Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
20-04-2021 14:17
Static task
static1
Behavioral task
behavioral1
Sample
Shipment Document BL,INV and packing list.jpg.exe
Resource
win7v20210410
General
-
Target
Shipment Document BL,INV and packing list.jpg.exe
-
Size
231KB
-
MD5
50456fb9b8f0806b76ffd072a5bb70f2
-
SHA1
ec8e584acd7b5153cf50d9c338b002666e7f85d8
-
SHA256
aca4e7d8bc5a58300b0945187c084f6c2c44418133ffb36adfb08e25d285de82
-
SHA512
42c006d277fb4526f56523fb8fb415f7f00e66fe165cbedac2af399a9cabd01c572b76a3706daac292dc5b64e0abcfe8d6f6a5744cba5295f1abc7d3eda00fe9
Malware Config
Extracted
formbook
4.1
http://www.localmarketingaiagency.com/pgr/
rhymewitnessnews.com
z1seven.com
quaidon.com
spruiodes.com
leanderpumpkinpatch.com
starfood-eg.com
americanrestorationreport.net
myonyxfoundation.com
adcvea.com
theassociationconsultant.com
snaparama.com
ukajp.com
guarfianlife.com
e-dourouss.com
beflybmx.com
ceoesalamanca.com
myoxx.com
maxwatertreatment.com
maskelicious.com
aditridental.com
tutun-galetusa.com
myhearingbuilder.com
dgxxs.com
theretaliatorsmovie.com
dc9667.com
evereez.com
renakerhomes.com
bestdiy2020.com
photomorphisis.com
trip-treats.com
dwadawdf009.com
letslearnpiano.online
gardenstatemask.com
idealimsges.com
yogabaydioxil.xyz
niix.institute
transcendhotels.net
sspsagriculture.com
ourhumancolor.com
yourdock.net
adalois.com
kissimmee-bookings.com
carolinaepatrick.com
djmohix.com
byonf.com
ssrrco.com
trindominstallation.com
easybigmoney.online
pubgeventcenter.com
kubynina.online
voterbymail.com
midtownkitchen.ca
creativepreneurshow.com
maxiang.cool
shb200.com
joomla3x.com
videosadomaso.com
skinfolkco.com
yzxjmf.com
16black.club
persian-gostar.com
westchesterpermitclass.com
madeonmainstreetbox.com
instantmerchantpay.com
Signatures
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3612-118-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/404-125-0x0000000000970000-0x000000000099E000-memory.dmp formbook -
Loads dropped DLL 1 IoCs
Processes:
Shipment Document BL,INV and packing list.jpg.exepid process 636 Shipment Document BL,INV and packing list.jpg.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Shipment Document BL,INV and packing list.jpg.exeShipment Document BL,INV and packing list.jpg.exehelp.exedescription pid process target process PID 636 set thread context of 3612 636 Shipment Document BL,INV and packing list.jpg.exe Shipment Document BL,INV and packing list.jpg.exe PID 3612 set thread context of 2996 3612 Shipment Document BL,INV and packing list.jpg.exe Explorer.EXE PID 404 set thread context of 2996 404 help.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 58 IoCs
Processes:
Shipment Document BL,INV and packing list.jpg.exehelp.exepid process 3612 Shipment Document BL,INV and packing list.jpg.exe 3612 Shipment Document BL,INV and packing list.jpg.exe 3612 Shipment Document BL,INV and packing list.jpg.exe 3612 Shipment Document BL,INV and packing list.jpg.exe 404 help.exe 404 help.exe 404 help.exe 404 help.exe 404 help.exe 404 help.exe 404 help.exe 404 help.exe 404 help.exe 404 help.exe 404 help.exe 404 help.exe 404 help.exe 404 help.exe 404 help.exe 404 help.exe 404 help.exe 404 help.exe 404 help.exe 404 help.exe 404 help.exe 404 help.exe 404 help.exe 404 help.exe 404 help.exe 404 help.exe 404 help.exe 404 help.exe 404 help.exe 404 help.exe 404 help.exe 404 help.exe 404 help.exe 404 help.exe 404 help.exe 404 help.exe 404 help.exe 404 help.exe 404 help.exe 404 help.exe 404 help.exe 404 help.exe 404 help.exe 404 help.exe 404 help.exe 404 help.exe 404 help.exe 404 help.exe 404 help.exe 404 help.exe 404 help.exe 404 help.exe 404 help.exe 404 help.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2996 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
Shipment Document BL,INV and packing list.jpg.exeShipment Document BL,INV and packing list.jpg.exehelp.exepid process 636 Shipment Document BL,INV and packing list.jpg.exe 3612 Shipment Document BL,INV and packing list.jpg.exe 3612 Shipment Document BL,INV and packing list.jpg.exe 3612 Shipment Document BL,INV and packing list.jpg.exe 404 help.exe 404 help.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Shipment Document BL,INV and packing list.jpg.exehelp.exedescription pid process Token: SeDebugPrivilege 3612 Shipment Document BL,INV and packing list.jpg.exe Token: SeDebugPrivilege 404 help.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 2996 Explorer.EXE 2996 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 2996 Explorer.EXE 2996 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 2996 Explorer.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
Shipment Document BL,INV and packing list.jpg.exeExplorer.EXEhelp.exedescription pid process target process PID 636 wrote to memory of 3612 636 Shipment Document BL,INV and packing list.jpg.exe Shipment Document BL,INV and packing list.jpg.exe PID 636 wrote to memory of 3612 636 Shipment Document BL,INV and packing list.jpg.exe Shipment Document BL,INV and packing list.jpg.exe PID 636 wrote to memory of 3612 636 Shipment Document BL,INV and packing list.jpg.exe Shipment Document BL,INV and packing list.jpg.exe PID 636 wrote to memory of 3612 636 Shipment Document BL,INV and packing list.jpg.exe Shipment Document BL,INV and packing list.jpg.exe PID 2996 wrote to memory of 404 2996 Explorer.EXE help.exe PID 2996 wrote to memory of 404 2996 Explorer.EXE help.exe PID 2996 wrote to memory of 404 2996 Explorer.EXE help.exe PID 404 wrote to memory of 2672 404 help.exe cmd.exe PID 404 wrote to memory of 2672 404 help.exe cmd.exe PID 404 wrote to memory of 2672 404 help.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Shipment Document BL,INV and packing list.jpg.exe"C:\Users\Admin\AppData\Local\Temp\Shipment Document BL,INV and packing list.jpg.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Shipment Document BL,INV and packing list.jpg.exe"C:\Users\Admin\AppData\Local\Temp\Shipment Document BL,INV and packing list.jpg.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Shipment Document BL,INV and packing list.jpg.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsgBCFE.tmp\juukqoeba.dllMD5
c96e0db05235eda2de5a1bb8b15c22e5
SHA141cd64af5c4da417b6acdc6e0bf6af432085c6b8
SHA2562802bba60b65fae0c3d480971e8e03adc8a97bacc4688f9d3943073592fc2b8f
SHA512bede0119c47e15c4dfc9c4d0d27496d2f72fe2a160cf403002644e1fb000e57bee28fe303fdbfa40ee08cb21407c292628dbb14ce190e05a291f6f1aada9b75f
-
memory/404-124-0x0000000003410000-0x0000000003730000-memory.dmpFilesize
3.1MB
-
memory/404-127-0x0000000003170000-0x0000000003203000-memory.dmpFilesize
588KB
-
memory/404-125-0x0000000000970000-0x000000000099E000-memory.dmpFilesize
184KB
-
memory/404-123-0x0000000000AB0000-0x0000000000AB7000-memory.dmpFilesize
28KB
-
memory/404-122-0x0000000000000000-mapping.dmp
-
memory/636-115-0x0000000003140000-0x0000000003141000-memory.dmpFilesize
4KB
-
memory/636-116-0x0000000003141000-0x0000000003143000-memory.dmpFilesize
8KB
-
memory/2672-126-0x0000000000000000-mapping.dmp
-
memory/2996-121-0x0000000006CF0000-0x0000000006E69000-memory.dmpFilesize
1.5MB
-
memory/2996-128-0x0000000006E70000-0x0000000006FCB000-memory.dmpFilesize
1.4MB
-
memory/3612-119-0x00000000009E0000-0x0000000000D00000-memory.dmpFilesize
3.1MB
-
memory/3612-120-0x0000000000EA0000-0x0000000000EB4000-memory.dmpFilesize
80KB
-
memory/3612-118-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/3612-117-0x000000000041EBA0-mapping.dmp