Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
07-12-2022 07:19
Static task
static1
Behavioral task
behavioral1
Sample
713290575.exe
Resource
win7-20220901-en
General
-
Target
713290575.exe
-
Size
271KB
-
MD5
042c5506f6d384f18529e2247c09b2d1
-
SHA1
f6e91718b5bcf487e1fc040d228e87c7cdf72aae
-
SHA256
34ba86fe0e8ed621b916cf851855cd2c616af85a19534bfc25b5806ca43cbb58
-
SHA512
7d2fc7c1ebf7eea04c3846ff99ac7ba55a8f98225a4a3e679e55b3d9b9887487c822582cb4fb85493b66ac9c2d3e501872e8bfb2f6f87d36315051bf9f0cbaa3
-
SSDEEP
6144:QBn1ufsqsOrt2ureZR0SJ+9/NDEBeZSeR36:guEIt2urg2/NDEBeZrR36
Malware Config
Extracted
formbook
yurm
X06d1tis1GUX/R0g87Ud
BKiZ33D1P766GVXO1ZwV
lAFdjB7CSxGX8Trz
Gc7dWizTVxWX8Trz
tDkr9JAfi1OHAW1PGOageIp4
bCpMtHKU3mVp8BY5sQ==
7WKpsMWt8nsrhJClJeOZNg==
0A9KTlETQ86Cmd8k0o5NP5RwCg==
aJ61paNJztSp42c=
CrgoA8ySIOsytCbO1ZwV
i46SnHYDD9tTIHI=
XFRCRCjtFZeU3x4Rn3xfD5BnPz+RDA==
c4CZghuHvzW9A31gEz0d
QAjzz9qyRRWBNYseAI4M
Jpbmu4A1YvBvN3ruZgiRmJA5BCFd
PfoFXGNFhhuX8Trz
bqCfk0m8ApAl+Tm1Ms5Tb23IT7tS
z7INff7HNALxc5HWq2/ftrVR6A7R1zvTUQ==
m7IShV4LSFxbqxhrVsZ1Ig==
BHRp7q0gtoRuqBRnVsZ1Ig==
SnqEhE/pEKitAVYv+MtfgDwL1EuxZyihRg==
1xpDKRHJ7K/tqQzEfaJvDIeRWI5DZyihRg==
tAQpBfGi8mppxC4LbDQNI945BCFd
nk5kz8aKDecavxHOYeugeIp4
wPYvLS3zK8FvdJFbQVY=
WAATk07VS0xU9Dvx
KdwXaxSYC9G8DG2tUOBR/X3wtEM=
EPQVcwx5eXw9i/E3B9tpP5RwCg==
MN0FmlPPDZiu5zVpA58wA0Q/5F4=
797QsL+c/saMxtZeQFQ=
TISijiWfydvQFQ==
ama7D8Ntnxsr9Gg=
PcnRSFMPjGFm8BY5sQ==
npSIXvRrsj25h91pUHZGbX3wtEM=
0CAJglT6dkKyhZFbQVY=
kL69pLud0pT4Am0=
sG1JDgXWXydt/VHO1ZwV
zxVdYWYhqoHvrt5W2G7a5PL71zEyHIIx
i0Zm9MhPh/vvI3ycVsZ1Ig==
kjRJqKB3nRgihH2kM0E=
/s4LgD5dmCtOBCkprA==
I278sNm5/o/FX2dZBAKYKg==
eP/5flDtVw2X8Trz
Ik9oUEj8hFO6eeK1gJg/xkILDkwPAw==
QIS5jUjlUhtr/VHO1ZwV
RcC5QQyGv0mFC2BnT3igeIp4
NL7LMCoKT93dJWVTHJgywToxAg==
yzhyPgzSYDGthZFbQVY=
PqmV5ObKBpvKUJZYcGg05HtiCA==
/W9bsq7IsDuC
T8LMKrI2jA8BQ4yQVsZ1Ig==
eHof90VMPMXQDQ==
8TSLglnyajdx/VDO1ZwV
ZQYihA2I+rn4g7eQVsZ1Ig==
JCmxphUQ06is5Gc=
H2C6sYYiZPAxoxNnVsZ1Ig==
5NxIrpR6DM2Jd5FbQVY=
vDCXqaJj6Pw2EXA=
CBI+Gdh67Pw2EXA=
zxoDhkPEDpTET7a6Os0tj1BpDBfmYgo=
neEtD8Y0YN7fMV7O1ZwV
W+BPJ/S6QhmScpFbQVY=
iAZaRHA3ZgUpsQvRiZ5XP5RwCg==
CQtXS8LIsDuC
absbox.org
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
xyvpsaxhg.exexyvpsaxhg.exepid process 3200 xyvpsaxhg.exe 4920 xyvpsaxhg.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
xyvpsaxhg.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation xyvpsaxhg.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
xyvpsaxhg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bpjpistakkuwv = "C:\\Users\\Admin\\AppData\\Roaming\\vmlabyfvgrncd\\xgjhkwlvohqq.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\xyvpsaxhg.exe\" C:\\Users\\Admin\\App" xyvpsaxhg.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
xyvpsaxhg.exexyvpsaxhg.exechkdsk.exedescription pid process target process PID 3200 set thread context of 4920 3200 xyvpsaxhg.exe xyvpsaxhg.exe PID 4920 set thread context of 900 4920 xyvpsaxhg.exe Explorer.EXE PID 4920 set thread context of 900 4920 xyvpsaxhg.exe Explorer.EXE PID 2200 set thread context of 900 2200 chkdsk.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Processes:
chkdsk.exedescription ioc process Key created \Registry\User\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 60 IoCs
Processes:
xyvpsaxhg.exechkdsk.exepid process 4920 xyvpsaxhg.exe 4920 xyvpsaxhg.exe 4920 xyvpsaxhg.exe 4920 xyvpsaxhg.exe 4920 xyvpsaxhg.exe 4920 xyvpsaxhg.exe 4920 xyvpsaxhg.exe 4920 xyvpsaxhg.exe 4920 xyvpsaxhg.exe 4920 xyvpsaxhg.exe 2200 chkdsk.exe 2200 chkdsk.exe 2200 chkdsk.exe 2200 chkdsk.exe 2200 chkdsk.exe 2200 chkdsk.exe 2200 chkdsk.exe 2200 chkdsk.exe 2200 chkdsk.exe 2200 chkdsk.exe 2200 chkdsk.exe 2200 chkdsk.exe 2200 chkdsk.exe 2200 chkdsk.exe 2200 chkdsk.exe 2200 chkdsk.exe 2200 chkdsk.exe 2200 chkdsk.exe 2200 chkdsk.exe 2200 chkdsk.exe 2200 chkdsk.exe 2200 chkdsk.exe 2200 chkdsk.exe 2200 chkdsk.exe 2200 chkdsk.exe 2200 chkdsk.exe 2200 chkdsk.exe 2200 chkdsk.exe 2200 chkdsk.exe 2200 chkdsk.exe 2200 chkdsk.exe 2200 chkdsk.exe 2200 chkdsk.exe 2200 chkdsk.exe 2200 chkdsk.exe 2200 chkdsk.exe 2200 chkdsk.exe 2200 chkdsk.exe 2200 chkdsk.exe 2200 chkdsk.exe 2200 chkdsk.exe 2200 chkdsk.exe 2200 chkdsk.exe 2200 chkdsk.exe 2200 chkdsk.exe 2200 chkdsk.exe 2200 chkdsk.exe 2200 chkdsk.exe 2200 chkdsk.exe 2200 chkdsk.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 900 Explorer.EXE -
Suspicious behavior: MapViewOfSection 10 IoCs
Processes:
xyvpsaxhg.exexyvpsaxhg.exechkdsk.exepid process 3200 xyvpsaxhg.exe 3200 xyvpsaxhg.exe 4920 xyvpsaxhg.exe 4920 xyvpsaxhg.exe 4920 xyvpsaxhg.exe 4920 xyvpsaxhg.exe 2200 chkdsk.exe 2200 chkdsk.exe 2200 chkdsk.exe 2200 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
xyvpsaxhg.exechkdsk.exedescription pid process Token: SeDebugPrivilege 4920 xyvpsaxhg.exe Token: SeDebugPrivilege 2200 chkdsk.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
713290575.exexyvpsaxhg.exeExplorer.EXEchkdsk.exedescription pid process target process PID 3712 wrote to memory of 3200 3712 713290575.exe xyvpsaxhg.exe PID 3712 wrote to memory of 3200 3712 713290575.exe xyvpsaxhg.exe PID 3712 wrote to memory of 3200 3712 713290575.exe xyvpsaxhg.exe PID 3200 wrote to memory of 4920 3200 xyvpsaxhg.exe xyvpsaxhg.exe PID 3200 wrote to memory of 4920 3200 xyvpsaxhg.exe xyvpsaxhg.exe PID 3200 wrote to memory of 4920 3200 xyvpsaxhg.exe xyvpsaxhg.exe PID 3200 wrote to memory of 4920 3200 xyvpsaxhg.exe xyvpsaxhg.exe PID 900 wrote to memory of 2200 900 Explorer.EXE chkdsk.exe PID 900 wrote to memory of 2200 900 Explorer.EXE chkdsk.exe PID 900 wrote to memory of 2200 900 Explorer.EXE chkdsk.exe PID 2200 wrote to memory of 3464 2200 chkdsk.exe Firefox.exe PID 2200 wrote to memory of 3464 2200 chkdsk.exe Firefox.exe PID 2200 wrote to memory of 3464 2200 chkdsk.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\713290575.exe"C:\Users\Admin\AppData\Local\Temp\713290575.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\xyvpsaxhg.exe"C:\Users\Admin\AppData\Local\Temp\xyvpsaxhg.exe" C:\Users\Admin\AppData\Local\Temp\pqdivdru.j3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\xyvpsaxhg.exe"C:\Users\Admin\AppData\Local\Temp\xyvpsaxhg.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\pqdivdru.jFilesize
7KB
MD5112c58cc0d7557c13b500fd901a97164
SHA18c02afae7fd6caee5a51ad36d161c176dc156010
SHA256783d842d977cb802f87c2c4b503134b4d1d63a727fbe2ceedbf3d8fa0ff329d8
SHA5128b6f76f58a6e086be78a99182f3e7f20437598af12c7fb0f86febf94c1617b4ef9476e405b5b46bba292936165433199b81c354c0b853f1f7ce914fa9893d7bd
-
C:\Users\Admin\AppData\Local\Temp\rjdkrussue.xrFilesize
185KB
MD56145b59a27fbedf9d079a857efc172be
SHA17e06ebad08546e86ca4fbceb83cbfd3d10eb9fb7
SHA256a44c5dd3f79e73d60592b495b63da598e57d05c67c914e16e3cc69a19ea1b72b
SHA512ef245e314570861e2120a20e095abbdb6ce09289188f6ea53221fbd3e717a339eac8848154733eb3eba684558353d532f7348c00f7bf102fa54d7f92d69f5c8f
-
C:\Users\Admin\AppData\Local\Temp\xyvpsaxhg.exeFilesize
100KB
MD57d2f68788b3ee076fa9eb6484ee05bd9
SHA1bd8580a0f568152464117fcf534af2b39b4bc7e3
SHA256dfcafdc033e87358e4fc663167b213beaae80bc886a670f4ca535bdaaca6ba05
SHA5122df7465c7ad674a02a2179ca2b6a397f743079a45bff64d415c7a328af64e3e2928ca0e9f63d19f871d20ee191e706b9fcf093ce7d676ba40d06e23caf000137
-
C:\Users\Admin\AppData\Local\Temp\xyvpsaxhg.exeFilesize
100KB
MD57d2f68788b3ee076fa9eb6484ee05bd9
SHA1bd8580a0f568152464117fcf534af2b39b4bc7e3
SHA256dfcafdc033e87358e4fc663167b213beaae80bc886a670f4ca535bdaaca6ba05
SHA5122df7465c7ad674a02a2179ca2b6a397f743079a45bff64d415c7a328af64e3e2928ca0e9f63d19f871d20ee191e706b9fcf093ce7d676ba40d06e23caf000137
-
C:\Users\Admin\AppData\Local\Temp\xyvpsaxhg.exeFilesize
100KB
MD57d2f68788b3ee076fa9eb6484ee05bd9
SHA1bd8580a0f568152464117fcf534af2b39b4bc7e3
SHA256dfcafdc033e87358e4fc663167b213beaae80bc886a670f4ca535bdaaca6ba05
SHA5122df7465c7ad674a02a2179ca2b6a397f743079a45bff64d415c7a328af64e3e2928ca0e9f63d19f871d20ee191e706b9fcf093ce7d676ba40d06e23caf000137
-
memory/900-142-0x0000000008570000-0x00000000086D3000-memory.dmpFilesize
1.4MB
-
memory/900-153-0x0000000008BD0000-0x0000000008CBD000-memory.dmpFilesize
948KB
-
memory/900-151-0x0000000008BD0000-0x0000000008CBD000-memory.dmpFilesize
948KB
-
memory/900-144-0x0000000008B00000-0x0000000008BCB000-memory.dmpFilesize
812KB
-
memory/2200-147-0x0000000000350000-0x000000000035A000-memory.dmpFilesize
40KB
-
memory/2200-145-0x0000000000000000-mapping.dmp
-
memory/2200-148-0x0000000000B40000-0x0000000000B6D000-memory.dmpFilesize
180KB
-
memory/2200-149-0x00000000014A0000-0x00000000017EA000-memory.dmpFilesize
3.3MB
-
memory/2200-150-0x0000000001320000-0x00000000013AF000-memory.dmpFilesize
572KB
-
memory/2200-152-0x0000000000B40000-0x0000000000B6D000-memory.dmpFilesize
180KB
-
memory/3200-132-0x0000000000000000-mapping.dmp
-
memory/4920-141-0x0000000000A70000-0x0000000000A80000-memory.dmpFilesize
64KB
-
memory/4920-143-0x0000000002B30000-0x0000000002B40000-memory.dmpFilesize
64KB
-
memory/4920-140-0x0000000000DD0000-0x000000000111A000-memory.dmpFilesize
3.3MB
-
memory/4920-146-0x0000000000790000-0x00000000007BF000-memory.dmpFilesize
188KB
-
memory/4920-139-0x0000000000790000-0x00000000007BF000-memory.dmpFilesize
188KB
-
memory/4920-137-0x0000000000000000-mapping.dmp