Analysis
-
max time kernel
148s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2023 06:52
Static task
static1
General
-
Target
f3b8435e7359411cefb4d6c762550f4881195a2ec0cb035da5737c4b4891fb6f.exe
-
Size
301KB
-
MD5
542ef4a811e2fa45e96efe1602acd737
-
SHA1
116ae7e038b75fcee7ac7ddc33f96f981c0e81a7
-
SHA256
f3b8435e7359411cefb4d6c762550f4881195a2ec0cb035da5737c4b4891fb6f
-
SHA512
5fa0fd179e7fe6157aed9766281d74dedbef4ce52b287634550f3b11bd29ff08081fbc3590bd435ff6846d4018c84d2a76aa2010b220023654b873c46a6c566c
-
SSDEEP
6144:TYa6RWpn++a1jQdqOgTSZ6i7vJYnmb7qEPDRtmfGe8C9jxIihLY2XJg:TYDWp++UEEOgmZ6uJwmb7q0DRtmfoC9s
Malware Config
Extracted
formbook
4.1
sa79
aidigify.com
angelavamundson.xyz
glicotoday.fun
agencyforbuyers.com
blacklifecoachquiz.com
4e6aqw.site
huawei1990.com
diyetcay.online
chesirechefs.co.uk
generalhospitaleu.africa
hfewha.xyz
lemons2cents.com
rahilprakash.com
kave.tech
netlexfrance.net
youthexsa.africa
car-covers-40809.com
bambooactive.store
fotobugil48.com
kuhler.club
ftyon.xyz
cramyact1.info
finefrenchcaviar.co.uk
158029.xyz
doneswanneeds.com
campanianetwork.online
trade.boo
totaltrace.co.uk
grandgoldrange.africa
oliviahodges04.uk
eckiahe.club
imagebeuty.com
kutxa-incidencias.info
goodnewz.africa
alampsoldes.com
xuanliuchushaqi.com
leaf-spa.net
artblocks.bio
estres0.com
hcoltun.xyz
boostonsquelette.com
bettygrablerm.com
tulipbaddie.com
binosresidence.africa
sunnyola.com
guangxisangna.com
8888m.net
alaamriproducts.com
busy-people-gifts.com
i-sell-fun.com
grandnatali.ru
allstarssport.co.uk
cloud-spartan.co.uk
vitamincbd.africa
winelandsphotography.africa
ndyc.africa
cvbetter.co.uk
bestinvestment-trust.info
lblpackagestore.com
grabacionescaseras.com
fixmypothole.com
combatwash.com
brittnybuttondesign.net
eerieytorrent.com
heguangxueyuan.com
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1332-142-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1332-146-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/3904-154-0x0000000000940000-0x000000000096F000-memory.dmp formbook behavioral1/memory/3904-156-0x0000000000940000-0x000000000096F000-memory.dmp formbook -
Executes dropped EXE 2 IoCs
Processes:
omrjw.exeomrjw.exepid process 4864 omrjw.exe 1332 omrjw.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
omrjw.exeomrjw.exesystray.exedescription pid process target process PID 4864 set thread context of 1332 4864 omrjw.exe omrjw.exe PID 1332 set thread context of 3148 1332 omrjw.exe Explorer.EXE PID 3904 set thread context of 3148 3904 systray.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 60 IoCs
Processes:
omrjw.exesystray.exepid process 1332 omrjw.exe 1332 omrjw.exe 1332 omrjw.exe 1332 omrjw.exe 3904 systray.exe 3904 systray.exe 3904 systray.exe 3904 systray.exe 3904 systray.exe 3904 systray.exe 3904 systray.exe 3904 systray.exe 3904 systray.exe 3904 systray.exe 3904 systray.exe 3904 systray.exe 3904 systray.exe 3904 systray.exe 3904 systray.exe 3904 systray.exe 3904 systray.exe 3904 systray.exe 3904 systray.exe 3904 systray.exe 3904 systray.exe 3904 systray.exe 3904 systray.exe 3904 systray.exe 3904 systray.exe 3904 systray.exe 3904 systray.exe 3904 systray.exe 3904 systray.exe 3904 systray.exe 3904 systray.exe 3904 systray.exe 3904 systray.exe 3904 systray.exe 3904 systray.exe 3904 systray.exe 3904 systray.exe 3904 systray.exe 3904 systray.exe 3904 systray.exe 3904 systray.exe 3904 systray.exe 3904 systray.exe 3904 systray.exe 3904 systray.exe 3904 systray.exe 3904 systray.exe 3904 systray.exe 3904 systray.exe 3904 systray.exe 3904 systray.exe 3904 systray.exe 3904 systray.exe 3904 systray.exe 3904 systray.exe 3904 systray.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3148 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
omrjw.exeomrjw.exesystray.exepid process 4864 omrjw.exe 1332 omrjw.exe 1332 omrjw.exe 1332 omrjw.exe 3904 systray.exe 3904 systray.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
omrjw.exesystray.exedescription pid process Token: SeDebugPrivilege 1332 omrjw.exe Token: SeDebugPrivilege 3904 systray.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
f3b8435e7359411cefb4d6c762550f4881195a2ec0cb035da5737c4b4891fb6f.exeomrjw.exeExplorer.EXEsystray.exedescription pid process target process PID 4928 wrote to memory of 4864 4928 f3b8435e7359411cefb4d6c762550f4881195a2ec0cb035da5737c4b4891fb6f.exe omrjw.exe PID 4928 wrote to memory of 4864 4928 f3b8435e7359411cefb4d6c762550f4881195a2ec0cb035da5737c4b4891fb6f.exe omrjw.exe PID 4928 wrote to memory of 4864 4928 f3b8435e7359411cefb4d6c762550f4881195a2ec0cb035da5737c4b4891fb6f.exe omrjw.exe PID 4864 wrote to memory of 1332 4864 omrjw.exe omrjw.exe PID 4864 wrote to memory of 1332 4864 omrjw.exe omrjw.exe PID 4864 wrote to memory of 1332 4864 omrjw.exe omrjw.exe PID 4864 wrote to memory of 1332 4864 omrjw.exe omrjw.exe PID 3148 wrote to memory of 3904 3148 Explorer.EXE systray.exe PID 3148 wrote to memory of 3904 3148 Explorer.EXE systray.exe PID 3148 wrote to memory of 3904 3148 Explorer.EXE systray.exe PID 3904 wrote to memory of 3700 3904 systray.exe cmd.exe PID 3904 wrote to memory of 3700 3904 systray.exe cmd.exe PID 3904 wrote to memory of 3700 3904 systray.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f3b8435e7359411cefb4d6c762550f4881195a2ec0cb035da5737c4b4891fb6f.exe"C:\Users\Admin\AppData\Local\Temp\f3b8435e7359411cefb4d6c762550f4881195a2ec0cb035da5737c4b4891fb6f.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\omrjw.exe"C:\Users\Admin\AppData\Local\Temp\omrjw.exe" C:\Users\Admin\AppData\Local\Temp\lnbvfzmz.kjd3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\omrjw.exe"C:\Users\Admin\AppData\Local\Temp\omrjw.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\omrjw.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\lnbvfzmz.kjdFilesize
5KB
MD56708008ed1049596aea130d698b95b72
SHA1cd85c88ca9bcdf443b2618e58602bc5da2ab2606
SHA2562c8cab39aba9cb704c658e1f2174319e645f1249b8bd4b996569daba4b877cdd
SHA512cb506c5bf424465937a836996a35bf3a2625f3de6f7b9ab1a76b8f9245f387a5a6866eca009345782c1e96adb1c1610c73ae179feac11f409fe5bd1eea12e485
-
C:\Users\Admin\AppData\Local\Temp\omrjw.exeFilesize
159KB
MD55ae8e4fca84468df1846f5a3a2fbf24f
SHA11a4ef0d31bd8586986b8c99e69755a55bb9d20b5
SHA25640c5f58f008ac0a8afda1b37bc1c6fa4a8f7e748d957bc54a9195d06bcaf8611
SHA5123328b0a8b3b92f807e4f6aa4c59bf0f97c9aecbfdd4a66555fa3d1ea1e0bb49128dee76ec97c44b192b301716a0f2ce9f5d258ba25bfbdec5619ccea6e07c8f2
-
C:\Users\Admin\AppData\Local\Temp\omrjw.exeFilesize
159KB
MD55ae8e4fca84468df1846f5a3a2fbf24f
SHA11a4ef0d31bd8586986b8c99e69755a55bb9d20b5
SHA25640c5f58f008ac0a8afda1b37bc1c6fa4a8f7e748d957bc54a9195d06bcaf8611
SHA5123328b0a8b3b92f807e4f6aa4c59bf0f97c9aecbfdd4a66555fa3d1ea1e0bb49128dee76ec97c44b192b301716a0f2ce9f5d258ba25bfbdec5619ccea6e07c8f2
-
C:\Users\Admin\AppData\Local\Temp\omrjw.exeFilesize
159KB
MD55ae8e4fca84468df1846f5a3a2fbf24f
SHA11a4ef0d31bd8586986b8c99e69755a55bb9d20b5
SHA25640c5f58f008ac0a8afda1b37bc1c6fa4a8f7e748d957bc54a9195d06bcaf8611
SHA5123328b0a8b3b92f807e4f6aa4c59bf0f97c9aecbfdd4a66555fa3d1ea1e0bb49128dee76ec97c44b192b301716a0f2ce9f5d258ba25bfbdec5619ccea6e07c8f2
-
C:\Users\Admin\AppData\Local\Temp\pczmt.sFilesize
205KB
MD54dd6535840793a7f5b71ee849a03b850
SHA1ef2e3c0890ecec630cf8d544be1715e4c3c0fd90
SHA25695703b208c0c156d13995204ecb4180cddc134345cc2ebfed722d2480fa07122
SHA5123c31b4161c5ea16888d944311525fbf04acd55440bfcf6be62d2c882ad297bd90e64ea5b7f2e930c13a42ce9e2993128ac595bf947f9ef67969931754c8570f3
-
memory/1332-148-0x00000000006D0000-0x00000000006E4000-memory.dmpFilesize
80KB
-
memory/1332-142-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1332-146-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1332-147-0x0000000000A40000-0x0000000000D8A000-memory.dmpFilesize
3.3MB
-
memory/3148-149-0x0000000002520000-0x000000000263B000-memory.dmpFilesize
1.1MB
-
memory/3148-157-0x0000000002520000-0x000000000263B000-memory.dmpFilesize
1.1MB
-
memory/3148-160-0x0000000002640000-0x00000000026D9000-memory.dmpFilesize
612KB
-
memory/3148-161-0x0000000002640000-0x00000000026D9000-memory.dmpFilesize
612KB
-
memory/3148-163-0x0000000002640000-0x00000000026D9000-memory.dmpFilesize
612KB
-
memory/3904-151-0x0000000000C60000-0x0000000000C66000-memory.dmpFilesize
24KB
-
memory/3904-153-0x0000000000C60000-0x0000000000C66000-memory.dmpFilesize
24KB
-
memory/3904-154-0x0000000000940000-0x000000000096F000-memory.dmpFilesize
188KB
-
memory/3904-155-0x0000000002B50000-0x0000000002E9A000-memory.dmpFilesize
3.3MB
-
memory/3904-156-0x0000000000940000-0x000000000096F000-memory.dmpFilesize
188KB
-
memory/3904-159-0x00000000028A0000-0x0000000002933000-memory.dmpFilesize
588KB
-
memory/4864-140-0x00000000004A0000-0x00000000004A2000-memory.dmpFilesize
8KB