Analysis
-
max time kernel
149s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
03-03-2023 12:46
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230220-en
General
-
Target
tmp.exe
-
Size
259KB
-
MD5
4e8bee4ffcd91df4d0af5ad5809a5836
-
SHA1
f667fdda0388044884a7b98a9e25c79344e986ec
-
SHA256
fe69a7884252cb7f2728065d43e5143e1c6168b5800813154f70727a97f78fc2
-
SHA512
7d78d0fe3c3d761db9e79de77d2100d829f46b1c343e0fe0d59c2f6e30a41ed5ab3bbe6d154b01b71c1883a824f458865d0614fe40c3178963ef5ecfe079185b
-
SSDEEP
6144:/Ya6Wp9dAl3KJDohZfDxO9rItqosk+MMnrSQBQvfD+DnYTT14UPj7Q:/YopwlqM7D09stErqQKvfAnYTT1PY
Malware Config
Extracted
formbook
4.1
ho62
aqawonky.com
ancachsroadsideassistance.com
artologycreatlive.com
olesinfo.africa
lovebreatheandsleep.com
friendsofdragonsprings.com
homecomingmums.wiki
hg222.bet
precision-spares.co.uk
generalhospitaleu.africa
touchstone4x4.africa
dynamator.com
dental-implants-52531.com
efefear.buzz
bentonapp.net
89luxu.com
bridgesonelm.com
acesaigon.online
instantapprovals.loans
evuniverso.com
kasoraenterprises.com
instasteamer.com
granolei.com
iamavisioniar.site
beachexplo.com
ynametro.com
littlegallery-rovinj.com
27og.com
horrorcity.online
zexo.africa
perdeumane.com
drugsaddiction.co.uk
tickleyourfancy.africa
jimyhq.top
rajputnetwork.co.uk
lacuspidehn.com
bestxdenotecyby.top
gg10siyahposet.xyz
biorigin.co.uk
jye-group.com
digito.exposed
eternalstw.com
schjetne.dev
climateviking.com
easysaldoya.xyz
1233332.xyz
centerverified.online
lezzetyemekfabrikasi.com
wzshayang.com
cloudadonis.com
zxpz6.com
alifecube.com
induscontrolpcb.site
golfingineurope.com
ducksathomephotos.com
aimeesbellaboutique.com
justrebottle.com
hachettejeunesse.pro
238142.com
casabiancapanama.com
dohenydesalination.com
1-kh.com
cdhptor.xyz
island6.work
ehirtt.com
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1648-68-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1648-73-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1112-83-0x0000000000090000-0x00000000000BF000-memory.dmp formbook behavioral1/memory/1112-85-0x0000000000090000-0x00000000000BF000-memory.dmp formbook -
Executes dropped EXE 2 IoCs
Processes:
mgsbmh.exemgsbmh.exepid process 1304 mgsbmh.exe 1648 mgsbmh.exe -
Loads dropped DLL 3 IoCs
Processes:
tmp.exemgsbmh.exepid process 1260 tmp.exe 1260 tmp.exe 1304 mgsbmh.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
mgsbmh.exemgsbmh.exemsiexec.exedescription pid process target process PID 1304 set thread context of 1648 1304 mgsbmh.exe mgsbmh.exe PID 1648 set thread context of 1240 1648 mgsbmh.exe Explorer.EXE PID 1112 set thread context of 1240 1112 msiexec.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
Processes:
mgsbmh.exemsiexec.exepid process 1648 mgsbmh.exe 1648 mgsbmh.exe 1112 msiexec.exe 1112 msiexec.exe 1112 msiexec.exe 1112 msiexec.exe 1112 msiexec.exe 1112 msiexec.exe 1112 msiexec.exe 1112 msiexec.exe 1112 msiexec.exe 1112 msiexec.exe 1112 msiexec.exe 1112 msiexec.exe 1112 msiexec.exe 1112 msiexec.exe 1112 msiexec.exe 1112 msiexec.exe 1112 msiexec.exe 1112 msiexec.exe 1112 msiexec.exe 1112 msiexec.exe 1112 msiexec.exe 1112 msiexec.exe 1112 msiexec.exe 1112 msiexec.exe 1112 msiexec.exe 1112 msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1240 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
mgsbmh.exemgsbmh.exemsiexec.exepid process 1304 mgsbmh.exe 1648 mgsbmh.exe 1648 mgsbmh.exe 1648 mgsbmh.exe 1112 msiexec.exe 1112 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
mgsbmh.exemsiexec.exedescription pid process Token: SeDebugPrivilege 1648 mgsbmh.exe Token: SeDebugPrivilege 1112 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1240 Explorer.EXE 1240 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1240 Explorer.EXE 1240 Explorer.EXE -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
tmp.exemgsbmh.exeExplorer.EXEmsiexec.exedescription pid process target process PID 1260 wrote to memory of 1304 1260 tmp.exe mgsbmh.exe PID 1260 wrote to memory of 1304 1260 tmp.exe mgsbmh.exe PID 1260 wrote to memory of 1304 1260 tmp.exe mgsbmh.exe PID 1260 wrote to memory of 1304 1260 tmp.exe mgsbmh.exe PID 1304 wrote to memory of 1648 1304 mgsbmh.exe mgsbmh.exe PID 1304 wrote to memory of 1648 1304 mgsbmh.exe mgsbmh.exe PID 1304 wrote to memory of 1648 1304 mgsbmh.exe mgsbmh.exe PID 1304 wrote to memory of 1648 1304 mgsbmh.exe mgsbmh.exe PID 1304 wrote to memory of 1648 1304 mgsbmh.exe mgsbmh.exe PID 1240 wrote to memory of 1112 1240 Explorer.EXE msiexec.exe PID 1240 wrote to memory of 1112 1240 Explorer.EXE msiexec.exe PID 1240 wrote to memory of 1112 1240 Explorer.EXE msiexec.exe PID 1240 wrote to memory of 1112 1240 Explorer.EXE msiexec.exe PID 1240 wrote to memory of 1112 1240 Explorer.EXE msiexec.exe PID 1240 wrote to memory of 1112 1240 Explorer.EXE msiexec.exe PID 1240 wrote to memory of 1112 1240 Explorer.EXE msiexec.exe PID 1112 wrote to memory of 1768 1112 msiexec.exe cmd.exe PID 1112 wrote to memory of 1768 1112 msiexec.exe cmd.exe PID 1112 wrote to memory of 1768 1112 msiexec.exe cmd.exe PID 1112 wrote to memory of 1768 1112 msiexec.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\mgsbmh.exe"C:\Users\Admin\AppData\Local\Temp\mgsbmh.exe" C:\Users\Admin\AppData\Local\Temp\qzvvclg.hww3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\mgsbmh.exe"C:\Users\Admin\AppData\Local\Temp\mgsbmh.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1648 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\mgsbmh.exe"3⤵PID:1768
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\mgsbmh.exeFilesize
51KB
MD5a0448488825d9ec069f14f096f7819bf
SHA1b4b134e05075042992ab43cfdf8d89cf7035ebae
SHA2560b3acb81b12210f2c6ed929a2ba1800c06faa781d65cbf03a00b35bd15bfb84b
SHA512e78d2528c80dda2bca9c96c6e1d929cefb11de1ead484946d7d170e918f07dc1113ae4ee0c8264f39ca2e872ef8ef931c55976f7e172267de8d30a042fd600ef
-
C:\Users\Admin\AppData\Local\Temp\mgsbmh.exeFilesize
51KB
MD5a0448488825d9ec069f14f096f7819bf
SHA1b4b134e05075042992ab43cfdf8d89cf7035ebae
SHA2560b3acb81b12210f2c6ed929a2ba1800c06faa781d65cbf03a00b35bd15bfb84b
SHA512e78d2528c80dda2bca9c96c6e1d929cefb11de1ead484946d7d170e918f07dc1113ae4ee0c8264f39ca2e872ef8ef931c55976f7e172267de8d30a042fd600ef
-
C:\Users\Admin\AppData\Local\Temp\mgsbmh.exeFilesize
51KB
MD5a0448488825d9ec069f14f096f7819bf
SHA1b4b134e05075042992ab43cfdf8d89cf7035ebae
SHA2560b3acb81b12210f2c6ed929a2ba1800c06faa781d65cbf03a00b35bd15bfb84b
SHA512e78d2528c80dda2bca9c96c6e1d929cefb11de1ead484946d7d170e918f07dc1113ae4ee0c8264f39ca2e872ef8ef931c55976f7e172267de8d30a042fd600ef
-
C:\Users\Admin\AppData\Local\Temp\mgsbmh.exeFilesize
51KB
MD5a0448488825d9ec069f14f096f7819bf
SHA1b4b134e05075042992ab43cfdf8d89cf7035ebae
SHA2560b3acb81b12210f2c6ed929a2ba1800c06faa781d65cbf03a00b35bd15bfb84b
SHA512e78d2528c80dda2bca9c96c6e1d929cefb11de1ead484946d7d170e918f07dc1113ae4ee0c8264f39ca2e872ef8ef931c55976f7e172267de8d30a042fd600ef
-
C:\Users\Admin\AppData\Local\Temp\olpkhizgs.adFilesize
205KB
MD5da93adf6273d48dc40849b0b0d763798
SHA1e04be861160e8c80d8246cf7762659d7545d31c1
SHA25608e22731cb15a03b218cc142c9aeb69b62159ea187f2491a7be8ca6cb558e32e
SHA512eee5a1defcd159158606523db0f98ab1101ca1ec0dfc8c1cfbb73f16a37011552fbb5da3389fd740b8d215fc87f1c4df433f2fa8a222c809dae4a062e1524db2
-
C:\Users\Admin\AppData\Local\Temp\qzvvclg.hwwFilesize
5KB
MD5911b087e7ba59d148ae81188bdbd70b1
SHA1964665215f8ccae6974e9e23baac2efa3cbbc587
SHA256cf80c63612e589e1fadc5405cdae4b1e34b7ffad4786afa7312308d7fd510a1d
SHA512cd3cb008c92d20e950f99e2a88a12ce776f4f8a5e59fe8094bf71eeca00c70ea8ae731efd6b37ceb5c6a9e26a2aa358ec7283e28fba1e4df7109b8326d32080f
-
\Users\Admin\AppData\Local\Temp\mgsbmh.exeFilesize
51KB
MD5a0448488825d9ec069f14f096f7819bf
SHA1b4b134e05075042992ab43cfdf8d89cf7035ebae
SHA2560b3acb81b12210f2c6ed929a2ba1800c06faa781d65cbf03a00b35bd15bfb84b
SHA512e78d2528c80dda2bca9c96c6e1d929cefb11de1ead484946d7d170e918f07dc1113ae4ee0c8264f39ca2e872ef8ef931c55976f7e172267de8d30a042fd600ef
-
\Users\Admin\AppData\Local\Temp\mgsbmh.exeFilesize
51KB
MD5a0448488825d9ec069f14f096f7819bf
SHA1b4b134e05075042992ab43cfdf8d89cf7035ebae
SHA2560b3acb81b12210f2c6ed929a2ba1800c06faa781d65cbf03a00b35bd15bfb84b
SHA512e78d2528c80dda2bca9c96c6e1d929cefb11de1ead484946d7d170e918f07dc1113ae4ee0c8264f39ca2e872ef8ef931c55976f7e172267de8d30a042fd600ef
-
\Users\Admin\AppData\Local\Temp\mgsbmh.exeFilesize
51KB
MD5a0448488825d9ec069f14f096f7819bf
SHA1b4b134e05075042992ab43cfdf8d89cf7035ebae
SHA2560b3acb81b12210f2c6ed929a2ba1800c06faa781d65cbf03a00b35bd15bfb84b
SHA512e78d2528c80dda2bca9c96c6e1d929cefb11de1ead484946d7d170e918f07dc1113ae4ee0c8264f39ca2e872ef8ef931c55976f7e172267de8d30a042fd600ef
-
memory/1112-83-0x0000000000090000-0x00000000000BF000-memory.dmpFilesize
188KB
-
memory/1112-77-0x0000000000C00000-0x0000000000C14000-memory.dmpFilesize
80KB
-
memory/1112-87-0x0000000000A80000-0x0000000000B14000-memory.dmpFilesize
592KB
-
memory/1112-85-0x0000000000090000-0x00000000000BF000-memory.dmpFilesize
188KB
-
memory/1112-84-0x00000000021B0000-0x00000000024B3000-memory.dmpFilesize
3.0MB
-
memory/1112-82-0x0000000000C00000-0x0000000000C14000-memory.dmpFilesize
80KB
-
memory/1112-80-0x0000000000C00000-0x0000000000C14000-memory.dmpFilesize
80KB
-
memory/1240-88-0x00000000049E0000-0x0000000004ACD000-memory.dmpFilesize
948KB
-
memory/1240-76-0x0000000007180000-0x00000000072E0000-memory.dmpFilesize
1.4MB
-
memory/1240-72-0x00000000039A0000-0x0000000003AA0000-memory.dmpFilesize
1024KB
-
memory/1240-89-0x00000000049E0000-0x0000000004ACD000-memory.dmpFilesize
948KB
-
memory/1240-92-0x00000000049E0000-0x0000000004ACD000-memory.dmpFilesize
948KB
-
memory/1240-97-0x000007FF6AC90000-0x000007FF6AC9A000-memory.dmpFilesize
40KB
-
memory/1648-68-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1648-75-0x0000000000470000-0x0000000000485000-memory.dmpFilesize
84KB
-
memory/1648-74-0x0000000000700000-0x0000000000A03000-memory.dmpFilesize
3.0MB
-
memory/1648-73-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB