Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
10-05-2023 01:01
Static task
static1
Behavioral task
behavioral1
Sample
c1a8208a8af8fb2ab397e586ea8a7f265921e6f21eb592af42a8f5c805d18557.exe
Resource
win7-20230220-en
General
-
Target
c1a8208a8af8fb2ab397e586ea8a7f265921e6f21eb592af42a8f5c805d18557.exe
-
Size
586KB
-
MD5
0e17be44ab5949aa7e8c435c724d7fe4
-
SHA1
1ecd4bc58605af6eb4566fc14df40275523dbe8b
-
SHA256
c1a8208a8af8fb2ab397e586ea8a7f265921e6f21eb592af42a8f5c805d18557
-
SHA512
c766ae02363a7935da65d5173abd1a9a6371d258a6f323bbfb6a8e785c503c39a4cd945b85febe2acbbeced309678cc77511433e366e0215b121133cb85cc536
-
SSDEEP
12288:NHTZxe6aa8B9y8y04ogPZn96ryMj4+7hBQarT:NHNxe6r04hnQ9B
Malware Config
Extracted
formbook
4.1
m82
jamesdevereux.com
artificialturfminneapolis.com
hongmeiyan.com
lojaderoupasbr.com
yit.africa
austinrelocationexpert.com
saiva.page
exitsategy.com
chochonux.com
klosterbraeu-unterliezheim.com
byseymanur.com
sblwarwickshire.co.uk
brazimaid.com
ciogame.com
bronzesailing.com
dwkapl.xyz
022dyd.com
compassandpathwriting.com
alphabet1x.com
selfcleaninghairbrush.co.uk
power-bank.co.uk
kickskaart.com
baumanbilliardsnv.com
bestcp.net
doghospitalnearme.com
mixano.africa
helarybaber.online
illubio.com
ciutas.com
ldpr33.ru
killtheblacks.com
cassino-portugal.com
danhaii.com
gvtowingservice.com
let-travel.africa
dental-implants-67128.com
facetaxi.xyz
ctjh9u8e.vip
kyosaiohruri.com
executivepresencetrainer.com
greatharmony.africa
feelingsarereal.com
devopsuday.club
happiestminds-udemy.com
fittingstands.com
happyhousegarment.com
24daysofheaven.com
herhustlenation.com
xn--oy2b27nt6b.net
hothotcogixem.online
hausmeisterservice-berlin.net
hjddbb.com
stoutfamilychiro.com
bookishthoughtsbychristy.com
gibellinaheartquake.com
8cf1utrb6.xyz
patrick-daggitt.com
ebcbank.net
angel909reviews.com
arcteryxsouthafricaonline.com
cutematvhy.com
art2z.com
bulkforeverstamps.com
heatbling.com
despachocontablequinsa.com
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4400-146-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4400-165-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2692-193-0x0000000000E20000-0x0000000000E4F000-memory.dmp formbook behavioral2/memory/2692-197-0x0000000000E20000-0x0000000000E4F000-memory.dmp formbook -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
c1a8208a8af8fb2ab397e586ea8a7f265921e6f21eb592af42a8f5c805d18557.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation c1a8208a8af8fb2ab397e586ea8a7f265921e6f21eb592af42a8f5c805d18557.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
c1a8208a8af8fb2ab397e586ea8a7f265921e6f21eb592af42a8f5c805d18557.exeRegSvcs.exerundll32.exedescription pid process target process PID 4932 set thread context of 4400 4932 c1a8208a8af8fb2ab397e586ea8a7f265921e6f21eb592af42a8f5c805d18557.exe RegSvcs.exe PID 4400 set thread context of 3184 4400 RegSvcs.exe Explorer.EXE PID 2692 set thread context of 3184 2692 rundll32.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 46 IoCs
Processes:
c1a8208a8af8fb2ab397e586ea8a7f265921e6f21eb592af42a8f5c805d18557.exepowershell.exeRegSvcs.exerundll32.exepid process 4932 c1a8208a8af8fb2ab397e586ea8a7f265921e6f21eb592af42a8f5c805d18557.exe 4932 c1a8208a8af8fb2ab397e586ea8a7f265921e6f21eb592af42a8f5c805d18557.exe 5080 powershell.exe 4400 RegSvcs.exe 4400 RegSvcs.exe 4400 RegSvcs.exe 4400 RegSvcs.exe 5080 powershell.exe 2692 rundll32.exe 2692 rundll32.exe 2692 rundll32.exe 2692 rundll32.exe 2692 rundll32.exe 2692 rundll32.exe 2692 rundll32.exe 2692 rundll32.exe 2692 rundll32.exe 2692 rundll32.exe 2692 rundll32.exe 2692 rundll32.exe 2692 rundll32.exe 2692 rundll32.exe 2692 rundll32.exe 2692 rundll32.exe 2692 rundll32.exe 2692 rundll32.exe 2692 rundll32.exe 2692 rundll32.exe 2692 rundll32.exe 2692 rundll32.exe 2692 rundll32.exe 2692 rundll32.exe 2692 rundll32.exe 2692 rundll32.exe 2692 rundll32.exe 2692 rundll32.exe 2692 rundll32.exe 2692 rundll32.exe 2692 rundll32.exe 2692 rundll32.exe 2692 rundll32.exe 2692 rundll32.exe 2692 rundll32.exe 2692 rundll32.exe 2692 rundll32.exe 2692 rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3184 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.exerundll32.exepid process 4400 RegSvcs.exe 4400 RegSvcs.exe 4400 RegSvcs.exe 2692 rundll32.exe 2692 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
c1a8208a8af8fb2ab397e586ea8a7f265921e6f21eb592af42a8f5c805d18557.exepowershell.exeRegSvcs.exerundll32.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 4932 c1a8208a8af8fb2ab397e586ea8a7f265921e6f21eb592af42a8f5c805d18557.exe Token: SeDebugPrivilege 5080 powershell.exe Token: SeDebugPrivilege 4400 RegSvcs.exe Token: SeDebugPrivilege 2692 rundll32.exe Token: SeShutdownPrivilege 3184 Explorer.EXE Token: SeCreatePagefilePrivilege 3184 Explorer.EXE Token: SeShutdownPrivilege 3184 Explorer.EXE Token: SeCreatePagefilePrivilege 3184 Explorer.EXE Token: SeShutdownPrivilege 3184 Explorer.EXE Token: SeCreatePagefilePrivilege 3184 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
c1a8208a8af8fb2ab397e586ea8a7f265921e6f21eb592af42a8f5c805d18557.exeExplorer.EXErundll32.exedescription pid process target process PID 4932 wrote to memory of 5080 4932 c1a8208a8af8fb2ab397e586ea8a7f265921e6f21eb592af42a8f5c805d18557.exe powershell.exe PID 4932 wrote to memory of 5080 4932 c1a8208a8af8fb2ab397e586ea8a7f265921e6f21eb592af42a8f5c805d18557.exe powershell.exe PID 4932 wrote to memory of 5080 4932 c1a8208a8af8fb2ab397e586ea8a7f265921e6f21eb592af42a8f5c805d18557.exe powershell.exe PID 4932 wrote to memory of 528 4932 c1a8208a8af8fb2ab397e586ea8a7f265921e6f21eb592af42a8f5c805d18557.exe schtasks.exe PID 4932 wrote to memory of 528 4932 c1a8208a8af8fb2ab397e586ea8a7f265921e6f21eb592af42a8f5c805d18557.exe schtasks.exe PID 4932 wrote to memory of 528 4932 c1a8208a8af8fb2ab397e586ea8a7f265921e6f21eb592af42a8f5c805d18557.exe schtasks.exe PID 4932 wrote to memory of 4400 4932 c1a8208a8af8fb2ab397e586ea8a7f265921e6f21eb592af42a8f5c805d18557.exe RegSvcs.exe PID 4932 wrote to memory of 4400 4932 c1a8208a8af8fb2ab397e586ea8a7f265921e6f21eb592af42a8f5c805d18557.exe RegSvcs.exe PID 4932 wrote to memory of 4400 4932 c1a8208a8af8fb2ab397e586ea8a7f265921e6f21eb592af42a8f5c805d18557.exe RegSvcs.exe PID 4932 wrote to memory of 4400 4932 c1a8208a8af8fb2ab397e586ea8a7f265921e6f21eb592af42a8f5c805d18557.exe RegSvcs.exe PID 4932 wrote to memory of 4400 4932 c1a8208a8af8fb2ab397e586ea8a7f265921e6f21eb592af42a8f5c805d18557.exe RegSvcs.exe PID 4932 wrote to memory of 4400 4932 c1a8208a8af8fb2ab397e586ea8a7f265921e6f21eb592af42a8f5c805d18557.exe RegSvcs.exe PID 3184 wrote to memory of 2692 3184 Explorer.EXE rundll32.exe PID 3184 wrote to memory of 2692 3184 Explorer.EXE rundll32.exe PID 3184 wrote to memory of 2692 3184 Explorer.EXE rundll32.exe PID 2692 wrote to memory of 1536 2692 rundll32.exe cmd.exe PID 2692 wrote to memory of 1536 2692 rundll32.exe cmd.exe PID 2692 wrote to memory of 1536 2692 rundll32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c1a8208a8af8fb2ab397e586ea8a7f265921e6f21eb592af42a8f5c805d18557.exe"C:\Users\Admin\AppData\Local\Temp\c1a8208a8af8fb2ab397e586ea8a7f265921e6f21eb592af42a8f5c805d18557.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\TOgHWtRrFhnWSR.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TOgHWtRrFhnWSR" /XML "C:\Users\Admin\AppData\Local\Temp\tmp39EC.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yu311i4b.lmc.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmp39EC.tmpFilesize
1KB
MD55d62bb428e8d36ad5bb0a5a290d5051c
SHA1ccd50ffa986f92042ab4559c99e3785d873e7b49
SHA2565e316f408a134e8a0f69280439440f96b4aee93fee42f8cfce06e89c96b605a6
SHA5122e7646124f5a3e0fd40ccd3e302a6624ce25ccda9c12b6eb3795b8c4c40a5bfe9f2dd18e96d043a749cb8975ba4c0d7b256738979103809836232dbb9b68870d
-
memory/2692-199-0x0000000002B50000-0x0000000002BE4000-memory.dmpFilesize
592KB
-
memory/2692-197-0x0000000000E20000-0x0000000000E4F000-memory.dmpFilesize
188KB
-
memory/2692-194-0x0000000002D00000-0x000000000304A000-memory.dmpFilesize
3.3MB
-
memory/2692-193-0x0000000000E20000-0x0000000000E4F000-memory.dmpFilesize
188KB
-
memory/2692-189-0x0000000000220000-0x0000000000234000-memory.dmpFilesize
80KB
-
memory/2692-187-0x0000000000220000-0x0000000000234000-memory.dmpFilesize
80KB
-
memory/3184-211-0x0000000002630000-0x0000000002640000-memory.dmpFilesize
64KB
-
memory/3184-220-0x0000000002630000-0x0000000002640000-memory.dmpFilesize
64KB
-
memory/3184-231-0x0000000002830000-0x0000000002840000-memory.dmpFilesize
64KB
-
memory/3184-230-0x0000000002830000-0x0000000002840000-memory.dmpFilesize
64KB
-
memory/3184-229-0x0000000002820000-0x0000000002822000-memory.dmpFilesize
8KB
-
memory/3184-227-0x0000000002830000-0x0000000002840000-memory.dmpFilesize
64KB
-
memory/3184-226-0x0000000002830000-0x0000000002840000-memory.dmpFilesize
64KB
-
memory/3184-201-0x0000000008310000-0x00000000083F5000-memory.dmpFilesize
916KB
-
memory/3184-225-0x0000000002830000-0x0000000002840000-memory.dmpFilesize
64KB
-
memory/3184-223-0x0000000002630000-0x0000000002640000-memory.dmpFilesize
64KB
-
memory/3184-203-0x0000000008310000-0x00000000083F5000-memory.dmpFilesize
916KB
-
memory/3184-222-0x0000000002630000-0x0000000002640000-memory.dmpFilesize
64KB
-
memory/3184-206-0x0000000002630000-0x0000000002640000-memory.dmpFilesize
64KB
-
memory/3184-168-0x0000000007DE0000-0x0000000007F2E000-memory.dmpFilesize
1.3MB
-
memory/3184-221-0x0000000002630000-0x0000000002640000-memory.dmpFilesize
64KB
-
memory/3184-200-0x0000000008310000-0x00000000083F5000-memory.dmpFilesize
916KB
-
memory/3184-219-0x0000000002630000-0x0000000002640000-memory.dmpFilesize
64KB
-
memory/3184-218-0x0000000002630000-0x0000000002640000-memory.dmpFilesize
64KB
-
memory/3184-217-0x0000000002630000-0x0000000002640000-memory.dmpFilesize
64KB
-
memory/3184-216-0x0000000002630000-0x0000000002640000-memory.dmpFilesize
64KB
-
memory/3184-212-0x0000000002820000-0x0000000002822000-memory.dmpFilesize
8KB
-
memory/3184-215-0x0000000002630000-0x0000000002640000-memory.dmpFilesize
64KB
-
memory/3184-214-0x0000000002830000-0x0000000002840000-memory.dmpFilesize
64KB
-
memory/3184-213-0x0000000002630000-0x0000000002640000-memory.dmpFilesize
64KB
-
memory/3184-210-0x0000000002630000-0x0000000002640000-memory.dmpFilesize
64KB
-
memory/3184-209-0x0000000002630000-0x0000000002640000-memory.dmpFilesize
64KB
-
memory/3184-208-0x0000000002630000-0x0000000002640000-memory.dmpFilesize
64KB
-
memory/3184-207-0x0000000002630000-0x0000000002640000-memory.dmpFilesize
64KB
-
memory/4400-167-0x0000000000DF0000-0x0000000000E05000-memory.dmpFilesize
84KB
-
memory/4400-146-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4400-165-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4400-161-0x0000000000EA0000-0x00000000011EA000-memory.dmpFilesize
3.3MB
-
memory/4932-136-0x0000000005420000-0x000000000542A000-memory.dmpFilesize
40KB
-
memory/4932-138-0x0000000005460000-0x0000000005470000-memory.dmpFilesize
64KB
-
memory/4932-135-0x0000000005480000-0x0000000005512000-memory.dmpFilesize
584KB
-
memory/4932-137-0x0000000005460000-0x0000000005470000-memory.dmpFilesize
64KB
-
memory/4932-134-0x0000000005A30000-0x0000000005FD4000-memory.dmpFilesize
5.6MB
-
memory/4932-139-0x0000000006D60000-0x0000000006DFC000-memory.dmpFilesize
624KB
-
memory/4932-133-0x00000000009D0000-0x0000000000A68000-memory.dmpFilesize
608KB
-
memory/5080-183-0x00000000076F0000-0x0000000007D6A000-memory.dmpFilesize
6.5MB
-
memory/5080-180-0x0000000006350000-0x000000000636E000-memory.dmpFilesize
120KB
-
memory/5080-191-0x00000000073E0000-0x00000000073FA000-memory.dmpFilesize
104KB
-
memory/5080-186-0x0000000007320000-0x00000000073B6000-memory.dmpFilesize
600KB
-
memory/5080-185-0x0000000007110000-0x000000000711A000-memory.dmpFilesize
40KB
-
memory/5080-184-0x00000000070A0000-0x00000000070BA000-memory.dmpFilesize
104KB
-
memory/5080-192-0x00000000073C0000-0x00000000073C8000-memory.dmpFilesize
32KB
-
memory/5080-182-0x000000007F120000-0x000000007F130000-memory.dmpFilesize
64KB
-
memory/5080-181-0x0000000004940000-0x0000000004950000-memory.dmpFilesize
64KB
-
memory/5080-190-0x00000000072D0000-0x00000000072DE000-memory.dmpFilesize
56KB
-
memory/5080-170-0x0000000070CF0000-0x0000000070D3C000-memory.dmpFilesize
304KB
-
memory/5080-169-0x0000000006F20000-0x0000000006F52000-memory.dmpFilesize
200KB
-
memory/5080-166-0x0000000005D90000-0x0000000005DAE000-memory.dmpFilesize
120KB
-
memory/5080-163-0x0000000004940000-0x0000000004950000-memory.dmpFilesize
64KB
-
memory/5080-162-0x0000000004940000-0x0000000004950000-memory.dmpFilesize
64KB
-
memory/5080-156-0x0000000005720000-0x0000000005786000-memory.dmpFilesize
408KB
-
memory/5080-150-0x00000000056B0000-0x0000000005716000-memory.dmpFilesize
408KB
-
memory/5080-144-0x00000000047C0000-0x00000000047F6000-memory.dmpFilesize
216KB
-
memory/5080-149-0x0000000004CE0000-0x0000000004D02000-memory.dmpFilesize
136KB
-
memory/5080-147-0x0000000004F80000-0x00000000055A8000-memory.dmpFilesize
6.2MB