Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
15-12-2022 14:55
Static task
static1
Behavioral task
behavioral1
Sample
32398cba360318425a3f1ba57676cba07546d5419e4d5f041752273ea389da33.exe
Resource
win7-20220812-en
General
-
Target
32398cba360318425a3f1ba57676cba07546d5419e4d5f041752273ea389da33.exe
-
Size
213KB
-
MD5
ace23ae0a5524989a50081e0416cd06f
-
SHA1
d5ee9183be486bf153d7666ca4301e600ea06087
-
SHA256
32398cba360318425a3f1ba57676cba07546d5419e4d5f041752273ea389da33
-
SHA512
9ae64c7e067d123357887951cbb4e5dfa1876a4a8febb41f6e9065e9c0cf0aaf68f4c0a449fe89ec46d51a807c545609b005bdbe4efdc34128a1c1de2287ed4f
-
SSDEEP
6144:QBn17YpPP72F3ApRMkW5lYeXzYMXAkqs1ZOcABcqGKq:g7YpH1RepXACZGAN
Malware Config
Extracted
formbook
4.1
je14
innervisionbuildings.com
theenergysocialite.com
565548.com
panghr.com
onlyonesolutions.com
stjohnzone6.com
cnotes.rest
helfeb.online
xixi-s-inc.club
easilyentered.com
theshopx.store
mrclean-ac.com
miamibeachwateradventures.com
jpearce.co.uk
seseragi-bunkou.com
minimaddie.com
commbank-help-849c3.com
segohandelsonderneming.com
namthanhreal.com
fototerapi.online
your-download.com
klindt.one
sellerscourt.com
francoislambert.store
smokedoutvapes.co.uk
rundacg.com
flavors-and-spices-lyon.com
qifengsuo.com
sunnyislesgardens.com
tunneldutransit.com
restorecodes.website
blast4me.com
bingser.space
co-gpco.com
emporioaliwen.com
mr5g.com
abcp666.com
consulvip.net
sagaming168.info
zjpbhsuz.top
socal-labworx.com
arethaglennevents.com
rafiqsiregar.com
esgh2.com
veirdmusic.com
abzcc.xyz
8065yp.com
dronebazar.com
duetpbr.com
apartamentoslaencantada.com
digigold.info
homedecorsuppliers.com
duenorthrm.com
xmmdsy.com
ddstennessee.com
marmeluz.com
ragnallhess.com
methinelli.com
randomlymetheseer.com
magicgrowthproducts.com
shreejistudio.com
mattress-37684.com
yellyfishfilms.com
www1111cpw.com
tigermedlagroup.com
Signatures
-
Formbook payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1448-64-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/864-72-0x00000000000C0000-0x00000000000EF000-memory.dmp formbook behavioral1/memory/864-76-0x00000000000C0000-0x00000000000EF000-memory.dmp formbook -
Executes dropped EXE 2 IoCs
Processes:
vpxpxta.exevpxpxta.exepid process 804 vpxpxta.exe 1448 vpxpxta.exe -
Loads dropped DLL 2 IoCs
Processes:
32398cba360318425a3f1ba57676cba07546d5419e4d5f041752273ea389da33.exevpxpxta.exepid process 1280 32398cba360318425a3f1ba57676cba07546d5419e4d5f041752273ea389da33.exe 804 vpxpxta.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
vpxpxta.exevpxpxta.execontrol.exedescription pid process target process PID 804 set thread context of 1448 804 vpxpxta.exe vpxpxta.exe PID 1448 set thread context of 1372 1448 vpxpxta.exe Explorer.EXE PID 864 set thread context of 1372 864 control.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 27 IoCs
Processes:
vpxpxta.execontrol.exepid process 1448 vpxpxta.exe 1448 vpxpxta.exe 864 control.exe 864 control.exe 864 control.exe 864 control.exe 864 control.exe 864 control.exe 864 control.exe 864 control.exe 864 control.exe 864 control.exe 864 control.exe 864 control.exe 864 control.exe 864 control.exe 864 control.exe 864 control.exe 864 control.exe 864 control.exe 864 control.exe 864 control.exe 864 control.exe 864 control.exe 864 control.exe 864 control.exe 864 control.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
vpxpxta.exevpxpxta.execontrol.exepid process 804 vpxpxta.exe 1448 vpxpxta.exe 1448 vpxpxta.exe 1448 vpxpxta.exe 864 control.exe 864 control.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
vpxpxta.execontrol.exedescription pid process Token: SeDebugPrivilege 1448 vpxpxta.exe Token: SeDebugPrivilege 864 control.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1372 Explorer.EXE 1372 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1372 Explorer.EXE 1372 Explorer.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
32398cba360318425a3f1ba57676cba07546d5419e4d5f041752273ea389da33.exevpxpxta.exeExplorer.EXEcontrol.exedescription pid process target process PID 1280 wrote to memory of 804 1280 32398cba360318425a3f1ba57676cba07546d5419e4d5f041752273ea389da33.exe vpxpxta.exe PID 1280 wrote to memory of 804 1280 32398cba360318425a3f1ba57676cba07546d5419e4d5f041752273ea389da33.exe vpxpxta.exe PID 1280 wrote to memory of 804 1280 32398cba360318425a3f1ba57676cba07546d5419e4d5f041752273ea389da33.exe vpxpxta.exe PID 1280 wrote to memory of 804 1280 32398cba360318425a3f1ba57676cba07546d5419e4d5f041752273ea389da33.exe vpxpxta.exe PID 804 wrote to memory of 1448 804 vpxpxta.exe vpxpxta.exe PID 804 wrote to memory of 1448 804 vpxpxta.exe vpxpxta.exe PID 804 wrote to memory of 1448 804 vpxpxta.exe vpxpxta.exe PID 804 wrote to memory of 1448 804 vpxpxta.exe vpxpxta.exe PID 804 wrote to memory of 1448 804 vpxpxta.exe vpxpxta.exe PID 1372 wrote to memory of 864 1372 Explorer.EXE control.exe PID 1372 wrote to memory of 864 1372 Explorer.EXE control.exe PID 1372 wrote to memory of 864 1372 Explorer.EXE control.exe PID 1372 wrote to memory of 864 1372 Explorer.EXE control.exe PID 864 wrote to memory of 1136 864 control.exe cmd.exe PID 864 wrote to memory of 1136 864 control.exe cmd.exe PID 864 wrote to memory of 1136 864 control.exe cmd.exe PID 864 wrote to memory of 1136 864 control.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\32398cba360318425a3f1ba57676cba07546d5419e4d5f041752273ea389da33.exe"C:\Users\Admin\AppData\Local\Temp\32398cba360318425a3f1ba57676cba07546d5419e4d5f041752273ea389da33.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vpxpxta.exe"C:\Users\Admin\AppData\Local\Temp\vpxpxta.exe" C:\Users\Admin\AppData\Local\Temp\rdsdqatpbhs.z3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vpxpxta.exe"C:\Users\Admin\AppData\Local\Temp\vpxpxta.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\vpxpxta.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\gvffc.ytuFilesize
185KB
MD50259fde3e396b0abdf865d2227a3e1b6
SHA1d9d03d8050e968b192bb1fc112fe28d53df4bded
SHA256ca6c0d21f3ea9f6a8c67f0ba534ab394fd05b3ecfa6576428cea4ce42adb6861
SHA5128ba17292d2fb3a0324e49bd5c490c3a2139c7079290399709582131d26d061f1eaddb5c8e5363bf79797bf55e34f791b3c0c7eb64eb3756fc8bdd00e79c3dd9c
-
C:\Users\Admin\AppData\Local\Temp\rdsdqatpbhs.zFilesize
6KB
MD5b34b9ffd1150f121d29fcd48c89d7de4
SHA1fe76263983ef50bb1f46c44e3ee1d85c87cb56d9
SHA256ecc775d058ed2b1f6746748a3e28e3117188225e3c63766250e3b4287c6fe538
SHA512a820cf2892b3569af35477f2bd26d7e44121f165214ca9dec9de0d26e8831751f04e57d3409e9cdfb3dc81b1c2b21072b0c8a73caa4fa2a24fd53c324054e476
-
C:\Users\Admin\AppData\Local\Temp\vpxpxta.exeFilesize
12KB
MD5d5a51803072a4fc064ba840fa97b052c
SHA129b163435bb0e4d7e7532108af9fdf2d346ad204
SHA25652f984ff112c1b873209cacafecf5e774bb4100083a9049e741b93baaa63b75b
SHA512c9f15cefd8a002dbba8a1cf80299b227e82a867824346739521ca1d671908842f29aa837b8da01e7c42a11af39597a8969a055a0ef87076ca1dccfea82f8da73
-
C:\Users\Admin\AppData\Local\Temp\vpxpxta.exeFilesize
12KB
MD5d5a51803072a4fc064ba840fa97b052c
SHA129b163435bb0e4d7e7532108af9fdf2d346ad204
SHA25652f984ff112c1b873209cacafecf5e774bb4100083a9049e741b93baaa63b75b
SHA512c9f15cefd8a002dbba8a1cf80299b227e82a867824346739521ca1d671908842f29aa837b8da01e7c42a11af39597a8969a055a0ef87076ca1dccfea82f8da73
-
C:\Users\Admin\AppData\Local\Temp\vpxpxta.exeFilesize
12KB
MD5d5a51803072a4fc064ba840fa97b052c
SHA129b163435bb0e4d7e7532108af9fdf2d346ad204
SHA25652f984ff112c1b873209cacafecf5e774bb4100083a9049e741b93baaa63b75b
SHA512c9f15cefd8a002dbba8a1cf80299b227e82a867824346739521ca1d671908842f29aa837b8da01e7c42a11af39597a8969a055a0ef87076ca1dccfea82f8da73
-
\Users\Admin\AppData\Local\Temp\vpxpxta.exeFilesize
12KB
MD5d5a51803072a4fc064ba840fa97b052c
SHA129b163435bb0e4d7e7532108af9fdf2d346ad204
SHA25652f984ff112c1b873209cacafecf5e774bb4100083a9049e741b93baaa63b75b
SHA512c9f15cefd8a002dbba8a1cf80299b227e82a867824346739521ca1d671908842f29aa837b8da01e7c42a11af39597a8969a055a0ef87076ca1dccfea82f8da73
-
\Users\Admin\AppData\Local\Temp\vpxpxta.exeFilesize
12KB
MD5d5a51803072a4fc064ba840fa97b052c
SHA129b163435bb0e4d7e7532108af9fdf2d346ad204
SHA25652f984ff112c1b873209cacafecf5e774bb4100083a9049e741b93baaa63b75b
SHA512c9f15cefd8a002dbba8a1cf80299b227e82a867824346739521ca1d671908842f29aa837b8da01e7c42a11af39597a8969a055a0ef87076ca1dccfea82f8da73
-
memory/804-56-0x0000000000000000-mapping.dmp
-
memory/864-68-0x0000000000000000-mapping.dmp
-
memory/864-76-0x00000000000C0000-0x00000000000EF000-memory.dmpFilesize
188KB
-
memory/864-74-0x0000000001DA0000-0x0000000001E33000-memory.dmpFilesize
588KB
-
memory/864-73-0x0000000001F60000-0x0000000002263000-memory.dmpFilesize
3.0MB
-
memory/864-71-0x0000000000460000-0x000000000047F000-memory.dmpFilesize
124KB
-
memory/864-72-0x00000000000C0000-0x00000000000EF000-memory.dmpFilesize
188KB
-
memory/1136-70-0x0000000000000000-mapping.dmp
-
memory/1280-54-0x0000000075811000-0x0000000075813000-memory.dmpFilesize
8KB
-
memory/1372-67-0x00000000070D0000-0x000000000726C000-memory.dmpFilesize
1.6MB
-
memory/1372-75-0x00000000063F0000-0x00000000064D0000-memory.dmpFilesize
896KB
-
memory/1372-77-0x00000000063F0000-0x00000000064D0000-memory.dmpFilesize
896KB
-
memory/1448-66-0x0000000000150000-0x0000000000164000-memory.dmpFilesize
80KB
-
memory/1448-65-0x0000000000AE0000-0x0000000000DE3000-memory.dmpFilesize
3.0MB
-
memory/1448-64-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1448-62-0x000000000041F120-mapping.dmp