Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
23-03-2023 01:54
Static task
static1
Behavioral task
behavioral1
Sample
1193af601f7742f964a6b14b0616a860.exe
Resource
win7-20230220-en
General
-
Target
1193af601f7742f964a6b14b0616a860.exe
-
Size
294KB
-
MD5
1193af601f7742f964a6b14b0616a860
-
SHA1
5f18b2b9aa276eb7a98593fce285c3d4d1705cf8
-
SHA256
b918ed3991e3f8cbcac0ec8b4d3d176634be12ed0614654cef1df9b84e15b4de
-
SHA512
96632f81685bc25a590153c3f18a6611e8a285dc5fde3b38e090360e91ebf7dd5f37cc91bc0e50325644b17430caf5c5112b855a35e906f8b3da1faa586b65d1
-
SSDEEP
6144:PYa6kUTqhzYIewfyV32depRkYu9iRooob:PY6WgzEdpfPof
Malware Config
Extracted
formbook
dcn0
ZVx68vDtAMBCwg==
oBMBvsNORkM/O/ox
Ff9pISWkm6eG4lByIspp
c2T42c6CIIF6B8xTxm9XzpVw
bvjhxRbnAC183w==
0lTttSNG4HUDNflyIspp
hPXFlstqiHA/O/ox
WLR+MeerxZ0cNn1ja+IQAYo=
IHRn4xXOVKi477zarG+ObSy7YJA=
Xhf3e+tdAC183w==
Xk0ZAezv2rWH
kngo+vBeSRN7AszNwam3Osmguuqc0MoC
a2Qp7a+E8fSw7LDjpnqEKjsRZA==
3zjy4E7+QM48wg==
YcCmqT3OUNAigVott2pBKiy7YJA=
4+SMeX1juat/5cZ1AZihcyy7YJA=
/+m7sro0OBTl3TMpCw==
i2ctEfe4//a64yklMsgS2J90
+loZ2QKGX0UWgpvErMs=
b9BNCnJWQJS8IfsR0uR3bCy7YJA=
9eiUYE0ynHE/O/ox
F2/75pOIYNg0hzOD99192J8=
Y1xOONdO105okfha33EZ2A==
qYZIIB+dfF0wp1nVWFz067hJ2/qoXEVeAA==
moQMzat7tfKyKPYs
aMZJI/NfUSSpPQUBJ8/11g==
QKMN15GjpHcpyA==
6+S1hTvphhFfoCdj6tw=
DPynhWcnZWho7a0p33EZ2A==
EXY//zDm7ej3Guwo
PSWxPYkk0SNioSdj6tw=
jv+tmhv1ySZloydj6tw=
P8GUV5BhNZflCCBBFg==
IQZ0PWog1lcVVkJYHg==
aOTCq/Cet6AdhSdj6tw=
OBzJrqYS+eac46nZo4aI84kWMEtH
kBzTkbI2LTo/O/ox
a8pwOrU/tyx93a/QrGBpXGQIfZI=
GWoC9K5Mx0GR34urFcDPyQ==
dGxKGM2FI4iAkTOD99192J8=
UqQv8Vkx7WzkCCBBFg==
NcBsPK+YmdZP0cyhY+Lrzw==
zcKbk5oK7NCgFOpa4tHv0g==
uIomFkUTzdWa
QkAF8NuWMZmnPjCFgJBa+Y1t
51w6Gw7c3NyY
IyDnsW89dXaMrAxotF8jGZc=
1s1RHCrCwI8PnVhMY+Lrzw==
zBnRazUUWCsrM5t0SEth
1z4R/XM98Wn3j1RMY+Lrzw==
h3b34yQL3cI8wg==
/+27PhUTzdWa
CO0jnOIoAC183w==
Cn8jz+pyZEfWCCBBFg==
jI4f4NnKFwoSUb4YbnkzePzLv+Sc0MoC
xZnrS1Y+5Sxv1g==
phjYsTTGW8zAMydj6tw=
v7JcJyW3x64phzOD99192J8=
tBJ+Uh3sJxYqbyvrfF6BKjsRZA==
xRTxyfuTgMhGxg==
6ceNTfir2qmQHtxWwqIrI8GQ7h/Te/A2CA==
00gVx7d5/U5soCdj6tw=
Jgvgt58H8MFLfBzTp1VZXCe2ZYg=
1NKRY1QTzdWa
ahmedo.ch
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
hiufmy.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Control Panel\International\Geo\Nation hiufmy.exe -
Executes dropped EXE 2 IoCs
Processes:
hiufmy.exehiufmy.exepid process 1388 hiufmy.exe 1872 hiufmy.exe -
Loads dropped DLL 4 IoCs
Processes:
1193af601f7742f964a6b14b0616a860.exehiufmy.exemsdt.exepid process 2012 1193af601f7742f964a6b14b0616a860.exe 2012 1193af601f7742f964a6b14b0616a860.exe 1388 hiufmy.exe 1316 msdt.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
hiufmy.exehiufmy.exemsdt.exedescription pid process target process PID 1388 set thread context of 1872 1388 hiufmy.exe hiufmy.exe PID 1872 set thread context of 1236 1872 hiufmy.exe Explorer.EXE PID 1316 set thread context of 1236 1316 msdt.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
msdt.exedescription ioc process Key created \Registry\User\S-1-5-21-3430344531-3702557399-3004411149-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 msdt.exe -
Suspicious behavior: EnumeratesProcesses 27 IoCs
Processes:
hiufmy.exemsdt.exepid process 1872 hiufmy.exe 1872 hiufmy.exe 1872 hiufmy.exe 1872 hiufmy.exe 1316 msdt.exe 1316 msdt.exe 1316 msdt.exe 1316 msdt.exe 1316 msdt.exe 1316 msdt.exe 1316 msdt.exe 1316 msdt.exe 1316 msdt.exe 1316 msdt.exe 1316 msdt.exe 1316 msdt.exe 1316 msdt.exe 1316 msdt.exe 1316 msdt.exe 1316 msdt.exe 1316 msdt.exe 1316 msdt.exe 1316 msdt.exe 1316 msdt.exe 1316 msdt.exe 1316 msdt.exe 1316 msdt.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1236 Explorer.EXE -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
hiufmy.exehiufmy.exemsdt.exepid process 1388 hiufmy.exe 1872 hiufmy.exe 1872 hiufmy.exe 1872 hiufmy.exe 1316 msdt.exe 1316 msdt.exe 1316 msdt.exe 1316 msdt.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
hiufmy.exemsdt.exedescription pid process Token: SeDebugPrivilege 1872 hiufmy.exe Token: SeDebugPrivilege 1316 msdt.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1236 Explorer.EXE 1236 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1236 Explorer.EXE 1236 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
1193af601f7742f964a6b14b0616a860.exehiufmy.exeExplorer.EXEmsdt.exedescription pid process target process PID 2012 wrote to memory of 1388 2012 1193af601f7742f964a6b14b0616a860.exe hiufmy.exe PID 2012 wrote to memory of 1388 2012 1193af601f7742f964a6b14b0616a860.exe hiufmy.exe PID 2012 wrote to memory of 1388 2012 1193af601f7742f964a6b14b0616a860.exe hiufmy.exe PID 2012 wrote to memory of 1388 2012 1193af601f7742f964a6b14b0616a860.exe hiufmy.exe PID 1388 wrote to memory of 1872 1388 hiufmy.exe hiufmy.exe PID 1388 wrote to memory of 1872 1388 hiufmy.exe hiufmy.exe PID 1388 wrote to memory of 1872 1388 hiufmy.exe hiufmy.exe PID 1388 wrote to memory of 1872 1388 hiufmy.exe hiufmy.exe PID 1388 wrote to memory of 1872 1388 hiufmy.exe hiufmy.exe PID 1236 wrote to memory of 1316 1236 Explorer.EXE msdt.exe PID 1236 wrote to memory of 1316 1236 Explorer.EXE msdt.exe PID 1236 wrote to memory of 1316 1236 Explorer.EXE msdt.exe PID 1236 wrote to memory of 1316 1236 Explorer.EXE msdt.exe PID 1316 wrote to memory of 1128 1316 msdt.exe Firefox.exe PID 1316 wrote to memory of 1128 1316 msdt.exe Firefox.exe PID 1316 wrote to memory of 1128 1316 msdt.exe Firefox.exe PID 1316 wrote to memory of 1128 1316 msdt.exe Firefox.exe PID 1316 wrote to memory of 1128 1316 msdt.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1193af601f7742f964a6b14b0616a860.exe"C:\Users\Admin\AppData\Local\Temp\1193af601f7742f964a6b14b0616a860.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\hiufmy.exe"C:\Users\Admin\AppData\Local\Temp\hiufmy.exe" C:\Users\Admin\AppData\Local\Temp\ufrrm.re3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\hiufmy.exe"C:\Users\Admin\AppData\Local\Temp\hiufmy.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\hiufmy.exeFilesize
99KB
MD59bd983a7f7cafd066b183cc621731ace
SHA15e48e8f6d654301ea92eba3e2719d61253be59e5
SHA2569a45850409d77e661e6add9914865303eeee16199f2db1065b5faf143b2a6290
SHA512435bcd4af83ba253b45c12f30890fcfae083fc3760e5d25b366469cf330eaa7d553c86687d334ab0b19d4ffe0ccda8cdba60f2d069845e5ec15a4ec564e25a35
-
C:\Users\Admin\AppData\Local\Temp\hiufmy.exeFilesize
99KB
MD59bd983a7f7cafd066b183cc621731ace
SHA15e48e8f6d654301ea92eba3e2719d61253be59e5
SHA2569a45850409d77e661e6add9914865303eeee16199f2db1065b5faf143b2a6290
SHA512435bcd4af83ba253b45c12f30890fcfae083fc3760e5d25b366469cf330eaa7d553c86687d334ab0b19d4ffe0ccda8cdba60f2d069845e5ec15a4ec564e25a35
-
C:\Users\Admin\AppData\Local\Temp\hiufmy.exeFilesize
99KB
MD59bd983a7f7cafd066b183cc621731ace
SHA15e48e8f6d654301ea92eba3e2719d61253be59e5
SHA2569a45850409d77e661e6add9914865303eeee16199f2db1065b5faf143b2a6290
SHA512435bcd4af83ba253b45c12f30890fcfae083fc3760e5d25b366469cf330eaa7d553c86687d334ab0b19d4ffe0ccda8cdba60f2d069845e5ec15a4ec564e25a35
-
C:\Users\Admin\AppData\Local\Temp\hiufmy.exeFilesize
99KB
MD59bd983a7f7cafd066b183cc621731ace
SHA15e48e8f6d654301ea92eba3e2719d61253be59e5
SHA2569a45850409d77e661e6add9914865303eeee16199f2db1065b5faf143b2a6290
SHA512435bcd4af83ba253b45c12f30890fcfae083fc3760e5d25b366469cf330eaa7d553c86687d334ab0b19d4ffe0ccda8cdba60f2d069845e5ec15a4ec564e25a35
-
C:\Users\Admin\AppData\Local\Temp\lrhlbv.zipFilesize
478KB
MD572b88067a5a1a4f8d52c45e6621d13fe
SHA1f84542474b8583f4371749282e5cc4d52661c222
SHA25670a11669bb8ad1099fd7fba9da92e1a75124bef0d16a01fd10dcdc45e9582092
SHA512a8bf75fd4f38e4c8dee5e6f2527062c5be21f5a8bae4ea561f4aa28139d65a6f215afb212f1e4857ee482e16e813fc0d63ef8ec43ec94d5f8a722489e89e154d
-
C:\Users\Admin\AppData\Local\Temp\ufrrm.reFilesize
6KB
MD50f55e8f1fafe8a10f5d0700f89845b20
SHA1a1b14d2a50993d55057ed453b39e8124ed3f79f7
SHA256c4ab35124468b9bb5ea0bb6e26a9694ea1554bd8592270e2260bf8f3dcf49a90
SHA5121962c15d715a73f8c2754301f43d64f3127a83a1189c58f07bf16788b6d48267e0a05dfb8847924d268eff90c22543c088dc564eda080fec62f4a31dc5fc965c
-
C:\Users\Admin\AppData\Local\Temp\uxpgjlroki.mczFilesize
204KB
MD507f0262d1a9028a22e5c35b9b5e00642
SHA1cc26afbd084517a34063409b705dd3c58f5f7bc3
SHA256ee1453e0677273ef631502e9cd13f195ea0530d1f6d95c6f0cc6fe92e97c4dca
SHA5125c30c933d5dbec9254327160438fd6c162c2e6b6ba7a54040f708719196bb14f4a1fb962ebe0573947a6db597b1801f85681272e155e43818d27437132a75a20
-
\Users\Admin\AppData\Local\Temp\hiufmy.exeFilesize
99KB
MD59bd983a7f7cafd066b183cc621731ace
SHA15e48e8f6d654301ea92eba3e2719d61253be59e5
SHA2569a45850409d77e661e6add9914865303eeee16199f2db1065b5faf143b2a6290
SHA512435bcd4af83ba253b45c12f30890fcfae083fc3760e5d25b366469cf330eaa7d553c86687d334ab0b19d4ffe0ccda8cdba60f2d069845e5ec15a4ec564e25a35
-
\Users\Admin\AppData\Local\Temp\hiufmy.exeFilesize
99KB
MD59bd983a7f7cafd066b183cc621731ace
SHA15e48e8f6d654301ea92eba3e2719d61253be59e5
SHA2569a45850409d77e661e6add9914865303eeee16199f2db1065b5faf143b2a6290
SHA512435bcd4af83ba253b45c12f30890fcfae083fc3760e5d25b366469cf330eaa7d553c86687d334ab0b19d4ffe0ccda8cdba60f2d069845e5ec15a4ec564e25a35
-
\Users\Admin\AppData\Local\Temp\hiufmy.exeFilesize
99KB
MD59bd983a7f7cafd066b183cc621731ace
SHA15e48e8f6d654301ea92eba3e2719d61253be59e5
SHA2569a45850409d77e661e6add9914865303eeee16199f2db1065b5faf143b2a6290
SHA512435bcd4af83ba253b45c12f30890fcfae083fc3760e5d25b366469cf330eaa7d553c86687d334ab0b19d4ffe0ccda8cdba60f2d069845e5ec15a4ec564e25a35
-
\Users\Admin\AppData\Local\Temp\sqlite3.dllFilesize
910KB
MD5d79258c5189103d69502eac786addb04
SHA1f34b33681cfe8ce649218173a7f58b237821c1ef
SHA25657d89a52061d70d87e40281f1196d53273f87860c4d707d667a8c7d9573da675
SHA512da797f4dd1ad628aa4e8004b2e00b7c278facbc57a313f56b70dc8fcfbdb0050ea8b025b3475098223cce96ea53537d678273656d46c2d33d81b496d90da34b2
-
memory/1236-74-0x0000000002E20000-0x0000000002F20000-memory.dmpFilesize
1024KB
-
memory/1236-90-0x000007FF0C130000-0x000007FF0C13A000-memory.dmpFilesize
40KB
-
memory/1236-89-0x0000000004D40000-0x0000000004DFA000-memory.dmpFilesize
744KB
-
memory/1236-87-0x0000000004D40000-0x0000000004DFA000-memory.dmpFilesize
744KB
-
memory/1236-78-0x0000000004B50000-0x0000000004C1E000-memory.dmpFilesize
824KB
-
memory/1236-86-0x0000000004D40000-0x0000000004DFA000-memory.dmpFilesize
744KB
-
memory/1316-85-0x0000000002010000-0x000000000209F000-memory.dmpFilesize
572KB
-
memory/1316-82-0x00000000022E0000-0x00000000025E3000-memory.dmpFilesize
3.0MB
-
memory/1316-81-0x00000000000C0000-0x00000000000ED000-memory.dmpFilesize
180KB
-
memory/1316-83-0x00000000000C0000-0x00000000000ED000-memory.dmpFilesize
180KB
-
memory/1316-80-0x0000000000B10000-0x0000000000C04000-memory.dmpFilesize
976KB
-
memory/1316-79-0x0000000000B10000-0x0000000000C04000-memory.dmpFilesize
976KB
-
memory/1316-134-0x0000000061E00000-0x0000000061ECF000-memory.dmpFilesize
828KB
-
memory/1872-77-0x0000000000160000-0x0000000000170000-memory.dmpFilesize
64KB
-
memory/1872-76-0x0000000000870000-0x0000000000B73000-memory.dmpFilesize
3.0MB
-
memory/1872-75-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1872-73-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1872-69-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB