Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
21-03-2023 05:45
Static task
static1
Behavioral task
behavioral1
Sample
27bb66e7e3ff9b2094fb568e243c1d20.exe
Resource
win7-20230220-en
General
-
Target
27bb66e7e3ff9b2094fb568e243c1d20.exe
-
Size
307KB
-
MD5
27bb66e7e3ff9b2094fb568e243c1d20
-
SHA1
58ccfc20f2240af3bf98fc7121cfafb0c2a6f833
-
SHA256
9223ea1f88d99f8c593d7f8b888df49378bbdad7ba3a3a21cd762ea390f7c28d
-
SHA512
bc7e55c3bb2fbd5ffe58ef69b935b26ce0e893a37ac038733420b8335bce06a2a7beebde745760586a309af0bdadfc42c444f8d6e7d7886b0e2c10858d17d1f2
-
SSDEEP
6144:/Ya6/om87RH3+UAHQlFVTgy0vSRyPtZQA39ee8GDKkNKpd2DryescPi:/YdoV7p3MuF9WKIPtZb97DKfp1Aq
Malware Config
Extracted
formbook
dcn0
ZVx68vDtAMBCwg==
oBMBvsNORkM/O/ox
Ff9pISWkm6eG4lByIspp
c2T42c6CIIF6B8xTxm9XzpVw
bvjhxRbnAC183w==
0lTttSNG4HUDNflyIspp
hPXFlstqiHA/O/ox
WLR+MeerxZ0cNn1ja+IQAYo=
IHRn4xXOVKi477zarG+ObSy7YJA=
Xhf3e+tdAC183w==
Xk0ZAezv2rWH
kngo+vBeSRN7AszNwam3Osmguuqc0MoC
a2Qp7a+E8fSw7LDjpnqEKjsRZA==
3zjy4E7+QM48wg==
YcCmqT3OUNAigVott2pBKiy7YJA=
4+SMeX1juat/5cZ1AZihcyy7YJA=
/+m7sro0OBTl3TMpCw==
i2ctEfe4//a64yklMsgS2J90
+loZ2QKGX0UWgpvErMs=
b9BNCnJWQJS8IfsR0uR3bCy7YJA=
9eiUYE0ynHE/O/ox
F2/75pOIYNg0hzOD99192J8=
Y1xOONdO105okfha33EZ2A==
qYZIIB+dfF0wp1nVWFz067hJ2/qoXEVeAA==
moQMzat7tfKyKPYs
aMZJI/NfUSSpPQUBJ8/11g==
QKMN15GjpHcpyA==
6+S1hTvphhFfoCdj6tw=
DPynhWcnZWho7a0p33EZ2A==
EXY//zDm7ej3Guwo
PSWxPYkk0SNioSdj6tw=
jv+tmhv1ySZloydj6tw=
P8GUV5BhNZflCCBBFg==
IQZ0PWog1lcVVkJYHg==
aOTCq/Cet6AdhSdj6tw=
OBzJrqYS+eac46nZo4aI84kWMEtH
kBzTkbI2LTo/O/ox
a8pwOrU/tyx93a/QrGBpXGQIfZI=
GWoC9K5Mx0GR34urFcDPyQ==
dGxKGM2FI4iAkTOD99192J8=
UqQv8Vkx7WzkCCBBFg==
NcBsPK+YmdZP0cyhY+Lrzw==
zcKbk5oK7NCgFOpa4tHv0g==
uIomFkUTzdWa
QkAF8NuWMZmnPjCFgJBa+Y1t
51w6Gw7c3NyY
IyDnsW89dXaMrAxotF8jGZc=
1s1RHCrCwI8PnVhMY+Lrzw==
zBnRazUUWCsrM5t0SEth
1z4R/XM98Wn3j1RMY+Lrzw==
h3b34yQL3cI8wg==
/+27PhUTzdWa
CO0jnOIoAC183w==
Cn8jz+pyZEfWCCBBFg==
jI4f4NnKFwoSUb4YbnkzePzLv+Sc0MoC
xZnrS1Y+5Sxv1g==
phjYsTTGW8zAMydj6tw=
v7JcJyW3x64phzOD99192J8=
tBJ+Uh3sJxYqbyvrfF6BKjsRZA==
xRTxyfuTgMhGxg==
6ceNTfir2qmQHtxWwqIrI8GQ7h/Te/A2CA==
00gVx7d5/U5soCdj6tw=
Jgvgt58H8MFLfBzTp1VZXCe2ZYg=
1NKRY1QTzdWa
ahmedo.ch
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
kmdgiiip.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Control Panel\International\Geo\Nation kmdgiiip.exe -
Executes dropped EXE 2 IoCs
Processes:
kmdgiiip.exekmdgiiip.exepid process 1404 kmdgiiip.exe 752 kmdgiiip.exe -
Loads dropped DLL 4 IoCs
Processes:
27bb66e7e3ff9b2094fb568e243c1d20.exekmdgiiip.exesvchost.exepid process 1376 27bb66e7e3ff9b2094fb568e243c1d20.exe 1376 27bb66e7e3ff9b2094fb568e243c1d20.exe 1404 kmdgiiip.exe 1124 svchost.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
kmdgiiip.exekmdgiiip.exesvchost.exedescription pid process target process PID 1404 set thread context of 752 1404 kmdgiiip.exe kmdgiiip.exe PID 752 set thread context of 1236 752 kmdgiiip.exe Explorer.EXE PID 1124 set thread context of 1236 1124 svchost.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
svchost.exedescription ioc process Key created \Registry\User\S-1-5-21-3948302646-268491222-1934009652-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 svchost.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
kmdgiiip.exesvchost.exepid process 752 kmdgiiip.exe 752 kmdgiiip.exe 752 kmdgiiip.exe 752 kmdgiiip.exe 1124 svchost.exe 1124 svchost.exe 1124 svchost.exe 1124 svchost.exe 1124 svchost.exe 1124 svchost.exe 1124 svchost.exe 1124 svchost.exe 1124 svchost.exe 1124 svchost.exe 1124 svchost.exe 1124 svchost.exe 1124 svchost.exe 1124 svchost.exe 1124 svchost.exe 1124 svchost.exe 1124 svchost.exe 1124 svchost.exe 1124 svchost.exe 1124 svchost.exe 1124 svchost.exe 1124 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1236 Explorer.EXE -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
kmdgiiip.exekmdgiiip.exesvchost.exepid process 1404 kmdgiiip.exe 752 kmdgiiip.exe 752 kmdgiiip.exe 752 kmdgiiip.exe 1124 svchost.exe 1124 svchost.exe 1124 svchost.exe 1124 svchost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
kmdgiiip.exesvchost.exedescription pid process Token: SeDebugPrivilege 752 kmdgiiip.exe Token: SeDebugPrivilege 1124 svchost.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1236 Explorer.EXE 1236 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1236 Explorer.EXE 1236 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
27bb66e7e3ff9b2094fb568e243c1d20.exekmdgiiip.exeExplorer.EXEsvchost.exedescription pid process target process PID 1376 wrote to memory of 1404 1376 27bb66e7e3ff9b2094fb568e243c1d20.exe kmdgiiip.exe PID 1376 wrote to memory of 1404 1376 27bb66e7e3ff9b2094fb568e243c1d20.exe kmdgiiip.exe PID 1376 wrote to memory of 1404 1376 27bb66e7e3ff9b2094fb568e243c1d20.exe kmdgiiip.exe PID 1376 wrote to memory of 1404 1376 27bb66e7e3ff9b2094fb568e243c1d20.exe kmdgiiip.exe PID 1404 wrote to memory of 752 1404 kmdgiiip.exe kmdgiiip.exe PID 1404 wrote to memory of 752 1404 kmdgiiip.exe kmdgiiip.exe PID 1404 wrote to memory of 752 1404 kmdgiiip.exe kmdgiiip.exe PID 1404 wrote to memory of 752 1404 kmdgiiip.exe kmdgiiip.exe PID 1404 wrote to memory of 752 1404 kmdgiiip.exe kmdgiiip.exe PID 1236 wrote to memory of 1124 1236 Explorer.EXE svchost.exe PID 1236 wrote to memory of 1124 1236 Explorer.EXE svchost.exe PID 1236 wrote to memory of 1124 1236 Explorer.EXE svchost.exe PID 1236 wrote to memory of 1124 1236 Explorer.EXE svchost.exe PID 1124 wrote to memory of 912 1124 svchost.exe Firefox.exe PID 1124 wrote to memory of 912 1124 svchost.exe Firefox.exe PID 1124 wrote to memory of 912 1124 svchost.exe Firefox.exe PID 1124 wrote to memory of 912 1124 svchost.exe Firefox.exe PID 1124 wrote to memory of 912 1124 svchost.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\27bb66e7e3ff9b2094fb568e243c1d20.exe"C:\Users\Admin\AppData\Local\Temp\27bb66e7e3ff9b2094fb568e243c1d20.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\kmdgiiip.exe"C:\Users\Admin\AppData\Local\Temp\kmdgiiip.exe" C:\Users\Admin\AppData\Local\Temp\gwobocms.rto3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\kmdgiiip.exe"C:\Users\Admin\AppData\Local\Temp\kmdgiiip.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\gwobocms.rtoFilesize
5KB
MD5fe6fcfefa38bab70b5a5de603030ff61
SHA13dda65557dc6ce0955f01f1d100ad7700ae4baef
SHA256225d9b3a3361c769ce75cc5940e5075e5d5548030ba2681736a3b403dcae59f7
SHA512ad19cca6697f91da5148f7ddcaf91fe8ea1c43053da21720d4ba39c7b7660f5f9434e463a701b5163fed6940efa2fc8ee945a2706646b9ec6363a600613a5725
-
C:\Users\Admin\AppData\Local\Temp\k4j8ury8.zipFilesize
435KB
MD5c42ec8f35c6a06666e6ad54471a2728b
SHA1c3cc57a816927fa616616939b4b7a63c2322cfa1
SHA25622bb304aab3ec7a51fc4dc7749f304bbe01c5ec014144fbc8f86012dc3b0708b
SHA5126fe9a3c3f861663b6408fd5136d202835a89344072996dd65dda14fa04707662a26d0c6ed482fd0606a270943112d9effc07424af90621094f6fbb88c8ff7eae
-
C:\Users\Admin\AppData\Local\Temp\kmdgiiip.exeFilesize
122KB
MD5fbf3b6215ccf43a9f8bd094dd30315a5
SHA14ba70897d79deab49c1002eb359e81bf75447578
SHA2560c874caffd22395e3abdef0a3da851237942f3a2db7b4ab2e9ca9e9da4a57ff7
SHA5120d3fee9351238880555e20d6606ab8064871f6588292c56490d6e07f7a3a20f050fa26732cf80e880ec037ab839a791277b6ad154eb02e26fb72b9cd214abc66
-
C:\Users\Admin\AppData\Local\Temp\kmdgiiip.exeFilesize
122KB
MD5fbf3b6215ccf43a9f8bd094dd30315a5
SHA14ba70897d79deab49c1002eb359e81bf75447578
SHA2560c874caffd22395e3abdef0a3da851237942f3a2db7b4ab2e9ca9e9da4a57ff7
SHA5120d3fee9351238880555e20d6606ab8064871f6588292c56490d6e07f7a3a20f050fa26732cf80e880ec037ab839a791277b6ad154eb02e26fb72b9cd214abc66
-
C:\Users\Admin\AppData\Local\Temp\kmdgiiip.exeFilesize
122KB
MD5fbf3b6215ccf43a9f8bd094dd30315a5
SHA14ba70897d79deab49c1002eb359e81bf75447578
SHA2560c874caffd22395e3abdef0a3da851237942f3a2db7b4ab2e9ca9e9da4a57ff7
SHA5120d3fee9351238880555e20d6606ab8064871f6588292c56490d6e07f7a3a20f050fa26732cf80e880ec037ab839a791277b6ad154eb02e26fb72b9cd214abc66
-
C:\Users\Admin\AppData\Local\Temp\kmdgiiip.exeFilesize
122KB
MD5fbf3b6215ccf43a9f8bd094dd30315a5
SHA14ba70897d79deab49c1002eb359e81bf75447578
SHA2560c874caffd22395e3abdef0a3da851237942f3a2db7b4ab2e9ca9e9da4a57ff7
SHA5120d3fee9351238880555e20d6606ab8064871f6588292c56490d6e07f7a3a20f050fa26732cf80e880ec037ab839a791277b6ad154eb02e26fb72b9cd214abc66
-
C:\Users\Admin\AppData\Local\Temp\wfcbdjdnov.eeFilesize
204KB
MD54931431215e9651423864a58443356c8
SHA1d3c37dc4a5cb932ccb57241cdb5db5f98fe58cbf
SHA256e03aa0023fa3257acab678ce97eb39ac4d5c576815241e306cb232906d4e8918
SHA5124dbb1a6e89d46b4beadbe3763a1da60c8c886531acb39d5a35d1675d2edd0f3d9b77b5ef8fa80f36e5e07758dd08bdd1e9d82f2b5e9259059a8f8122f0dd510a
-
\Users\Admin\AppData\Local\Temp\kmdgiiip.exeFilesize
122KB
MD5fbf3b6215ccf43a9f8bd094dd30315a5
SHA14ba70897d79deab49c1002eb359e81bf75447578
SHA2560c874caffd22395e3abdef0a3da851237942f3a2db7b4ab2e9ca9e9da4a57ff7
SHA5120d3fee9351238880555e20d6606ab8064871f6588292c56490d6e07f7a3a20f050fa26732cf80e880ec037ab839a791277b6ad154eb02e26fb72b9cd214abc66
-
\Users\Admin\AppData\Local\Temp\kmdgiiip.exeFilesize
122KB
MD5fbf3b6215ccf43a9f8bd094dd30315a5
SHA14ba70897d79deab49c1002eb359e81bf75447578
SHA2560c874caffd22395e3abdef0a3da851237942f3a2db7b4ab2e9ca9e9da4a57ff7
SHA5120d3fee9351238880555e20d6606ab8064871f6588292c56490d6e07f7a3a20f050fa26732cf80e880ec037ab839a791277b6ad154eb02e26fb72b9cd214abc66
-
\Users\Admin\AppData\Local\Temp\kmdgiiip.exeFilesize
122KB
MD5fbf3b6215ccf43a9f8bd094dd30315a5
SHA14ba70897d79deab49c1002eb359e81bf75447578
SHA2560c874caffd22395e3abdef0a3da851237942f3a2db7b4ab2e9ca9e9da4a57ff7
SHA5120d3fee9351238880555e20d6606ab8064871f6588292c56490d6e07f7a3a20f050fa26732cf80e880ec037ab839a791277b6ad154eb02e26fb72b9cd214abc66
-
\Users\Admin\AppData\Local\Temp\sqlite3.dllFilesize
832KB
MD507fb6d31f37fb1b4164bef301306c288
SHA14cb41af6d63a07324ef6b18b1a1f43ce94e25626
SHA25606ddf0a370af00d994824605a8e1307ba138f89b2d864539f0d19e8804edac02
SHA512cab4a7c5805b80851aba5f2c9b001fabc1416f6648d891f49eacc81fe79287c5baa01306a42298da722750b812a4ea85388ffae9200dcf656dd1d5b5b9323353
-
memory/752-76-0x00000000000A0000-0x00000000000B0000-memory.dmpFilesize
64KB
-
memory/752-74-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/752-75-0x00000000008F0000-0x0000000000BF3000-memory.dmpFilesize
3.0MB
-
memory/752-68-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/752-72-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1124-82-0x0000000000080000-0x00000000000AD000-memory.dmpFilesize
180KB
-
memory/1124-132-0x0000000061E00000-0x0000000061EBD000-memory.dmpFilesize
756KB
-
memory/1124-81-0x0000000000870000-0x0000000000B73000-memory.dmpFilesize
3.0MB
-
memory/1124-80-0x0000000000080000-0x00000000000AD000-memory.dmpFilesize
180KB
-
memory/1124-78-0x0000000000860000-0x0000000000868000-memory.dmpFilesize
32KB
-
memory/1124-84-0x0000000000580000-0x000000000060F000-memory.dmpFilesize
572KB
-
memory/1124-135-0x0000000061E00000-0x0000000061EBD000-memory.dmpFilesize
756KB
-
memory/1124-79-0x0000000000860000-0x0000000000868000-memory.dmpFilesize
32KB
-
memory/1236-86-0x0000000006B50000-0x0000000006C94000-memory.dmpFilesize
1.3MB
-
memory/1236-90-0x000007FF5FA20000-0x000007FF5FA2A000-memory.dmpFilesize
40KB
-
memory/1236-77-0x0000000002B10000-0x0000000002BC7000-memory.dmpFilesize
732KB
-
memory/1236-73-0x0000000000010000-0x0000000000020000-memory.dmpFilesize
64KB
-
memory/1236-88-0x0000000006B50000-0x0000000006C94000-memory.dmpFilesize
1.3MB
-
memory/1236-85-0x0000000006B50000-0x0000000006C94000-memory.dmpFilesize
1.3MB