Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
10-03-2023 10:55
Static task
static1
Behavioral task
behavioral1
Sample
SCAN 000090499000045739.IMG.exe
Resource
win7-20230220-en
General
-
Target
SCAN 000090499000045739.IMG.exe
-
Size
1.1MB
-
MD5
912b66f6aeee60ff00e90b9d267529b3
-
SHA1
38cb4ce90e7e19bb42f3fb6d48e69d02db891ec1
-
SHA256
d5fe9ec3478dfc65a14ded1ca3e9ced361617a085ec6c3da1bd9b9cc0083511f
-
SHA512
0e58095cbe3a50103e1a76c3918c8c0f55d965df9fc4a2526ec0d8ac5c65ed9161c81c2fa9dfbae93ba5ec925b578bf52632fbc8a39126936912abfad1ddb80b
-
SSDEEP
24576:3uOZ6wGkB+e9uf8mSiEPQ3h5oPIpYAMYDkX94bMtP9DGfO:SYQ38+Y72O94bu9GO
Malware Config
Extracted
formbook
4.1
bpnw
subsc-music.com
spiffyd01.buzz
link2it.xyz
coenst.site
carltonautomatic.com
argbeauty.co.uk
tenantdfgg.click
mammothbechtelar.com
bekkarblogger.com
rheamoments.com
themagicofbedtime.com
berksbeaconnews.com
1stpagerealestate.com
ammarshoes.com
lv-newlife.com
travelnewsbuzz.com
promo-tv.fun
getfreedownload.online
al-istitmar.info
strataclleanenergy.com
furnishedcottage.com
bklcbd.com
oayara.com
rttranslate.com
hmmm.services
economycutslawnservice.com
coreinternationalbusiness.com
outpv.online
drinja-tirkiz.com
martline.website
osanala.com
tridentacquisition.info
thecoachhq.com
fawjianyu.com
innoinfinitesolutions.net
tamilnadumetal.com
spig.nu
cyberjam.live
southern-sniper.com
goldquick.club
foxhound-armory.com
ethype.xyz
itfckingmatters.info
drlaskovets.space
nhadat413.com
sjlh267.com
soulrichcollections.com
uiemvh.xyz
deafazagency.com
zenstel.com
thriftytrack.com
tuirctrapped.buzz
skestar.top
prilagatelnoe.makeup
discordserver.net
ypm8.top
wristlancer.com
davidleeproperty.co.uk
ryconascimentotelasfake.website
eldritchventures.net
china-opq.com
allayrival.net
ns9x.xyz
memorymakersottawa.com
casinospinwin.net
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4716-147-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4716-183-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1900-187-0x0000000000E00000-0x0000000000E2F000-memory.dmp formbook behavioral2/memory/1900-196-0x0000000000E00000-0x0000000000E2F000-memory.dmp formbook -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
SCAN 000090499000045739.IMG.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation SCAN 000090499000045739.IMG.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
SCAN 000090499000045739.IMG.exeSCAN 000090499000045739.IMG.execontrol.exedescription pid process target process PID 4656 set thread context of 4716 4656 SCAN 000090499000045739.IMG.exe SCAN 000090499000045739.IMG.exe PID 4716 set thread context of 3152 4716 SCAN 000090499000045739.IMG.exe Explorer.EXE PID 1900 set thread context of 3152 1900 control.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 46 IoCs
Processes:
powershell.exeSCAN 000090499000045739.IMG.execontrol.exepid process 4748 powershell.exe 4748 powershell.exe 4716 SCAN 000090499000045739.IMG.exe 4716 SCAN 000090499000045739.IMG.exe 4716 SCAN 000090499000045739.IMG.exe 4716 SCAN 000090499000045739.IMG.exe 1900 control.exe 1900 control.exe 1900 control.exe 1900 control.exe 1900 control.exe 1900 control.exe 1900 control.exe 1900 control.exe 1900 control.exe 1900 control.exe 1900 control.exe 1900 control.exe 1900 control.exe 1900 control.exe 1900 control.exe 1900 control.exe 1900 control.exe 1900 control.exe 1900 control.exe 1900 control.exe 1900 control.exe 1900 control.exe 1900 control.exe 1900 control.exe 1900 control.exe 1900 control.exe 1900 control.exe 1900 control.exe 1900 control.exe 1900 control.exe 1900 control.exe 1900 control.exe 1900 control.exe 1900 control.exe 1900 control.exe 1900 control.exe 1900 control.exe 1900 control.exe 1900 control.exe 1900 control.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3152 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
SCAN 000090499000045739.IMG.execontrol.exepid process 4716 SCAN 000090499000045739.IMG.exe 4716 SCAN 000090499000045739.IMG.exe 4716 SCAN 000090499000045739.IMG.exe 1900 control.exe 1900 control.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
Processes:
powershell.exeSCAN 000090499000045739.IMG.execontrol.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 4748 powershell.exe Token: SeDebugPrivilege 4716 SCAN 000090499000045739.IMG.exe Token: SeDebugPrivilege 1900 control.exe Token: SeShutdownPrivilege 3152 Explorer.EXE Token: SeCreatePagefilePrivilege 3152 Explorer.EXE Token: SeShutdownPrivilege 3152 Explorer.EXE Token: SeCreatePagefilePrivilege 3152 Explorer.EXE Token: SeShutdownPrivilege 3152 Explorer.EXE Token: SeCreatePagefilePrivilege 3152 Explorer.EXE Token: SeShutdownPrivilege 3152 Explorer.EXE Token: SeCreatePagefilePrivilege 3152 Explorer.EXE Token: SeShutdownPrivilege 3152 Explorer.EXE Token: SeCreatePagefilePrivilege 3152 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
SCAN 000090499000045739.IMG.exeExplorer.EXEcontrol.exedescription pid process target process PID 4656 wrote to memory of 4748 4656 SCAN 000090499000045739.IMG.exe powershell.exe PID 4656 wrote to memory of 4748 4656 SCAN 000090499000045739.IMG.exe powershell.exe PID 4656 wrote to memory of 4748 4656 SCAN 000090499000045739.IMG.exe powershell.exe PID 4656 wrote to memory of 3568 4656 SCAN 000090499000045739.IMG.exe schtasks.exe PID 4656 wrote to memory of 3568 4656 SCAN 000090499000045739.IMG.exe schtasks.exe PID 4656 wrote to memory of 3568 4656 SCAN 000090499000045739.IMG.exe schtasks.exe PID 4656 wrote to memory of 4716 4656 SCAN 000090499000045739.IMG.exe SCAN 000090499000045739.IMG.exe PID 4656 wrote to memory of 4716 4656 SCAN 000090499000045739.IMG.exe SCAN 000090499000045739.IMG.exe PID 4656 wrote to memory of 4716 4656 SCAN 000090499000045739.IMG.exe SCAN 000090499000045739.IMG.exe PID 4656 wrote to memory of 4716 4656 SCAN 000090499000045739.IMG.exe SCAN 000090499000045739.IMG.exe PID 4656 wrote to memory of 4716 4656 SCAN 000090499000045739.IMG.exe SCAN 000090499000045739.IMG.exe PID 4656 wrote to memory of 4716 4656 SCAN 000090499000045739.IMG.exe SCAN 000090499000045739.IMG.exe PID 3152 wrote to memory of 1900 3152 Explorer.EXE control.exe PID 3152 wrote to memory of 1900 3152 Explorer.EXE control.exe PID 3152 wrote to memory of 1900 3152 Explorer.EXE control.exe PID 1900 wrote to memory of 4836 1900 control.exe cmd.exe PID 1900 wrote to memory of 4836 1900 control.exe cmd.exe PID 1900 wrote to memory of 4836 1900 control.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SCAN 000090499000045739.IMG.exe"C:\Users\Admin\AppData\Local\Temp\SCAN 000090499000045739.IMG.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\lSKfiPQsNNpnoZ.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lSKfiPQsNNpnoZ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp539E.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\SCAN 000090499000045739.IMG.exe"C:\Users\Admin\AppData\Local\Temp\SCAN 000090499000045739.IMG.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\SCAN 000090499000045739.IMG.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rb2r5aoe.s0s.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmp539E.tmpFilesize
1KB
MD59b6dc0033a5924d08a0f0ac2aeaa4650
SHA144c5c1f68d6fbdfd829b3800a47e847854c02278
SHA256dc5c6bbaa5337ab3f2f485e3d19ec99f7c38eda0dd7fe840e0a7407f1236ec99
SHA5125d67c9354905339b51bfe8b65ef4aeaaf667816c121dcf4798faaf28ab8b7573c93d18cdd552e9d91092e6e4eb5878325941f796abb938fe507a7ff217e35a2f
-
memory/1900-198-0x0000000002FE0000-0x0000000003073000-memory.dmpFilesize
588KB
-
memory/1900-196-0x0000000000E00000-0x0000000000E2F000-memory.dmpFilesize
188KB
-
memory/1900-190-0x0000000002C90000-0x0000000002FDA000-memory.dmpFilesize
3.3MB
-
memory/1900-187-0x0000000000E00000-0x0000000000E2F000-memory.dmpFilesize
188KB
-
memory/1900-185-0x0000000000B60000-0x0000000000B87000-memory.dmpFilesize
156KB
-
memory/1900-184-0x0000000000B60000-0x0000000000B87000-memory.dmpFilesize
156KB
-
memory/3152-221-0x0000000002EE0000-0x0000000002EF0000-memory.dmpFilesize
64KB
-
memory/3152-225-0x0000000003350000-0x0000000003360000-memory.dmpFilesize
64KB
-
memory/3152-250-0x0000000001490000-0x00000000014A0000-memory.dmpFilesize
64KB
-
memory/3152-249-0x0000000001490000-0x00000000014A0000-memory.dmpFilesize
64KB
-
memory/3152-248-0x0000000001490000-0x00000000014A0000-memory.dmpFilesize
64KB
-
memory/3152-206-0x0000000002EE0000-0x0000000002EF0000-memory.dmpFilesize
64KB
-
memory/3152-246-0x0000000002EE0000-0x0000000002EF0000-memory.dmpFilesize
64KB
-
memory/3152-245-0x0000000002EE0000-0x0000000002EF0000-memory.dmpFilesize
64KB
-
memory/3152-244-0x0000000002EE0000-0x0000000002EF0000-memory.dmpFilesize
64KB
-
memory/3152-243-0x0000000002EE0000-0x0000000002EF0000-memory.dmpFilesize
64KB
-
memory/3152-242-0x0000000002EE0000-0x0000000002EF0000-memory.dmpFilesize
64KB
-
memory/3152-241-0x0000000002EE0000-0x0000000002EF0000-memory.dmpFilesize
64KB
-
memory/3152-167-0x0000000009240000-0x00000000093CF000-memory.dmpFilesize
1.6MB
-
memory/3152-240-0x0000000002EE0000-0x0000000002EF0000-memory.dmpFilesize
64KB
-
memory/3152-239-0x0000000002EE0000-0x0000000002EF0000-memory.dmpFilesize
64KB
-
memory/3152-205-0x0000000002EE0000-0x0000000002EF0000-memory.dmpFilesize
64KB
-
memory/3152-238-0x0000000002EE0000-0x0000000002EF0000-memory.dmpFilesize
64KB
-
memory/3152-235-0x0000000002EE0000-0x0000000002EF0000-memory.dmpFilesize
64KB
-
memory/3152-236-0x0000000002EE0000-0x0000000002EF0000-memory.dmpFilesize
64KB
-
memory/3152-237-0x0000000002EE0000-0x0000000002EF0000-memory.dmpFilesize
64KB
-
memory/3152-234-0x0000000002EE0000-0x0000000002EF0000-memory.dmpFilesize
64KB
-
memory/3152-233-0x0000000002EE0000-0x0000000002EF0000-memory.dmpFilesize
64KB
-
memory/3152-232-0x0000000002EE0000-0x0000000002EF0000-memory.dmpFilesize
64KB
-
memory/3152-224-0x0000000003350000-0x0000000003360000-memory.dmpFilesize
64KB
-
memory/3152-223-0x0000000003340000-0x0000000003342000-memory.dmpFilesize
8KB
-
memory/3152-220-0x0000000002EE0000-0x0000000002EF0000-memory.dmpFilesize
64KB
-
memory/3152-217-0x0000000003350000-0x0000000003360000-memory.dmpFilesize
64KB
-
memory/3152-207-0x0000000002EE0000-0x0000000002EF0000-memory.dmpFilesize
64KB
-
memory/3152-218-0x0000000002EE0000-0x0000000002EF0000-memory.dmpFilesize
64KB
-
memory/3152-215-0x0000000003340000-0x0000000003342000-memory.dmpFilesize
8KB
-
memory/3152-216-0x0000000002EE0000-0x0000000002EF0000-memory.dmpFilesize
64KB
-
memory/3152-214-0x0000000002EE0000-0x0000000002EF0000-memory.dmpFilesize
64KB
-
memory/3152-199-0x0000000008DA0000-0x0000000008EBC000-memory.dmpFilesize
1.1MB
-
memory/3152-200-0x0000000008DA0000-0x0000000008EBC000-memory.dmpFilesize
1.1MB
-
memory/3152-203-0x0000000002EE0000-0x0000000002EF0000-memory.dmpFilesize
64KB
-
memory/3152-204-0x0000000002EE0000-0x0000000002EF0000-memory.dmpFilesize
64KB
-
memory/3152-213-0x0000000002EE0000-0x0000000002EF0000-memory.dmpFilesize
64KB
-
memory/3152-247-0x0000000002EE0000-0x0000000002EF0000-memory.dmpFilesize
64KB
-
memory/3152-219-0x0000000003350000-0x0000000003360000-memory.dmpFilesize
64KB
-
memory/3152-208-0x0000000002EE0000-0x0000000002EF0000-memory.dmpFilesize
64KB
-
memory/3152-209-0x0000000002EE0000-0x0000000002EF0000-memory.dmpFilesize
64KB
-
memory/3152-210-0x0000000002EE0000-0x0000000002EF0000-memory.dmpFilesize
64KB
-
memory/3152-211-0x0000000002EE0000-0x0000000002EF0000-memory.dmpFilesize
64KB
-
memory/3152-212-0x0000000002EE0000-0x0000000002EF0000-memory.dmpFilesize
64KB
-
memory/4656-134-0x0000000005710000-0x0000000005CB4000-memory.dmpFilesize
5.6MB
-
memory/4656-135-0x0000000005160000-0x00000000051F2000-memory.dmpFilesize
584KB
-
memory/4656-138-0x0000000005120000-0x0000000005130000-memory.dmpFilesize
64KB
-
memory/4656-139-0x0000000006DA0000-0x0000000006E3C000-memory.dmpFilesize
624KB
-
memory/4656-136-0x0000000005210000-0x000000000521A000-memory.dmpFilesize
40KB
-
memory/4656-133-0x0000000000680000-0x000000000079C000-memory.dmpFilesize
1.1MB
-
memory/4656-137-0x0000000005120000-0x0000000005130000-memory.dmpFilesize
64KB
-
memory/4716-147-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4716-183-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4716-165-0x0000000001310000-0x000000000165A000-memory.dmpFilesize
3.3MB
-
memory/4716-166-0x0000000001210000-0x0000000001224000-memory.dmpFilesize
80KB
-
memory/4748-189-0x0000000007900000-0x0000000007996000-memory.dmpFilesize
600KB
-
memory/4748-168-0x0000000004EA0000-0x0000000004EB0000-memory.dmpFilesize
64KB
-
memory/4748-146-0x00000000054E0000-0x0000000005B08000-memory.dmpFilesize
6.2MB
-
memory/4748-150-0x0000000005C80000-0x0000000005CE6000-memory.dmpFilesize
408KB
-
memory/4748-191-0x00000000078B0000-0x00000000078BE000-memory.dmpFilesize
56KB
-
memory/4748-182-0x0000000007680000-0x000000000769A000-memory.dmpFilesize
104KB
-
memory/4748-181-0x0000000007CC0000-0x000000000833A000-memory.dmpFilesize
6.5MB
-
memory/4748-180-0x0000000006920000-0x000000000693E000-memory.dmpFilesize
120KB
-
memory/4748-169-0x0000000006940000-0x0000000006972000-memory.dmpFilesize
200KB
-
memory/4748-186-0x00000000076F0000-0x00000000076FA000-memory.dmpFilesize
40KB
-
memory/4748-188-0x000000007F2E0000-0x000000007F2F0000-memory.dmpFilesize
64KB
-
memory/4748-170-0x0000000071180000-0x00000000711CC000-memory.dmpFilesize
304KB
-
memory/4748-163-0x0000000006360000-0x000000000637E000-memory.dmpFilesize
120KB
-
memory/4748-161-0x0000000004EA0000-0x0000000004EB0000-memory.dmpFilesize
64KB
-
memory/4748-162-0x0000000004EA0000-0x0000000004EB0000-memory.dmpFilesize
64KB
-
memory/4748-156-0x0000000005D60000-0x0000000005DC6000-memory.dmpFilesize
408KB
-
memory/4748-144-0x0000000004DB0000-0x0000000004DE6000-memory.dmpFilesize
216KB
-
memory/4748-192-0x00000000079C0000-0x00000000079DA000-memory.dmpFilesize
104KB
-
memory/4748-149-0x00000000053B0000-0x00000000053D2000-memory.dmpFilesize
136KB
-
memory/4748-193-0x00000000079A0000-0x00000000079A8000-memory.dmpFilesize
32KB