Analysis
-
max time kernel
147s -
max time network
140s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
19-01-2021 07:21
Static task
static1
Behavioral task
behavioral1
Sample
Arrival Notice.scr
Resource
win7v20201028
General
-
Target
Arrival Notice.scr
-
Size
1.0MB
-
MD5
4817f2cac71c4d47f1f478d69703db60
-
SHA1
71aaa5e421c5252d4399cacf81a673d84891d1c6
-
SHA256
14ee2894b546ba6d7835ee4dd8e07ef72fb10bfaebec8f1687da4559267cb72e
-
SHA512
efa1e717d902e27ef95f32c73e606798e24dac9c9c612bc6499627fea475fbd06cee4e39fff201bc96f22101ab2acd789b719186bbb6d15f81000a151f1026d0
Malware Config
Extracted
formbook
http://www.thesiromiel.com/kgw/
valentinakasu.com
soyelmatador.com
collaborativeprosperity.com
power8brokers.com
nexus-ink.com
manpasandmeatmarket.com
the-ethical-forums.today
maryannpark.com
bikininbodymommy.com
pxwuo.com
bigbangmerch.com
okaysinger.com
shopcarpe.com
rainbowhillsswimclub.com
crifinmarket.com
ebl-play.net
forceandsonsequipment.com
viagraytqwi.com
latashashop.com
suffocatinglymundanepodcast.com
metanoria.com
camera-kento.com
hotsaledeals.store
outlawgospelshow.com
saisaharashipping.com
buyiprod.com
pestigenix.com
opendesignpodcast.com
patentml.com
covaxbiotech.com
youjar.com
domvy.xyz
remodelmemphis.com
milehighdistributionllc.com
merchandisingpremium.com
fallguysmovile.com
actuelburo.xyz
nedlebow.com
shopcryptocurrency247.com
riellymoore.com
affinitymotorsales.com
akmh.pro
hsrrxs.com
atlanticdentallab.com
sagarpantry.com
murinemodel.com
karybeautycare.com
boshangkeji.com
dailynewstodays.com
oregonpyramids.com
dsjmzyz.com
gidagozlemevi.com
tribelessofficial.com
cyberonica.com
onehourcheckout.com
tenaflypedatrics.com
nbworldfire.com
setyourhead.com
manticore-habitat.com
iqftomatoes.com
fejsearesete.com
gregsgradeaappliancerepair.com
sfmfgco.com
directprnews.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3100-13-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/3100-14-0x000000000041EB70-mapping.dmp formbook behavioral2/memory/672-25-0x0000000000FD0000-0x0000000000FFE000-memory.dmp formbook -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Arrival Notice.scrArrival Notice.scrmsiexec.exedescription pid process target process PID 4764 set thread context of 3100 4764 Arrival Notice.scr Arrival Notice.scr PID 3100 set thread context of 3012 3100 Arrival Notice.scr Explorer.EXE PID 3100 set thread context of 3012 3100 Arrival Notice.scr Explorer.EXE PID 672 set thread context of 3012 672 msiexec.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 39 IoCs
Processes:
Arrival Notice.scrArrival Notice.scrmsiexec.exepid process 4764 Arrival Notice.scr 3100 Arrival Notice.scr 3100 Arrival Notice.scr 3100 Arrival Notice.scr 3100 Arrival Notice.scr 3100 Arrival Notice.scr 3100 Arrival Notice.scr 672 msiexec.exe 672 msiexec.exe 672 msiexec.exe 672 msiexec.exe 672 msiexec.exe 672 msiexec.exe 672 msiexec.exe 672 msiexec.exe 672 msiexec.exe 672 msiexec.exe 672 msiexec.exe 672 msiexec.exe 672 msiexec.exe 672 msiexec.exe 672 msiexec.exe 672 msiexec.exe 672 msiexec.exe 672 msiexec.exe 672 msiexec.exe 672 msiexec.exe 672 msiexec.exe 672 msiexec.exe 672 msiexec.exe 672 msiexec.exe 672 msiexec.exe 672 msiexec.exe 672 msiexec.exe 672 msiexec.exe 672 msiexec.exe 672 msiexec.exe 672 msiexec.exe 672 msiexec.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
Arrival Notice.scrmsiexec.exepid process 3100 Arrival Notice.scr 3100 Arrival Notice.scr 3100 Arrival Notice.scr 3100 Arrival Notice.scr 672 msiexec.exe 672 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Arrival Notice.scrArrival Notice.scrmsiexec.exedescription pid process Token: SeDebugPrivilege 4764 Arrival Notice.scr Token: SeDebugPrivilege 3100 Arrival Notice.scr Token: SeDebugPrivilege 672 msiexec.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Arrival Notice.scrArrival Notice.scrmsiexec.exedescription pid process target process PID 4764 wrote to memory of 3100 4764 Arrival Notice.scr Arrival Notice.scr PID 4764 wrote to memory of 3100 4764 Arrival Notice.scr Arrival Notice.scr PID 4764 wrote to memory of 3100 4764 Arrival Notice.scr Arrival Notice.scr PID 4764 wrote to memory of 3100 4764 Arrival Notice.scr Arrival Notice.scr PID 4764 wrote to memory of 3100 4764 Arrival Notice.scr Arrival Notice.scr PID 4764 wrote to memory of 3100 4764 Arrival Notice.scr Arrival Notice.scr PID 3100 wrote to memory of 672 3100 Arrival Notice.scr msiexec.exe PID 3100 wrote to memory of 672 3100 Arrival Notice.scr msiexec.exe PID 3100 wrote to memory of 672 3100 Arrival Notice.scr msiexec.exe PID 672 wrote to memory of 876 672 msiexec.exe cmd.exe PID 672 wrote to memory of 876 672 msiexec.exe cmd.exe PID 672 wrote to memory of 876 672 msiexec.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\Arrival Notice.scr"C:\Users\Admin\AppData\Local\Temp\Arrival Notice.scr" /S2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Arrival Notice.scr"C:\Users\Admin\AppData\Local\Temp\Arrival Notice.scr"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Arrival Notice.scr"5⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/672-27-0x0000000005010000-0x00000000050A3000-memory.dmpFilesize
588KB
-
memory/672-26-0x0000000005160000-0x0000000005480000-memory.dmpFilesize
3.1MB
-
memory/672-24-0x0000000001080000-0x0000000001092000-memory.dmpFilesize
72KB
-
memory/672-25-0x0000000000FD0000-0x0000000000FFE000-memory.dmpFilesize
184KB
-
memory/672-22-0x0000000000000000-mapping.dmp
-
memory/876-23-0x0000000000000000-mapping.dmp
-
memory/3012-19-0x00000000058F0000-0x0000000005A6C000-memory.dmpFilesize
1.5MB
-
memory/3012-28-0x00000000030E0000-0x0000000003192000-memory.dmpFilesize
712KB
-
memory/3012-21-0x00000000065E0000-0x000000000673E000-memory.dmpFilesize
1.4MB
-
memory/3100-18-0x0000000001460000-0x0000000001474000-memory.dmpFilesize
80KB
-
memory/3100-20-0x00000000014B0000-0x00000000014C4000-memory.dmpFilesize
80KB
-
memory/3100-14-0x000000000041EB70-mapping.dmp
-
memory/3100-13-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/3100-17-0x00000000017D0000-0x0000000001AF0000-memory.dmpFilesize
3.1MB
-
memory/4764-12-0x0000000005DB0000-0x0000000005E16000-memory.dmpFilesize
408KB
-
memory/4764-11-0x0000000005240000-0x0000000005263000-memory.dmpFilesize
140KB
-
memory/4764-2-0x0000000073150000-0x000000007383E000-memory.dmpFilesize
6.9MB
-
memory/4764-10-0x0000000004F30000-0x0000000004F31000-memory.dmpFilesize
4KB
-
memory/4764-9-0x00000000051E0000-0x00000000051E1000-memory.dmpFilesize
4KB
-
memory/4764-8-0x0000000004F00000-0x0000000004F01000-memory.dmpFilesize
4KB
-
memory/4764-7-0x0000000005080000-0x0000000005081000-memory.dmpFilesize
4KB
-
memory/4764-6-0x0000000005580000-0x0000000005581000-memory.dmpFilesize
4KB
-
memory/4764-5-0x0000000004FE0000-0x0000000004FE1000-memory.dmpFilesize
4KB
-
memory/4764-3-0x00000000005E0000-0x00000000005E1000-memory.dmpFilesize
4KB