Analysis
-
max time kernel
146s -
max time network
12s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
15-01-2021 07:22
Static task
static1
Behavioral task
behavioral1
Sample
SCAN_20210115140930669.exe
Resource
win7v20201028
General
-
Target
SCAN_20210115140930669.exe
-
Size
892KB
-
MD5
c0aa1598d486cceab2fdea9a6c41ac0e
-
SHA1
21263c3f531b81d949bf15c486bc3aeb16b9bb00
-
SHA256
7aa65f77c48841f9f1545c2e5bb7cb186cd259631c4c449400206f1bb3d16d5e
-
SHA512
2bba64e13254b3b5dfe98fac0681335a23a801065ffc1a69a80e63d8144067f98edb8c0b252ab8953ac78798dc4b23e4bff188d9ad3508997f6dfa4b7e987c65
Malware Config
Extracted
formbook
http://www.midnightblueinc.com/2kf/
edmondscakes.com
doublewldr.online
tickets2usa.com
heyhxry.com
weightloss-gulfport.com
prosselius.com
newviewroofers.com
jacksonarearealestate.com
catparkas.xyz
pagos2020.com
sonwsefjrahi.online
franchisethings.com
nuocvietngaynay.com
sohelvai.com
mikeyroush.com
lamesaroofing.com
betbigo138.com
amazon-service-recovery.com
clockin.net
riostrader.com
novergi.com
bounethone.online
unsaluted-muckworm.info
qmglg.com
trans-chna.com
bloom-cottage.info
espacioholista.com
vitrines72.com
vtnywveb.club
shelfdryrock.com
lowcountrykindermusik.com
brendolangiovanni.com
samilisback.com
coffeeofmyheart.com
moderndetailist.com
royalparkhotelandsuites.com
camsick.com
khoetuthiennhien.com
link-glue.com
zzirk.com
alyxthorne.com
tristateinsurancegroup.com
pdztwl.com
basecampmedics.com
orionbilisim.net
comaholic.com
sai-re.com
mimmodetullio.net
thevyvd.com
bookstorie.com
preparednessnow.net
lvtvmounting.com
anchondowedding.com
the-florida-accident-md.com
indyspirits.com
culture-of-safety.com
blue-003.com
federation-advens.com
junmedicare.com
qjnhilfhs.icu
chesed72.com
kingrvrentals.com
greenlightsuccesscoach.com
efrenjose.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1700-9-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1700-10-0x000000000041EB30-mapping.dmp formbook behavioral1/memory/1312-11-0x0000000000000000-mapping.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1848 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
SCAN_20210115140930669.exeSCAN_20210115140930669.exechkdsk.exedescription pid process target process PID 1840 set thread context of 1700 1840 SCAN_20210115140930669.exe SCAN_20210115140930669.exe PID 1700 set thread context of 1196 1700 SCAN_20210115140930669.exe Explorer.EXE PID 1700 set thread context of 1196 1700 SCAN_20210115140930669.exe Explorer.EXE PID 1312 set thread context of 1196 1312 chkdsk.exe Explorer.EXE -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 19 IoCs
Processes:
SCAN_20210115140930669.exechkdsk.exepid process 1700 SCAN_20210115140930669.exe 1700 SCAN_20210115140930669.exe 1700 SCAN_20210115140930669.exe 1312 chkdsk.exe 1312 chkdsk.exe 1312 chkdsk.exe 1312 chkdsk.exe 1312 chkdsk.exe 1312 chkdsk.exe 1312 chkdsk.exe 1312 chkdsk.exe 1312 chkdsk.exe 1312 chkdsk.exe 1312 chkdsk.exe 1312 chkdsk.exe 1312 chkdsk.exe 1312 chkdsk.exe 1312 chkdsk.exe 1312 chkdsk.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
SCAN_20210115140930669.exechkdsk.exepid process 1700 SCAN_20210115140930669.exe 1700 SCAN_20210115140930669.exe 1700 SCAN_20210115140930669.exe 1700 SCAN_20210115140930669.exe 1312 chkdsk.exe 1312 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
SCAN_20210115140930669.exechkdsk.exedescription pid process Token: SeDebugPrivilege 1700 SCAN_20210115140930669.exe Token: SeDebugPrivilege 1312 chkdsk.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1196 Explorer.EXE 1196 Explorer.EXE 1196 Explorer.EXE 1196 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1196 Explorer.EXE 1196 Explorer.EXE 1196 Explorer.EXE 1196 Explorer.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
SCAN_20210115140930669.exeExplorer.EXEchkdsk.exedescription pid process target process PID 1840 wrote to memory of 1300 1840 SCAN_20210115140930669.exe schtasks.exe PID 1840 wrote to memory of 1300 1840 SCAN_20210115140930669.exe schtasks.exe PID 1840 wrote to memory of 1300 1840 SCAN_20210115140930669.exe schtasks.exe PID 1840 wrote to memory of 1300 1840 SCAN_20210115140930669.exe schtasks.exe PID 1840 wrote to memory of 1700 1840 SCAN_20210115140930669.exe SCAN_20210115140930669.exe PID 1840 wrote to memory of 1700 1840 SCAN_20210115140930669.exe SCAN_20210115140930669.exe PID 1840 wrote to memory of 1700 1840 SCAN_20210115140930669.exe SCAN_20210115140930669.exe PID 1840 wrote to memory of 1700 1840 SCAN_20210115140930669.exe SCAN_20210115140930669.exe PID 1840 wrote to memory of 1700 1840 SCAN_20210115140930669.exe SCAN_20210115140930669.exe PID 1840 wrote to memory of 1700 1840 SCAN_20210115140930669.exe SCAN_20210115140930669.exe PID 1840 wrote to memory of 1700 1840 SCAN_20210115140930669.exe SCAN_20210115140930669.exe PID 1196 wrote to memory of 1312 1196 Explorer.EXE chkdsk.exe PID 1196 wrote to memory of 1312 1196 Explorer.EXE chkdsk.exe PID 1196 wrote to memory of 1312 1196 Explorer.EXE chkdsk.exe PID 1196 wrote to memory of 1312 1196 Explorer.EXE chkdsk.exe PID 1312 wrote to memory of 1848 1312 chkdsk.exe cmd.exe PID 1312 wrote to memory of 1848 1312 chkdsk.exe cmd.exe PID 1312 wrote to memory of 1848 1312 chkdsk.exe cmd.exe PID 1312 wrote to memory of 1848 1312 chkdsk.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SCAN_20210115140930669.exe"C:\Users\Admin\AppData\Local\Temp\SCAN_20210115140930669.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CuWqoOcxq" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4F0A.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\SCAN_20210115140930669.exe"C:\Users\Admin\AppData\Local\Temp\SCAN_20210115140930669.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\SCAN_20210115140930669.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp4F0A.tmpMD5
0860d69be3ca8e253785e0b85151d500
SHA172f56430c14508e767fb471b0996a8b4b788e1bd
SHA256c136fa6d0060d93637e1fb0f69bbb5d643177a3d4af55c1c40f0b401ac3bcb92
SHA512f8b7478c8beb9b9b20d84e43a58b2c77b74472f85aee254b86b8d388b1d631fc034801f41544c8a505e99357c918f14740f39f063c146dea1e3949bd87799607
-
memory/1300-7-0x0000000000000000-mapping.dmp
-
memory/1312-11-0x0000000000000000-mapping.dmp
-
memory/1312-12-0x0000000000B00000-0x0000000000B07000-memory.dmpFilesize
28KB
-
memory/1312-14-0x0000000003180000-0x000000000329E000-memory.dmpFilesize
1.1MB
-
memory/1700-9-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1700-10-0x000000000041EB30-mapping.dmp
-
memory/1840-2-0x00000000749E0000-0x00000000750CE000-memory.dmpFilesize
6.9MB
-
memory/1840-3-0x0000000000EA0000-0x0000000000EA1000-memory.dmpFilesize
4KB
-
memory/1840-5-0x0000000000540000-0x0000000000552000-memory.dmpFilesize
72KB
-
memory/1840-6-0x0000000004F90000-0x0000000004FF6000-memory.dmpFilesize
408KB
-
memory/1848-13-0x0000000000000000-mapping.dmp