Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03-03-2023 12:46
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230220-en
General
-
Target
tmp.exe
-
Size
259KB
-
MD5
4e8bee4ffcd91df4d0af5ad5809a5836
-
SHA1
f667fdda0388044884a7b98a9e25c79344e986ec
-
SHA256
fe69a7884252cb7f2728065d43e5143e1c6168b5800813154f70727a97f78fc2
-
SHA512
7d78d0fe3c3d761db9e79de77d2100d829f46b1c343e0fe0d59c2f6e30a41ed5ab3bbe6d154b01b71c1883a824f458865d0614fe40c3178963ef5ecfe079185b
-
SSDEEP
6144:/Ya6Wp9dAl3KJDohZfDxO9rItqosk+MMnrSQBQvfD+DnYTT14UPj7Q:/YopwlqM7D09stErqQKvfAnYTT1PY
Malware Config
Extracted
formbook
4.1
ho62
aqawonky.com
ancachsroadsideassistance.com
artologycreatlive.com
olesinfo.africa
lovebreatheandsleep.com
friendsofdragonsprings.com
homecomingmums.wiki
hg222.bet
precision-spares.co.uk
generalhospitaleu.africa
touchstone4x4.africa
dynamator.com
dental-implants-52531.com
efefear.buzz
bentonapp.net
89luxu.com
bridgesonelm.com
acesaigon.online
instantapprovals.loans
evuniverso.com
kasoraenterprises.com
instasteamer.com
granolei.com
iamavisioniar.site
beachexplo.com
ynametro.com
littlegallery-rovinj.com
27og.com
horrorcity.online
zexo.africa
perdeumane.com
drugsaddiction.co.uk
tickleyourfancy.africa
jimyhq.top
rajputnetwork.co.uk
lacuspidehn.com
bestxdenotecyby.top
gg10siyahposet.xyz
biorigin.co.uk
jye-group.com
digito.exposed
eternalstw.com
schjetne.dev
climateviking.com
easysaldoya.xyz
1233332.xyz
centerverified.online
lezzetyemekfabrikasi.com
wzshayang.com
cloudadonis.com
zxpz6.com
alifecube.com
induscontrolpcb.site
golfingineurope.com
ducksathomephotos.com
aimeesbellaboutique.com
justrebottle.com
hachettejeunesse.pro
238142.com
casabiancapanama.com
dohenydesalination.com
1-kh.com
cdhptor.xyz
island6.work
ehirtt.com
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3208-142-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3208-147-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2592-154-0x0000000000490000-0x00000000004BF000-memory.dmp formbook behavioral2/memory/2592-156-0x0000000000490000-0x00000000004BF000-memory.dmp formbook -
Executes dropped EXE 2 IoCs
Processes:
mgsbmh.exemgsbmh.exepid process 2060 mgsbmh.exe 3208 mgsbmh.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
mgsbmh.exemgsbmh.exeipconfig.exedescription pid process target process PID 2060 set thread context of 3208 2060 mgsbmh.exe mgsbmh.exe PID 3208 set thread context of 3136 3208 mgsbmh.exe Explorer.EXE PID 2592 set thread context of 3136 2592 ipconfig.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid process 2592 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 60 IoCs
Processes:
mgsbmh.exeipconfig.exepid process 3208 mgsbmh.exe 3208 mgsbmh.exe 3208 mgsbmh.exe 3208 mgsbmh.exe 2592 ipconfig.exe 2592 ipconfig.exe 2592 ipconfig.exe 2592 ipconfig.exe 2592 ipconfig.exe 2592 ipconfig.exe 2592 ipconfig.exe 2592 ipconfig.exe 2592 ipconfig.exe 2592 ipconfig.exe 2592 ipconfig.exe 2592 ipconfig.exe 2592 ipconfig.exe 2592 ipconfig.exe 2592 ipconfig.exe 2592 ipconfig.exe 2592 ipconfig.exe 2592 ipconfig.exe 2592 ipconfig.exe 2592 ipconfig.exe 2592 ipconfig.exe 2592 ipconfig.exe 2592 ipconfig.exe 2592 ipconfig.exe 2592 ipconfig.exe 2592 ipconfig.exe 2592 ipconfig.exe 2592 ipconfig.exe 2592 ipconfig.exe 2592 ipconfig.exe 2592 ipconfig.exe 2592 ipconfig.exe 2592 ipconfig.exe 2592 ipconfig.exe 2592 ipconfig.exe 2592 ipconfig.exe 2592 ipconfig.exe 2592 ipconfig.exe 2592 ipconfig.exe 2592 ipconfig.exe 2592 ipconfig.exe 2592 ipconfig.exe 2592 ipconfig.exe 2592 ipconfig.exe 2592 ipconfig.exe 2592 ipconfig.exe 2592 ipconfig.exe 2592 ipconfig.exe 2592 ipconfig.exe 2592 ipconfig.exe 2592 ipconfig.exe 2592 ipconfig.exe 2592 ipconfig.exe 2592 ipconfig.exe 2592 ipconfig.exe 2592 ipconfig.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3136 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
mgsbmh.exemgsbmh.exeipconfig.exepid process 2060 mgsbmh.exe 3208 mgsbmh.exe 3208 mgsbmh.exe 3208 mgsbmh.exe 2592 ipconfig.exe 2592 ipconfig.exe -
Suspicious use of AdjustPrivilegeToken 22 IoCs
Processes:
mgsbmh.exeipconfig.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 3208 mgsbmh.exe Token: SeDebugPrivilege 2592 ipconfig.exe Token: SeShutdownPrivilege 3136 Explorer.EXE Token: SeCreatePagefilePrivilege 3136 Explorer.EXE Token: SeShutdownPrivilege 3136 Explorer.EXE Token: SeCreatePagefilePrivilege 3136 Explorer.EXE Token: SeShutdownPrivilege 3136 Explorer.EXE Token: SeCreatePagefilePrivilege 3136 Explorer.EXE Token: SeShutdownPrivilege 3136 Explorer.EXE Token: SeCreatePagefilePrivilege 3136 Explorer.EXE Token: SeShutdownPrivilege 3136 Explorer.EXE Token: SeCreatePagefilePrivilege 3136 Explorer.EXE Token: SeShutdownPrivilege 3136 Explorer.EXE Token: SeCreatePagefilePrivilege 3136 Explorer.EXE Token: SeShutdownPrivilege 3136 Explorer.EXE Token: SeCreatePagefilePrivilege 3136 Explorer.EXE Token: SeShutdownPrivilege 3136 Explorer.EXE Token: SeCreatePagefilePrivilege 3136 Explorer.EXE Token: SeShutdownPrivilege 3136 Explorer.EXE Token: SeCreatePagefilePrivilege 3136 Explorer.EXE Token: SeShutdownPrivilege 3136 Explorer.EXE Token: SeCreatePagefilePrivilege 3136 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 3136 Explorer.EXE 3136 Explorer.EXE -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
tmp.exemgsbmh.exeExplorer.EXEipconfig.exedescription pid process target process PID 4832 wrote to memory of 2060 4832 tmp.exe mgsbmh.exe PID 4832 wrote to memory of 2060 4832 tmp.exe mgsbmh.exe PID 4832 wrote to memory of 2060 4832 tmp.exe mgsbmh.exe PID 2060 wrote to memory of 3208 2060 mgsbmh.exe mgsbmh.exe PID 2060 wrote to memory of 3208 2060 mgsbmh.exe mgsbmh.exe PID 2060 wrote to memory of 3208 2060 mgsbmh.exe mgsbmh.exe PID 2060 wrote to memory of 3208 2060 mgsbmh.exe mgsbmh.exe PID 3136 wrote to memory of 2592 3136 Explorer.EXE ipconfig.exe PID 3136 wrote to memory of 2592 3136 Explorer.EXE ipconfig.exe PID 3136 wrote to memory of 2592 3136 Explorer.EXE ipconfig.exe PID 2592 wrote to memory of 3308 2592 ipconfig.exe cmd.exe PID 2592 wrote to memory of 3308 2592 ipconfig.exe cmd.exe PID 2592 wrote to memory of 3308 2592 ipconfig.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\mgsbmh.exe"C:\Users\Admin\AppData\Local\Temp\mgsbmh.exe" C:\Users\Admin\AppData\Local\Temp\qzvvclg.hww3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\mgsbmh.exe"C:\Users\Admin\AppData\Local\Temp\mgsbmh.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\mgsbmh.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\mgsbmh.exeFilesize
51KB
MD5a0448488825d9ec069f14f096f7819bf
SHA1b4b134e05075042992ab43cfdf8d89cf7035ebae
SHA2560b3acb81b12210f2c6ed929a2ba1800c06faa781d65cbf03a00b35bd15bfb84b
SHA512e78d2528c80dda2bca9c96c6e1d929cefb11de1ead484946d7d170e918f07dc1113ae4ee0c8264f39ca2e872ef8ef931c55976f7e172267de8d30a042fd600ef
-
C:\Users\Admin\AppData\Local\Temp\mgsbmh.exeFilesize
51KB
MD5a0448488825d9ec069f14f096f7819bf
SHA1b4b134e05075042992ab43cfdf8d89cf7035ebae
SHA2560b3acb81b12210f2c6ed929a2ba1800c06faa781d65cbf03a00b35bd15bfb84b
SHA512e78d2528c80dda2bca9c96c6e1d929cefb11de1ead484946d7d170e918f07dc1113ae4ee0c8264f39ca2e872ef8ef931c55976f7e172267de8d30a042fd600ef
-
C:\Users\Admin\AppData\Local\Temp\mgsbmh.exeFilesize
51KB
MD5a0448488825d9ec069f14f096f7819bf
SHA1b4b134e05075042992ab43cfdf8d89cf7035ebae
SHA2560b3acb81b12210f2c6ed929a2ba1800c06faa781d65cbf03a00b35bd15bfb84b
SHA512e78d2528c80dda2bca9c96c6e1d929cefb11de1ead484946d7d170e918f07dc1113ae4ee0c8264f39ca2e872ef8ef931c55976f7e172267de8d30a042fd600ef
-
C:\Users\Admin\AppData\Local\Temp\olpkhizgs.adFilesize
205KB
MD5da93adf6273d48dc40849b0b0d763798
SHA1e04be861160e8c80d8246cf7762659d7545d31c1
SHA25608e22731cb15a03b218cc142c9aeb69b62159ea187f2491a7be8ca6cb558e32e
SHA512eee5a1defcd159158606523db0f98ab1101ca1ec0dfc8c1cfbb73f16a37011552fbb5da3389fd740b8d215fc87f1c4df433f2fa8a222c809dae4a062e1524db2
-
C:\Users\Admin\AppData\Local\Temp\qzvvclg.hwwFilesize
5KB
MD5911b087e7ba59d148ae81188bdbd70b1
SHA1964665215f8ccae6974e9e23baac2efa3cbbc587
SHA256cf80c63612e589e1fadc5405cdae4b1e34b7ffad4786afa7312308d7fd510a1d
SHA512cd3cb008c92d20e950f99e2a88a12ce776f4f8a5e59fe8094bf71eeca00c70ea8ae731efd6b37ceb5c6a9e26a2aa358ec7283e28fba1e4df7109b8326d32080f
-
memory/2060-140-0x00000000005D0000-0x00000000005D2000-memory.dmpFilesize
8KB
-
memory/2592-156-0x0000000000490000-0x00000000004BF000-memory.dmpFilesize
188KB
-
memory/2592-152-0x0000000000FA0000-0x0000000000FAB000-memory.dmpFilesize
44KB
-
memory/2592-153-0x0000000000FA0000-0x0000000000FAB000-memory.dmpFilesize
44KB
-
memory/2592-158-0x0000000000AC0000-0x0000000000B54000-memory.dmpFilesize
592KB
-
memory/2592-154-0x0000000000490000-0x00000000004BF000-memory.dmpFilesize
188KB
-
memory/2592-155-0x0000000000BD0000-0x0000000000F1A000-memory.dmpFilesize
3.3MB
-
memory/3136-182-0x0000000008BC0000-0x0000000008BD0000-memory.dmpFilesize
64KB
-
memory/3136-194-0x0000000008020000-0x0000000008030000-memory.dmpFilesize
64KB
-
memory/3136-159-0x00000000099D0000-0x0000000009B3A000-memory.dmpFilesize
1.4MB
-
memory/3136-160-0x00000000099D0000-0x0000000009B3A000-memory.dmpFilesize
1.4MB
-
memory/3136-161-0x0000000008020000-0x0000000008030000-memory.dmpFilesize
64KB
-
memory/3136-162-0x0000000008020000-0x0000000008030000-memory.dmpFilesize
64KB
-
memory/3136-163-0x0000000008020000-0x0000000008030000-memory.dmpFilesize
64KB
-
memory/3136-164-0x0000000008020000-0x0000000008030000-memory.dmpFilesize
64KB
-
memory/3136-166-0x0000000008020000-0x0000000008030000-memory.dmpFilesize
64KB
-
memory/3136-165-0x0000000008020000-0x0000000008030000-memory.dmpFilesize
64KB
-
memory/3136-167-0x0000000008020000-0x0000000008030000-memory.dmpFilesize
64KB
-
memory/3136-168-0x0000000008020000-0x0000000008030000-memory.dmpFilesize
64KB
-
memory/3136-169-0x0000000008020000-0x0000000008030000-memory.dmpFilesize
64KB
-
memory/3136-170-0x0000000008020000-0x0000000008030000-memory.dmpFilesize
64KB
-
memory/3136-171-0x0000000008020000-0x0000000008030000-memory.dmpFilesize
64KB
-
memory/3136-172-0x0000000008020000-0x0000000008030000-memory.dmpFilesize
64KB
-
memory/3136-173-0x0000000008020000-0x0000000008030000-memory.dmpFilesize
64KB
-
memory/3136-174-0x0000000008020000-0x0000000008030000-memory.dmpFilesize
64KB
-
memory/3136-175-0x0000000008020000-0x0000000008030000-memory.dmpFilesize
64KB
-
memory/3136-176-0x0000000008020000-0x0000000008030000-memory.dmpFilesize
64KB
-
memory/3136-177-0x0000000008BC0000-0x0000000008BD0000-memory.dmpFilesize
64KB
-
memory/3136-178-0x0000000008BC0000-0x0000000008BD0000-memory.dmpFilesize
64KB
-
memory/3136-180-0x00000000099D0000-0x0000000009B3A000-memory.dmpFilesize
1.4MB
-
memory/3136-181-0x0000000008BC0000-0x0000000008BD0000-memory.dmpFilesize
64KB
-
memory/3136-149-0x00000000090D0000-0x000000000924B000-memory.dmpFilesize
1.5MB
-
memory/3136-188-0x0000000008020000-0x0000000008030000-memory.dmpFilesize
64KB
-
memory/3136-189-0x0000000008020000-0x0000000008030000-memory.dmpFilesize
64KB
-
memory/3136-190-0x0000000008020000-0x0000000008030000-memory.dmpFilesize
64KB
-
memory/3136-191-0x0000000008020000-0x0000000008030000-memory.dmpFilesize
64KB
-
memory/3136-192-0x0000000008020000-0x0000000008030000-memory.dmpFilesize
64KB
-
memory/3136-193-0x0000000008020000-0x0000000008030000-memory.dmpFilesize
64KB
-
memory/3136-235-0x0000000003420000-0x0000000003430000-memory.dmpFilesize
64KB
-
memory/3136-195-0x0000000008020000-0x0000000008030000-memory.dmpFilesize
64KB
-
memory/3136-196-0x0000000008020000-0x0000000008030000-memory.dmpFilesize
64KB
-
memory/3136-197-0x0000000008020000-0x0000000008030000-memory.dmpFilesize
64KB
-
memory/3136-198-0x0000000008020000-0x0000000008030000-memory.dmpFilesize
64KB
-
memory/3136-199-0x0000000008020000-0x0000000008030000-memory.dmpFilesize
64KB
-
memory/3136-200-0x0000000008020000-0x0000000008030000-memory.dmpFilesize
64KB
-
memory/3136-201-0x0000000008020000-0x0000000008030000-memory.dmpFilesize
64KB
-
memory/3136-202-0x0000000008020000-0x0000000008030000-memory.dmpFilesize
64KB
-
memory/3136-203-0x0000000008020000-0x0000000008030000-memory.dmpFilesize
64KB
-
memory/3136-205-0x0000000003030000-0x0000000003040000-memory.dmpFilesize
64KB
-
memory/3136-206-0x0000000003030000-0x0000000003040000-memory.dmpFilesize
64KB
-
memory/3136-207-0x0000000003030000-0x0000000003040000-memory.dmpFilesize
64KB
-
memory/3136-209-0x0000000003030000-0x0000000003040000-memory.dmpFilesize
64KB
-
memory/3136-210-0x0000000003030000-0x0000000003040000-memory.dmpFilesize
64KB
-
memory/3136-211-0x0000000003030000-0x0000000003040000-memory.dmpFilesize
64KB
-
memory/3136-217-0x0000000008020000-0x0000000008030000-memory.dmpFilesize
64KB
-
memory/3136-218-0x0000000008020000-0x0000000008030000-memory.dmpFilesize
64KB
-
memory/3136-219-0x0000000008020000-0x0000000008030000-memory.dmpFilesize
64KB
-
memory/3136-220-0x0000000008020000-0x0000000008030000-memory.dmpFilesize
64KB
-
memory/3136-221-0x0000000008020000-0x0000000008030000-memory.dmpFilesize
64KB
-
memory/3136-222-0x0000000008020000-0x0000000008030000-memory.dmpFilesize
64KB
-
memory/3136-223-0x0000000008020000-0x0000000008030000-memory.dmpFilesize
64KB
-
memory/3136-224-0x0000000008020000-0x0000000008030000-memory.dmpFilesize
64KB
-
memory/3136-225-0x0000000008020000-0x0000000008030000-memory.dmpFilesize
64KB
-
memory/3136-226-0x0000000008020000-0x0000000008030000-memory.dmpFilesize
64KB
-
memory/3136-233-0x0000000003420000-0x0000000003430000-memory.dmpFilesize
64KB
-
memory/3136-234-0x0000000003420000-0x0000000003430000-memory.dmpFilesize
64KB
-
memory/3208-142-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3208-146-0x0000000000980000-0x0000000000CCA000-memory.dmpFilesize
3.3MB
-
memory/3208-148-0x0000000000EA0000-0x0000000000EB5000-memory.dmpFilesize
84KB
-
memory/3208-147-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB