Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
16-02-2023 21:47
Static task
static1
Behavioral task
behavioral1
Sample
new.exe
Resource
win10-20220812-en
Behavioral task
behavioral2
Sample
new.exe
Resource
win7-20221111-en
General
-
Target
new.exe
-
Size
432KB
-
MD5
e3a874c6e454d2591f5380be7aa4dff4
-
SHA1
3714bee104682ecc3867aa84f9b049d3b6d58639
-
SHA256
9e804f046cb3978daaa84fe71badb3a5fef3aea5387377e3b05524cbb8092a89
-
SHA512
6eb235dfcdb612b4db9926275e827e179166e3522256de14b51da3fb6610fe610c6547c7eb29ceb3b95eebb434c68d9bf000e7d1a14320853363e0dcd0c0f93e
-
SSDEEP
12288:TY74I2N2tpc73OFMf0aHFJOJYT8htu8GIS1r7L:TY7G2tW731zHnOJYmE8Fq3L
Malware Config
Extracted
formbook
4.1
ho62
aqawonky.com
ancachsroadsideassistance.com
artologycreatlive.com
olesinfo.africa
lovebreatheandsleep.com
friendsofdragonsprings.com
homecomingmums.wiki
hg222.bet
precision-spares.co.uk
generalhospitaleu.africa
touchstone4x4.africa
dynamator.com
dental-implants-52531.com
efefear.buzz
bentonapp.net
89luxu.com
bridgesonelm.com
acesaigon.online
instantapprovals.loans
evuniverso.com
kasoraenterprises.com
instasteamer.com
granolei.com
iamavisioniar.site
beachexplo.com
ynametro.com
littlegallery-rovinj.com
27og.com
horrorcity.online
zexo.africa
perdeumane.com
drugsaddiction.co.uk
tickleyourfancy.africa
jimyhq.top
rajputnetwork.co.uk
lacuspidehn.com
bestxdenotecyby.top
gg10siyahposet.xyz
biorigin.co.uk
jye-group.com
digito.exposed
eternalstw.com
schjetne.dev
climateviking.com
easysaldoya.xyz
1233332.xyz
centerverified.online
lezzetyemekfabrikasi.com
wzshayang.com
cloudadonis.com
zxpz6.com
alifecube.com
induscontrolpcb.site
golfingineurope.com
ducksathomephotos.com
aimeesbellaboutique.com
justrebottle.com
hachettejeunesse.pro
238142.com
casabiancapanama.com
dohenydesalination.com
1-kh.com
cdhptor.xyz
island6.work
ehirtt.com
Signatures
-
Formbook payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1476-65-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1496-72-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Executes dropped EXE 2 IoCs
Processes:
njxmhiqte.exenjxmhiqte.exepid process 1828 njxmhiqte.exe 1476 njxmhiqte.exe -
Loads dropped DLL 2 IoCs
Processes:
new.exenjxmhiqte.exepid process 1576 new.exe 1828 njxmhiqte.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
njxmhiqte.exenjxmhiqte.exewlanext.exedescription pid process target process PID 1828 set thread context of 1476 1828 njxmhiqte.exe njxmhiqte.exe PID 1476 set thread context of 1244 1476 njxmhiqte.exe Explorer.EXE PID 1496 set thread context of 1244 1496 wlanext.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
Processes:
njxmhiqte.exewlanext.exepid process 1476 njxmhiqte.exe 1476 njxmhiqte.exe 1496 wlanext.exe 1496 wlanext.exe 1496 wlanext.exe 1496 wlanext.exe 1496 wlanext.exe 1496 wlanext.exe 1496 wlanext.exe 1496 wlanext.exe 1496 wlanext.exe 1496 wlanext.exe 1496 wlanext.exe 1496 wlanext.exe 1496 wlanext.exe 1496 wlanext.exe 1496 wlanext.exe 1496 wlanext.exe 1496 wlanext.exe 1496 wlanext.exe 1496 wlanext.exe 1496 wlanext.exe 1496 wlanext.exe 1496 wlanext.exe 1496 wlanext.exe 1496 wlanext.exe 1496 wlanext.exe 1496 wlanext.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1244 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
njxmhiqte.exenjxmhiqte.exewlanext.exepid process 1828 njxmhiqte.exe 1476 njxmhiqte.exe 1476 njxmhiqte.exe 1476 njxmhiqte.exe 1496 wlanext.exe 1496 wlanext.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
njxmhiqte.exewlanext.exedescription pid process Token: SeDebugPrivilege 1476 njxmhiqte.exe Token: SeDebugPrivilege 1496 wlanext.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1244 Explorer.EXE 1244 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1244 Explorer.EXE 1244 Explorer.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
new.exenjxmhiqte.exeExplorer.EXEwlanext.exedescription pid process target process PID 1576 wrote to memory of 1828 1576 new.exe njxmhiqte.exe PID 1576 wrote to memory of 1828 1576 new.exe njxmhiqte.exe PID 1576 wrote to memory of 1828 1576 new.exe njxmhiqte.exe PID 1576 wrote to memory of 1828 1576 new.exe njxmhiqte.exe PID 1828 wrote to memory of 1476 1828 njxmhiqte.exe njxmhiqte.exe PID 1828 wrote to memory of 1476 1828 njxmhiqte.exe njxmhiqte.exe PID 1828 wrote to memory of 1476 1828 njxmhiqte.exe njxmhiqte.exe PID 1828 wrote to memory of 1476 1828 njxmhiqte.exe njxmhiqte.exe PID 1828 wrote to memory of 1476 1828 njxmhiqte.exe njxmhiqte.exe PID 1244 wrote to memory of 1496 1244 Explorer.EXE wlanext.exe PID 1244 wrote to memory of 1496 1244 Explorer.EXE wlanext.exe PID 1244 wrote to memory of 1496 1244 Explorer.EXE wlanext.exe PID 1244 wrote to memory of 1496 1244 Explorer.EXE wlanext.exe PID 1496 wrote to memory of 652 1496 wlanext.exe cmd.exe PID 1496 wrote to memory of 652 1496 wlanext.exe cmd.exe PID 1496 wrote to memory of 652 1496 wlanext.exe cmd.exe PID 1496 wrote to memory of 652 1496 wlanext.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\new.exe"C:\Users\Admin\AppData\Local\Temp\new.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\njxmhiqte.exe"C:\Users\Admin\AppData\Local\Temp\njxmhiqte.exe" C:\Users\Admin\AppData\Local\Temp\tjjnidhdl.x3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\njxmhiqte.exe"C:\Users\Admin\AppData\Local\Temp\njxmhiqte.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1476 -
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\njxmhiqte.exe"3⤵PID:652
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\aeqxmj.piaFilesize
205KB
MD5baec02094b35270a151460be6cd66e65
SHA17c26210d4c1c7f2add9a13164179649b3a3c9dbe
SHA256614efbff773c1b4425326ebc028ae76905a96bc9d59d76b33a1eff15fd0d8ad3
SHA5123d5b117d6658a414e4a674fb559d0a6b6d46436cef7df94bbbdec48b86d4a2a17eff3dcb90bfbac3b8e1b8cb3440aa10c063226b1793cf9faec98e599d3e5566
-
C:\Users\Admin\AppData\Local\Temp\njxmhiqte.exeFilesize
322KB
MD560ee2623954b697257bb49f0189d751a
SHA12598c631a24546a707cbc797dbe2772512f08b49
SHA25680ac0e1f3ce4e9512e6821849b0c9296b61adb17ed52632aebe6853b02599a1c
SHA512f0bb9279d81d2acc888b9991e68c338c86d1b1aafc760c32517c5738ff1766f22019b179b1e196ecb8eddceb6e8aa63dec663b08f49b69d0dad0e81f4a0e1459
-
C:\Users\Admin\AppData\Local\Temp\njxmhiqte.exeFilesize
322KB
MD560ee2623954b697257bb49f0189d751a
SHA12598c631a24546a707cbc797dbe2772512f08b49
SHA25680ac0e1f3ce4e9512e6821849b0c9296b61adb17ed52632aebe6853b02599a1c
SHA512f0bb9279d81d2acc888b9991e68c338c86d1b1aafc760c32517c5738ff1766f22019b179b1e196ecb8eddceb6e8aa63dec663b08f49b69d0dad0e81f4a0e1459
-
C:\Users\Admin\AppData\Local\Temp\njxmhiqte.exeFilesize
322KB
MD560ee2623954b697257bb49f0189d751a
SHA12598c631a24546a707cbc797dbe2772512f08b49
SHA25680ac0e1f3ce4e9512e6821849b0c9296b61adb17ed52632aebe6853b02599a1c
SHA512f0bb9279d81d2acc888b9991e68c338c86d1b1aafc760c32517c5738ff1766f22019b179b1e196ecb8eddceb6e8aa63dec663b08f49b69d0dad0e81f4a0e1459
-
C:\Users\Admin\AppData\Local\Temp\tjjnidhdl.xFilesize
5KB
MD522a3bb50bacb64d72699f4e7642d550d
SHA19ec311fd68910b475b95f5bc187dfb00a385d58d
SHA2565bfcbe087f6d1e836243ae8e69b6fe11dfc8ff434b70f90c7c64936db8512327
SHA5126360c9d4208a9de79996cdced4af9fe478f973c59b1318929a2b630dcd5dec9d0a9eb015a467533ab5d8318779eaf9ead4c750c120660342888ad0b85f45fd53
-
\Users\Admin\AppData\Local\Temp\njxmhiqte.exeFilesize
322KB
MD560ee2623954b697257bb49f0189d751a
SHA12598c631a24546a707cbc797dbe2772512f08b49
SHA25680ac0e1f3ce4e9512e6821849b0c9296b61adb17ed52632aebe6853b02599a1c
SHA512f0bb9279d81d2acc888b9991e68c338c86d1b1aafc760c32517c5738ff1766f22019b179b1e196ecb8eddceb6e8aa63dec663b08f49b69d0dad0e81f4a0e1459
-
\Users\Admin\AppData\Local\Temp\njxmhiqte.exeFilesize
322KB
MD560ee2623954b697257bb49f0189d751a
SHA12598c631a24546a707cbc797dbe2772512f08b49
SHA25680ac0e1f3ce4e9512e6821849b0c9296b61adb17ed52632aebe6853b02599a1c
SHA512f0bb9279d81d2acc888b9991e68c338c86d1b1aafc760c32517c5738ff1766f22019b179b1e196ecb8eddceb6e8aa63dec663b08f49b69d0dad0e81f4a0e1459
-
memory/652-70-0x0000000000000000-mapping.dmp
-
memory/1244-79-0x000007FF38AF0000-0x000007FF38AFA000-memory.dmpFilesize
40KB
-
memory/1244-78-0x000007FEF5E20000-0x000007FEF5F63000-memory.dmpFilesize
1.3MB
-
memory/1244-77-0x0000000004A10000-0x0000000004B04000-memory.dmpFilesize
976KB
-
memory/1244-76-0x0000000004B60000-0x0000000004C99000-memory.dmpFilesize
1.2MB
-
memory/1244-75-0x0000000004A10000-0x0000000004B04000-memory.dmpFilesize
976KB
-
memory/1244-68-0x0000000004B60000-0x0000000004C99000-memory.dmpFilesize
1.2MB
-
memory/1476-67-0x0000000000280000-0x0000000000295000-memory.dmpFilesize
84KB
-
memory/1476-65-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1476-66-0x00000000008F0000-0x0000000000BF3000-memory.dmpFilesize
3.0MB
-
memory/1476-63-0x000000000041F070-mapping.dmp
-
memory/1496-69-0x0000000000000000-mapping.dmp
-
memory/1496-71-0x0000000000DD0000-0x0000000000DE6000-memory.dmpFilesize
88KB
-
memory/1496-72-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/1496-73-0x0000000000AB0000-0x0000000000DB3000-memory.dmpFilesize
3.0MB
-
memory/1496-74-0x0000000000920000-0x00000000009B4000-memory.dmpFilesize
592KB
-
memory/1576-54-0x0000000075611000-0x0000000075613000-memory.dmpFilesize
8KB
-
memory/1828-56-0x0000000000000000-mapping.dmp