Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
13-12-2022 15:43
Static task
static1
Behavioral task
behavioral1
Sample
RFQ PT089110.exe
Resource
win7-20220812-en
General
-
Target
RFQ PT089110.exe
-
Size
272KB
-
MD5
8ea739a14035ea523b015f33eafe6953
-
SHA1
228ee69b1fccea68b79f9c1a9bb9796882696cf3
-
SHA256
1a685538deaab9e0cfe393b43f4f08e48c076ce115911c46e93952a121322c87
-
SHA512
76d462569c16143c41ce75eb8e5f4f6304f32f42f939433752a5aa3fefcfa4550da8a55179dfef2d3eef0c6a41a9de8018de785669bfc6daf337a14323f98f2a
-
SSDEEP
6144:9kwrUMSvXxBADF+bVEN8fyqNkpHVtxgWljiXcU0GfJyqI2q:/UMEBBAAJVfjS1EWljiXcU0EJyqy
Malware Config
Extracted
formbook
m5oe
HdR8hG6r12hBYuHY4zv6YeeFPQ==
tD1V9gswYvgQXEGd
1xKtJ1LdqRYMRMC84U1A
MbhjiWb7Lz8z7KIWl3UyUIJwA6Tb
joVB5Xggy2RtE+odsZg=
TrduAIay6Y3SvoIK20xI
pSna7LOsXXwXT/zz3Iow4g==
QnthmO4Qst5gC3sDoA==
eAirzOOgO7SOCenz3Iow4g==
xg0uSbfLTg==
YWQXwyGRzPEHzGrDFE8CBSE=
ujLnfuXoH9dbgHIK20xI
291v0XsGFrYQXEGd
MRvTd/qMuaHpjCM=
X131fLC6VWX4MsvCb2IPjIfq8wlksWfg
Y9Bur8DbgqFt/Yni86MMCCE=
q6RTBmJkmy5pWTmmCCrvmuCDPw==
mQS26DojT+EQXEGd
sjHQ+Kav2Wx9FeodsZg=
JA24UKnTA5re1LhcQaVo/w==
+nMYDuKNduLsjSE=
0Y9DVy/Tc9l+yjQ=
y7lwdkvTChreCREDpQ==
Ii3WdB9OaKHpjCM=
CMWQ4A8JKbwoNFp9nu7t6g==
gbV4IoyzQljj18uoLgjx6g==
6K5hYUwJtU5ySf92shofvBfYrldksWfg
HShGoi6WeQZh
+XRHCtltpLisZhq8oQP3tsIn
H92Mnqi1WFbtCREDpQ==
ScNmhoycwTWCnCciRLFr/A92fk4lLrXv
/mcDDzqp2eN+iqKcQzk8IFpI47Z1oDSkYg==
4Zw22mgivXjUVwsKrQ==
H6BuCCqWeQZh
AXgnNxLA5SJB/+odsZg=
ewIhwqy9EmQJYg==
r2QP0TaWeQZh
wH0tLEHAY/MrFNYtfK1ScJWi7cI=
CC3fiO5tJLm2VNIwxwNPYSP0u4nR
Fx7Zhw2aS6HpjCM=
IJxWlqZEdZpwDuodsZg=
yUjv9d2BuOS0KOodsZg=
3p9Rc2X7ORpG8LMaPbR8DkBwu0YHcGeudQ==
1HEaIfD3b79KiDEL3Iow4g==
wWMAE/eTvqHpjCM=
vLlwIqnDnTWyCREDpQ==
5Zw354BpX25V+MYFrJI=
bqtnHoun2nf7CREDpQ==
rWETGOZxl6iRGP8fuokZ/GMv
sn1e9rsTPWA=
nN+z3PKiu6HpjCM=
qifMPKbZgoXSZjD1FJA=
wJAvzTSWeQZh
XYVBzCOsTvAQXEGd
tCi/4MTHdZ9v9pT5FGwZ/GMv
uWdW5jhhSjC67o2V
IejMbKK5EmQJYg==
2ptC9k/Nex0+/uodsZg=
69+iVeaYNOokmEsorQ==
f4MkxCEdWBSt5WJD5cLF7EoRn8M=
d7dR4opPbeIZwWovuA==
4alR50ZbhAxOJfHUaVhA
g403rfwQH7w9ZvHron4xbLDfMg==
m9aSQLs51jmh18uoLgjx6g==
singglostudio.com
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
faclv.exefaclv.exepid process 860 faclv.exe 1988 faclv.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
faclv.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\International\Geo\Nation faclv.exe -
Loads dropped DLL 3 IoCs
Processes:
RFQ PT089110.exefaclv.exeexplorer.exepid process 1248 RFQ PT089110.exe 860 faclv.exe 880 explorer.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
faclv.exefaclv.exeexplorer.exedescription pid process target process PID 860 set thread context of 1988 860 faclv.exe faclv.exe PID 1988 set thread context of 1444 1988 faclv.exe Explorer.EXE PID 880 set thread context of 1444 880 explorer.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
explorer.exedescription ioc process Key created \Registry\User\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 explorer.exe -
Suspicious behavior: EnumeratesProcesses 25 IoCs
Processes:
faclv.exeexplorer.exepid process 1988 faclv.exe 1988 faclv.exe 1988 faclv.exe 1988 faclv.exe 880 explorer.exe 880 explorer.exe 880 explorer.exe 880 explorer.exe 880 explorer.exe 880 explorer.exe 880 explorer.exe 880 explorer.exe 880 explorer.exe 880 explorer.exe 880 explorer.exe 880 explorer.exe 880 explorer.exe 880 explorer.exe 880 explorer.exe 880 explorer.exe 880 explorer.exe 880 explorer.exe 880 explorer.exe 880 explorer.exe 880 explorer.exe -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
faclv.exefaclv.exeexplorer.exepid process 860 faclv.exe 1988 faclv.exe 1988 faclv.exe 1988 faclv.exe 880 explorer.exe 880 explorer.exe 880 explorer.exe 880 explorer.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
faclv.exeexplorer.exedescription pid process Token: SeDebugPrivilege 1988 faclv.exe Token: SeDebugPrivilege 880 explorer.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1444 Explorer.EXE 1444 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1444 Explorer.EXE 1444 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
RFQ PT089110.exefaclv.exeExplorer.EXEexplorer.exedescription pid process target process PID 1248 wrote to memory of 860 1248 RFQ PT089110.exe faclv.exe PID 1248 wrote to memory of 860 1248 RFQ PT089110.exe faclv.exe PID 1248 wrote to memory of 860 1248 RFQ PT089110.exe faclv.exe PID 1248 wrote to memory of 860 1248 RFQ PT089110.exe faclv.exe PID 860 wrote to memory of 1988 860 faclv.exe faclv.exe PID 860 wrote to memory of 1988 860 faclv.exe faclv.exe PID 860 wrote to memory of 1988 860 faclv.exe faclv.exe PID 860 wrote to memory of 1988 860 faclv.exe faclv.exe PID 860 wrote to memory of 1988 860 faclv.exe faclv.exe PID 1444 wrote to memory of 880 1444 Explorer.EXE explorer.exe PID 1444 wrote to memory of 880 1444 Explorer.EXE explorer.exe PID 1444 wrote to memory of 880 1444 Explorer.EXE explorer.exe PID 1444 wrote to memory of 880 1444 Explorer.EXE explorer.exe PID 880 wrote to memory of 1476 880 explorer.exe Firefox.exe PID 880 wrote to memory of 1476 880 explorer.exe Firefox.exe PID 880 wrote to memory of 1476 880 explorer.exe Firefox.exe PID 880 wrote to memory of 1476 880 explorer.exe Firefox.exe PID 880 wrote to memory of 1476 880 explorer.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RFQ PT089110.exe"C:\Users\Admin\AppData\Local\Temp\RFQ PT089110.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\faclv.exe"C:\Users\Admin\AppData\Local\Temp\faclv.exe" C:\Users\Admin\AppData\Local\Temp\jjqrtywbglb.t3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\faclv.exe"C:\Users\Admin\AppData\Local\Temp\faclv.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\faclv.exeFilesize
141KB
MD5f88b0229271ec4a4962ade420916973f
SHA18c3eff757988b1b43213b85dd272af0289a85f2f
SHA256e66c55f14ddcfb93aa5f236b67829bc4b43916e1ff84bf89ee90275bc873729e
SHA512f09c5cc0a50169582d0578fb2959a15841394c2a391b7a31be8a6e2cd90586b37b18e39d3395e176a250ac5dbba1db091206c3b3364221ec92cde78a182dba53
-
C:\Users\Admin\AppData\Local\Temp\faclv.exeFilesize
141KB
MD5f88b0229271ec4a4962ade420916973f
SHA18c3eff757988b1b43213b85dd272af0289a85f2f
SHA256e66c55f14ddcfb93aa5f236b67829bc4b43916e1ff84bf89ee90275bc873729e
SHA512f09c5cc0a50169582d0578fb2959a15841394c2a391b7a31be8a6e2cd90586b37b18e39d3395e176a250ac5dbba1db091206c3b3364221ec92cde78a182dba53
-
C:\Users\Admin\AppData\Local\Temp\faclv.exeFilesize
141KB
MD5f88b0229271ec4a4962ade420916973f
SHA18c3eff757988b1b43213b85dd272af0289a85f2f
SHA256e66c55f14ddcfb93aa5f236b67829bc4b43916e1ff84bf89ee90275bc873729e
SHA512f09c5cc0a50169582d0578fb2959a15841394c2a391b7a31be8a6e2cd90586b37b18e39d3395e176a250ac5dbba1db091206c3b3364221ec92cde78a182dba53
-
C:\Users\Admin\AppData\Local\Temp\jjqrtywbglb.tFilesize
5KB
MD5c4da7b1938a01beace3d69275e1826f9
SHA1bb7e8c0d6b9e404551d45e9d1701a49a6aa41eda
SHA2567d1696aa4c800e800aa5b49124b66cc00e94d155e78cd06aece207a9d7b7e47d
SHA5129a6493fb8eaee411248e0eb65b134baee7d2746d9ff0af493f7083c6403f80c1c0588971409e2c1a5d785b674b029eaf6122d2f60bce7cc16154d91947e97fb0
-
C:\Users\Admin\AppData\Local\Temp\zhphjyjg.axkFilesize
185KB
MD5c290c052854d20566294229800e4471d
SHA1eb4cef65b362a4ade2977078286e60b06551d2c3
SHA25669c12b29ea58482fa5a07f00810e350c9436d40808f4b9bcc6567b32f8104255
SHA512d199fc2fed053c1d5107084fd9930630bcb297ce281b3fdc62e83ecf641e62f1b9d64049b446f9d546347ca025305dd4f699defb1c661a1646dd9583a0207d7d
-
\Users\Admin\AppData\Local\Temp\faclv.exeFilesize
141KB
MD5f88b0229271ec4a4962ade420916973f
SHA18c3eff757988b1b43213b85dd272af0289a85f2f
SHA256e66c55f14ddcfb93aa5f236b67829bc4b43916e1ff84bf89ee90275bc873729e
SHA512f09c5cc0a50169582d0578fb2959a15841394c2a391b7a31be8a6e2cd90586b37b18e39d3395e176a250ac5dbba1db091206c3b3364221ec92cde78a182dba53
-
\Users\Admin\AppData\Local\Temp\faclv.exeFilesize
141KB
MD5f88b0229271ec4a4962ade420916973f
SHA18c3eff757988b1b43213b85dd272af0289a85f2f
SHA256e66c55f14ddcfb93aa5f236b67829bc4b43916e1ff84bf89ee90275bc873729e
SHA512f09c5cc0a50169582d0578fb2959a15841394c2a391b7a31be8a6e2cd90586b37b18e39d3395e176a250ac5dbba1db091206c3b3364221ec92cde78a182dba53
-
\Users\Admin\AppData\Local\Temp\sqlite3.dllFilesize
828KB
MD5d5ea9b5814553bd2f9bbb8bf0ea94ed6
SHA129629836c088dcd968efb321832edcbcfaac5b51
SHA2565ea67d6b7f67301ca214af511740f26b9e6cc9e16b2c0ec7bba071d05b9bde78
SHA5126867452995c8354622fe22ce4fb4868d2b9cb28bb31aa60b42f06e494b952f66c427aa66c7af09240954bf55ebcde62d4c7feb9d99e742ea3bc5beb3756a7a1e
-
memory/860-56-0x0000000000000000-mapping.dmp
-
memory/880-74-0x0000000000080000-0x00000000000AD000-memory.dmpFilesize
180KB
-
memory/880-75-0x0000000002410000-0x0000000002713000-memory.dmpFilesize
3.0MB
-
memory/880-78-0x0000000000080000-0x00000000000AD000-memory.dmpFilesize
180KB
-
memory/880-76-0x0000000000B10000-0x0000000000B9F000-memory.dmpFilesize
572KB
-
memory/880-73-0x0000000000BA0000-0x0000000000E21000-memory.dmpFilesize
2.5MB
-
memory/880-72-0x0000000074D11000-0x0000000074D13000-memory.dmpFilesize
8KB
-
memory/880-70-0x0000000000000000-mapping.dmp
-
memory/1248-54-0x0000000075351000-0x0000000075353000-memory.dmpFilesize
8KB
-
memory/1444-69-0x0000000004840000-0x0000000004957000-memory.dmpFilesize
1.1MB
-
memory/1444-77-0x0000000004970000-0x0000000004A49000-memory.dmpFilesize
868KB
-
memory/1444-79-0x0000000004970000-0x0000000004A49000-memory.dmpFilesize
868KB
-
memory/1988-68-0x0000000000320000-0x0000000000330000-memory.dmpFilesize
64KB
-
memory/1988-65-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1988-67-0x00000000008E0000-0x0000000000BE3000-memory.dmpFilesize
3.0MB
-
memory/1988-66-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1988-63-0x00000000004012B0-mapping.dmp