Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
01-03-2023 20:22
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230220-en
General
-
Target
tmp.exe
-
Size
259KB
-
MD5
4e8bee4ffcd91df4d0af5ad5809a5836
-
SHA1
f667fdda0388044884a7b98a9e25c79344e986ec
-
SHA256
fe69a7884252cb7f2728065d43e5143e1c6168b5800813154f70727a97f78fc2
-
SHA512
7d78d0fe3c3d761db9e79de77d2100d829f46b1c343e0fe0d59c2f6e30a41ed5ab3bbe6d154b01b71c1883a824f458865d0614fe40c3178963ef5ecfe079185b
-
SSDEEP
6144:/Ya6Wp9dAl3KJDohZfDxO9rItqosk+MMnrSQBQvfD+DnYTT14UPj7Q:/YopwlqM7D09stErqQKvfAnYTT1PY
Malware Config
Extracted
formbook
4.1
ho62
aqawonky.com
ancachsroadsideassistance.com
artologycreatlive.com
olesinfo.africa
lovebreatheandsleep.com
friendsofdragonsprings.com
homecomingmums.wiki
hg222.bet
precision-spares.co.uk
generalhospitaleu.africa
touchstone4x4.africa
dynamator.com
dental-implants-52531.com
efefear.buzz
bentonapp.net
89luxu.com
bridgesonelm.com
acesaigon.online
instantapprovals.loans
evuniverso.com
kasoraenterprises.com
instasteamer.com
granolei.com
iamavisioniar.site
beachexplo.com
ynametro.com
littlegallery-rovinj.com
27og.com
horrorcity.online
zexo.africa
perdeumane.com
drugsaddiction.co.uk
tickleyourfancy.africa
jimyhq.top
rajputnetwork.co.uk
lacuspidehn.com
bestxdenotecyby.top
gg10siyahposet.xyz
biorigin.co.uk
jye-group.com
digito.exposed
eternalstw.com
schjetne.dev
climateviking.com
easysaldoya.xyz
1233332.xyz
centerverified.online
lezzetyemekfabrikasi.com
wzshayang.com
cloudadonis.com
zxpz6.com
alifecube.com
induscontrolpcb.site
golfingineurope.com
ducksathomephotos.com
aimeesbellaboutique.com
justrebottle.com
hachettejeunesse.pro
238142.com
casabiancapanama.com
dohenydesalination.com
1-kh.com
cdhptor.xyz
island6.work
ehirtt.com
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/428-68-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/428-76-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/864-82-0x0000000000090000-0x00000000000BF000-memory.dmp formbook behavioral1/memory/864-84-0x0000000000090000-0x00000000000BF000-memory.dmp formbook -
Executes dropped EXE 2 IoCs
Processes:
mgsbmh.exemgsbmh.exepid process 2032 mgsbmh.exe 428 mgsbmh.exe -
Loads dropped DLL 3 IoCs
Processes:
tmp.exemgsbmh.exepid process 2028 tmp.exe 2028 tmp.exe 2032 mgsbmh.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
mgsbmh.exemgsbmh.exemsiexec.exedescription pid process target process PID 2032 set thread context of 428 2032 mgsbmh.exe mgsbmh.exe PID 428 set thread context of 1244 428 mgsbmh.exe Explorer.EXE PID 864 set thread context of 1244 864 msiexec.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
Processes:
mgsbmh.exemsiexec.exepid process 428 mgsbmh.exe 428 mgsbmh.exe 864 msiexec.exe 864 msiexec.exe 864 msiexec.exe 864 msiexec.exe 864 msiexec.exe 864 msiexec.exe 864 msiexec.exe 864 msiexec.exe 864 msiexec.exe 864 msiexec.exe 864 msiexec.exe 864 msiexec.exe 864 msiexec.exe 864 msiexec.exe 864 msiexec.exe 864 msiexec.exe 864 msiexec.exe 864 msiexec.exe 864 msiexec.exe 864 msiexec.exe 864 msiexec.exe 864 msiexec.exe 864 msiexec.exe 864 msiexec.exe 864 msiexec.exe 864 msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1244 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
mgsbmh.exemgsbmh.exemsiexec.exepid process 2032 mgsbmh.exe 428 mgsbmh.exe 428 mgsbmh.exe 428 mgsbmh.exe 864 msiexec.exe 864 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
mgsbmh.exemsiexec.exedescription pid process Token: SeDebugPrivilege 428 mgsbmh.exe Token: SeDebugPrivilege 864 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1244 Explorer.EXE 1244 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1244 Explorer.EXE 1244 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 1244 Explorer.EXE -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
tmp.exemgsbmh.exeExplorer.EXEmsiexec.exedescription pid process target process PID 2028 wrote to memory of 2032 2028 tmp.exe mgsbmh.exe PID 2028 wrote to memory of 2032 2028 tmp.exe mgsbmh.exe PID 2028 wrote to memory of 2032 2028 tmp.exe mgsbmh.exe PID 2028 wrote to memory of 2032 2028 tmp.exe mgsbmh.exe PID 2032 wrote to memory of 428 2032 mgsbmh.exe mgsbmh.exe PID 2032 wrote to memory of 428 2032 mgsbmh.exe mgsbmh.exe PID 2032 wrote to memory of 428 2032 mgsbmh.exe mgsbmh.exe PID 2032 wrote to memory of 428 2032 mgsbmh.exe mgsbmh.exe PID 2032 wrote to memory of 428 2032 mgsbmh.exe mgsbmh.exe PID 1244 wrote to memory of 864 1244 Explorer.EXE msiexec.exe PID 1244 wrote to memory of 864 1244 Explorer.EXE msiexec.exe PID 1244 wrote to memory of 864 1244 Explorer.EXE msiexec.exe PID 1244 wrote to memory of 864 1244 Explorer.EXE msiexec.exe PID 1244 wrote to memory of 864 1244 Explorer.EXE msiexec.exe PID 1244 wrote to memory of 864 1244 Explorer.EXE msiexec.exe PID 1244 wrote to memory of 864 1244 Explorer.EXE msiexec.exe PID 864 wrote to memory of 1828 864 msiexec.exe cmd.exe PID 864 wrote to memory of 1828 864 msiexec.exe cmd.exe PID 864 wrote to memory of 1828 864 msiexec.exe cmd.exe PID 864 wrote to memory of 1828 864 msiexec.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\mgsbmh.exe"C:\Users\Admin\AppData\Local\Temp\mgsbmh.exe" C:\Users\Admin\AppData\Local\Temp\qzvvclg.hww3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\mgsbmh.exe"C:\Users\Admin\AppData\Local\Temp\mgsbmh.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:428 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\mgsbmh.exe"3⤵PID:1828
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\mgsbmh.exeFilesize
51KB
MD5a0448488825d9ec069f14f096f7819bf
SHA1b4b134e05075042992ab43cfdf8d89cf7035ebae
SHA2560b3acb81b12210f2c6ed929a2ba1800c06faa781d65cbf03a00b35bd15bfb84b
SHA512e78d2528c80dda2bca9c96c6e1d929cefb11de1ead484946d7d170e918f07dc1113ae4ee0c8264f39ca2e872ef8ef931c55976f7e172267de8d30a042fd600ef
-
C:\Users\Admin\AppData\Local\Temp\mgsbmh.exeFilesize
51KB
MD5a0448488825d9ec069f14f096f7819bf
SHA1b4b134e05075042992ab43cfdf8d89cf7035ebae
SHA2560b3acb81b12210f2c6ed929a2ba1800c06faa781d65cbf03a00b35bd15bfb84b
SHA512e78d2528c80dda2bca9c96c6e1d929cefb11de1ead484946d7d170e918f07dc1113ae4ee0c8264f39ca2e872ef8ef931c55976f7e172267de8d30a042fd600ef
-
C:\Users\Admin\AppData\Local\Temp\mgsbmh.exeFilesize
51KB
MD5a0448488825d9ec069f14f096f7819bf
SHA1b4b134e05075042992ab43cfdf8d89cf7035ebae
SHA2560b3acb81b12210f2c6ed929a2ba1800c06faa781d65cbf03a00b35bd15bfb84b
SHA512e78d2528c80dda2bca9c96c6e1d929cefb11de1ead484946d7d170e918f07dc1113ae4ee0c8264f39ca2e872ef8ef931c55976f7e172267de8d30a042fd600ef
-
C:\Users\Admin\AppData\Local\Temp\mgsbmh.exeFilesize
51KB
MD5a0448488825d9ec069f14f096f7819bf
SHA1b4b134e05075042992ab43cfdf8d89cf7035ebae
SHA2560b3acb81b12210f2c6ed929a2ba1800c06faa781d65cbf03a00b35bd15bfb84b
SHA512e78d2528c80dda2bca9c96c6e1d929cefb11de1ead484946d7d170e918f07dc1113ae4ee0c8264f39ca2e872ef8ef931c55976f7e172267de8d30a042fd600ef
-
C:\Users\Admin\AppData\Local\Temp\olpkhizgs.adFilesize
205KB
MD5da93adf6273d48dc40849b0b0d763798
SHA1e04be861160e8c80d8246cf7762659d7545d31c1
SHA25608e22731cb15a03b218cc142c9aeb69b62159ea187f2491a7be8ca6cb558e32e
SHA512eee5a1defcd159158606523db0f98ab1101ca1ec0dfc8c1cfbb73f16a37011552fbb5da3389fd740b8d215fc87f1c4df433f2fa8a222c809dae4a062e1524db2
-
C:\Users\Admin\AppData\Local\Temp\qzvvclg.hwwFilesize
5KB
MD5911b087e7ba59d148ae81188bdbd70b1
SHA1964665215f8ccae6974e9e23baac2efa3cbbc587
SHA256cf80c63612e589e1fadc5405cdae4b1e34b7ffad4786afa7312308d7fd510a1d
SHA512cd3cb008c92d20e950f99e2a88a12ce776f4f8a5e59fe8094bf71eeca00c70ea8ae731efd6b37ceb5c6a9e26a2aa358ec7283e28fba1e4df7109b8326d32080f
-
\Users\Admin\AppData\Local\Temp\mgsbmh.exeFilesize
51KB
MD5a0448488825d9ec069f14f096f7819bf
SHA1b4b134e05075042992ab43cfdf8d89cf7035ebae
SHA2560b3acb81b12210f2c6ed929a2ba1800c06faa781d65cbf03a00b35bd15bfb84b
SHA512e78d2528c80dda2bca9c96c6e1d929cefb11de1ead484946d7d170e918f07dc1113ae4ee0c8264f39ca2e872ef8ef931c55976f7e172267de8d30a042fd600ef
-
\Users\Admin\AppData\Local\Temp\mgsbmh.exeFilesize
51KB
MD5a0448488825d9ec069f14f096f7819bf
SHA1b4b134e05075042992ab43cfdf8d89cf7035ebae
SHA2560b3acb81b12210f2c6ed929a2ba1800c06faa781d65cbf03a00b35bd15bfb84b
SHA512e78d2528c80dda2bca9c96c6e1d929cefb11de1ead484946d7d170e918f07dc1113ae4ee0c8264f39ca2e872ef8ef931c55976f7e172267de8d30a042fd600ef
-
\Users\Admin\AppData\Local\Temp\mgsbmh.exeFilesize
51KB
MD5a0448488825d9ec069f14f096f7819bf
SHA1b4b134e05075042992ab43cfdf8d89cf7035ebae
SHA2560b3acb81b12210f2c6ed929a2ba1800c06faa781d65cbf03a00b35bd15bfb84b
SHA512e78d2528c80dda2bca9c96c6e1d929cefb11de1ead484946d7d170e918f07dc1113ae4ee0c8264f39ca2e872ef8ef931c55976f7e172267de8d30a042fd600ef
-
memory/428-68-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/428-72-0x0000000000770000-0x0000000000A73000-memory.dmpFilesize
3.0MB
-
memory/428-74-0x00000000003D0000-0x00000000003E5000-memory.dmpFilesize
84KB
-
memory/428-76-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/864-82-0x0000000000090000-0x00000000000BF000-memory.dmpFilesize
188KB
-
memory/864-77-0x0000000000E20000-0x0000000000E34000-memory.dmpFilesize
80KB
-
memory/864-79-0x0000000000E20000-0x0000000000E34000-memory.dmpFilesize
80KB
-
memory/864-81-0x0000000000E20000-0x0000000000E34000-memory.dmpFilesize
80KB
-
memory/864-83-0x0000000002240000-0x0000000002543000-memory.dmpFilesize
3.0MB
-
memory/864-84-0x0000000000090000-0x00000000000BF000-memory.dmpFilesize
188KB
-
memory/864-87-0x0000000000C20000-0x0000000000CB4000-memory.dmpFilesize
592KB
-
memory/1244-75-0x0000000004A30000-0x0000000004B7F000-memory.dmpFilesize
1.3MB
-
memory/1244-86-0x00000000001B0000-0x00000000002B0000-memory.dmpFilesize
1024KB
-
memory/1244-88-0x0000000004C50000-0x0000000004D42000-memory.dmpFilesize
968KB
-
memory/1244-89-0x0000000004C50000-0x0000000004D42000-memory.dmpFilesize
968KB
-
memory/1244-91-0x0000000004C50000-0x0000000004D42000-memory.dmpFilesize
968KB