Analysis
-
max time kernel
147s -
max time network
11s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
21-01-2021 04:16
Static task
static1
Behavioral task
behavioral1
Sample
PO20210120.exe
Resource
win7v20201028
General
-
Target
PO20210120.exe
-
Size
943KB
-
MD5
6fc44193a2a79ad1bd15606386bb0cb0
-
SHA1
d76e50ba12ea567584f9ee992b60bbf838be3c0a
-
SHA256
82c118d71fb0433b051b37a040f31f2455ceb3ddd01b7d314cf6b1f4648d454d
-
SHA512
554fa9c246a5284cf6f273cd13e744875150a5ac15d6443a46116a3e311ed60feafde4c9364f8d23dfef22bf1abb38a1bae2c21405c94a68489376a04a1c96ec
Malware Config
Extracted
formbook
http://www.adamjbrowne.com/knb/
nona-home.com
themundoverdeproject.com
nhlkrakenfans.com
mak-bauunternehmung.com
public-secret.com
exitumgestao.com
stopforeclosurenow.net
citestbiz1597776507.com
kythuatxetnghiemyhoc.com
longislandeventplanner.com
uaetechworld.com
centretabacstop.net
jomelvendivel.com
agricultureesm.com
successwithspencer.com
companywars.net
terrellhillsdirectory.com
ngldwyy.com
cwiprinting.net
lnstagramgetverifyaccounts.site
celerationeducation.com
moodrops.com
connorwill.com
jackwoodguitar.com
healthytreatsandmore.com
treasurespartyrental.com
completeservicos.com
byteart.club
kreationsbyittybitty.com
studiomaternofetal.com
fastecourses.com
mahlatblog.com
morkiehouse.com
livefreegoddess.love
asyadizicevirileri.com
xn--u2u404a3kr5xb.com
surptalb.xyz
stockbrokerpotential.xyz
arigibicalis.com
contactorsplan.com
huaxichenfei.com
856380163.xyz
martid-2006.com
inspirationalsblog.com
tienda-sky.com
higherresin.com
occasioncelebrations.com
mybeesplatform.com
elementary-farming.com
bandao56.com
fivebyfivefglobal.com
sandeepasblog.com
nirvanatopshelf.net
jncwjzgc.com
zauhaus.com
librasnacks.com
thefashiondaily.net
piecegig.com
astaxanthinsavedme.com
rileypm.com
the-champions-club.com
vkdeb.site
eco-decking.com
onlinecryptoforexminers.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1124-11-0x000000000041EC00-mapping.dmp formbook behavioral1/memory/1124-10-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1088-19-0x0000000000080000-0x00000000000AE000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 576 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
PO20210120.exePO20210120.exewlanext.exedescription pid process target process PID 1668 set thread context of 1124 1668 PO20210120.exe PO20210120.exe PID 1124 set thread context of 1248 1124 PO20210120.exe Explorer.EXE PID 1088 set thread context of 1248 1088 wlanext.exe Explorer.EXE -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
PO20210120.exewlanext.exepid process 1124 PO20210120.exe 1124 PO20210120.exe 1088 wlanext.exe 1088 wlanext.exe 1088 wlanext.exe 1088 wlanext.exe 1088 wlanext.exe 1088 wlanext.exe 1088 wlanext.exe 1088 wlanext.exe 1088 wlanext.exe 1088 wlanext.exe 1088 wlanext.exe 1088 wlanext.exe 1088 wlanext.exe 1088 wlanext.exe 1088 wlanext.exe 1088 wlanext.exe 1088 wlanext.exe 1088 wlanext.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
PO20210120.exewlanext.exepid process 1124 PO20210120.exe 1124 PO20210120.exe 1124 PO20210120.exe 1088 wlanext.exe 1088 wlanext.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PO20210120.exewlanext.exedescription pid process Token: SeDebugPrivilege 1124 PO20210120.exe Token: SeDebugPrivilege 1088 wlanext.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
PO20210120.exeExplorer.EXEwlanext.exedescription pid process target process PID 1668 wrote to memory of 1064 1668 PO20210120.exe schtasks.exe PID 1668 wrote to memory of 1064 1668 PO20210120.exe schtasks.exe PID 1668 wrote to memory of 1064 1668 PO20210120.exe schtasks.exe PID 1668 wrote to memory of 1064 1668 PO20210120.exe schtasks.exe PID 1668 wrote to memory of 1124 1668 PO20210120.exe PO20210120.exe PID 1668 wrote to memory of 1124 1668 PO20210120.exe PO20210120.exe PID 1668 wrote to memory of 1124 1668 PO20210120.exe PO20210120.exe PID 1668 wrote to memory of 1124 1668 PO20210120.exe PO20210120.exe PID 1668 wrote to memory of 1124 1668 PO20210120.exe PO20210120.exe PID 1668 wrote to memory of 1124 1668 PO20210120.exe PO20210120.exe PID 1668 wrote to memory of 1124 1668 PO20210120.exe PO20210120.exe PID 1248 wrote to memory of 1088 1248 Explorer.EXE wlanext.exe PID 1248 wrote to memory of 1088 1248 Explorer.EXE wlanext.exe PID 1248 wrote to memory of 1088 1248 Explorer.EXE wlanext.exe PID 1248 wrote to memory of 1088 1248 Explorer.EXE wlanext.exe PID 1088 wrote to memory of 576 1088 wlanext.exe cmd.exe PID 1088 wrote to memory of 576 1088 wlanext.exe cmd.exe PID 1088 wrote to memory of 576 1088 wlanext.exe cmd.exe PID 1088 wrote to memory of 576 1088 wlanext.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO20210120.exe"C:\Users\Admin\AppData\Local\Temp\PO20210120.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hTvBqiZhSaoi" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3E19.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\PO20210120.exe"C:\Users\Admin\AppData\Local\Temp\PO20210120.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO20210120.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp3E19.tmpMD5
af04ae71918191408dbf54b934d624d1
SHA13de2b3e3b1fa7234caf806b622370d85bd777d86
SHA2568ce4818494896434fb205173995ca67786c83e1706688a4e24568b8cc1556a61
SHA512aa263e7038141a0c4632c5dbd0803ee1c129fa6df56ad0bc6d700affafd9339a1f2d1d8506c1c2844f090707d30946e239079074e1104bbbeb5a8db1e37a01e2
-
memory/576-17-0x0000000000000000-mapping.dmp
-
memory/1064-8-0x0000000000000000-mapping.dmp
-
memory/1088-16-0x0000000000000000-mapping.dmp
-
memory/1088-21-0x0000000001D60000-0x0000000001DF3000-memory.dmpFilesize
588KB
-
memory/1088-20-0x0000000001EA0000-0x00000000021A3000-memory.dmpFilesize
3.0MB
-
memory/1088-19-0x0000000000080000-0x00000000000AE000-memory.dmpFilesize
184KB
-
memory/1088-18-0x00000000007B0000-0x00000000007C6000-memory.dmpFilesize
88KB
-
memory/1124-10-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1124-13-0x00000000009F0000-0x0000000000CF3000-memory.dmpFilesize
3.0MB
-
memory/1124-14-0x0000000000180000-0x0000000000194000-memory.dmpFilesize
80KB
-
memory/1124-11-0x000000000041EC00-mapping.dmp
-
memory/1248-15-0x00000000064C0000-0x000000000666A000-memory.dmpFilesize
1.7MB
-
memory/1668-2-0x0000000074110000-0x00000000747FE000-memory.dmpFilesize
6.9MB
-
memory/1668-7-0x00000000071C0000-0x0000000007226000-memory.dmpFilesize
408KB
-
memory/1668-6-0x0000000007140000-0x0000000007141000-memory.dmpFilesize
4KB
-
memory/1668-5-0x0000000000440000-0x0000000000463000-memory.dmpFilesize
140KB
-
memory/1668-3-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB