Analysis
-
max time kernel
152s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06-12-2022 14:21
Static task
static1
Behavioral task
behavioral1
Sample
a0c275ebd1005a313b20dd27ea739dcb.exe
Resource
win7-20220901-en
General
-
Target
a0c275ebd1005a313b20dd27ea739dcb.exe
-
Size
414KB
-
MD5
a0c275ebd1005a313b20dd27ea739dcb
-
SHA1
4c7fb52d3129f485919cf8dd2d8ea3f665e0a6b9
-
SHA256
3077abc4b785271fc43389f94cee024de4fd4d3d7f4ada5c569a9aca09374a9d
-
SHA512
19746c6270d4e54827488b31fa856286e81370c124c2f99b6fddc07311b62baf8969f5bbe433c891f921771e2aa912ad79e5015b97d247600b13eb844c467e6b
-
SSDEEP
6144:PBnxm/hZudIIuLplWND4YOSAsRJVWMmH/w/dv4e6Hc+2u:LzdIZplW94YzAIJ0MT/ucPu
Malware Config
Extracted
formbook
4.1
h3ha
ideas-dulces.store
store1995.store
swuhn.com
ninideal.com
musiqhaus.com
quranchart.com
kszq26.club
lightfx.online
thetickettruth.com
meritloancubk.com
lawnforcement.com
sogeanetwork.com
thedinoexotics.com
kojima-ah.net
gr-myab3z.xyz
platiniuminestor.net
reviewsiske.com
stessil-lifestyle.com
goodqjourney.biz
cirimpianti.com
garsouurber.com
dakshaini.com
dingshuitong.com
pateme.com
diablographic.com
elenesse.com
neginoptical.com
junkremovalbedford.com
dunclearnia.bid
arabicadev.com
thelastsize.com
ku7web.net
chaijiaxia.com
shopnexvn.net
gacorking.asia
missmadddison.com
rigapyk.xyz
chain.place
nosesports.com
paymallmart.info
opi-utp.xyz
institutogdb.com
f819a.site
truefundd.com
producteight.com
quasetudo.store
littlelaughsandgiggles.com
rickhightower.com
urbaniteboffin.com
distributorolinasional.com
bcffji.xyz
wwwbaronhr.com
veridian-ae.com
luxeeventsny.net
freedom-hotline.com
lylaixin.com
mathematicalapologist.com
captivatortees.com
rb-premium.com
nairabet365.com
b2cfaq.com
sunroadrunning.com
centaurusvaccination.com
lamegatienda.online
fucktheenemy.com
Signatures
-
Formbook payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4320-145-0x0000000001030000-0x000000000105F000-memory.dmp formbook behavioral2/memory/4320-148-0x0000000001030000-0x000000000105F000-memory.dmp formbook -
Executes dropped EXE 2 IoCs
Processes:
zgovbtz.exezgovbtz.exepid process 5036 zgovbtz.exe 3136 zgovbtz.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
zgovbtz.exezgovbtz.exewscript.exedescription pid process target process PID 5036 set thread context of 3136 5036 zgovbtz.exe zgovbtz.exe PID 3136 set thread context of 1124 3136 zgovbtz.exe Explorer.EXE PID 4320 set thread context of 1124 4320 wscript.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 44 IoCs
Processes:
zgovbtz.exewscript.exepid process 3136 zgovbtz.exe 3136 zgovbtz.exe 3136 zgovbtz.exe 3136 zgovbtz.exe 4320 wscript.exe 4320 wscript.exe 4320 wscript.exe 4320 wscript.exe 4320 wscript.exe 4320 wscript.exe 4320 wscript.exe 4320 wscript.exe 4320 wscript.exe 4320 wscript.exe 4320 wscript.exe 4320 wscript.exe 4320 wscript.exe 4320 wscript.exe 4320 wscript.exe 4320 wscript.exe 4320 wscript.exe 4320 wscript.exe 4320 wscript.exe 4320 wscript.exe 4320 wscript.exe 4320 wscript.exe 4320 wscript.exe 4320 wscript.exe 4320 wscript.exe 4320 wscript.exe 4320 wscript.exe 4320 wscript.exe 4320 wscript.exe 4320 wscript.exe 4320 wscript.exe 4320 wscript.exe 4320 wscript.exe 4320 wscript.exe 4320 wscript.exe 4320 wscript.exe 4320 wscript.exe 4320 wscript.exe 4320 wscript.exe 4320 wscript.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1124 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
zgovbtz.exezgovbtz.exewscript.exepid process 5036 zgovbtz.exe 5036 zgovbtz.exe 3136 zgovbtz.exe 3136 zgovbtz.exe 3136 zgovbtz.exe 4320 wscript.exe 4320 wscript.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
zgovbtz.exewscript.exedescription pid process Token: SeDebugPrivilege 3136 zgovbtz.exe Token: SeDebugPrivilege 4320 wscript.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
a0c275ebd1005a313b20dd27ea739dcb.exezgovbtz.exeExplorer.EXEwscript.exedescription pid process target process PID 4696 wrote to memory of 5036 4696 a0c275ebd1005a313b20dd27ea739dcb.exe zgovbtz.exe PID 4696 wrote to memory of 5036 4696 a0c275ebd1005a313b20dd27ea739dcb.exe zgovbtz.exe PID 4696 wrote to memory of 5036 4696 a0c275ebd1005a313b20dd27ea739dcb.exe zgovbtz.exe PID 5036 wrote to memory of 3136 5036 zgovbtz.exe zgovbtz.exe PID 5036 wrote to memory of 3136 5036 zgovbtz.exe zgovbtz.exe PID 5036 wrote to memory of 3136 5036 zgovbtz.exe zgovbtz.exe PID 5036 wrote to memory of 3136 5036 zgovbtz.exe zgovbtz.exe PID 1124 wrote to memory of 4320 1124 Explorer.EXE wscript.exe PID 1124 wrote to memory of 4320 1124 Explorer.EXE wscript.exe PID 1124 wrote to memory of 4320 1124 Explorer.EXE wscript.exe PID 4320 wrote to memory of 1480 4320 wscript.exe cmd.exe PID 4320 wrote to memory of 1480 4320 wscript.exe cmd.exe PID 4320 wrote to memory of 1480 4320 wscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a0c275ebd1005a313b20dd27ea739dcb.exe"C:\Users\Admin\AppData\Local\Temp\a0c275ebd1005a313b20dd27ea739dcb.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\zgovbtz.exe"C:\Users\Admin\AppData\Local\Temp\zgovbtz.exe" C:\Users\Admin\AppData\Local\Temp\ahbdus.k3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\zgovbtz.exe"C:\Users\Admin\AppData\Local\Temp\zgovbtz.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\zgovbtz.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ahbdus.kFilesize
5KB
MD5533b564dd4c64c19e3b7d860f03801a6
SHA1745a017c6f1e58a6b7bea787eb3a20597c17fb62
SHA25625a5b8a00567719024844286427f3fd986a6f72b4ed826bbae58d882c20fd3cd
SHA512e1450a5ea0156db8cb02f359964ba1d279fcd0b8e60c30b8b39b51771e7da0b823a39fa2edcd184bc00152612fa1ae50e1304e7a8fb337102f33455df6372ddf
-
C:\Users\Admin\AppData\Local\Temp\nnfoo.pFilesize
185KB
MD50fd8fad06f5a97c481fbbb60828d686e
SHA1eab488ae696a31dbd02c959662e356612d5c4c40
SHA256e3a937e8170b273687231c76c7539d1282a6c904df8b44aa249fc52dd09ab518
SHA512b1151c9a8ce0b516879afc6838cb453d68d820ec4743b731974291d402fa0f0416b515b489ee7758de6c975402bd78bb016e9d8342a849157cce4ebc904de7f4
-
C:\Users\Admin\AppData\Local\Temp\zgovbtz.exeFilesize
13KB
MD5f15812c468166ad85fda4223195da140
SHA14ed0da8b9e738f3d08a0f00270e92a0539e32136
SHA256ac7ebc8987bb3712e198213a0e1fd7f96608b488dc8602f094a7bf4bc0f38e04
SHA512bfcf6d30f1efa8c0a6f8d500782a5b314b0ac811fa4b7a5ebcfb479ca302ca0d8de8fc2c827155def08750d11297974d081781d0dcd4badc01534eb5aaeebdaa
-
C:\Users\Admin\AppData\Local\Temp\zgovbtz.exeFilesize
13KB
MD5f15812c468166ad85fda4223195da140
SHA14ed0da8b9e738f3d08a0f00270e92a0539e32136
SHA256ac7ebc8987bb3712e198213a0e1fd7f96608b488dc8602f094a7bf4bc0f38e04
SHA512bfcf6d30f1efa8c0a6f8d500782a5b314b0ac811fa4b7a5ebcfb479ca302ca0d8de8fc2c827155def08750d11297974d081781d0dcd4badc01534eb5aaeebdaa
-
C:\Users\Admin\AppData\Local\Temp\zgovbtz.exeFilesize
13KB
MD5f15812c468166ad85fda4223195da140
SHA14ed0da8b9e738f3d08a0f00270e92a0539e32136
SHA256ac7ebc8987bb3712e198213a0e1fd7f96608b488dc8602f094a7bf4bc0f38e04
SHA512bfcf6d30f1efa8c0a6f8d500782a5b314b0ac811fa4b7a5ebcfb479ca302ca0d8de8fc2c827155def08750d11297974d081781d0dcd4badc01534eb5aaeebdaa
-
memory/1124-143-0x0000000009150000-0x00000000092F8000-memory.dmpFilesize
1.7MB
-
memory/1124-151-0x00000000030C0000-0x0000000003173000-memory.dmpFilesize
716KB
-
memory/1124-150-0x00000000030C0000-0x0000000003173000-memory.dmpFilesize
716KB
-
memory/1124-141-0x0000000009150000-0x00000000092F8000-memory.dmpFilesize
1.7MB
-
memory/1480-147-0x0000000000000000-mapping.dmp
-
memory/3136-137-0x0000000000000000-mapping.dmp
-
memory/3136-140-0x0000000000C40000-0x0000000000C54000-memory.dmpFilesize
80KB
-
memory/3136-139-0x0000000000C90000-0x0000000000FDA000-memory.dmpFilesize
3.3MB
-
memory/4320-142-0x0000000000000000-mapping.dmp
-
memory/4320-144-0x00000000006B0000-0x00000000006D7000-memory.dmpFilesize
156KB
-
memory/4320-145-0x0000000001030000-0x000000000105F000-memory.dmpFilesize
188KB
-
memory/4320-146-0x00000000030B0000-0x00000000033FA000-memory.dmpFilesize
3.3MB
-
memory/4320-148-0x0000000001030000-0x000000000105F000-memory.dmpFilesize
188KB
-
memory/4320-149-0x0000000002EF0000-0x0000000002F83000-memory.dmpFilesize
588KB
-
memory/5036-132-0x0000000000000000-mapping.dmp