Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
21-04-2021 13:04
Static task
static1
Behavioral task
behavioral1
Sample
Shipping Docs.exe
Resource
win7v20210410
General
-
Target
Shipping Docs.exe
-
Size
944KB
-
MD5
1c7c7a3b0cfb41627125bb609863675a
-
SHA1
83a9b9eec6dcc897b1406b7ca166e40c33f58d3d
-
SHA256
3f37e123258dcf5b2a18a1ba8299f21ddb6fa585db1dac3a957022d7c763a184
-
SHA512
d2b455fb31994cf79fe7d198917382822d772f95b00c913683ff539c351b36ae85c2545b163e934cca8282435650446d24e3614bc283486b9dfd49d7e636ec5b
Malware Config
Extracted
formbook
4.1
http://w����5 �@q[*��S=���m
Signatures
-
Formbook Payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/2712-117-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/2712-118-0x000000000041EAC0-mapping.dmp formbook behavioral2/memory/2712-121-0x0000000000D00000-0x0000000000DAE000-memory.dmp formbook behavioral2/memory/1304-125-0x0000000000540000-0x000000000056E000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Shipping Docs.exeShipping Docs.exechkdsk.exedescription pid process target process PID 900 set thread context of 2712 900 Shipping Docs.exe Shipping Docs.exe PID 2712 set thread context of 3024 2712 Shipping Docs.exe Explorer.EXE PID 1304 set thread context of 3024 1304 chkdsk.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
Processes:
Shipping Docs.exeShipping Docs.exechkdsk.exepid process 900 Shipping Docs.exe 900 Shipping Docs.exe 900 Shipping Docs.exe 900 Shipping Docs.exe 900 Shipping Docs.exe 900 Shipping Docs.exe 900 Shipping Docs.exe 900 Shipping Docs.exe 2712 Shipping Docs.exe 2712 Shipping Docs.exe 2712 Shipping Docs.exe 2712 Shipping Docs.exe 1304 chkdsk.exe 1304 chkdsk.exe 1304 chkdsk.exe 1304 chkdsk.exe 1304 chkdsk.exe 1304 chkdsk.exe 1304 chkdsk.exe 1304 chkdsk.exe 1304 chkdsk.exe 1304 chkdsk.exe 1304 chkdsk.exe 1304 chkdsk.exe 1304 chkdsk.exe 1304 chkdsk.exe 1304 chkdsk.exe 1304 chkdsk.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Shipping Docs.exechkdsk.exepid process 2712 Shipping Docs.exe 2712 Shipping Docs.exe 2712 Shipping Docs.exe 1304 chkdsk.exe 1304 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Shipping Docs.exeShipping Docs.exechkdsk.exedescription pid process Token: SeDebugPrivilege 900 Shipping Docs.exe Token: SeDebugPrivilege 2712 Shipping Docs.exe Token: SeDebugPrivilege 1304 chkdsk.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
Shipping Docs.exeExplorer.EXEchkdsk.exedescription pid process target process PID 900 wrote to memory of 3800 900 Shipping Docs.exe schtasks.exe PID 900 wrote to memory of 3800 900 Shipping Docs.exe schtasks.exe PID 900 wrote to memory of 3800 900 Shipping Docs.exe schtasks.exe PID 900 wrote to memory of 1484 900 Shipping Docs.exe Shipping Docs.exe PID 900 wrote to memory of 1484 900 Shipping Docs.exe Shipping Docs.exe PID 900 wrote to memory of 1484 900 Shipping Docs.exe Shipping Docs.exe PID 900 wrote to memory of 2680 900 Shipping Docs.exe Shipping Docs.exe PID 900 wrote to memory of 2680 900 Shipping Docs.exe Shipping Docs.exe PID 900 wrote to memory of 2680 900 Shipping Docs.exe Shipping Docs.exe PID 900 wrote to memory of 2712 900 Shipping Docs.exe Shipping Docs.exe PID 900 wrote to memory of 2712 900 Shipping Docs.exe Shipping Docs.exe PID 900 wrote to memory of 2712 900 Shipping Docs.exe Shipping Docs.exe PID 900 wrote to memory of 2712 900 Shipping Docs.exe Shipping Docs.exe PID 900 wrote to memory of 2712 900 Shipping Docs.exe Shipping Docs.exe PID 900 wrote to memory of 2712 900 Shipping Docs.exe Shipping Docs.exe PID 3024 wrote to memory of 1304 3024 Explorer.EXE chkdsk.exe PID 3024 wrote to memory of 1304 3024 Explorer.EXE chkdsk.exe PID 3024 wrote to memory of 1304 3024 Explorer.EXE chkdsk.exe PID 1304 wrote to memory of 888 1304 chkdsk.exe cmd.exe PID 1304 wrote to memory of 888 1304 chkdsk.exe cmd.exe PID 1304 wrote to memory of 888 1304 chkdsk.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Shipping Docs.exe"C:\Users\Admin\AppData\Local\Temp\Shipping Docs.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vLcIzJDan" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2893.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Shipping Docs.exe"C:\Users\Admin\AppData\Local\Temp\Shipping Docs.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Shipping Docs.exe"C:\Users\Admin\AppData\Local\Temp\Shipping Docs.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Shipping Docs.exe"C:\Users\Admin\AppData\Local\Temp\Shipping Docs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Shipping Docs.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp2893.tmpMD5
8cb960d7c9d01cf8d1ac206ec0432607
SHA1d9577ffa24f9d7135de5550baae29705917bc110
SHA25601f60839eb3e68a29c1d562f98ad468180fc4308c4d7723c7e39c8484b469fdf
SHA512dd3ed1434dcd2818c49930acc7e58a248a05fe50acfb09356d150eca64712363085d0a951d4ec91602bbb0c866480ef57d2f1751e7b0c6ebc5871c193a434cb5
-
memory/888-126-0x0000000000000000-mapping.dmp
-
memory/900-114-0x0000000001310000-0x0000000001311000-memory.dmpFilesize
4KB
-
memory/1304-123-0x0000000000000000-mapping.dmp
-
memory/1304-128-0x0000000004E60000-0x0000000004EF3000-memory.dmpFilesize
588KB
-
memory/1304-127-0x0000000004F90000-0x00000000052B0000-memory.dmpFilesize
3.1MB
-
memory/1304-125-0x0000000000540000-0x000000000056E000-memory.dmpFilesize
184KB
-
memory/1304-124-0x00000000008D0000-0x00000000008DA000-memory.dmpFilesize
40KB
-
memory/2712-117-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/2712-121-0x0000000000D00000-0x0000000000DAE000-memory.dmpFilesize
696KB
-
memory/2712-120-0x00000000013B0000-0x00000000016D0000-memory.dmpFilesize
3.1MB
-
memory/2712-118-0x000000000041EAC0-mapping.dmp
-
memory/3024-122-0x0000000004DA0000-0x0000000004EB3000-memory.dmpFilesize
1.1MB
-
memory/3024-129-0x0000000005E30000-0x0000000005FA8000-memory.dmpFilesize
1.5MB
-
memory/3800-115-0x0000000000000000-mapping.dmp