Analysis
-
max time kernel
152s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
08-12-2022 19:43
Static task
static1
Behavioral task
behavioral1
Sample
REVISED_.exe
Resource
win7-20220812-en
General
-
Target
REVISED_.exe
-
Size
573KB
-
MD5
0e27fab3f710b0b524091aba6ed455c7
-
SHA1
2b6aca7bc31a565f0cb1e00d9daab463b570f269
-
SHA256
40f511e420e73d2cb620d782e9ed31dbd1dabe4103b31e025a4158d39a209a5e
-
SHA512
d795b666ec53c9ed058c8fa77dac06e6e77f9d4871dfea8d59ebe49653b9b0620d292677482a88e81b276893948780db6ecc7b7e67ebb1c2a1995fc16876ba2a
-
SSDEEP
6144:/+qpqSmgUZtFUaJqMJ3iwyoqAnrHxC4AbUkO0dDW8P4SATkU6Uk5dWXwzlf7Tvm:GqgSmdzUZAUndDWE4pkFv5DzA
Malware Config
Extracted
formbook
4.1
f9r5
teknotimur.com
zuliboo.com
remmingtoncampbell.com
vehicletitleloansphoenix.com
sen-computer.com
98731.biz
shelikesblu.com
canis-totem.com
metaversemedianetwork.com
adsdu.com
vanishmediasystems.com
astewaykebede.com
wszhongxue.com
gacha-animator-free.com
papatyadekorasyon.com
mqc168.top
simplebrilliantsolutions.com
jubileehawkesprairie.com
ridflab.com
conboysfilm.com
iseemerit.world
airhbb.com
haveyourshare.com
qcstcsz.com
attorneykarinaramirez.com
patriziabartelle.com
dcc.coop
hdzz.top
treesandstarsoracle.com
rebarunikont.com
achivego.site
baipiao100.com
menslibwrty.com
insulationtraining.online
horseflix.club
suxyqyu.xyz
sqoki.com
ffbsjhvbsjhbvsajv.xyz
beapest.cfd
4892166.com
dvdmediastar.com
hotwomensearching4u.site
cupompetlover.com
terrapretasales.com
joinsequene.com
powerkitap.com
jonjene.com
wqcwgl.com
utahexotics.com
ballerboutique.com
cftronline.com
gettidaladvance.site
anagladstonedesign.com
bunsi-figura.store
ttvip-13.net
cmjysx-uqps.website
ifealafia.com
carlospainter.com
elitetrio.xyz
inggridangelia.com
leporebaq.com
youpinhang.com
palm3d.net
wo567567.com
shinecleaningasheville.com
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/2088-145-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2088-154-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3348-156-0x0000000000980000-0x00000000009AF000-memory.dmp formbook behavioral2/memory/3348-162-0x0000000000980000-0x00000000009AF000-memory.dmp formbook -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
REVISED_.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation REVISED_.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
REVISED_.exeREVISED_.execmmon32.exedescription pid process target process PID 4712 set thread context of 2088 4712 REVISED_.exe REVISED_.exe PID 2088 set thread context of 2616 2088 REVISED_.exe Explorer.EXE PID 3348 set thread context of 2616 3348 cmmon32.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 44 IoCs
Processes:
powershell.exeREVISED_.exeREVISED_.execmmon32.exepid process 1752 powershell.exe 4712 REVISED_.exe 4712 REVISED_.exe 2088 REVISED_.exe 2088 REVISED_.exe 2088 REVISED_.exe 2088 REVISED_.exe 1752 powershell.exe 3348 cmmon32.exe 3348 cmmon32.exe 3348 cmmon32.exe 3348 cmmon32.exe 3348 cmmon32.exe 3348 cmmon32.exe 3348 cmmon32.exe 3348 cmmon32.exe 3348 cmmon32.exe 3348 cmmon32.exe 3348 cmmon32.exe 3348 cmmon32.exe 3348 cmmon32.exe 3348 cmmon32.exe 3348 cmmon32.exe 3348 cmmon32.exe 3348 cmmon32.exe 3348 cmmon32.exe 3348 cmmon32.exe 3348 cmmon32.exe 3348 cmmon32.exe 3348 cmmon32.exe 3348 cmmon32.exe 3348 cmmon32.exe 3348 cmmon32.exe 3348 cmmon32.exe 3348 cmmon32.exe 3348 cmmon32.exe 3348 cmmon32.exe 3348 cmmon32.exe 3348 cmmon32.exe 3348 cmmon32.exe 3348 cmmon32.exe 3348 cmmon32.exe 3348 cmmon32.exe 3348 cmmon32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2616 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
REVISED_.execmmon32.exepid process 2088 REVISED_.exe 2088 REVISED_.exe 2088 REVISED_.exe 3348 cmmon32.exe 3348 cmmon32.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
powershell.exeREVISED_.exeREVISED_.execmmon32.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1752 powershell.exe Token: SeDebugPrivilege 4712 REVISED_.exe Token: SeDebugPrivilege 2088 REVISED_.exe Token: SeDebugPrivilege 3348 cmmon32.exe Token: SeShutdownPrivilege 2616 Explorer.EXE Token: SeCreatePagefilePrivilege 2616 Explorer.EXE -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
REVISED_.exeExplorer.EXEcmmon32.exedescription pid process target process PID 4712 wrote to memory of 1752 4712 REVISED_.exe powershell.exe PID 4712 wrote to memory of 1752 4712 REVISED_.exe powershell.exe PID 4712 wrote to memory of 1752 4712 REVISED_.exe powershell.exe PID 4712 wrote to memory of 2044 4712 REVISED_.exe schtasks.exe PID 4712 wrote to memory of 2044 4712 REVISED_.exe schtasks.exe PID 4712 wrote to memory of 2044 4712 REVISED_.exe schtasks.exe PID 4712 wrote to memory of 4676 4712 REVISED_.exe REVISED_.exe PID 4712 wrote to memory of 4676 4712 REVISED_.exe REVISED_.exe PID 4712 wrote to memory of 4676 4712 REVISED_.exe REVISED_.exe PID 4712 wrote to memory of 2088 4712 REVISED_.exe REVISED_.exe PID 4712 wrote to memory of 2088 4712 REVISED_.exe REVISED_.exe PID 4712 wrote to memory of 2088 4712 REVISED_.exe REVISED_.exe PID 4712 wrote to memory of 2088 4712 REVISED_.exe REVISED_.exe PID 4712 wrote to memory of 2088 4712 REVISED_.exe REVISED_.exe PID 4712 wrote to memory of 2088 4712 REVISED_.exe REVISED_.exe PID 2616 wrote to memory of 3348 2616 Explorer.EXE cmmon32.exe PID 2616 wrote to memory of 3348 2616 Explorer.EXE cmmon32.exe PID 2616 wrote to memory of 3348 2616 Explorer.EXE cmmon32.exe PID 3348 wrote to memory of 3184 3348 cmmon32.exe cmd.exe PID 3348 wrote to memory of 3184 3348 cmmon32.exe cmd.exe PID 3348 wrote to memory of 3184 3348 cmmon32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\REVISED_.exe"C:\Users\Admin\AppData\Local\Temp\REVISED_.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\GlzwuZ.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1752 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GlzwuZ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3BD0.tmp"3⤵
- Creates scheduled task(s)
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\REVISED_.exe"C:\Users\Admin\AppData\Local\Temp\REVISED_.exe"3⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\REVISED_.exe"C:\Users\Admin\AppData\Local\Temp\REVISED_.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2088 -
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\REVISED_.exe"3⤵PID:3184
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp3BD0.tmpFilesize
1KB
MD5ad4c708a289312d4cc590431e3613309
SHA195b6218d9a4518492d9eb2aa9e5da0e44f5bbbd8
SHA256862a750edcde0e0410398db965ac7d54e69c696bf03f3ce061196289f25a05b8
SHA512ab5a1b5f0731f19e453236a3244e6e8105ebcd14177a17efa313d405475541a46e7670f3e3460e89393e8abb1cfcc8ca2af8637ef3b899fe7f09abb6c93b9b82
-
memory/1752-146-0x0000000006070000-0x00000000060D6000-memory.dmpFilesize
408KB
-
memory/1752-160-0x0000000073390000-0x00000000733DC000-memory.dmpFilesize
304KB
-
memory/1752-161-0x00000000077C0000-0x00000000077DE000-memory.dmpFilesize
120KB
-
memory/1752-169-0x0000000007E00000-0x0000000007E96000-memory.dmpFilesize
600KB
-
memory/1752-137-0x0000000000000000-mapping.dmp
-
memory/1752-159-0x00000000077E0000-0x0000000007812000-memory.dmpFilesize
200KB
-
memory/1752-139-0x00000000051B0000-0x00000000051E6000-memory.dmpFilesize
216KB
-
memory/1752-140-0x0000000005820000-0x0000000005E48000-memory.dmpFilesize
6.2MB
-
memory/1752-172-0x0000000007DF0000-0x0000000007DF8000-memory.dmpFilesize
32KB
-
memory/1752-142-0x0000000005E50000-0x0000000005E72000-memory.dmpFilesize
136KB
-
memory/1752-168-0x0000000007BD0000-0x0000000007BDA000-memory.dmpFilesize
40KB
-
memory/1752-147-0x0000000006190000-0x00000000061F6000-memory.dmpFilesize
408KB
-
memory/1752-170-0x0000000007DB0000-0x0000000007DBE000-memory.dmpFilesize
56KB
-
memory/1752-171-0x0000000007EA0000-0x0000000007EBA000-memory.dmpFilesize
104KB
-
memory/1752-166-0x00000000081B0000-0x000000000882A000-memory.dmpFilesize
6.5MB
-
memory/1752-167-0x0000000007B70000-0x0000000007B8A000-memory.dmpFilesize
104KB
-
memory/1752-152-0x0000000006140000-0x000000000615E000-memory.dmpFilesize
120KB
-
memory/2044-138-0x0000000000000000-mapping.dmp
-
memory/2088-150-0x0000000001370000-0x0000000001384000-memory.dmpFilesize
80KB
-
memory/2088-149-0x00000000013B0000-0x00000000016FA000-memory.dmpFilesize
3.3MB
-
memory/2088-154-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2088-144-0x0000000000000000-mapping.dmp
-
memory/2088-145-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2616-151-0x0000000007C00000-0x0000000007D11000-memory.dmpFilesize
1.1MB
-
memory/2616-165-0x0000000008BD0000-0x0000000008D5F000-memory.dmpFilesize
1.6MB
-
memory/2616-164-0x0000000008BD0000-0x0000000008D5F000-memory.dmpFilesize
1.6MB
-
memory/3184-158-0x0000000000000000-mapping.dmp
-
memory/3348-153-0x0000000000000000-mapping.dmp
-
memory/3348-162-0x0000000000980000-0x00000000009AF000-memory.dmpFilesize
188KB
-
memory/3348-163-0x0000000002970000-0x0000000002A03000-memory.dmpFilesize
588KB
-
memory/3348-157-0x0000000002B00000-0x0000000002E4A000-memory.dmpFilesize
3.3MB
-
memory/3348-156-0x0000000000980000-0x00000000009AF000-memory.dmpFilesize
188KB
-
memory/3348-155-0x0000000000A30000-0x0000000000A3C000-memory.dmpFilesize
48KB
-
memory/4676-143-0x0000000000000000-mapping.dmp
-
memory/4712-132-0x0000000000BB0000-0x0000000000C46000-memory.dmpFilesize
600KB
-
memory/4712-136-0x00000000092F0000-0x000000000938C000-memory.dmpFilesize
624KB
-
memory/4712-135-0x0000000005690000-0x000000000569A000-memory.dmpFilesize
40KB
-
memory/4712-134-0x00000000055E0000-0x0000000005672000-memory.dmpFilesize
584KB
-
memory/4712-133-0x0000000005C60000-0x0000000006204000-memory.dmpFilesize
5.6MB