Analysis
-
max time kernel
150s -
max time network
70s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
23-02-2021 12:55
Static task
static1
Behavioral task
behavioral1
Sample
PO-29840032.exe
Resource
win7v20201028
General
-
Target
PO-29840032.exe
-
Size
495KB
-
MD5
16a8bcda6b8877e2a76f56ac5707eaa8
-
SHA1
2f6a4a474c53183a14ef815d2f3aa9cdb6a0b545
-
SHA256
4116c5111907369d23e1a5f7adf2b0cd13186d6155a8f9406b794f191180f914
-
SHA512
6cacea9c50c6f5d8fa96a6c8047db43458cd5159e87fe3c0807599b21ba80d4f31649b0f26c51edc352c0f55f2c405e32131d81baa70c0547a556efd253ad380
Malware Config
Extracted
formbook
http://www.merckcbd.com/dei5/
studiomullerphoto.com
reallionairewear.com
dogsalondoggy-tail.com
excelmache.net
bigdiscounters.com
7986799.com
ignition.guru
xiaoxu.info
jpinpd.com
solpool.info
uchooswrewards.com
everestengineeringworks.com
qianglongzhipin.com
deepimper-325.com
appliedrate.com
radsazemehr.com
vivabematividadesfisicas.com
capacitalo.com
somecore.com
listingclass.net
romel.codes
mybettermentor.com
hxc43.com
btccvil312723.com
rudiskenya.com
internationalrockmusic.com
wudiwifi.com
scienceacademyraj.com
tumulusinnovations.com
studioeduardobeninca.com
formabench.com
ribbonredwhiteandblue.com
miningequipmentrental.com
myamom.com
riversportswear.net
14505glenmarkdr.com
nikolcosmetic.com
toninopr.com
cutfortheconnect.com
nl22584.com
mezokovesd.com
rozhandesign.com
futbolki.space
rmobipanoshop.com
merchmuslim.com
recurrentcornealerosion.com
enottampan.com
vasquez.photos
koreanmindbeauty.com
andressabode.com
thetwolouises.com
weberbyroble.com
followmargpolo.com
englishclubb.online
sorryididnthearthat.com
greatlookfashion.club
cartoleriagrillocatania.com
esteprize.com
sdsej.com
phiecraft.xyz
psm-gen.com
passivefiresafe.com
homeyplantycosy.com
0343888.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1012-10-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1012-11-0x000000000041ECD0-mapping.dmp formbook behavioral1/memory/1648-20-0x0000000000090000-0x00000000000BE000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 620 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
PO-29840032.exePO-29840032.exemsiexec.exedescription pid process target process PID 2008 set thread context of 1012 2008 PO-29840032.exe PO-29840032.exe PID 1012 set thread context of 1248 1012 PO-29840032.exe Explorer.EXE PID 1648 set thread context of 1248 1648 msiexec.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
PO-29840032.exePO-29840032.exemsiexec.exepid process 2008 PO-29840032.exe 1012 PO-29840032.exe 1012 PO-29840032.exe 1648 msiexec.exe 1648 msiexec.exe 1648 msiexec.exe 1648 msiexec.exe 1648 msiexec.exe 1648 msiexec.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
PO-29840032.exemsiexec.exepid process 1012 PO-29840032.exe 1012 PO-29840032.exe 1012 PO-29840032.exe 1648 msiexec.exe 1648 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
PO-29840032.exePO-29840032.exemsiexec.exedescription pid process Token: SeDebugPrivilege 2008 PO-29840032.exe Token: SeDebugPrivilege 1012 PO-29840032.exe Token: SeDebugPrivilege 1648 msiexec.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
PO-29840032.exeExplorer.EXEmsiexec.exedescription pid process target process PID 2008 wrote to memory of 1896 2008 PO-29840032.exe schtasks.exe PID 2008 wrote to memory of 1896 2008 PO-29840032.exe schtasks.exe PID 2008 wrote to memory of 1896 2008 PO-29840032.exe schtasks.exe PID 2008 wrote to memory of 1896 2008 PO-29840032.exe schtasks.exe PID 2008 wrote to memory of 1012 2008 PO-29840032.exe PO-29840032.exe PID 2008 wrote to memory of 1012 2008 PO-29840032.exe PO-29840032.exe PID 2008 wrote to memory of 1012 2008 PO-29840032.exe PO-29840032.exe PID 2008 wrote to memory of 1012 2008 PO-29840032.exe PO-29840032.exe PID 2008 wrote to memory of 1012 2008 PO-29840032.exe PO-29840032.exe PID 2008 wrote to memory of 1012 2008 PO-29840032.exe PO-29840032.exe PID 2008 wrote to memory of 1012 2008 PO-29840032.exe PO-29840032.exe PID 1248 wrote to memory of 1648 1248 Explorer.EXE msiexec.exe PID 1248 wrote to memory of 1648 1248 Explorer.EXE msiexec.exe PID 1248 wrote to memory of 1648 1248 Explorer.EXE msiexec.exe PID 1248 wrote to memory of 1648 1248 Explorer.EXE msiexec.exe PID 1248 wrote to memory of 1648 1248 Explorer.EXE msiexec.exe PID 1248 wrote to memory of 1648 1248 Explorer.EXE msiexec.exe PID 1248 wrote to memory of 1648 1248 Explorer.EXE msiexec.exe PID 1648 wrote to memory of 620 1648 msiexec.exe cmd.exe PID 1648 wrote to memory of 620 1648 msiexec.exe cmd.exe PID 1648 wrote to memory of 620 1648 msiexec.exe cmd.exe PID 1648 wrote to memory of 620 1648 msiexec.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO-29840032.exe"C:\Users\Admin\AppData\Local\Temp\PO-29840032.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eejXKlefbIzpJy" /XML "C:\Users\Admin\AppData\Local\Temp\tmpED6B.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\PO-29840032.exe"C:\Users\Admin\AppData\Local\Temp\PO-29840032.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO-29840032.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpED6B.tmpMD5
6f5a3f2d05075bf8b2db6c17c09d7213
SHA1f09d1e2370db97b1ff8166f8576a2d1a57ac839a
SHA256934c00f2ce62005e73581559efcb24ee4361b9a3fb230393a0c57f481d505978
SHA512c1bb695743df58df0833a2ce9e69cbc90ea3be70cd70c61693de39be427e0a22889978b19e74da9fa873231dd56f3c75d31a78ed8874d8e719c66dfb9767a4ae
-
memory/620-18-0x0000000000000000-mapping.dmp
-
memory/1012-10-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1012-14-0x00000000002B0000-0x00000000002C4000-memory.dmpFilesize
80KB
-
memory/1012-13-0x0000000000800000-0x0000000000B03000-memory.dmpFilesize
3.0MB
-
memory/1012-11-0x000000000041ECD0-mapping.dmp
-
memory/1248-15-0x0000000003B00000-0x0000000003C3C000-memory.dmpFilesize
1.2MB
-
memory/1648-16-0x0000000000000000-mapping.dmp
-
memory/1648-17-0x0000000076641000-0x0000000076643000-memory.dmpFilesize
8KB
-
memory/1648-19-0x0000000000B90000-0x0000000000BA4000-memory.dmpFilesize
80KB
-
memory/1648-20-0x0000000000090000-0x00000000000BE000-memory.dmpFilesize
184KB
-
memory/1648-21-0x0000000002430000-0x0000000002733000-memory.dmpFilesize
3.0MB
-
memory/1648-22-0x0000000000AB0000-0x0000000000B43000-memory.dmpFilesize
588KB
-
memory/1896-8-0x0000000000000000-mapping.dmp
-
memory/2008-7-0x0000000005C20000-0x0000000005C75000-memory.dmpFilesize
340KB
-
memory/2008-6-0x00000000003A0000-0x00000000003A3000-memory.dmpFilesize
12KB
-
memory/2008-5-0x0000000004DC0000-0x0000000004DC1000-memory.dmpFilesize
4KB
-
memory/2008-2-0x0000000074BA0000-0x000000007528E000-memory.dmpFilesize
6.9MB
-
memory/2008-3-0x0000000000CC0000-0x0000000000CC1000-memory.dmpFilesize
4KB