Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06-12-2022 12:28
Static task
static1
Behavioral task
behavioral1
Sample
3305e6f47a497c5a157f92bb6a062af2a257121e93e0914bd771f09d550f5a83.exe
Resource
win7-20220812-en
General
-
Target
3305e6f47a497c5a157f92bb6a062af2a257121e93e0914bd771f09d550f5a83.exe
-
Size
352KB
-
MD5
cd5033888dd7ee1ccab2ca5dc6e08f11
-
SHA1
041a2832b6f88a8eb5f58cea0c6da87e5639a8a5
-
SHA256
3305e6f47a497c5a157f92bb6a062af2a257121e93e0914bd771f09d550f5a83
-
SHA512
4740129d37b9d4b6f75eeaa47bba84fededb4489a46ee111f72c0a444697d07d0c022d049328ca523bb4eea426f8ee3d3737cb954dfd51598de18a3dd5084a94
-
SSDEEP
6144:PBnyL0v+1l/iTZ5zA/KHJyroHK6T9Pe31ILRlG+tKgZBEypNQr8:44v+7is/KHEIeGrG1gZ+6U8
Malware Config
Extracted
formbook
m8on
5RDJg6PD8b8/lg==
z+6tEasghyxTRlAm8HeF0rCTn4HchcIaMA==
hY6JDp4OeFclIzg=
2n/nBKEMvlUg
TQnCBZUdgFclIzg=
RoBCgR5KI0aa5rrVt24Bn6zPykA=
sEG8UAyhFJVnVdUp6H2hncgEew==
g0futs/jzu99IJgM4A==
YifLj6YLs642v7/UXiXF
QN+IobKqkqUncrCskFgnesA=
/cRBHQXRQVgBWgiVOUed3g==
2OOiy0XNMs/jyhGljU3Y
EMu0wdnLtMtMj+2FSr8=
04k8CS/jXna1wGgYsjVaGck=
ixeHKD9bM9/N24ED8merIyfKD1g=
ARzXDqXXoaUyQdMl9Q==
RAOPg5J5ex0kS04Z
gbJpkQiD2oNFlymBQBFguUYz
hosWDpYs4Hg5
xIE4IzUZ7xKqPJgN6A==
eZlWsb154OhgGKD5xowz1w==
D0P9rr3SyMo9oVThr2OpncgEew==
s2e0ka+ogJIzskWaOUed3g==
AzA3a6EYhi6AaFmSBdgs7ogRUmqyFA==
dEHvlXX8VOuW9S8=
GMt4Q119UPjKmu2FSr8=
y+Cch7nF5bxLlw==
3u2p7XT5aF//aBuZOUed3g==
WfVmzsqS9JBkS+RfKuYb30nG6D0ShJQ=
ThKVJ9q05YY6gA==
rrhlzH71alclIzg=
rdG2JBTNJs/r6QQKtahXyQ==
E7cbt9Lz29pjz23Bo1gnesA=
97U8v8KmDLd25dkI8A==
nVQlBJAUfFclIzg=
vM1XQr4F849j2OLGiE4CGIVgec/nFvie
Fi0boULFJBe2MTcR
0o0tVt0B8Ic3k41RMbPq+nSZab2k
gg8eEiER5bxLlw==
w1rDKrUTdQvnw+nYolgnesA=
pVPH4F7FK8bhtPPUXiXF
ONdKs6O/uM45u8fUXiXF
p2MTcya5DptVusKZikWcncgEew==
WuhpPZ35YlclIzg=
oXmiSraV6zNBLjE=
/ZsO9Guri7dJ0XDnr3sIBckgUmqyFA==
lnFUWGpcIgLudcVKOKg=
e/4T7759EYM5gA==
hDSl0BHlyd5c1VScOUed3g==
0pUAHbtBpkRFF0RIH/Gasjwtf3DKaboXLg==
7pjf9AUH5bxLlw==
ZyDVpdIA45ifnu2FSr8=
OctAyWLELi7OLdxJHu6bISfKD1g=
FizptjiRdY0kS04Z
OO5u32q/Zv3nssVKOKg=
Er5/Py8RLfQ8
/TQtKCwO9AyJ0FSvhln5az4kc3xShcIaMA==
+BULkIY5lqr7PJgN6A==
OmBbYnZ1S/xCCS8xJLY=
hOLPV3wy5bxLlw==
T93q5QAE5bxLlw==
7alXo+LCpsgrijucOUed3g==
kbW5iL3I5bxLlw==
0A3yi61r4f5OT/aBWPIG2poMUmqyFA==
yallports.world
Signatures
-
Detected phishing page
-
Executes dropped EXE 2 IoCs
Processes:
ltqqhtcad.exeltqqhtcad.exepid process 2040 ltqqhtcad.exe 1532 ltqqhtcad.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ltqqhtcad.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\International\Geo\Nation ltqqhtcad.exe -
Loads dropped DLL 3 IoCs
Processes:
3305e6f47a497c5a157f92bb6a062af2a257121e93e0914bd771f09d550f5a83.exeltqqhtcad.exesvchost.exepid process 1256 3305e6f47a497c5a157f92bb6a062af2a257121e93e0914bd771f09d550f5a83.exe 2040 ltqqhtcad.exe 1520 svchost.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
ltqqhtcad.exeltqqhtcad.exesvchost.exedescription pid process target process PID 2040 set thread context of 1532 2040 ltqqhtcad.exe ltqqhtcad.exe PID 1532 set thread context of 1208 1532 ltqqhtcad.exe Explorer.EXE PID 1520 set thread context of 1208 1520 svchost.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
svchost.exedescription ioc process Key created \Registry\User\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 svchost.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
ltqqhtcad.exesvchost.exepid process 1532 ltqqhtcad.exe 1532 ltqqhtcad.exe 1532 ltqqhtcad.exe 1532 ltqqhtcad.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
ltqqhtcad.exeltqqhtcad.exesvchost.exepid process 2040 ltqqhtcad.exe 1532 ltqqhtcad.exe 1532 ltqqhtcad.exe 1532 ltqqhtcad.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
ltqqhtcad.exesvchost.exedescription pid process Token: SeDebugPrivilege 1532 ltqqhtcad.exe Token: SeDebugPrivilege 1520 svchost.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1208 Explorer.EXE 1208 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1208 Explorer.EXE 1208 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
3305e6f47a497c5a157f92bb6a062af2a257121e93e0914bd771f09d550f5a83.exeltqqhtcad.exeExplorer.EXEsvchost.exedescription pid process target process PID 1256 wrote to memory of 2040 1256 3305e6f47a497c5a157f92bb6a062af2a257121e93e0914bd771f09d550f5a83.exe ltqqhtcad.exe PID 1256 wrote to memory of 2040 1256 3305e6f47a497c5a157f92bb6a062af2a257121e93e0914bd771f09d550f5a83.exe ltqqhtcad.exe PID 1256 wrote to memory of 2040 1256 3305e6f47a497c5a157f92bb6a062af2a257121e93e0914bd771f09d550f5a83.exe ltqqhtcad.exe PID 1256 wrote to memory of 2040 1256 3305e6f47a497c5a157f92bb6a062af2a257121e93e0914bd771f09d550f5a83.exe ltqqhtcad.exe PID 2040 wrote to memory of 1532 2040 ltqqhtcad.exe ltqqhtcad.exe PID 2040 wrote to memory of 1532 2040 ltqqhtcad.exe ltqqhtcad.exe PID 2040 wrote to memory of 1532 2040 ltqqhtcad.exe ltqqhtcad.exe PID 2040 wrote to memory of 1532 2040 ltqqhtcad.exe ltqqhtcad.exe PID 2040 wrote to memory of 1532 2040 ltqqhtcad.exe ltqqhtcad.exe PID 1208 wrote to memory of 1520 1208 Explorer.EXE svchost.exe PID 1208 wrote to memory of 1520 1208 Explorer.EXE svchost.exe PID 1208 wrote to memory of 1520 1208 Explorer.EXE svchost.exe PID 1208 wrote to memory of 1520 1208 Explorer.EXE svchost.exe PID 1520 wrote to memory of 1884 1520 svchost.exe Firefox.exe PID 1520 wrote to memory of 1884 1520 svchost.exe Firefox.exe PID 1520 wrote to memory of 1884 1520 svchost.exe Firefox.exe PID 1520 wrote to memory of 1884 1520 svchost.exe Firefox.exe PID 1520 wrote to memory of 1884 1520 svchost.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3305e6f47a497c5a157f92bb6a062af2a257121e93e0914bd771f09d550f5a83.exe"C:\Users\Admin\AppData\Local\Temp\3305e6f47a497c5a157f92bb6a062af2a257121e93e0914bd771f09d550f5a83.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ltqqhtcad.exe"C:\Users\Admin\AppData\Local\Temp\ltqqhtcad.exe" C:\Users\Admin\AppData\Local\Temp\xwauktnimxi.e3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ltqqhtcad.exe"C:\Users\Admin\AppData\Local\Temp\ltqqhtcad.exe" C:\Users\Admin\AppData\Local\Temp\xwauktnimxi.e4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\gajdq.sgFilesize
185KB
MD53b61a4a244536dd018bf2690c177b521
SHA131daa9dbcebf8661bce00fa2e377e2103446fad1
SHA2562ee93016d0669052bbed7a67c87722931b5a055effcb0002db7da09d017d7847
SHA512c9edfd94cd3c88482b2fc16c5d1ad44e5ec85aee9b8273143db48f4e63424101e773bb29d0d7d8a9affe9889cc840374483b7c627a36db53bccd6aa92e00d00d
-
C:\Users\Admin\AppData\Local\Temp\ltqqhtcad.exeFilesize
320KB
MD53c9863c51ab9328b84f17273c6742534
SHA18d4e4ce2acc2fc179e29e8b8d8479c6b1fb5403b
SHA256fc93bc25d9d29ec8a80d81ea5c338567f92bbf8f5c1db434c1ecf9741a4733e6
SHA5124b793a0be71c38eda977295e698b5f08d069add8a3ab13fb9954021fee554e52d673a5ab4d87f20cbe4f1857a03eb69ede420d0156c4c464a33598a5609ea61c
-
C:\Users\Admin\AppData\Local\Temp\ltqqhtcad.exeFilesize
320KB
MD53c9863c51ab9328b84f17273c6742534
SHA18d4e4ce2acc2fc179e29e8b8d8479c6b1fb5403b
SHA256fc93bc25d9d29ec8a80d81ea5c338567f92bbf8f5c1db434c1ecf9741a4733e6
SHA5124b793a0be71c38eda977295e698b5f08d069add8a3ab13fb9954021fee554e52d673a5ab4d87f20cbe4f1857a03eb69ede420d0156c4c464a33598a5609ea61c
-
C:\Users\Admin\AppData\Local\Temp\ltqqhtcad.exeFilesize
320KB
MD53c9863c51ab9328b84f17273c6742534
SHA18d4e4ce2acc2fc179e29e8b8d8479c6b1fb5403b
SHA256fc93bc25d9d29ec8a80d81ea5c338567f92bbf8f5c1db434c1ecf9741a4733e6
SHA5124b793a0be71c38eda977295e698b5f08d069add8a3ab13fb9954021fee554e52d673a5ab4d87f20cbe4f1857a03eb69ede420d0156c4c464a33598a5609ea61c
-
C:\Users\Admin\AppData\Local\Temp\xwauktnimxi.eFilesize
5KB
MD518d463ab2493a9795fcff9238271be94
SHA1bdb2d8cb8fca102acbf35859dfeb9e0f1eddd967
SHA25606c666fc77051482e96fac9c986b3b95f22d3bc3a3de7d27045256a410c3553a
SHA512085ff5b1da065e416e49e30c229acba2c33e220f83078bd30d5e16e4ce6462408bba937b2564518a1db45c858c531dbe762dae0f3f66a6bd3338b2d99b13c58e
-
\Users\Admin\AppData\Local\Temp\ltqqhtcad.exeFilesize
320KB
MD53c9863c51ab9328b84f17273c6742534
SHA18d4e4ce2acc2fc179e29e8b8d8479c6b1fb5403b
SHA256fc93bc25d9d29ec8a80d81ea5c338567f92bbf8f5c1db434c1ecf9741a4733e6
SHA5124b793a0be71c38eda977295e698b5f08d069add8a3ab13fb9954021fee554e52d673a5ab4d87f20cbe4f1857a03eb69ede420d0156c4c464a33598a5609ea61c
-
\Users\Admin\AppData\Local\Temp\ltqqhtcad.exeFilesize
320KB
MD53c9863c51ab9328b84f17273c6742534
SHA18d4e4ce2acc2fc179e29e8b8d8479c6b1fb5403b
SHA256fc93bc25d9d29ec8a80d81ea5c338567f92bbf8f5c1db434c1ecf9741a4733e6
SHA5124b793a0be71c38eda977295e698b5f08d069add8a3ab13fb9954021fee554e52d673a5ab4d87f20cbe4f1857a03eb69ede420d0156c4c464a33598a5609ea61c
-
\Users\Admin\AppData\Local\Temp\sqlite3.dllFilesize
1.0MB
MD5ce5c15b5092877974d5b6476ad1cb2d7
SHA176a6fc307d1524081cba1886d312df97c9dd658f
SHA2561f1a186ea26bd2462ea2a9cf35a816b92caf0897fdf332af3a61569e0ba97b24
SHA512bb9ced38c63d2a29e18c38f60020cfdf0161384cd4ad6328352626643becdf49f6b4bef47012391720344fdd8ad520aa802dcbbed15b5026d27eb93b0a839c90
-
memory/1208-69-0x0000000004810000-0x00000000048E9000-memory.dmpFilesize
868KB
-
memory/1208-77-0x0000000004CB0000-0x0000000004DC2000-memory.dmpFilesize
1.1MB
-
memory/1208-75-0x0000000004CB0000-0x0000000004DC2000-memory.dmpFilesize
1.1MB
-
memory/1256-54-0x0000000075C61000-0x0000000075C63000-memory.dmpFilesize
8KB
-
memory/1520-73-0x0000000000780000-0x0000000000A83000-memory.dmpFilesize
3.0MB
-
memory/1520-70-0x0000000000000000-mapping.dmp
-
memory/1520-71-0x0000000000DA0000-0x0000000000DA8000-memory.dmpFilesize
32KB
-
memory/1520-72-0x0000000000080000-0x00000000000AD000-memory.dmpFilesize
180KB
-
memory/1520-74-0x0000000000550000-0x00000000005DF000-memory.dmpFilesize
572KB
-
memory/1520-76-0x0000000000080000-0x00000000000AD000-memory.dmpFilesize
180KB
-
memory/1532-68-0x00000000002A0000-0x00000000002B0000-memory.dmpFilesize
64KB
-
memory/1532-67-0x0000000000830000-0x0000000000B33000-memory.dmpFilesize
3.0MB
-
memory/1532-66-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1532-65-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1532-63-0x00000000004012B0-mapping.dmp
-
memory/2040-56-0x0000000000000000-mapping.dmp