Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
10-01-2023 11:23
Static task
static1
Behavioral task
behavioral1
Sample
862c17b77ece5eb013bbe5ced057f1a635a80d4a21c43356aed77e19fadcc0e3.exe
Resource
win7-20220812-en
General
-
Target
862c17b77ece5eb013bbe5ced057f1a635a80d4a21c43356aed77e19fadcc0e3.exe
-
Size
799KB
-
MD5
dfde7866b2de880f117836aa8d5b8adc
-
SHA1
66006bb4a7d2a35841bfea14abf1536b20f7a974
-
SHA256
862c17b77ece5eb013bbe5ced057f1a635a80d4a21c43356aed77e19fadcc0e3
-
SHA512
499f08d5830a9c55c1a3526f54d24247eb16a27145a438496dc7b42698dbb89ae8f1b2773609b2a928ec0843e4bb95778500f9fb97f4b62a2aafa31dadf9d9a6
-
SSDEEP
12288:OGlaKpWkdJ9pQ15Hzj4WlhjWPPvCLyZ+RvugSrmhktjxGty20qTszOFk:XlppWw9pC4pPPpkR0ymtjxUBYz0k
Malware Config
Extracted
formbook
m9ae
nWTQpX6TYm6dfT3Lcw==
7JaBLgMm8EKn2AlTy5Ksj4Jq
yWRJIhE3viQgqEpZS3o=
ES9dFo0bytF8vlvRcg==
aX/aBZn29pD+cg==
lU64sYOZV7ZVpUy1ag==
9BpOCYAPv8L8TyIFAiTp2PSqLg==
uEJ2RyQ1BcBXfFr8kT5Z1KV0
oVM42Ury9pD+cg==
0Zl3VkcuKaY+
OjZeGI8dw67Z6eWtnOoBfoI=
ytwFn9j4i+N8nKYRSgcfh3xn5LU=
xMb1+YkOyxmbxJ53JsP7Pg==
HODQpzTBS1gVoi4X0hStKQ==
fQ417ycwD+ziKt1u0hStKQ==
nsApOqE62sA8uS735uCXVP+YcrQ=
4aobG3oZ3AHqTPs=
P2LEwJatZbQZUTayTW0=
/bopO7NR6clCfT3Lcw==
bBxRRkFY01R+20pZS3o=
enylSY//R0Euo5Hc
s3hoHGn+blzIzLD2XcWsj4Jq
MvZlcWyHEnNHRGHB
qDJgM38Zlp2BriDZBnI=
JlaRDbpPJo43fT3Lcw==
aZgM/YERpLJOfT3Lcw==
dgcdTgcuKaY+
N12TQ5X0uI7/dA==
85d5Cn4gEuXNHOY=
XGyjNRUvzkzpFEb98NiZYf+YcrQ=
nUc1kamtJHlHRGHB
M+1WZ6NvT6VHRGHB
k1iSQqU6E3biHW3Ev1x/
yoeZZ9suKaY+
yiqErKzdOA==
I8FYQ4Mx9pD+cg==
e3sMggibmaRHRGHB
YBxPTjVYD4c2WVRYdfxP9f/w5W+IU0g=
A6GFXmNsA4y3ByPuEXU=
RkSck9R+79lCe5vEv1x/
c4Hf8OWx18LuWN4pPnA=
IK6UOZcpvKTL2/PbBHI=
dpbLY0FV8mxHRGHB
RoTt48Dgi/aZtJ/Ev1x/
4/FRPhpH3TPGD0uYB7Yf2PSqLg==
5A5CBZYyzanG52lgk7V7K8G4gdDu5w==
p8IpCMzdxqyj2UpZS3o=
cToa+3QRpLJOfT3Lcw==
Lat9/Yk19pD+cg==
CrjklYWQN6tXfIjEv1x/
SfQyB+TxpJSt20pZS3o=
eTEdrAOeVYJ4Cx6WSxqnYGgz01Yv7w==
NP7rnOJz7QXxQfk=
hrYdLa1V+exp20UX0hStKQ==
R+gl+MvhTQHqTPs=
CC6YqK+3hWJYpEseExvt2PSqLg==
VmybWD1f6EIreDUVP47Yw5la3rI=
Sgv5moChVKcQSZYjwYWyvbeuMw==
rtxt7QYo5mxHRGHB
cH/l/4Ecn61OfT3Lcw==
T4iddmuQEGhd1NwMviZm
cyH/sQGRb8s6e5vEv1x/
Y3DL3M3XS86ftJ7Ev1x/
U2jGyqnCYcDDJt3mAjZDxf+YcrQ=
spirituallyzen.com
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
rsphjnyos.exersphjnyos.exepid process 4088 rsphjnyos.exe 1804 rsphjnyos.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
rsphjnyos.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation rsphjnyos.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
rsphjnyos.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\eoruthnaadeju = "C:\\Users\\Admin\\AppData\\Roaming\\jtcpo\\ckdijf.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\rsphjnyos.exe\" \"C:\\Users\\Admin\\AppData\\Local\\Te" rsphjnyos.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
rsphjnyos.exersphjnyos.exeWWAHost.exedescription pid process target process PID 4088 set thread context of 1804 4088 rsphjnyos.exe rsphjnyos.exe PID 1804 set thread context of 2484 1804 rsphjnyos.exe Explorer.EXE PID 2736 set thread context of 2484 2736 WWAHost.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
WWAHost.exedescription ioc process Key created \Registry\User\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 WWAHost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
rsphjnyos.exeWWAHost.exepid process 1804 rsphjnyos.exe 1804 rsphjnyos.exe 1804 rsphjnyos.exe 1804 rsphjnyos.exe 1804 rsphjnyos.exe 1804 rsphjnyos.exe 1804 rsphjnyos.exe 1804 rsphjnyos.exe 2736 WWAHost.exe 2736 WWAHost.exe 2736 WWAHost.exe 2736 WWAHost.exe 2736 WWAHost.exe 2736 WWAHost.exe 2736 WWAHost.exe 2736 WWAHost.exe 2736 WWAHost.exe 2736 WWAHost.exe 2736 WWAHost.exe 2736 WWAHost.exe 2736 WWAHost.exe 2736 WWAHost.exe 2736 WWAHost.exe 2736 WWAHost.exe 2736 WWAHost.exe 2736 WWAHost.exe 2736 WWAHost.exe 2736 WWAHost.exe 2736 WWAHost.exe 2736 WWAHost.exe 2736 WWAHost.exe 2736 WWAHost.exe 2736 WWAHost.exe 2736 WWAHost.exe 2736 WWAHost.exe 2736 WWAHost.exe 2736 WWAHost.exe 2736 WWAHost.exe 2736 WWAHost.exe 2736 WWAHost.exe 2736 WWAHost.exe 2736 WWAHost.exe 2736 WWAHost.exe 2736 WWAHost.exe 2736 WWAHost.exe 2736 WWAHost.exe 2736 WWAHost.exe 2736 WWAHost.exe 2736 WWAHost.exe 2736 WWAHost.exe 2736 WWAHost.exe 2736 WWAHost.exe 2736 WWAHost.exe 2736 WWAHost.exe 2736 WWAHost.exe 2736 WWAHost.exe 2736 WWAHost.exe 2736 WWAHost.exe 2736 WWAHost.exe 2736 WWAHost.exe 2736 WWAHost.exe 2736 WWAHost.exe 2736 WWAHost.exe 2736 WWAHost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2484 Explorer.EXE -
Suspicious behavior: MapViewOfSection 9 IoCs
Processes:
rsphjnyos.exersphjnyos.exeWWAHost.exepid process 4088 rsphjnyos.exe 4088 rsphjnyos.exe 1804 rsphjnyos.exe 1804 rsphjnyos.exe 1804 rsphjnyos.exe 2736 WWAHost.exe 2736 WWAHost.exe 2736 WWAHost.exe 2736 WWAHost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
rsphjnyos.exeWWAHost.exedescription pid process Token: SeDebugPrivilege 1804 rsphjnyos.exe Token: SeDebugPrivilege 2736 WWAHost.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
rsphjnyos.exepid process 4088 rsphjnyos.exe 4088 rsphjnyos.exe -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
rsphjnyos.exepid process 4088 rsphjnyos.exe 4088 rsphjnyos.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
862c17b77ece5eb013bbe5ced057f1a635a80d4a21c43356aed77e19fadcc0e3.exersphjnyos.exeExplorer.EXEWWAHost.exedescription pid process target process PID 4700 wrote to memory of 4088 4700 862c17b77ece5eb013bbe5ced057f1a635a80d4a21c43356aed77e19fadcc0e3.exe rsphjnyos.exe PID 4700 wrote to memory of 4088 4700 862c17b77ece5eb013bbe5ced057f1a635a80d4a21c43356aed77e19fadcc0e3.exe rsphjnyos.exe PID 4700 wrote to memory of 4088 4700 862c17b77ece5eb013bbe5ced057f1a635a80d4a21c43356aed77e19fadcc0e3.exe rsphjnyos.exe PID 4088 wrote to memory of 1804 4088 rsphjnyos.exe rsphjnyos.exe PID 4088 wrote to memory of 1804 4088 rsphjnyos.exe rsphjnyos.exe PID 4088 wrote to memory of 1804 4088 rsphjnyos.exe rsphjnyos.exe PID 4088 wrote to memory of 1804 4088 rsphjnyos.exe rsphjnyos.exe PID 2484 wrote to memory of 2736 2484 Explorer.EXE WWAHost.exe PID 2484 wrote to memory of 2736 2484 Explorer.EXE WWAHost.exe PID 2484 wrote to memory of 2736 2484 Explorer.EXE WWAHost.exe PID 2736 wrote to memory of 4268 2736 WWAHost.exe Firefox.exe PID 2736 wrote to memory of 4268 2736 WWAHost.exe Firefox.exe PID 2736 wrote to memory of 4268 2736 WWAHost.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\862c17b77ece5eb013bbe5ced057f1a635a80d4a21c43356aed77e19fadcc0e3.exe"C:\Users\Admin\AppData\Local\Temp\862c17b77ece5eb013bbe5ced057f1a635a80d4a21c43356aed77e19fadcc0e3.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rsphjnyos.exe"C:\Users\Admin\AppData\Local\Temp\rsphjnyos.exe" "C:\Users\Admin\AppData\Local\Temp\ruegnseq.au3"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rsphjnyos.exe"C:\Users\Admin\AppData\Local\Temp\rsphjnyos.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\WWAHost.exe"C:\Windows\SysWOW64\WWAHost.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\aomagrjhydq.zdFilesize
185KB
MD53080cac6a6b54539b068349098d18bca
SHA1b1b729e3f1f05a58322c60037c4a9b517119df07
SHA2561d95bc52ccb1fefbef0fd922ed362a89c9124ff54dd4b8e88f260b88b07931fe
SHA5121434959da256a74055a3be42884458b6cb261443a7bf75a85fd5acad9520076e5a8670d8bbf8929228398a3231f766af653786dad788c13154afd8de99bcc7b4
-
C:\Users\Admin\AppData\Local\Temp\rsphjnyos.exeFilesize
872KB
MD5c56b5f0201a3b3de53e561fe76912bfd
SHA12a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
-
C:\Users\Admin\AppData\Local\Temp\rsphjnyos.exeFilesize
872KB
MD5c56b5f0201a3b3de53e561fe76912bfd
SHA12a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
-
C:\Users\Admin\AppData\Local\Temp\rsphjnyos.exeFilesize
872KB
MD5c56b5f0201a3b3de53e561fe76912bfd
SHA12a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
-
C:\Users\Admin\AppData\Local\Temp\ruegnseq.au3Filesize
6KB
MD5933d6334c65c9c911cab800fee8d20d5
SHA17f737a264b4a32ea0415a2dffc4f885a2c01e45d
SHA2569a247631b0a296e0ace077af15a6362299b7b2043c97d00ae79bafb42f58f3bb
SHA512fad050e7283f766d88d5eea5609ee46121e9316a9f2f754eda48035e47ebc27fa5548b893432cf537d00c2568b026c858b09b4a962f55968a4e24f538bfe12bb
-
C:\Users\Admin\AppData\Local\Temp\wdvgqo.uFilesize
84KB
MD590107de2c92c5aae6b3d3aae5db5051d
SHA18711975380ec1ab309e1f3d280d0648111b103d8
SHA256ff0121b718cdcc67dcd3dcc08c43a2578ceed445566d1d3e20a51ba4641b283d
SHA512a0180382b6e5ab61a5f86455695c5cbaf7307926a55bae01415de1b036c1fc53c1c8a06e4e27d5d0a036448c481a6e1b5fc02e3e5a4d6b5e82f424483d2d68d0
-
memory/1804-141-0x0000000001400000-0x000000000174A000-memory.dmpFilesize
3.3MB
-
memory/1804-140-0x0000000000AA0000-0x0000000000ACF000-memory.dmpFilesize
188KB
-
memory/1804-143-0x0000000000AC2000-0x0000000000AC4000-memory.dmpFilesize
8KB
-
memory/1804-144-0x0000000000C70000-0x0000000000C80000-memory.dmpFilesize
64KB
-
memory/1804-146-0x0000000000AA0000-0x0000000000ACF000-memory.dmpFilesize
188KB
-
memory/1804-138-0x0000000000000000-mapping.dmp
-
memory/2484-151-0x0000000008230000-0x0000000008324000-memory.dmpFilesize
976KB
-
memory/2484-142-0x0000000008840000-0x00000000089CD000-memory.dmpFilesize
1.6MB
-
memory/2484-154-0x0000000008230000-0x0000000008324000-memory.dmpFilesize
976KB
-
memory/2484-152-0x0000000008840000-0x00000000089CD000-memory.dmpFilesize
1.6MB
-
memory/2736-147-0x0000000000D00000-0x0000000000DDC000-memory.dmpFilesize
880KB
-
memory/2736-149-0x0000000001F30000-0x000000000227A000-memory.dmpFilesize
3.3MB
-
memory/2736-148-0x0000000000CC0000-0x0000000000CED000-memory.dmpFilesize
180KB
-
memory/2736-150-0x0000000001DC0000-0x0000000001E4F000-memory.dmpFilesize
572KB
-
memory/2736-145-0x0000000000000000-mapping.dmp
-
memory/2736-153-0x0000000000CC0000-0x0000000000CED000-memory.dmpFilesize
180KB
-
memory/4088-132-0x0000000000000000-mapping.dmp