Analysis
-
max time kernel
149s -
max time network
130s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
12-01-2021 20:49
Static task
static1
Behavioral task
behavioral1
Sample
Project review_Pdf.exe
Resource
win7v20201028
General
-
Target
Project review_Pdf.exe
-
Size
887KB
-
MD5
75cdd33d69536dd19e8d0d1bf70a6407
-
SHA1
5c15819e25ad22325097863803a639ab205d17e2
-
SHA256
cf63918e0cb789a778c7eac7c1b5d896db35caa3fa9fd179b95a4101f5856af7
-
SHA512
732a9f7d96fd1c3ed500bda65ae02a1a04c774d409d4dab853b1c10145af10c3a81691cecb085d4925ca0c596ce2a6892ba14291427128a21768f657066fe417
Malware Config
Extracted
formbook
http://www.workonlinetimallen.com/dll/
nyeconcreations.com
generar-k.com
refugiodelmate.com
elementclubhouse.com
freescorrs.xyz
tonesweettone.com
lojachicco.com
cyberxchange.net
strobelsolutions.com
tipsytravelerbar.com
shesheofnewyork.com
jdallmed.com
woefys.online
naviwatch.net
yuelvzuche.com
thehoneysuppliers.site
smokindeebflavors.com
preventvaccins.com
thepraisehouse.com
lgbtpridedirectory.com
bestconcretelifting.com
commissary.xyz
jakeleeeakin.info
partakpakhsh.com
mystyleonline.online
brunoloulopes.com
softwarexcompanies.com
stockincloud.net
volemate.com
pubjek.com
miamibotany.com
khoing.com
abdpublicidad.com
sundialandpanel.com
latitiaseymour.xyz
ameluskajewelry.net
coltivazioneelementare.info
ontoicase.com
coeurdeconscience.com
komgo.net
literatur.site
shopbrandnew.com
propertiesnaija.com
vaca2day.net
laytikes.com
cryptocustodianship.com
chicagoarthaus.com
worm-tea.com
purchase-support.com
cdamultisport.com
capecodmicrowedding.com
firsttimehomebuyerusinfo.com
thedeepdivelab.com
xn--eiswrfelform-glb.com
oceanupdate.xyz
s8agency.com
lovethybodi.com
xeonnet.com
verificationrelay.xyz
0310li.com
richardpanitch.com
jaydenmichaelgouchie.com
oiltankremovaljc.com
olenfex.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3140-12-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/3140-13-0x000000000041EBD0-mapping.dmp formbook behavioral2/memory/744-14-0x0000000000000000-mapping.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Project review_Pdf.exeProject review_Pdf.exechkdsk.exedescription pid process target process PID 3976 set thread context of 3140 3976 Project review_Pdf.exe Project review_Pdf.exe PID 3140 set thread context of 3020 3140 Project review_Pdf.exe Explorer.EXE PID 744 set thread context of 3020 744 chkdsk.exe Explorer.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 40 IoCs
Processes:
Project review_Pdf.exechkdsk.exepid process 3140 Project review_Pdf.exe 3140 Project review_Pdf.exe 3140 Project review_Pdf.exe 3140 Project review_Pdf.exe 744 chkdsk.exe 744 chkdsk.exe 744 chkdsk.exe 744 chkdsk.exe 744 chkdsk.exe 744 chkdsk.exe 744 chkdsk.exe 744 chkdsk.exe 744 chkdsk.exe 744 chkdsk.exe 744 chkdsk.exe 744 chkdsk.exe 744 chkdsk.exe 744 chkdsk.exe 744 chkdsk.exe 744 chkdsk.exe 744 chkdsk.exe 744 chkdsk.exe 744 chkdsk.exe 744 chkdsk.exe 744 chkdsk.exe 744 chkdsk.exe 744 chkdsk.exe 744 chkdsk.exe 744 chkdsk.exe 744 chkdsk.exe 744 chkdsk.exe 744 chkdsk.exe 744 chkdsk.exe 744 chkdsk.exe 744 chkdsk.exe 744 chkdsk.exe 744 chkdsk.exe 744 chkdsk.exe 744 chkdsk.exe 744 chkdsk.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Project review_Pdf.exechkdsk.exepid process 3140 Project review_Pdf.exe 3140 Project review_Pdf.exe 3140 Project review_Pdf.exe 744 chkdsk.exe 744 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Project review_Pdf.exechkdsk.exedescription pid process Token: SeDebugPrivilege 3140 Project review_Pdf.exe Token: SeDebugPrivilege 744 chkdsk.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3020 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Project review_Pdf.exeExplorer.EXEchkdsk.exedescription pid process target process PID 3976 wrote to memory of 3140 3976 Project review_Pdf.exe Project review_Pdf.exe PID 3976 wrote to memory of 3140 3976 Project review_Pdf.exe Project review_Pdf.exe PID 3976 wrote to memory of 3140 3976 Project review_Pdf.exe Project review_Pdf.exe PID 3976 wrote to memory of 3140 3976 Project review_Pdf.exe Project review_Pdf.exe PID 3976 wrote to memory of 3140 3976 Project review_Pdf.exe Project review_Pdf.exe PID 3976 wrote to memory of 3140 3976 Project review_Pdf.exe Project review_Pdf.exe PID 3020 wrote to memory of 744 3020 Explorer.EXE chkdsk.exe PID 3020 wrote to memory of 744 3020 Explorer.EXE chkdsk.exe PID 3020 wrote to memory of 744 3020 Explorer.EXE chkdsk.exe PID 744 wrote to memory of 3368 744 chkdsk.exe cmd.exe PID 744 wrote to memory of 3368 744 chkdsk.exe cmd.exe PID 744 wrote to memory of 3368 744 chkdsk.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Project review_Pdf.exe"C:\Users\Admin\AppData\Local\Temp\Project review_Pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Project review_Pdf.exe"C:\Users\Admin\AppData\Local\Temp\Project review_Pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Project review_Pdf.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/744-18-0x0000000001130000-0x0000000001200000-memory.dmpFilesize
832KB
-
memory/744-16-0x0000000001320000-0x000000000132A000-memory.dmpFilesize
40KB
-
memory/744-15-0x0000000001320000-0x000000000132A000-memory.dmpFilesize
40KB
-
memory/744-14-0x0000000000000000-mapping.dmp
-
memory/3140-12-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/3140-13-0x000000000041EBD0-mapping.dmp
-
memory/3368-17-0x0000000000000000-mapping.dmp
-
memory/3976-7-0x0000000004C70000-0x0000000004C71000-memory.dmpFilesize
4KB
-
memory/3976-11-0x0000000005A70000-0x0000000005ADD000-memory.dmpFilesize
436KB
-
memory/3976-10-0x0000000002500000-0x0000000002512000-memory.dmpFilesize
72KB
-
memory/3976-9-0x0000000004DE0000-0x0000000004DE1000-memory.dmpFilesize
4KB
-
memory/3976-8-0x00000000024F0000-0x00000000024F1000-memory.dmpFilesize
4KB
-
memory/3976-2-0x0000000073920000-0x000000007400E000-memory.dmpFilesize
6.9MB
-
memory/3976-6-0x0000000005170000-0x0000000005171000-memory.dmpFilesize
4KB
-
memory/3976-5-0x0000000004BD0000-0x0000000004BD1000-memory.dmpFilesize
4KB
-
memory/3976-3-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB