Analysis
-
max time kernel
150s -
max time network
136s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
21-04-2021 10:11
Static task
static1
Behavioral task
behavioral1
Sample
Halkbank,doc 00100210210.exe
Resource
win7v20210410
General
-
Target
Halkbank,doc 00100210210.exe
-
Size
270KB
-
MD5
4744495f286ed57aee218fe035b6d8b5
-
SHA1
f90d47ed2f471017c913c6e6d5924f38d9a6673c
-
SHA256
b03f6bc5eec0f24076b3ef2c761b21d75c489ad34c5f94dcffab6d2b4d65263f
-
SHA512
c9b78c243895fdd30a673b045b6b2b5ca0d552490d4c0c005c583ccaa03c42d54df3a7b2e978f169dc9009ff651ea1a4eb8130a9335879c45b95d02f6153e037
Malware Config
Extracted
formbook
4.1
http://www.magnumopuspro.com/nyr/
anemone-vintage.com
ironcitytools.com
joshandmatthew.com
breathtakingscenery.photos
karabakh-terror.com
micahelgall.com
entretiendesterrasses.com
mhgholdings.com
blewm.com
sidewalknotary.com
ytrs-elec.com
danhpham.com
ma21cle2henz.xyz
lotusforlease.com
shipleyphotoandfilm.com
bulktool.xyz
ouedzmala.com
yichengvpr.com
connectmygames.com
chjcsc.com
dope-chocolate.com
tacowench.com
projectsbay.com
xn--pgboc92d.com
royaldropofoil.com
ranguanglian.club
mobilne-kucice.com
buytsycon.com
goiasbets.net
blpetroleum.com
starrealms.net
exclusiveflooringcollection.com
kudalive.com
tienda-sky.com
drillinginsider.info
theglasshousenyc.com
vietnammoi.xyz
walterbenicio.com
zoomtvliveshows.xyz
boujiehoodbaby.com
yzyangyu.com
exploreecetera.com
sycord.com
waykifood.com
shadingconsultancy.com
precedentai.net
linhanhkitchen.com
expekt24.com
socialdating24.com
lubvim.com
floryi.com
alerist.com
maluss.com
hitbbq.com
alerrandrotattoo.com
algoplayer.com
idahooutsiders.com
qygmuakhk.club
neverpossible.com
winparadigm.com
toughdecorative.com
yourbuildmedia.com
summercrowd.com
josemvazquez.com
Signatures
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1772-64-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1608-72-0x0000000000090000-0x00000000000BE000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 740 cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
Halkbank,doc 00100210210.exepid process 1996 Halkbank,doc 00100210210.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Halkbank,doc 00100210210.exeHalkbank,doc 00100210210.execmstp.exedescription pid process target process PID 1996 set thread context of 1772 1996 Halkbank,doc 00100210210.exe Halkbank,doc 00100210210.exe PID 1772 set thread context of 1220 1772 Halkbank,doc 00100210210.exe Explorer.EXE PID 1608 set thread context of 1220 1608 cmstp.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 31 IoCs
Processes:
Halkbank,doc 00100210210.execmstp.exepid process 1772 Halkbank,doc 00100210210.exe 1772 Halkbank,doc 00100210210.exe 1608 cmstp.exe 1608 cmstp.exe 1608 cmstp.exe 1608 cmstp.exe 1608 cmstp.exe 1608 cmstp.exe 1608 cmstp.exe 1608 cmstp.exe 1608 cmstp.exe 1608 cmstp.exe 1608 cmstp.exe 1608 cmstp.exe 1608 cmstp.exe 1608 cmstp.exe 1608 cmstp.exe 1608 cmstp.exe 1608 cmstp.exe 1608 cmstp.exe 1608 cmstp.exe 1608 cmstp.exe 1608 cmstp.exe 1608 cmstp.exe 1608 cmstp.exe 1608 cmstp.exe 1608 cmstp.exe 1608 cmstp.exe 1608 cmstp.exe 1608 cmstp.exe 1608 cmstp.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1220 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
Halkbank,doc 00100210210.exeHalkbank,doc 00100210210.execmstp.exepid process 1996 Halkbank,doc 00100210210.exe 1772 Halkbank,doc 00100210210.exe 1772 Halkbank,doc 00100210210.exe 1772 Halkbank,doc 00100210210.exe 1608 cmstp.exe 1608 cmstp.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Halkbank,doc 00100210210.execmstp.exedescription pid process Token: SeDebugPrivilege 1772 Halkbank,doc 00100210210.exe Token: SeDebugPrivilege 1608 cmstp.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
Halkbank,doc 00100210210.exeExplorer.EXEcmstp.exedescription pid process target process PID 1996 wrote to memory of 1772 1996 Halkbank,doc 00100210210.exe Halkbank,doc 00100210210.exe PID 1996 wrote to memory of 1772 1996 Halkbank,doc 00100210210.exe Halkbank,doc 00100210210.exe PID 1996 wrote to memory of 1772 1996 Halkbank,doc 00100210210.exe Halkbank,doc 00100210210.exe PID 1996 wrote to memory of 1772 1996 Halkbank,doc 00100210210.exe Halkbank,doc 00100210210.exe PID 1996 wrote to memory of 1772 1996 Halkbank,doc 00100210210.exe Halkbank,doc 00100210210.exe PID 1220 wrote to memory of 1608 1220 Explorer.EXE cmstp.exe PID 1220 wrote to memory of 1608 1220 Explorer.EXE cmstp.exe PID 1220 wrote to memory of 1608 1220 Explorer.EXE cmstp.exe PID 1220 wrote to memory of 1608 1220 Explorer.EXE cmstp.exe PID 1220 wrote to memory of 1608 1220 Explorer.EXE cmstp.exe PID 1220 wrote to memory of 1608 1220 Explorer.EXE cmstp.exe PID 1220 wrote to memory of 1608 1220 Explorer.EXE cmstp.exe PID 1608 wrote to memory of 740 1608 cmstp.exe cmd.exe PID 1608 wrote to memory of 740 1608 cmstp.exe cmd.exe PID 1608 wrote to memory of 740 1608 cmstp.exe cmd.exe PID 1608 wrote to memory of 740 1608 cmstp.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Halkbank,doc 00100210210.exe"C:\Users\Admin\AppData\Local\Temp\Halkbank,doc 00100210210.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Halkbank,doc 00100210210.exe"C:\Users\Admin\AppData\Local\Temp\Halkbank,doc 00100210210.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Halkbank,doc 00100210210.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nss4B4.tmp\c4y3gc.dllMD5
127cb178b9b88a44d8dd4c0f4d37d723
SHA1eebbe7fa1f97fb99ed8b9e22b5bab8b2838c0e86
SHA256b8f809ad68b284ad6039143935ffc90a3cd4c6a71a9eca77eef981e83a4c89b2
SHA512b6b02bae72fc9103d35238e2380f7213038cbcb7472f55b032b963993d8b9306f97651675796e3082360b42e717ae7d4aa5694c750cf0e9b18edbb3ff94415ad
-
memory/740-70-0x0000000000000000-mapping.dmp
-
memory/1220-67-0x00000000071C0000-0x0000000007307000-memory.dmpFilesize
1.3MB
-
memory/1220-75-0x0000000004FA0000-0x00000000050A3000-memory.dmpFilesize
1.0MB
-
memory/1608-71-0x00000000007C0000-0x00000000007D8000-memory.dmpFilesize
96KB
-
memory/1608-68-0x0000000000000000-mapping.dmp
-
memory/1608-72-0x0000000000090000-0x00000000000BE000-memory.dmpFilesize
184KB
-
memory/1608-73-0x0000000001F00000-0x0000000002203000-memory.dmpFilesize
3.0MB
-
memory/1608-74-0x0000000001D70000-0x0000000001E03000-memory.dmpFilesize
588KB
-
memory/1772-64-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1772-65-0x0000000000850000-0x0000000000B53000-memory.dmpFilesize
3.0MB
-
memory/1772-66-0x00000000002C0000-0x00000000002D4000-memory.dmpFilesize
80KB
-
memory/1772-61-0x000000000041EBA0-mapping.dmp
-
memory/1996-63-0x0000000002901000-0x0000000002903000-memory.dmpFilesize
8KB
-
memory/1996-62-0x0000000002900000-0x0000000002901000-memory.dmpFilesize
4KB
-
memory/1996-59-0x0000000075D41000-0x0000000075D43000-memory.dmpFilesize
8KB