Analysis
-
max time kernel
148s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
12-12-2022 08:46
Static task
static1
Behavioral task
behavioral1
Sample
jets8879.exe
Resource
win7-20220901-en
General
-
Target
jets8879.exe
-
Size
327KB
-
MD5
8fa5b93b0e8551f6d134dd5bcc423775
-
SHA1
04df2a601d983b7c6ff069c731620a9485f23067
-
SHA256
ae9df04eea9083e5d41bbf60f60bf0f30154518db24f29ffcf50e716aed2acfe
-
SHA512
c931b674d43541b05d183643b21fcd32a3f06732d3dbaeb7600b8b5bce3d741cb2c5fd4d4e675e76ccf6bcf019612da50575ed370bf7ac249bf33d938c35f91e
-
SSDEEP
6144:9kw+4/tHX/dDjqZsMEbcDf6IMfwzOOTgD7xvyIBWr75n3L4YnYTgQO:q49vkZsM/DiIytZ1BSF4Yb/
Malware Config
Extracted
formbook
4.1
je14
innervisionbuildings.com
theenergysocialite.com
565548.com
panghr.com
onlyonesolutions.com
stjohnzone6.com
cnotes.rest
helfeb.online
xixi-s-inc.club
easilyentered.com
theshopx.store
mrclean-ac.com
miamibeachwateradventures.com
jpearce.co.uk
seseragi-bunkou.com
minimaddie.com
commbank-help-849c3.com
segohandelsonderneming.com
namthanhreal.com
fototerapi.online
your-download.com
klindt.one
sellerscourt.com
francoislambert.store
smokedoutvapes.co.uk
rundacg.com
flavors-and-spices-lyon.com
qifengsuo.com
sunnyislesgardens.com
tunneldutransit.com
restorecodes.website
blast4me.com
bingser.space
co-gpco.com
emporioaliwen.com
mr5g.com
abcp666.com
consulvip.net
sagaming168.info
zjpbhsuz.top
socal-labworx.com
arethaglennevents.com
rafiqsiregar.com
esgh2.com
veirdmusic.com
abzcc.xyz
8065yp.com
dronebazar.com
duetpbr.com
apartamentoslaencantada.com
digigold.info
homedecorsuppliers.com
duenorthrm.com
xmmdsy.com
ddstennessee.com
marmeluz.com
ragnallhess.com
methinelli.com
randomlymetheseer.com
magicgrowthproducts.com
shreejistudio.com
mattress-37684.com
yellyfishfilms.com
www1111cpw.com
tigermedlagroup.com
Signatures
-
Formbook payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1964-65-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/896-72-0x0000000000080000-0x00000000000AF000-memory.dmp formbook behavioral1/memory/896-76-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Executes dropped EXE 2 IoCs
Processes:
xndovcoc.exexndovcoc.exepid process 1268 xndovcoc.exe 1964 xndovcoc.exe -
Loads dropped DLL 2 IoCs
Processes:
jets8879.exexndovcoc.exepid process 1368 jets8879.exe 1268 xndovcoc.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
xndovcoc.exexndovcoc.exesvchost.exedescription pid process target process PID 1268 set thread context of 1964 1268 xndovcoc.exe xndovcoc.exe PID 1964 set thread context of 1280 1964 xndovcoc.exe Explorer.EXE PID 896 set thread context of 1280 896 svchost.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 27 IoCs
Processes:
xndovcoc.exesvchost.exepid process 1964 xndovcoc.exe 1964 xndovcoc.exe 896 svchost.exe 896 svchost.exe 896 svchost.exe 896 svchost.exe 896 svchost.exe 896 svchost.exe 896 svchost.exe 896 svchost.exe 896 svchost.exe 896 svchost.exe 896 svchost.exe 896 svchost.exe 896 svchost.exe 896 svchost.exe 896 svchost.exe 896 svchost.exe 896 svchost.exe 896 svchost.exe 896 svchost.exe 896 svchost.exe 896 svchost.exe 896 svchost.exe 896 svchost.exe 896 svchost.exe 896 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1280 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
xndovcoc.exexndovcoc.exesvchost.exepid process 1268 xndovcoc.exe 1964 xndovcoc.exe 1964 xndovcoc.exe 1964 xndovcoc.exe 896 svchost.exe 896 svchost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
xndovcoc.exesvchost.exedescription pid process Token: SeDebugPrivilege 1964 xndovcoc.exe Token: SeDebugPrivilege 896 svchost.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1280 Explorer.EXE 1280 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1280 Explorer.EXE 1280 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 1280 Explorer.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
jets8879.exexndovcoc.exeExplorer.EXEsvchost.exedescription pid process target process PID 1368 wrote to memory of 1268 1368 jets8879.exe xndovcoc.exe PID 1368 wrote to memory of 1268 1368 jets8879.exe xndovcoc.exe PID 1368 wrote to memory of 1268 1368 jets8879.exe xndovcoc.exe PID 1368 wrote to memory of 1268 1368 jets8879.exe xndovcoc.exe PID 1268 wrote to memory of 1964 1268 xndovcoc.exe xndovcoc.exe PID 1268 wrote to memory of 1964 1268 xndovcoc.exe xndovcoc.exe PID 1268 wrote to memory of 1964 1268 xndovcoc.exe xndovcoc.exe PID 1268 wrote to memory of 1964 1268 xndovcoc.exe xndovcoc.exe PID 1268 wrote to memory of 1964 1268 xndovcoc.exe xndovcoc.exe PID 1280 wrote to memory of 896 1280 Explorer.EXE svchost.exe PID 1280 wrote to memory of 896 1280 Explorer.EXE svchost.exe PID 1280 wrote to memory of 896 1280 Explorer.EXE svchost.exe PID 1280 wrote to memory of 896 1280 Explorer.EXE svchost.exe PID 896 wrote to memory of 688 896 svchost.exe cmd.exe PID 896 wrote to memory of 688 896 svchost.exe cmd.exe PID 896 wrote to memory of 688 896 svchost.exe cmd.exe PID 896 wrote to memory of 688 896 svchost.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\jets8879.exe"C:\Users\Admin\AppData\Local\Temp\jets8879.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\xndovcoc.exe"C:\Users\Admin\AppData\Local\Temp\xndovcoc.exe" C:\Users\Admin\AppData\Local\Temp\gkeiqcnaami.sdw3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\xndovcoc.exe"C:\Users\Admin\AppData\Local\Temp\xndovcoc.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1964 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\xndovcoc.exe"3⤵PID:688
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\gkeiqcnaami.sdwFilesize
5KB
MD583389c5af191d574aa7d6a89bb45ac2c
SHA1f28c63cc4231c3a805523634efe80404ec099377
SHA256aaa06259fddb6dde4a666a75b387761814a1a5043cc12bbf15331068abc60be2
SHA512c7a41f5cde2aacf8ea295b538521f7fa944c85014bcc674d31bee268be80a2300fe2cf8cdb8e4cad92ba148ba677e394a0b18edc773683df57e3a7f5855c8886
-
C:\Users\Admin\AppData\Local\Temp\wwgohqxr.bFilesize
185KB
MD5b785a9615ee2d65546fb809413c4874e
SHA1c7d50e11e44446567b31b72c5d3706b8ac169aeb
SHA256a811cfbdaeda03379031987f7d754b9ee70e38b1d609767ac80ef40023e06873
SHA5125492284e2d7755a8498abcbdbf5de9a5dfd2fdb0fe674ace1b18e744822e4b100d885074132be265ecefa5a3e2dcf13eba224b7d54a9cec76a81803284b9ab1f
-
C:\Users\Admin\AppData\Local\Temp\xndovcoc.exeFilesize
287KB
MD560f2075f7d9e7e3ac0c7bc7b532ec8e8
SHA1310f6b153efb3cd12375834d62ebc30e4cf8dd3e
SHA25600d6ad142363cedb55e84690cdf856b4e4580f36e8bc54c9974f17acc6d40be4
SHA51288fd45a32fb8efadac8a10863d90ac510979a46d5589ea789af3f9f49d2c2f1df5cbd2d94630d1526edd8519abae0a190cb3fe719f3456d86f2f48bef37837d4
-
C:\Users\Admin\AppData\Local\Temp\xndovcoc.exeFilesize
287KB
MD560f2075f7d9e7e3ac0c7bc7b532ec8e8
SHA1310f6b153efb3cd12375834d62ebc30e4cf8dd3e
SHA25600d6ad142363cedb55e84690cdf856b4e4580f36e8bc54c9974f17acc6d40be4
SHA51288fd45a32fb8efadac8a10863d90ac510979a46d5589ea789af3f9f49d2c2f1df5cbd2d94630d1526edd8519abae0a190cb3fe719f3456d86f2f48bef37837d4
-
C:\Users\Admin\AppData\Local\Temp\xndovcoc.exeFilesize
287KB
MD560f2075f7d9e7e3ac0c7bc7b532ec8e8
SHA1310f6b153efb3cd12375834d62ebc30e4cf8dd3e
SHA25600d6ad142363cedb55e84690cdf856b4e4580f36e8bc54c9974f17acc6d40be4
SHA51288fd45a32fb8efadac8a10863d90ac510979a46d5589ea789af3f9f49d2c2f1df5cbd2d94630d1526edd8519abae0a190cb3fe719f3456d86f2f48bef37837d4
-
\Users\Admin\AppData\Local\Temp\xndovcoc.exeFilesize
287KB
MD560f2075f7d9e7e3ac0c7bc7b532ec8e8
SHA1310f6b153efb3cd12375834d62ebc30e4cf8dd3e
SHA25600d6ad142363cedb55e84690cdf856b4e4580f36e8bc54c9974f17acc6d40be4
SHA51288fd45a32fb8efadac8a10863d90ac510979a46d5589ea789af3f9f49d2c2f1df5cbd2d94630d1526edd8519abae0a190cb3fe719f3456d86f2f48bef37837d4
-
\Users\Admin\AppData\Local\Temp\xndovcoc.exeFilesize
287KB
MD560f2075f7d9e7e3ac0c7bc7b532ec8e8
SHA1310f6b153efb3cd12375834d62ebc30e4cf8dd3e
SHA25600d6ad142363cedb55e84690cdf856b4e4580f36e8bc54c9974f17acc6d40be4
SHA51288fd45a32fb8efadac8a10863d90ac510979a46d5589ea789af3f9f49d2c2f1df5cbd2d94630d1526edd8519abae0a190cb3fe719f3456d86f2f48bef37837d4
-
memory/688-70-0x0000000000000000-mapping.dmp
-
memory/896-72-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/896-73-0x00000000009E0000-0x0000000000CE3000-memory.dmpFilesize
3.0MB
-
memory/896-76-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/896-74-0x0000000000360000-0x00000000003F3000-memory.dmpFilesize
588KB
-
memory/896-69-0x0000000000000000-mapping.dmp
-
memory/896-71-0x0000000000700000-0x0000000000708000-memory.dmpFilesize
32KB
-
memory/1268-56-0x0000000000000000-mapping.dmp
-
memory/1280-68-0x0000000004B70000-0x0000000004C49000-memory.dmpFilesize
868KB
-
memory/1280-75-0x0000000006B80000-0x0000000006CEA000-memory.dmpFilesize
1.4MB
-
memory/1280-77-0x0000000006B80000-0x0000000006CEA000-memory.dmpFilesize
1.4MB
-
memory/1368-54-0x0000000074E41000-0x0000000074E43000-memory.dmpFilesize
8KB
-
memory/1964-67-0x0000000000210000-0x0000000000224000-memory.dmpFilesize
80KB
-
memory/1964-63-0x000000000041F120-mapping.dmp
-
memory/1964-66-0x00000000008D0000-0x0000000000BD3000-memory.dmpFilesize
3.0MB
-
memory/1964-65-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB