Analysis
-
max time kernel
91s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
08-12-2022 14:38
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe
Resource
win7-20221111-en
General
-
Target
SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe
-
Size
947KB
-
MD5
fa16f4fdb2d9ad31bbb18a35ed5aa8e8
-
SHA1
9cbe9ad8ae95765033c303abe150cec63642c32a
-
SHA256
21e08bb00bf5a84ec339e16296437ef3f5fc98b93d62da5a2e26bebbb2eb5861
-
SHA512
06a71d2636af52bc63524cace2066f5e5287d4d68fbb5f7db6f965d6cddbc9b0d92340f8a1e938d2b11acb5eeeff2e5abd15b9e7ab15cb489df351936a74f943
-
SSDEEP
12288:k2lmLFCXGPtdUA7pY+ZmBjHUk+qTBcrovP4uo7T2TwmiaY+A7e6u6Z/knOY9y5NI:1YCWl9FhZmBHQronA7TwioA7cO9Lgx
Malware Config
Extracted
formbook
4.1
f9r5
teknotimur.com
zuliboo.com
remmingtoncampbell.com
vehicletitleloansphoenix.com
sen-computer.com
98731.biz
shelikesblu.com
canis-totem.com
metaversemedianetwork.com
adsdu.com
vanishmediasystems.com
astewaykebede.com
wszhongxue.com
gacha-animator-free.com
papatyadekorasyon.com
mqc168.top
simplebrilliantsolutions.com
jubileehawkesprairie.com
ridflab.com
conboysfilm.com
iseemerit.world
airhbb.com
haveyourshare.com
qcstcsz.com
attorneykarinaramirez.com
patriziabartelle.com
dcc.coop
hdzz.top
treesandstarsoracle.com
rebarunikont.com
achivego.site
baipiao100.com
menslibwrty.com
insulationtraining.online
horseflix.club
suxyqyu.xyz
sqoki.com
ffbsjhvbsjhbvsajv.xyz
beapest.cfd
4892166.com
dvdmediastar.com
hotwomensearching4u.site
cupompetlover.com
terrapretasales.com
joinsequene.com
powerkitap.com
jonjene.com
wqcwgl.com
utahexotics.com
ballerboutique.com
cftronline.com
gettidaladvance.site
anagladstonedesign.com
bunsi-figura.store
ttvip-13.net
cmjysx-uqps.website
ifealafia.com
carlospainter.com
elitetrio.xyz
inggridangelia.com
leporebaq.com
youpinhang.com
palm3d.net
wo567567.com
shinecleaningasheville.com
Signatures
-
Formbook payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/864-143-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exedescription pid process target process PID 4800 set thread context of 864 4800 SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exeSecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exepowershell.exepid process 4800 SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe 4800 SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe 4800 SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe 864 SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe 864 SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe 2592 powershell.exe 2592 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exepowershell.exedescription pid process Token: SeDebugPrivilege 4800 SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe Token: SeDebugPrivilege 2592 powershell.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exedescription pid process target process PID 4800 wrote to memory of 2592 4800 SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe powershell.exe PID 4800 wrote to memory of 2592 4800 SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe powershell.exe PID 4800 wrote to memory of 2592 4800 SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe powershell.exe PID 4800 wrote to memory of 1280 4800 SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe schtasks.exe PID 4800 wrote to memory of 1280 4800 SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe schtasks.exe PID 4800 wrote to memory of 1280 4800 SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe schtasks.exe PID 4800 wrote to memory of 864 4800 SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe PID 4800 wrote to memory of 864 4800 SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe PID 4800 wrote to memory of 864 4800 SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe PID 4800 wrote to memory of 864 4800 SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe PID 4800 wrote to memory of 864 4800 SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe PID 4800 wrote to memory of 864 4800 SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\JhJajGFqWxtP.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2592 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JhJajGFqWxtP" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA6A0.tmp"2⤵
- Creates scheduled task(s)
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1725.22096.15782.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:864
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpA6A0.tmpFilesize
1KB
MD5b3b72052f4b7f4bd953e6a0d48e7c76c
SHA18f9fb7194da4de5829575094bb9600b61ecabd3c
SHA2569d4cc5a94b70c271d3ac1495d768077f1eb5b08b8aafe5f000e004acc206e635
SHA5126264f0bf0c7f68824e9fe8cefb0bea2ed3fa7504e6deedfe23dd38023534637186c3880a98856150595349cea591c8fabbe3a9e8661ad1bad87d357011090746
-
memory/864-145-0x00000000014E0000-0x000000000182A000-memory.dmpFilesize
3.3MB
-
memory/864-143-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/864-142-0x0000000000000000-mapping.dmp
-
memory/1280-138-0x0000000000000000-mapping.dmp
-
memory/2592-144-0x0000000005940000-0x0000000005962000-memory.dmpFilesize
136KB
-
memory/2592-153-0x0000000007C80000-0x0000000007C9A000-memory.dmpFilesize
104KB
-
memory/2592-139-0x0000000002FC0000-0x0000000002FF6000-memory.dmpFilesize
216KB
-
memory/2592-158-0x0000000007FA0000-0x0000000007FA8000-memory.dmpFilesize
32KB
-
memory/2592-141-0x0000000005C00000-0x0000000006228000-memory.dmpFilesize
6.2MB
-
memory/2592-157-0x0000000007FB0000-0x0000000007FCA000-memory.dmpFilesize
104KB
-
memory/2592-156-0x0000000007EB0000-0x0000000007EBE000-memory.dmpFilesize
56KB
-
memory/2592-155-0x0000000007EF0000-0x0000000007F86000-memory.dmpFilesize
600KB
-
memory/2592-154-0x0000000007CF0000-0x0000000007CFA000-memory.dmpFilesize
40KB
-
memory/2592-146-0x0000000005B70000-0x0000000005BD6000-memory.dmpFilesize
408KB
-
memory/2592-147-0x00000000062A0000-0x0000000006306000-memory.dmpFilesize
408KB
-
memory/2592-148-0x0000000006980000-0x000000000699E000-memory.dmpFilesize
120KB
-
memory/2592-149-0x0000000006F40000-0x0000000006F72000-memory.dmpFilesize
200KB
-
memory/2592-150-0x0000000070ED0000-0x0000000070F1C000-memory.dmpFilesize
304KB
-
memory/2592-151-0x0000000007B40000-0x0000000007B5E000-memory.dmpFilesize
120KB
-
memory/2592-152-0x00000000082D0000-0x000000000894A000-memory.dmpFilesize
6.5MB
-
memory/2592-137-0x0000000000000000-mapping.dmp
-
memory/4800-133-0x0000000005830000-0x0000000005DD4000-memory.dmpFilesize
5.6MB
-
memory/4800-132-0x0000000000870000-0x0000000000962000-memory.dmpFilesize
968KB
-
memory/4800-134-0x0000000005320000-0x00000000053B2000-memory.dmpFilesize
584KB
-
memory/4800-135-0x0000000005300000-0x000000000530A000-memory.dmpFilesize
40KB
-
memory/4800-136-0x00000000062F0000-0x000000000638C000-memory.dmpFilesize
624KB