Analysis
-
max time kernel
146s -
max time network
146s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
20-04-2021 11:35
Static task
static1
Behavioral task
behavioral1
Sample
Image001.exe
Resource
win7v20210410
General
-
Target
Image001.exe
-
Size
231KB
-
MD5
4ea509c18030b4e71413f2b2bd3b989c
-
SHA1
5ba34126a4a502bf6e5305c1e647fcf4a7488677
-
SHA256
c0ebfff80d42551c1a910f2c7b8c08af384e5ccf49c979b7bf664e6c1b731607
-
SHA512
864dfbe7e07fa4fcf15b487b6c41d20aad5c90d56518f305d8eeb2229ca3e28a9728c2ae5ef4e362d10d7f9a93996f0b67b61e8b5e224b89911152fa1a9db518
Malware Config
Extracted
formbook
4.1
http://www.riceandginger.com/fcn/
bellee-select.com
unlock-motorola.com
courtneyrunyon.com
hnzywjz.com
retrievingbest.net
ayescarrental.com
beyoutifulblessings.com
heritagediscovery.net
fasoum.com
wbz.xyz
lownak.com
alinkarmay.com
coffeyquiltco.com
validdreamers.com
yuksukcu.club
buildnextfrc.com
avantfarme.com
xyfs360.com
holisticpacific.com
banejia.com
champsn.com
ebitit.com
esseneceedibles.com
findmyautoparts.com
belenusadvisory.net
esrise.net
lovewillfindaway.net
chienluocmarketing.net
greenbelieve.com
shopyourgift.com
theweddingofshadiandmike.com
greenstavern.com
klinku.com
norastravel.com
team5thgroup.com
ohrchadash.com
hauteandcood.com
ap-333.com
jonathantyar.com
robertabraham.com
citestaccnt1597691130.com
665asilo.com
deerokoj.com
ezcovid19.com
heritageivhoa.com
ultraprecisiondata.com
alkiefsaudi.com
camelliaflowers.space
clickqrcoaster.com
ponorogokita.com
stainlesslion.com
china-ymc.com
littner.xyz
houseof2.com
metabolytix.com
1000-help6.club
another-sc.com
suafrisolac.com
whitetreechainmail.com
amazon-service-app-account.com
cruiseameroca.com
yaxett.net
adsmat.com
afternoontravel.site
Signatures
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1100-118-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/2828-127-0x0000000004F40000-0x0000000004F6E000-memory.dmp formbook -
Loads dropped DLL 1 IoCs
Processes:
Image001.exepid process 508 Image001.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Image001.exeImage001.exechkdsk.exedescription pid process target process PID 508 set thread context of 1100 508 Image001.exe Image001.exe PID 1100 set thread context of 3016 1100 Image001.exe Explorer.EXE PID 1100 set thread context of 3016 1100 Image001.exe Explorer.EXE PID 2828 set thread context of 3016 2828 chkdsk.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 60 IoCs
Processes:
Image001.exechkdsk.exepid process 1100 Image001.exe 1100 Image001.exe 1100 Image001.exe 1100 Image001.exe 1100 Image001.exe 1100 Image001.exe 2828 chkdsk.exe 2828 chkdsk.exe 2828 chkdsk.exe 2828 chkdsk.exe 2828 chkdsk.exe 2828 chkdsk.exe 2828 chkdsk.exe 2828 chkdsk.exe 2828 chkdsk.exe 2828 chkdsk.exe 2828 chkdsk.exe 2828 chkdsk.exe 2828 chkdsk.exe 2828 chkdsk.exe 2828 chkdsk.exe 2828 chkdsk.exe 2828 chkdsk.exe 2828 chkdsk.exe 2828 chkdsk.exe 2828 chkdsk.exe 2828 chkdsk.exe 2828 chkdsk.exe 2828 chkdsk.exe 2828 chkdsk.exe 2828 chkdsk.exe 2828 chkdsk.exe 2828 chkdsk.exe 2828 chkdsk.exe 2828 chkdsk.exe 2828 chkdsk.exe 2828 chkdsk.exe 2828 chkdsk.exe 2828 chkdsk.exe 2828 chkdsk.exe 2828 chkdsk.exe 2828 chkdsk.exe 2828 chkdsk.exe 2828 chkdsk.exe 2828 chkdsk.exe 2828 chkdsk.exe 2828 chkdsk.exe 2828 chkdsk.exe 2828 chkdsk.exe 2828 chkdsk.exe 2828 chkdsk.exe 2828 chkdsk.exe 2828 chkdsk.exe 2828 chkdsk.exe 2828 chkdsk.exe 2828 chkdsk.exe 2828 chkdsk.exe 2828 chkdsk.exe 2828 chkdsk.exe 2828 chkdsk.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3016 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
Image001.exeImage001.exechkdsk.exepid process 508 Image001.exe 1100 Image001.exe 1100 Image001.exe 1100 Image001.exe 1100 Image001.exe 2828 chkdsk.exe 2828 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Image001.exechkdsk.exedescription pid process Token: SeDebugPrivilege 1100 Image001.exe Token: SeDebugPrivilege 2828 chkdsk.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
Image001.exeExplorer.EXEchkdsk.exedescription pid process target process PID 508 wrote to memory of 1100 508 Image001.exe Image001.exe PID 508 wrote to memory of 1100 508 Image001.exe Image001.exe PID 508 wrote to memory of 1100 508 Image001.exe Image001.exe PID 508 wrote to memory of 1100 508 Image001.exe Image001.exe PID 3016 wrote to memory of 2828 3016 Explorer.EXE chkdsk.exe PID 3016 wrote to memory of 2828 3016 Explorer.EXE chkdsk.exe PID 3016 wrote to memory of 2828 3016 Explorer.EXE chkdsk.exe PID 2828 wrote to memory of 3116 2828 chkdsk.exe cmd.exe PID 2828 wrote to memory of 3116 2828 chkdsk.exe cmd.exe PID 2828 wrote to memory of 3116 2828 chkdsk.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Image001.exe"C:\Users\Admin\AppData\Local\Temp\Image001.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Image001.exe"C:\Users\Admin\AppData\Local\Temp\Image001.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Image001.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsnF421.tmp\xl19yxkx7ev.dllMD5
021e31cdf92985d3de940632b4229cc2
SHA1e18b54d4c7882a1cad146f921296c1461f1dd37b
SHA2568b67f5fcae3d901b37b4dafc71386cb3c3cf5ca92e91e8d931c4de394b09441b
SHA51291ace46af5fdc23e61dc5800d1bcfd8f9cbdca12c9e79f6fefa52ad51e5a062fcff46296bfadc18fdea577f99690e6d474c9ae90b24f0e4944cab4352a752e42
-
memory/508-116-0x00000000030C0000-0x00000000030C1000-memory.dmpFilesize
4KB
-
memory/508-117-0x00000000030C1000-0x00000000030C3000-memory.dmpFilesize
8KB
-
memory/1100-122-0x0000000000920000-0x0000000000934000-memory.dmpFilesize
80KB
-
memory/1100-115-0x000000000041EAA0-mapping.dmp
-
memory/1100-120-0x00000000008D0000-0x00000000008E4000-memory.dmpFilesize
80KB
-
memory/1100-119-0x0000000000970000-0x0000000000C90000-memory.dmpFilesize
3.1MB
-
memory/1100-118-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/2828-126-0x00000000009D0000-0x00000000009DA000-memory.dmpFilesize
40KB
-
memory/2828-124-0x0000000000000000-mapping.dmp
-
memory/2828-127-0x0000000004F40000-0x0000000004F6E000-memory.dmpFilesize
184KB
-
memory/2828-128-0x0000000005770000-0x0000000005A90000-memory.dmpFilesize
3.1MB
-
memory/2828-129-0x0000000005440000-0x00000000054D3000-memory.dmpFilesize
588KB
-
memory/3016-123-0x0000000005950000-0x0000000005A87000-memory.dmpFilesize
1.2MB
-
memory/3016-121-0x0000000005880000-0x0000000005942000-memory.dmpFilesize
776KB
-
memory/3016-130-0x0000000003220000-0x00000000032D4000-memory.dmpFilesize
720KB
-
memory/3116-125-0x0000000000000000-mapping.dmp