Analysis
- max time kernel
146s - max time network
128s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:19
Static task
static1
Behavioral task
behavioral1
Sample
TRS0000001062020_pdf.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target TRS0000001062020_pdf.exe
- Size 350KB
- Sample201109-3tkk5eq8m2
- SHA256 590fde182a154cd89b15d88546d60351b9fecb51e04fbbf4affd8d49a618bd23
- MD5 e59f75085d892b91e0400b1d80967cc5
- SHA1 b802bc66d1b347892feb99eb376dc2bc960229ef
- SHA512 61c27168dfe74ba8133713df4df767bbd16551541f554200cf49c442acdc2284eaec45b9e18e8c93303b1babeef6e5f942c9839c4d13aeaa9124793a24c910d8
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
C2
-
http://www.writusp.com/go7/
Decoy
-
reilit.com
-
dynyjys.com
-
710cqc.info
-
vana-world.com
-
sellproductsglobally.com
-
cfanfood.com
-
naturalmovementmaster.com
-
toleranciazero.net
-
forum168.com
-
buffetgalore.com
-
crisisequip.com
-
chicentertainmentgroupinc.com
-
xn--eckweza4e.com
-
zjgj56.com
-
pashmier.com
-
wzert.info
-
easternsierraloghomes.net
-
7pesth9rjq6.biz
-
3-ui.com
-
wwwugv.com
-
cxwgogogo.com
-
mungoaho.com
-
rajeshsurgical.com
-
fengshuiofitbook.com
-
bossbet365.com
-
omg.foundation
-
clickitlb.com
-
boav54.com
-
legacyprofitability.com
-
cheapsk8travels.com
-
inboundtolead.com
-
132robertsln.com
-
mardasyah.com
-
milwaukeemerchantaccount.com
-
mywebanywhere.com
-
nrexperts.com
-
romyrainer.com
-
apksdownload.net
-
prezenttutaj.com
-
cutthewaste.com
-
keripaide.com
-
stektech.com
-
mizhi512.net
-
natacionjanzu.com
-
dianagajdosz.com
-
yourdietguides.com
-
mixjockey.photography
-
chuyenhangtrung.com
-
exclusivascofradesdelsur.com
-
statsmyapp.com
-
zhengyi-edu.com
-
texelana.net
-
fomsqi.win
-
entertainmentfromthecloud.com
-
chiefsvpatriots.com
-
summerhillmanagement.net
-
bluehillfarmstand.info
-
majestachern.com
-
thoawho.net
-
maineseaweedexchange.com
-
flytdubs.com
-
ie2tv.com
-
titangelman.com
-
cyndiesmithdesigns.com
Signatures
- Formbook Payload 1 IoCs
resource yara_rule behavioral2/memory/3772-1-0x0000000000000000-mapping.dmp formbook - Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run cscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\6LMLVZIX = "C:\\Program Files (x86)\\Mjfjtg\\znylvbl8ttvtt2.exe" cscript.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2868 set thread context of 3028 2868 TRS0000001062020_pdf.exe 57 PID 3772 set thread context of 3028 3772 cscript.exe 57 - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Mjfjtg\znylvbl8ttvtt2.exe cscript.exe -
description ioc Process Key created \Registry\User\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 cscript.exe - Suspicious behavior: EnumeratesProcesses 52 IoCs
pid Process 2868 TRS0000001062020_pdf.exe 2868 TRS0000001062020_pdf.exe 2868 TRS0000001062020_pdf.exe 2868 TRS0000001062020_pdf.exe 3772 cscript.exe 3772 cscript.exe 3772 cscript.exe 3772 cscript.exe 3772 cscript.exe 3772 cscript.exe 3772 cscript.exe 3772 cscript.exe 3772 cscript.exe 3772 cscript.exe 3772 cscript.exe 3772 cscript.exe 3772 cscript.exe 3772 cscript.exe 3772 cscript.exe 3772 cscript.exe 3772 cscript.exe 3772 cscript.exe 3772 cscript.exe 3772 cscript.exe 3772 cscript.exe 3772 cscript.exe 3772 cscript.exe 3772 cscript.exe 3772 cscript.exe 3772 cscript.exe 3772 cscript.exe 3772 cscript.exe 3772 cscript.exe 3772 cscript.exe 3772 cscript.exe 3772 cscript.exe 3772 cscript.exe 3772 cscript.exe 3772 cscript.exe 3772 cscript.exe 3772 cscript.exe 3772 cscript.exe 3772 cscript.exe 3772 cscript.exe 3772 cscript.exe 3772 cscript.exe 3772 cscript.exe 3772 cscript.exe 3772 cscript.exe 3772 cscript.exe 3772 cscript.exe 3772 cscript.exe - Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 2868 TRS0000001062020_pdf.exe 2868 TRS0000001062020_pdf.exe 2868 TRS0000001062020_pdf.exe 3772 cscript.exe 3772 cscript.exe 3772 cscript.exe 3772 cscript.exe - Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 2868 TRS0000001062020_pdf.exe Token: SeShutdownPrivilege 3028 Explorer.EXE Token: SeCreatePagefilePrivilege 3028 Explorer.EXE Token: SeShutdownPrivilege 3028 Explorer.EXE Token: SeCreatePagefilePrivilege 3028 Explorer.EXE Token: SeDebugPrivilege 3772 cscript.exe Token: SeShutdownPrivilege 3028 Explorer.EXE Token: SeCreatePagefilePrivilege 3028 Explorer.EXE Token: SeShutdownPrivilege 3028 Explorer.EXE Token: SeCreatePagefilePrivilege 3028 Explorer.EXE - Suspicious use of UnmapMainImage 1 IoCs
pid Process 3028 Explorer.EXE - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3028 wrote to memory of 3772 3028 Explorer.EXE 78 PID 3028 wrote to memory of 3772 3028 Explorer.EXE 78 PID 3028 wrote to memory of 3772 3028 Explorer.EXE 78 PID 3772 wrote to memory of 32 3772 cscript.exe 79 PID 3772 wrote to memory of 32 3772 cscript.exe 79 PID 3772 wrote to memory of 32 3772 cscript.exe 79 PID 3772 wrote to memory of 2652 3772 cscript.exe 81 PID 3772 wrote to memory of 2652 3772 cscript.exe 81 PID 3772 wrote to memory of 2652 3772 cscript.exe 81 - System policy modification 1 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer cscript.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\TRS0000001062020_pdf.exe"C:\Users\Admin\AppData\Local\Temp\TRS0000001062020_pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2868
-
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Adds policy Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3772 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\TRS0000001062020_pdf.exe"3⤵PID:32
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:2652
-
-