID 4656 wrote to memory of 4336 4656 SecuriteInfo.com.Win32.PWSX-gen.7158.12123.exe powershell.exe PID 4656 wrote to memory of 4336 4656 SecuriteInfo.com.Win32.PWSX-gen.7158.12123.exe powershell.exe PID 4656 wrote to memory of 2104 4656 SecuriteInfo.com.Win32.PWSX-gen.7158.12123.exe schtasks.exe PID 4656 wrote to memory of 2104 4656 SecuriteInfo.com.Win32.PWSX-gen.7158.12123.exe schtasks.exe PID 4656 wrote to memory of 2104 4656 SecuriteInfo.com.Win32.PWSX-gen.7158.12123.exe schtasks.exe PID 4656 wrote to memory of 3948 4656 SecuriteInfo.com.Win32.PWSX-gen.7158.12123.exe SecuriteInfo.com.Win32.PWSX-gen.7158.12123.exe PID 4656 wrote to memory of 3948 4656 SecuriteInfo.com.Win32.PWSX-gen.7158.12123.exe SecuriteInfo.com.Win32.PWSX-gen.7158.12123.exe PID 4656 wrote to memory of 3948 4656 SecuriteInfo.com.Win32.PWSX-gen.7158.12123.exe SecuriteInfo.com.Win32.PWSX-gen.7158.12123.exe PID 4656 wrote to memory of 4988 4656 SecuriteInfo.com.Win32.PWSX-gen.7158.12123.exe SecuriteInfo.com.Win32.PWSX-gen.7158.12123.exe PID 4656 wrote to memory of 4988 4656 SecuriteInfo.com.Win32.PWSX-gen.7158.12123.exe SecuriteInfo.com.Win32.PWSX-gen.7158.12123.exe PID 4656 wrote to memory of 4988 4656 SecuriteInfo.com.Win32.PWSX-gen.7158.12123.exe SecuriteInfo.com.Win32.PWSX-gen.7158.12123.exe PID 4656 wrote to memory of 4988 4656 SecuriteInfo.com.Win32.PWSX-gen.7158.12123.exe SecuriteInfo.com.Win32.PWSX-gen.7158.12123.exe PID 4656 wrote to memory of 4988 4656 SecuriteInfo.com.Win32.PWSX-gen.7158.12123.exe SecuriteInfo.com.Win32.PWSX-gen.7158.12123.exe PID 4656 wrote to memory of 4988 4656 SecuriteInfo.com.Win32.PWSX-gen.7158.12123.exe SecuriteInfo.com.Win32.PWSX-gen.7158.12123.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.7158.12123.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.7158.12123.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\sWoaYFhAZd.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sWoaYFhAZd" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4371.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.7158.12123.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.7158.12123.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.7158.12123.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.7158.12123.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp4371.tmpFilesize
1KB
MD588ab120b64662e3e48449d4c8a7475a4
SHA1e732cde2cf28056c371e98f313d4bdfdbe2be8a3
SHA256d7572ff1e68a64dc490182d374728cb69be5e3ae45f9e4e8438aad5cb4133d83
SHA512098780ea4380caca4f5af556bfb2fb5d352ba003ef9cc3df17b0a3e7a89d89e1914f1551e144cad8a1b005ea70636e10337fdcba1c9f6f61cef0eadc390eff23
-
memory/2104-138-0x0000000000000000-mapping.dmp
-
memory/3948-142-0x0000000000000000-mapping.dmp
-
memory/4336-146-0x00000000059C0000-0x0000000005A26000-memory.dmpFilesize
408KB
-
memory/4336-155-0x0000000007270000-0x000000000727A000-memory.dmpFilesize
40KB
-
memory/4336-137-0x0000000000000000-mapping.dmp
-
memory/4336-159-0x0000000007680000-0x0000000007688000-memory.dmpFilesize
32KB
-
memory/4336-139-0x0000000002770000-0x00000000027A6000-memory.dmpFilesize
216KB
-
memory/4336-158-0x0000000007730000-0x000000000774A000-memory.dmpFilesize
104KB
-
memory/4336-141-0x0000000005320000-0x0000000005948000-memory.dmpFilesize
6.2MB
-
memory/4336-157-0x0000000007640000-0x000000000764E000-memory.dmpFilesize
56KB
-
memory/4336-156-0x0000000007690000-0x0000000007726000-memory.dmpFilesize
600KB
-
memory/4336-152-0x00000000065B0000-0x00000000065CE000-memory.dmpFilesize
120KB
-
memory/4336-145-0x0000000005120000-0x0000000005142000-memory.dmpFilesize
136KB
-
memory/4336-154-0x0000000007400000-0x000000000741A000-memory.dmpFilesize
104KB
-
memory/4336-147-0x0000000005A30000-0x0000000005A96000-memory.dmpFilesize
408KB
-
memory/4336-153-0x0000000007A50000-0x00000000080CA000-memory.dmpFilesize
6.5MB
-
memory/4336-149-0x00000000059A0000-0x00000000059BE000-memory.dmpFilesize
120KB
-
memory/4336-150-0x00000000072A0000-0x00000000072D2000-memory.dmpFilesize
200KB
-
memory/4336-151-0x0000000071250000-0x000000007129C000-memory.dmpFilesize
304KB
-
memory/4656-133-0x0000000005D80000-0x0000000006324000-memory.dmpFilesize
5.6MB
-
memory/4656-132-0x0000000000DE0000-0x0000000000E8A000-memory.dmpFilesize
680KB
-
memory/4656-136-0x00000000067D0000-0x000000000686C000-memory.dmpFilesize
624KB
-
memory/4656-134-0x0000000005870000-0x0000000005902000-memory.dmpFilesize
584KB
-
memory/4656-135-0x0000000005820000-0x000000000582A000-memory.dmpFilesize
40KB
-
memory/4988-148-0x0000000001700000-0x0000000001A4A000-memory.dmpFilesize
3.3MB
-
memory/4988-144-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4988-143-0x0000000000000000-mapping.dmp