Analysis
-
max time kernel
150s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
28-03-2023 07:02
Static task
static1
Behavioral task
behavioral1
Sample
542ef4a811e2fa45e96efe1602acd737.exe
Resource
win7-20230220-en
General
-
Target
542ef4a811e2fa45e96efe1602acd737.exe
-
Size
301KB
-
MD5
542ef4a811e2fa45e96efe1602acd737
-
SHA1
116ae7e038b75fcee7ac7ddc33f96f981c0e81a7
-
SHA256
f3b8435e7359411cefb4d6c762550f4881195a2ec0cb035da5737c4b4891fb6f
-
SHA512
5fa0fd179e7fe6157aed9766281d74dedbef4ce52b287634550f3b11bd29ff08081fbc3590bd435ff6846d4018c84d2a76aa2010b220023654b873c46a6c566c
-
SSDEEP
6144:TYa6RWpn++a1jQdqOgTSZ6i7vJYnmb7qEPDRtmfGe8C9jxIihLY2XJg:TYDWp++UEEOgmZ6uJwmb7q0DRtmfoC9s
Malware Config
Extracted
formbook
4.1
sa79
aidigify.com
angelavamundson.xyz
glicotoday.fun
agencyforbuyers.com
blacklifecoachquiz.com
4e6aqw.site
huawei1990.com
diyetcay.online
chesirechefs.co.uk
generalhospitaleu.africa
hfewha.xyz
lemons2cents.com
rahilprakash.com
kave.tech
netlexfrance.net
youthexsa.africa
car-covers-40809.com
bambooactive.store
fotobugil48.com
kuhler.club
ftyon.xyz
cramyact1.info
finefrenchcaviar.co.uk
158029.xyz
doneswanneeds.com
campanianetwork.online
trade.boo
totaltrace.co.uk
grandgoldrange.africa
oliviahodges04.uk
eckiahe.club
imagebeuty.com
kutxa-incidencias.info
goodnewz.africa
alampsoldes.com
xuanliuchushaqi.com
leaf-spa.net
artblocks.bio
estres0.com
hcoltun.xyz
boostonsquelette.com
bettygrablerm.com
tulipbaddie.com
binosresidence.africa
sunnyola.com
guangxisangna.com
8888m.net
alaamriproducts.com
busy-people-gifts.com
i-sell-fun.com
grandnatali.ru
allstarssport.co.uk
cloud-spartan.co.uk
vitamincbd.africa
winelandsphotography.africa
ndyc.africa
cvbetter.co.uk
bestinvestment-trust.info
lblpackagestore.com
grabacionescaseras.com
fixmypothole.com
combatwash.com
brittnybuttondesign.net
eerieytorrent.com
heguangxueyuan.com
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/676-68-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/676-76-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1704-80-0x0000000000080000-0x00000000000AF000-memory.dmp formbook behavioral1/memory/1704-82-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Executes dropped EXE 2 IoCs
Processes:
omrjw.exeomrjw.exepid process 2004 omrjw.exe 676 omrjw.exe -
Loads dropped DLL 3 IoCs
Processes:
542ef4a811e2fa45e96efe1602acd737.exeomrjw.exepid process 2044 542ef4a811e2fa45e96efe1602acd737.exe 2044 542ef4a811e2fa45e96efe1602acd737.exe 2004 omrjw.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
omrjw.exeomrjw.execontrol.exedescription pid process target process PID 2004 set thread context of 676 2004 omrjw.exe omrjw.exe PID 676 set thread context of 1264 676 omrjw.exe Explorer.EXE PID 1704 set thread context of 1264 1704 control.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
Processes:
omrjw.execontrol.exepid process 676 omrjw.exe 676 omrjw.exe 1704 control.exe 1704 control.exe 1704 control.exe 1704 control.exe 1704 control.exe 1704 control.exe 1704 control.exe 1704 control.exe 1704 control.exe 1704 control.exe 1704 control.exe 1704 control.exe 1704 control.exe 1704 control.exe 1704 control.exe 1704 control.exe 1704 control.exe 1704 control.exe 1704 control.exe 1704 control.exe 1704 control.exe 1704 control.exe 1704 control.exe 1704 control.exe 1704 control.exe 1704 control.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1264 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
omrjw.exeomrjw.execontrol.exepid process 2004 omrjw.exe 676 omrjw.exe 676 omrjw.exe 676 omrjw.exe 1704 control.exe 1704 control.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
omrjw.execontrol.exedescription pid process Token: SeDebugPrivilege 676 omrjw.exe Token: SeDebugPrivilege 1704 control.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1264 Explorer.EXE 1264 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1264 Explorer.EXE 1264 Explorer.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
542ef4a811e2fa45e96efe1602acd737.exeomrjw.exeExplorer.EXEcontrol.exedescription pid process target process PID 2044 wrote to memory of 2004 2044 542ef4a811e2fa45e96efe1602acd737.exe omrjw.exe PID 2044 wrote to memory of 2004 2044 542ef4a811e2fa45e96efe1602acd737.exe omrjw.exe PID 2044 wrote to memory of 2004 2044 542ef4a811e2fa45e96efe1602acd737.exe omrjw.exe PID 2044 wrote to memory of 2004 2044 542ef4a811e2fa45e96efe1602acd737.exe omrjw.exe PID 2004 wrote to memory of 676 2004 omrjw.exe omrjw.exe PID 2004 wrote to memory of 676 2004 omrjw.exe omrjw.exe PID 2004 wrote to memory of 676 2004 omrjw.exe omrjw.exe PID 2004 wrote to memory of 676 2004 omrjw.exe omrjw.exe PID 2004 wrote to memory of 676 2004 omrjw.exe omrjw.exe PID 1264 wrote to memory of 1704 1264 Explorer.EXE control.exe PID 1264 wrote to memory of 1704 1264 Explorer.EXE control.exe PID 1264 wrote to memory of 1704 1264 Explorer.EXE control.exe PID 1264 wrote to memory of 1704 1264 Explorer.EXE control.exe PID 1704 wrote to memory of 1744 1704 control.exe cmd.exe PID 1704 wrote to memory of 1744 1704 control.exe cmd.exe PID 1704 wrote to memory of 1744 1704 control.exe cmd.exe PID 1704 wrote to memory of 1744 1704 control.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\542ef4a811e2fa45e96efe1602acd737.exe"C:\Users\Admin\AppData\Local\Temp\542ef4a811e2fa45e96efe1602acd737.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\omrjw.exe"C:\Users\Admin\AppData\Local\Temp\omrjw.exe" C:\Users\Admin\AppData\Local\Temp\lnbvfzmz.kjd3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\omrjw.exe"C:\Users\Admin\AppData\Local\Temp\omrjw.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\omrjw.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\lnbvfzmz.kjdFilesize
5KB
MD56708008ed1049596aea130d698b95b72
SHA1cd85c88ca9bcdf443b2618e58602bc5da2ab2606
SHA2562c8cab39aba9cb704c658e1f2174319e645f1249b8bd4b996569daba4b877cdd
SHA512cb506c5bf424465937a836996a35bf3a2625f3de6f7b9ab1a76b8f9245f387a5a6866eca009345782c1e96adb1c1610c73ae179feac11f409fe5bd1eea12e485
-
C:\Users\Admin\AppData\Local\Temp\omrjw.exeFilesize
159KB
MD55ae8e4fca84468df1846f5a3a2fbf24f
SHA11a4ef0d31bd8586986b8c99e69755a55bb9d20b5
SHA25640c5f58f008ac0a8afda1b37bc1c6fa4a8f7e748d957bc54a9195d06bcaf8611
SHA5123328b0a8b3b92f807e4f6aa4c59bf0f97c9aecbfdd4a66555fa3d1ea1e0bb49128dee76ec97c44b192b301716a0f2ce9f5d258ba25bfbdec5619ccea6e07c8f2
-
C:\Users\Admin\AppData\Local\Temp\omrjw.exeFilesize
159KB
MD55ae8e4fca84468df1846f5a3a2fbf24f
SHA11a4ef0d31bd8586986b8c99e69755a55bb9d20b5
SHA25640c5f58f008ac0a8afda1b37bc1c6fa4a8f7e748d957bc54a9195d06bcaf8611
SHA5123328b0a8b3b92f807e4f6aa4c59bf0f97c9aecbfdd4a66555fa3d1ea1e0bb49128dee76ec97c44b192b301716a0f2ce9f5d258ba25bfbdec5619ccea6e07c8f2
-
C:\Users\Admin\AppData\Local\Temp\omrjw.exeFilesize
159KB
MD55ae8e4fca84468df1846f5a3a2fbf24f
SHA11a4ef0d31bd8586986b8c99e69755a55bb9d20b5
SHA25640c5f58f008ac0a8afda1b37bc1c6fa4a8f7e748d957bc54a9195d06bcaf8611
SHA5123328b0a8b3b92f807e4f6aa4c59bf0f97c9aecbfdd4a66555fa3d1ea1e0bb49128dee76ec97c44b192b301716a0f2ce9f5d258ba25bfbdec5619ccea6e07c8f2
-
C:\Users\Admin\AppData\Local\Temp\omrjw.exeFilesize
159KB
MD55ae8e4fca84468df1846f5a3a2fbf24f
SHA11a4ef0d31bd8586986b8c99e69755a55bb9d20b5
SHA25640c5f58f008ac0a8afda1b37bc1c6fa4a8f7e748d957bc54a9195d06bcaf8611
SHA5123328b0a8b3b92f807e4f6aa4c59bf0f97c9aecbfdd4a66555fa3d1ea1e0bb49128dee76ec97c44b192b301716a0f2ce9f5d258ba25bfbdec5619ccea6e07c8f2
-
C:\Users\Admin\AppData\Local\Temp\pczmt.sFilesize
205KB
MD54dd6535840793a7f5b71ee849a03b850
SHA1ef2e3c0890ecec630cf8d544be1715e4c3c0fd90
SHA25695703b208c0c156d13995204ecb4180cddc134345cc2ebfed722d2480fa07122
SHA5123c31b4161c5ea16888d944311525fbf04acd55440bfcf6be62d2c882ad297bd90e64ea5b7f2e930c13a42ce9e2993128ac595bf947f9ef67969931754c8570f3
-
\Users\Admin\AppData\Local\Temp\omrjw.exeFilesize
159KB
MD55ae8e4fca84468df1846f5a3a2fbf24f
SHA11a4ef0d31bd8586986b8c99e69755a55bb9d20b5
SHA25640c5f58f008ac0a8afda1b37bc1c6fa4a8f7e748d957bc54a9195d06bcaf8611
SHA5123328b0a8b3b92f807e4f6aa4c59bf0f97c9aecbfdd4a66555fa3d1ea1e0bb49128dee76ec97c44b192b301716a0f2ce9f5d258ba25bfbdec5619ccea6e07c8f2
-
\Users\Admin\AppData\Local\Temp\omrjw.exeFilesize
159KB
MD55ae8e4fca84468df1846f5a3a2fbf24f
SHA11a4ef0d31bd8586986b8c99e69755a55bb9d20b5
SHA25640c5f58f008ac0a8afda1b37bc1c6fa4a8f7e748d957bc54a9195d06bcaf8611
SHA5123328b0a8b3b92f807e4f6aa4c59bf0f97c9aecbfdd4a66555fa3d1ea1e0bb49128dee76ec97c44b192b301716a0f2ce9f5d258ba25bfbdec5619ccea6e07c8f2
-
\Users\Admin\AppData\Local\Temp\omrjw.exeFilesize
159KB
MD55ae8e4fca84468df1846f5a3a2fbf24f
SHA11a4ef0d31bd8586986b8c99e69755a55bb9d20b5
SHA25640c5f58f008ac0a8afda1b37bc1c6fa4a8f7e748d957bc54a9195d06bcaf8611
SHA5123328b0a8b3b92f807e4f6aa4c59bf0f97c9aecbfdd4a66555fa3d1ea1e0bb49128dee76ec97c44b192b301716a0f2ce9f5d258ba25bfbdec5619ccea6e07c8f2
-
memory/676-74-0x00000000002B0000-0x00000000002C4000-memory.dmpFilesize
80KB
-
memory/676-76-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/676-73-0x0000000000990000-0x0000000000C93000-memory.dmpFilesize
3.0MB
-
memory/676-68-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1264-75-0x0000000004CC0000-0x0000000004DFC000-memory.dmpFilesize
1.2MB
-
memory/1264-72-0x00000000037F0000-0x00000000038F0000-memory.dmpFilesize
1024KB
-
memory/1264-86-0x0000000004E80000-0x0000000004F62000-memory.dmpFilesize
904KB
-
memory/1264-87-0x0000000004E80000-0x0000000004F62000-memory.dmpFilesize
904KB
-
memory/1264-89-0x0000000004E80000-0x0000000004F62000-memory.dmpFilesize
904KB
-
memory/1704-77-0x0000000000880000-0x000000000089F000-memory.dmpFilesize
124KB
-
memory/1704-79-0x0000000000880000-0x000000000089F000-memory.dmpFilesize
124KB
-
memory/1704-80-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/1704-81-0x0000000001F70000-0x0000000002273000-memory.dmpFilesize
3.0MB
-
memory/1704-82-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/1704-85-0x0000000001D40000-0x0000000001DD3000-memory.dmpFilesize
588KB