Analysis
-
max time kernel
152s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
08-12-2022 20:27
Static task
static1
Behavioral task
behavioral1
Sample
scan001.exe
Resource
win7-20220812-en
General
-
Target
scan001.exe
-
Size
338KB
-
MD5
e6c47976b4d53fd52464cfc18c8a57af
-
SHA1
31bf2e8c7b123cd7c04899fb64bbe3832823e217
-
SHA256
b3bcb18dda143e601f302a1cd248189f553d03ffbd707a05a3df3048f0c5b407
-
SHA512
28d927de8a6a44ea0eea2789b4f2d6b73a21a38072fdf28242a79fcdea06244229c088c922e87fd8556c0dc774af97483ac66a73b3ef3a8d22b6858a37740753
-
SSDEEP
6144:9kwUZdjCHZAGW3UgK9Xa64EIcdM5Rqyz7t/SLkopNYXhH7jsL2Sk8csUv3YWlZ:QdjM6UgiXpycW3qaRkkyNq7jU2SVUv3B
Malware Config
Extracted
formbook
9qtp
0BbXnywB2jUlm9nKiMma
R5A2IaujqtD/dAqI8Y0IpQ==
hOvaxGAt51Bx33P7Vyt6XPnYWw==
IDg+M/RH+D5aQ18d8Y0IpQ==
W1xH1/2HTrysGWEUdK2equ4Y
qHgkqNn4xTo4
8S7brii3eMzty+KgvBqIXPnYWw==
j8x44wKIXrW2tRiH8Y0IpQ==
GywuINvBRm2eaNY=
dTja44gPmQhkiaLZ
s6aIdgBm7Dx5fsUB2rE=
m5h7cA6JHX1p5ylfoc4ouA==
uDxNFJgassFFTdQ=
RERUNcLCgdAOabklo1PDTjf5Uw==
pKeadO1BswJQKXZ0tAkBF9wkNVs=
xd7Yr00rxzGBNlS1XA==
01Jd2fhoQpThdH5Sc8sprQ==
oOSWBCeNDDWeB8M=
EV8ae4iFCmdrT78Zr6VnObkG
Ghkc7nZnXXPEOX1FUToisZc=
b+TNSW7b5QZMVNY=
9YuHzc4u/maAe8UB2rE=
7wf+AJthHXmV9nchmnw/IZawRg==
fhEQhqTxpfMF4vJ0v6k=
cMR3bRQDDTiO5zbR
NritHTEovCqJ3B2F8Y0IpQ==
klEQFNYnGkJ0jQ+4KgiS
xohapLQMeb4YA0lSOZeD
IqWU5PhT8lGJW6OQbk4mL3Lf82Z4
ID89EYH9b4MfdH5Sc8sprQ==
H3kqGamujP83ud3KiMma
W7BYEsCqn6IDgQ==
9AgU73x+RJKrHLBC28gz6NwkNVs=
CCIUpNIztsFFTdQ=
VGRaOKoCmsFFTdQ=
vrGmWzoJ1zw2fwOjGVdnObkG
h85TMWsBiug=
wEI/qbob6ERjMWGpNrAv4Z4=
MjpSfr8QAdZkiaLZ
CETvX1ph3SB7NlS1XA==
vfrKyXlaIoupAYD+p/AqgpPD+21xH/M=
Kh0UA7KJEl1zzNrKiMma
tqaWljgGrAxZ54InAWsXaUr6VA==
ICsazaoutRRkiaLZ
ouGdZ+Za0ELS9DacVA==
eCgAABjTFPe7NlS1XA==
9nNDGwq8yhYl
9nd4DDaEKkrLmt0ampEA4nMfeG0Ncw==
3/Ds4pKMZ8rsZfJzxqVnObkG
z9TY1XLzmsFFTdQ=
GUA9GZVwSLjXO0du8Y0IpQ==
a5SMdQiNJX/Atz9GIkAzVrMDD2Ny
XJdOIKzXsAYxMYnt57s=
RFFU5nM6NR1SNck=
dN3GPm7kpcFFTdQ=
kntqyckK1hxTyGTKiMma
Yvr0PlCxLXzXscUB2rE=
9M6TfP5T5j92TZiCrwX2CXMDD2Ny
a7B2YQPcthAMk9bKiMma
RMC0xwAWsBB2NlS1XA==
WyDgT2/Bgs7VuUJPQ43zqdwkNVs=
bkwVbI4C4j+XQl8d8Y0IpQ==
KiHQ/aot/FR626cNiciY
gYxzT9xg/l21ouUVgmjq8m8DD2Ny
lee-perez.com
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
rorndxxfhn.exerorndxxfhn.exepid process 1340 rorndxxfhn.exe 4684 rorndxxfhn.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
rorndxxfhn.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation rorndxxfhn.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
rorndxxfhn.exerorndxxfhn.exemsdt.exedescription pid process target process PID 1340 set thread context of 4684 1340 rorndxxfhn.exe rorndxxfhn.exe PID 4684 set thread context of 760 4684 rorndxxfhn.exe Explorer.EXE PID 888 set thread context of 760 888 msdt.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
msdt.exedescription ioc process Key created \Registry\User\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 msdt.exe -
Suspicious behavior: EnumeratesProcesses 62 IoCs
Processes:
rorndxxfhn.exemsdt.exepid process 4684 rorndxxfhn.exe 4684 rorndxxfhn.exe 4684 rorndxxfhn.exe 4684 rorndxxfhn.exe 4684 rorndxxfhn.exe 4684 rorndxxfhn.exe 4684 rorndxxfhn.exe 4684 rorndxxfhn.exe 888 msdt.exe 888 msdt.exe 888 msdt.exe 888 msdt.exe 888 msdt.exe 888 msdt.exe 888 msdt.exe 888 msdt.exe 888 msdt.exe 888 msdt.exe 888 msdt.exe 888 msdt.exe 888 msdt.exe 888 msdt.exe 888 msdt.exe 888 msdt.exe 888 msdt.exe 888 msdt.exe 888 msdt.exe 888 msdt.exe 888 msdt.exe 888 msdt.exe 888 msdt.exe 888 msdt.exe 888 msdt.exe 888 msdt.exe 888 msdt.exe 888 msdt.exe 888 msdt.exe 888 msdt.exe 888 msdt.exe 888 msdt.exe 888 msdt.exe 888 msdt.exe 888 msdt.exe 888 msdt.exe 888 msdt.exe 888 msdt.exe 888 msdt.exe 888 msdt.exe 888 msdt.exe 888 msdt.exe 888 msdt.exe 888 msdt.exe 888 msdt.exe 888 msdt.exe 888 msdt.exe 888 msdt.exe 888 msdt.exe 888 msdt.exe 888 msdt.exe 888 msdt.exe 888 msdt.exe 888 msdt.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 760 Explorer.EXE -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
rorndxxfhn.exerorndxxfhn.exemsdt.exepid process 1340 rorndxxfhn.exe 4684 rorndxxfhn.exe 4684 rorndxxfhn.exe 4684 rorndxxfhn.exe 888 msdt.exe 888 msdt.exe 888 msdt.exe 888 msdt.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
rorndxxfhn.exemsdt.exedescription pid process Token: SeDebugPrivilege 4684 rorndxxfhn.exe Token: SeDebugPrivilege 888 msdt.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
scan001.exerorndxxfhn.exeExplorer.EXEmsdt.exedescription pid process target process PID 4324 wrote to memory of 1340 4324 scan001.exe rorndxxfhn.exe PID 4324 wrote to memory of 1340 4324 scan001.exe rorndxxfhn.exe PID 4324 wrote to memory of 1340 4324 scan001.exe rorndxxfhn.exe PID 1340 wrote to memory of 4684 1340 rorndxxfhn.exe rorndxxfhn.exe PID 1340 wrote to memory of 4684 1340 rorndxxfhn.exe rorndxxfhn.exe PID 1340 wrote to memory of 4684 1340 rorndxxfhn.exe rorndxxfhn.exe PID 1340 wrote to memory of 4684 1340 rorndxxfhn.exe rorndxxfhn.exe PID 760 wrote to memory of 888 760 Explorer.EXE msdt.exe PID 760 wrote to memory of 888 760 Explorer.EXE msdt.exe PID 760 wrote to memory of 888 760 Explorer.EXE msdt.exe PID 888 wrote to memory of 212 888 msdt.exe Firefox.exe PID 888 wrote to memory of 212 888 msdt.exe Firefox.exe PID 888 wrote to memory of 212 888 msdt.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Users\Admin\AppData\Local\Temp\scan001.exe"C:\Users\Admin\AppData\Local\Temp\scan001.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\rorndxxfhn.exe"C:\Users\Admin\AppData\Local\Temp\rorndxxfhn.exe" C:\Users\Admin\AppData\Local\Temp\btrmcxtbyq.qmp3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\rorndxxfhn.exe"C:\Users\Admin\AppData\Local\Temp\rorndxxfhn.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4684 -
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:212
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\btrmcxtbyq.qmpFilesize
5KB
MD5c1fac186d9e098f4b422cf4245f4081b
SHA14eb9905fdbfe9954f5abb9f362db88dd50b0093b
SHA2567e6d984b161c2832970affedf1317440f118bb708c9bc54ccfc24a7a79e9f47b
SHA51225709fb0cd239fc3704e6bd15cf2377220e2a982879de82aaeee0f6232ad653434754c1ac987d6a488961619cfb79aee5ad26bb2422cf18cd2bb8252987a465e
-
C:\Users\Admin\AppData\Local\Temp\rorndxxfhn.exeFilesize
286KB
MD5472c69eb31dc3dba99eb29db51070929
SHA16a63502ef54448442431d9faa07566e7d683620a
SHA256e7f945e8ce246c1c00c4672bf542505b4995da2e24665f284ef25cbb7eb2b639
SHA512cbffce25139a47d14b763be56164cd8087ff548876918b5d17d3a167f4351d7d082992781094658eb7fc1b1d0eaa89d25478f1ddd658dd256fbf9ad6b4225ccf
-
C:\Users\Admin\AppData\Local\Temp\rorndxxfhn.exeFilesize
286KB
MD5472c69eb31dc3dba99eb29db51070929
SHA16a63502ef54448442431d9faa07566e7d683620a
SHA256e7f945e8ce246c1c00c4672bf542505b4995da2e24665f284ef25cbb7eb2b639
SHA512cbffce25139a47d14b763be56164cd8087ff548876918b5d17d3a167f4351d7d082992781094658eb7fc1b1d0eaa89d25478f1ddd658dd256fbf9ad6b4225ccf
-
C:\Users\Admin\AppData\Local\Temp\rorndxxfhn.exeFilesize
286KB
MD5472c69eb31dc3dba99eb29db51070929
SHA16a63502ef54448442431d9faa07566e7d683620a
SHA256e7f945e8ce246c1c00c4672bf542505b4995da2e24665f284ef25cbb7eb2b639
SHA512cbffce25139a47d14b763be56164cd8087ff548876918b5d17d3a167f4351d7d082992781094658eb7fc1b1d0eaa89d25478f1ddd658dd256fbf9ad6b4225ccf
-
C:\Users\Admin\AppData\Local\Temp\tijpqhm.koFilesize
185KB
MD5b0be4c47237b61396c8df065cc32bf99
SHA1d17aa0a780f5b82effceee9201d5f2d81b7ad7bc
SHA2568366c1427e0d2896cf00757f34cb5b2cb36cc102f5b640b22c91ef442bbe893a
SHA51265772dab596ed616b5833a135c07fb38fdf363e9fd0d5dec2047b827348a9fb33d79f8d6ca06d90dba49953a2d76a82ca2cd83fb96ba9fa0a933d428f7c6cde9
-
memory/760-153-0x0000000007E40000-0x0000000007FB4000-memory.dmpFilesize
1.5MB
-
memory/760-152-0x0000000007E40000-0x0000000007FB4000-memory.dmpFilesize
1.5MB
-
memory/760-143-0x0000000002410000-0x00000000024DC000-memory.dmpFilesize
816KB
-
memory/888-147-0x0000000000240000-0x0000000000297000-memory.dmpFilesize
348KB
-
memory/888-151-0x00000000026A0000-0x000000000272F000-memory.dmpFilesize
572KB
-
memory/888-150-0x0000000000890000-0x00000000008BD000-memory.dmpFilesize
180KB
-
memory/888-144-0x0000000000000000-mapping.dmp
-
memory/888-149-0x0000000002800000-0x0000000002B4A000-memory.dmpFilesize
3.3MB
-
memory/888-148-0x0000000000890000-0x00000000008BD000-memory.dmpFilesize
180KB
-
memory/1340-132-0x0000000000000000-mapping.dmp
-
memory/4684-137-0x0000000000000000-mapping.dmp
-
memory/4684-145-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4684-146-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/4684-142-0x0000000000CC0000-0x0000000000CD0000-memory.dmpFilesize
64KB
-
memory/4684-141-0x00000000011E0000-0x000000000152A000-memory.dmpFilesize
3.3MB
-
memory/4684-140-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/4684-139-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB