Analysis
-
max time kernel
147s -
max time network
12s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
19-01-2021 17:54
Static task
static1
Behavioral task
behavioral1
Sample
Shipping Docs_pdf.exe
Resource
win7v20201028
General
-
Target
Shipping Docs_pdf.exe
-
Size
1.4MB
-
MD5
6bcd66deb9a6bddfa3f2329cde1b6126
-
SHA1
e2414d88355d9d1f37c77d1562f1f1c8a2716880
-
SHA256
f3ddc95f31cacb29b7ec70b8dd6f0fb5befb759f7044e491b269417e91037d1d
-
SHA512
731921ac4210c5a4f0227bb4637f9fa525b9f56b88e00bc13fbe4a15579dcd7c762e3d29e6076e3157ba04f9ca9830da2000dc2134e1da8ff44f93bb5b35eb88
Malware Config
Extracted
formbook
http://www.huynhanhdung.com/kna/
lawrencefiredepartment.com
executivehomeoffices.com
solfed.world
oshawaexchange.com
webdavlexstore.com
youpieb.com
chiller-master.com
bearstoragetn.com
daf90x16.com
gewhacaalouine.com
simplyezi.com
cstechnologyservices.com
nosyboats.com
thecocomarie.com
vetinaryeco.club
americangoselfilm.com
gdsuhejia.com
verbunden-sein.net
the-minerva.com
loctrantv.com
casualluvonline.com
groups3usa.com
ncdcnow.com
qrastenmap.online
ltjxw.net
crystalblueboating.com
51adcn.com
abrasto.com
smokegas.com
schofieldoutpost.com
sh-ruidiclub.com
zzyxgl.com
qpremodeling.com
ayzvyeco.icu
modestartgallery.com
ref478.com
astutetopshop.com
pinebarrenfarms.com
webprofiji.com
purfect-air.com
transformesuasaude.com
oz-men.com
mpjjpwp.icu
zeinabiohouse.com
shopwaterlemon.com
radiohebron.com
americanheraldnews.com
clinicadentalfika.com
throughthelorgnette.com
carte-diem.com
elderstatesmanarchive.com
nanhulove.com
melonicwater.com
streamingdads.com
indrapandhari.com
dc-prices.com
xstarconnect.com
weninse.com
atlantavirtualmeetings.com
jobhelpseekers.com
freisaq.com
viajeaatenas.com
worldparcel.net
qcc3.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1536-9-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1536-10-0x000000000041EAB0-mapping.dmp formbook behavioral1/memory/1668-18-0x0000000000080000-0x00000000000AE000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1008 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Shipping Docs_pdf.exeShipping Docs_pdf.exesystray.exedescription pid process target process PID 912 set thread context of 1536 912 Shipping Docs_pdf.exe Shipping Docs_pdf.exe PID 1536 set thread context of 1244 1536 Shipping Docs_pdf.exe Explorer.EXE PID 1668 set thread context of 1244 1668 systray.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
Shipping Docs_pdf.exeShipping Docs_pdf.exesystray.exepid process 912 Shipping Docs_pdf.exe 912 Shipping Docs_pdf.exe 912 Shipping Docs_pdf.exe 1536 Shipping Docs_pdf.exe 1536 Shipping Docs_pdf.exe 1668 systray.exe 1668 systray.exe 1668 systray.exe 1668 systray.exe 1668 systray.exe 1668 systray.exe 1668 systray.exe 1668 systray.exe 1668 systray.exe 1668 systray.exe 1668 systray.exe 1668 systray.exe 1668 systray.exe 1668 systray.exe 1668 systray.exe 1668 systray.exe 1668 systray.exe 1668 systray.exe 1668 systray.exe 1668 systray.exe 1668 systray.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Shipping Docs_pdf.exesystray.exepid process 1536 Shipping Docs_pdf.exe 1536 Shipping Docs_pdf.exe 1536 Shipping Docs_pdf.exe 1668 systray.exe 1668 systray.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Shipping Docs_pdf.exeShipping Docs_pdf.exesystray.exedescription pid process Token: SeDebugPrivilege 912 Shipping Docs_pdf.exe Token: SeDebugPrivilege 1536 Shipping Docs_pdf.exe Token: SeDebugPrivilege 1668 systray.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1244 Explorer.EXE 1244 Explorer.EXE 1244 Explorer.EXE 1244 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1244 Explorer.EXE 1244 Explorer.EXE 1244 Explorer.EXE 1244 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Shipping Docs_pdf.exeExplorer.EXEsystray.exedescription pid process target process PID 912 wrote to memory of 1536 912 Shipping Docs_pdf.exe Shipping Docs_pdf.exe PID 912 wrote to memory of 1536 912 Shipping Docs_pdf.exe Shipping Docs_pdf.exe PID 912 wrote to memory of 1536 912 Shipping Docs_pdf.exe Shipping Docs_pdf.exe PID 912 wrote to memory of 1536 912 Shipping Docs_pdf.exe Shipping Docs_pdf.exe PID 912 wrote to memory of 1536 912 Shipping Docs_pdf.exe Shipping Docs_pdf.exe PID 912 wrote to memory of 1536 912 Shipping Docs_pdf.exe Shipping Docs_pdf.exe PID 912 wrote to memory of 1536 912 Shipping Docs_pdf.exe Shipping Docs_pdf.exe PID 1244 wrote to memory of 1668 1244 Explorer.EXE systray.exe PID 1244 wrote to memory of 1668 1244 Explorer.EXE systray.exe PID 1244 wrote to memory of 1668 1244 Explorer.EXE systray.exe PID 1244 wrote to memory of 1668 1244 Explorer.EXE systray.exe PID 1668 wrote to memory of 1008 1668 systray.exe cmd.exe PID 1668 wrote to memory of 1008 1668 systray.exe cmd.exe PID 1668 wrote to memory of 1008 1668 systray.exe cmd.exe PID 1668 wrote to memory of 1008 1668 systray.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Shipping Docs_pdf.exe"C:\Users\Admin\AppData\Local\Temp\Shipping Docs_pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Shipping Docs_pdf.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Shipping Docs_pdf.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/912-2-0x00000000748D0000-0x0000000074FBE000-memory.dmpFilesize
6.9MB
-
memory/912-3-0x00000000013A0000-0x00000000013A1000-memory.dmpFilesize
4KB
-
memory/912-5-0x0000000000DE0000-0x0000000000E68000-memory.dmpFilesize
544KB
-
memory/912-6-0x00000000002F0000-0x00000000002F1000-memory.dmpFilesize
4KB
-
memory/912-7-0x0000000000350000-0x000000000035E000-memory.dmpFilesize
56KB
-
memory/912-8-0x00000000005B0000-0x00000000005FC000-memory.dmpFilesize
304KB
-
memory/1008-16-0x0000000000000000-mapping.dmp
-
memory/1244-14-0x0000000006F90000-0x00000000070BE000-memory.dmpFilesize
1.2MB
-
memory/1536-10-0x000000000041EAB0-mapping.dmp
-
memory/1536-12-0x0000000000AA0000-0x0000000000DA3000-memory.dmpFilesize
3.0MB
-
memory/1536-13-0x0000000000140000-0x0000000000154000-memory.dmpFilesize
80KB
-
memory/1536-9-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1668-15-0x0000000000000000-mapping.dmp
-
memory/1668-18-0x0000000000080000-0x00000000000AE000-memory.dmpFilesize
184KB
-
memory/1668-19-0x0000000001F60000-0x0000000002263000-memory.dmpFilesize
3.0MB
-
memory/1668-17-0x0000000000560000-0x0000000000565000-memory.dmpFilesize
20KB
-
memory/1668-20-0x0000000001E70000-0x0000000001F03000-memory.dmpFilesize
588KB