Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
23-04-2021 10:04
Static task
static1
Behavioral task
behavioral1
Sample
SO.xlsm.com.exe
Resource
win7v20210410
General
-
Target
SO.xlsm.com.exe
-
Size
1000KB
-
MD5
1897e7a63a0424946e9274d83b405de2
-
SHA1
e15588e0c4ab4e12206e370b0b122b2b42ecf837
-
SHA256
b4751ea85e4bdc57c69f0dfd09e9622e31eb23bac589d7ee409eceaca56ea280
-
SHA512
66f07acbc89ff62dbdbed06efaaa7721f6bd46d9b94a86ba9f2bca3f5552977b8bd9ad375764036a8f6eaa6f74029dabd30e6602ab6f11a719eebec97338560e
Malware Config
Extracted
formbook
4.1
http://www.hollandhousedesigns.design/vns/
sparkspressworld.com
everydayresidency.com
thebosscollectionn.com
milkweedmagic.com
worklesshours.com
romeosfurnituremadera.com
unclepetesproduce.com
athleticamackay.com
9nhl.com
powellassetmanagement.com
jxlamp.com
onpointpetproducts.com
buymysoft.com
nazertrader.com
goprj.com
keeptalkservice.com
aolei1688.com
donstackl.com
almasorchids.com
pj5bwn.com
featuredshop2020.com
connectmheduaction.com
kcastleint.com
quintessentialmiss.com
forenvid.com
vetementsbd.com
fabrizioamadori.net
remaxplatinumva.com
drivecart.net
ordertds.com
huayuanjiajiao.com
islamiportal.com
innergardenhealing.space
wlwmwntor.com
wiitendo.com
ceschandigarh.com
mitchellche.com
levaporz.com
eraophthalmica.com
gnzywyht.com
bobbinsbroider.com
pollygen.com
xn--kbrsotocheckup-5fcc.com
theunprofessionalpodcast.com
lendini.site
digitalpardis.com
meenaveen.com
yihuafence.com
mercadoaria.com
domennyarendi44.net
juandiegopalacio.com
meltdownfitnesstulsa.com
xn--laclnicadelvnculo-gvbi.com
paripartners378.com
valadecia.com
womenring.com
ocarlosresolve.com
vedicherbsindia.com
nonnearrapate.com
viplending.net
angelbeatsgamingclan.com
rigmodisc.com
page-id-78613.com
yapadaihindi.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/836-69-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/836-70-0x000000000041EBB0-mapping.dmp formbook behavioral1/memory/824-80-0x0000000000110000-0x000000000013E000-memory.dmp formbook -
Executes dropped EXE 1 IoCs
Processes:
ummvhsex.pifpid process 1996 ummvhsex.pif -
Loads dropped DLL 4 IoCs
Processes:
SO.xlsm.com.exepid process 1084 SO.xlsm.com.exe 1084 SO.xlsm.com.exe 1084 SO.xlsm.com.exe 1084 SO.xlsm.com.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
ummvhsex.pifRegSvcs.exemsiexec.exedescription pid process target process PID 1996 set thread context of 836 1996 ummvhsex.pif RegSvcs.exe PID 836 set thread context of 1288 836 RegSvcs.exe Explorer.EXE PID 836 set thread context of 1288 836 RegSvcs.exe Explorer.EXE PID 824 set thread context of 1288 824 msiexec.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 29 IoCs
Processes:
RegSvcs.exemsiexec.exepid process 836 RegSvcs.exe 836 RegSvcs.exe 836 RegSvcs.exe 824 msiexec.exe 824 msiexec.exe 824 msiexec.exe 824 msiexec.exe 824 msiexec.exe 824 msiexec.exe 824 msiexec.exe 824 msiexec.exe 824 msiexec.exe 824 msiexec.exe 824 msiexec.exe 824 msiexec.exe 824 msiexec.exe 824 msiexec.exe 824 msiexec.exe 824 msiexec.exe 824 msiexec.exe 824 msiexec.exe 824 msiexec.exe 824 msiexec.exe 824 msiexec.exe 824 msiexec.exe 824 msiexec.exe 824 msiexec.exe 824 msiexec.exe 824 msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1288 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
RegSvcs.exemsiexec.exepid process 836 RegSvcs.exe 836 RegSvcs.exe 836 RegSvcs.exe 836 RegSvcs.exe 824 msiexec.exe 824 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
RegSvcs.exemsiexec.exedescription pid process Token: SeDebugPrivilege 836 RegSvcs.exe Token: SeDebugPrivilege 824 msiexec.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1288 Explorer.EXE 1288 Explorer.EXE 1288 Explorer.EXE 1288 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1288 Explorer.EXE 1288 Explorer.EXE 1288 Explorer.EXE 1288 Explorer.EXE -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
SO.xlsm.com.exeummvhsex.pifRegSvcs.exemsiexec.exedescription pid process target process PID 1084 wrote to memory of 1996 1084 SO.xlsm.com.exe ummvhsex.pif PID 1084 wrote to memory of 1996 1084 SO.xlsm.com.exe ummvhsex.pif PID 1084 wrote to memory of 1996 1084 SO.xlsm.com.exe ummvhsex.pif PID 1084 wrote to memory of 1996 1084 SO.xlsm.com.exe ummvhsex.pif PID 1996 wrote to memory of 316 1996 ummvhsex.pif RegSvcs.exe PID 1996 wrote to memory of 316 1996 ummvhsex.pif RegSvcs.exe PID 1996 wrote to memory of 316 1996 ummvhsex.pif RegSvcs.exe PID 1996 wrote to memory of 316 1996 ummvhsex.pif RegSvcs.exe PID 1996 wrote to memory of 316 1996 ummvhsex.pif RegSvcs.exe PID 1996 wrote to memory of 316 1996 ummvhsex.pif RegSvcs.exe PID 1996 wrote to memory of 316 1996 ummvhsex.pif RegSvcs.exe PID 1996 wrote to memory of 836 1996 ummvhsex.pif RegSvcs.exe PID 1996 wrote to memory of 836 1996 ummvhsex.pif RegSvcs.exe PID 1996 wrote to memory of 836 1996 ummvhsex.pif RegSvcs.exe PID 1996 wrote to memory of 836 1996 ummvhsex.pif RegSvcs.exe PID 1996 wrote to memory of 836 1996 ummvhsex.pif RegSvcs.exe PID 1996 wrote to memory of 836 1996 ummvhsex.pif RegSvcs.exe PID 1996 wrote to memory of 836 1996 ummvhsex.pif RegSvcs.exe PID 1996 wrote to memory of 836 1996 ummvhsex.pif RegSvcs.exe PID 1996 wrote to memory of 836 1996 ummvhsex.pif RegSvcs.exe PID 1996 wrote to memory of 836 1996 ummvhsex.pif RegSvcs.exe PID 836 wrote to memory of 824 836 RegSvcs.exe msiexec.exe PID 836 wrote to memory of 824 836 RegSvcs.exe msiexec.exe PID 836 wrote to memory of 824 836 RegSvcs.exe msiexec.exe PID 836 wrote to memory of 824 836 RegSvcs.exe msiexec.exe PID 836 wrote to memory of 824 836 RegSvcs.exe msiexec.exe PID 836 wrote to memory of 824 836 RegSvcs.exe msiexec.exe PID 836 wrote to memory of 824 836 RegSvcs.exe msiexec.exe PID 824 wrote to memory of 932 824 msiexec.exe cmd.exe PID 824 wrote to memory of 932 824 msiexec.exe cmd.exe PID 824 wrote to memory of 932 824 msiexec.exe cmd.exe PID 824 wrote to memory of 932 824 msiexec.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\SO.xlsm.com.exe"C:\Users\Admin\AppData\Local\Temp\SO.xlsm.com.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\57992106\ummvhsex.pif"C:\Users\Admin\57992106\ummvhsex.pif" smlhxxnpxo.scp3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"5⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"6⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\57992106\cnrxxvsq.xmlMD5
8ba6d1bcca58443c729743475e797e1b
SHA1a270f64248909dc7fef1637d29297f3b3512cbeb
SHA256c1771a56fdd00339066ffad9a8d0ed247dcaaafa0076f30e5477ce769c802048
SHA5124f5506ea2c0a0349edbdfaa3a19fa7f300fdc6cde15f53e1c17d1cb6e998294e07809336382004d5e3f805cbef49c2df8aa2d74bea7c68aafee60310e009f40a
-
C:\Users\Admin\57992106\smlhxxnpxo.scpMD5
66c7ff0768ddb64f4504146a56ed004b
SHA188507bd159e02bddfb5153cff306a49407c8d650
SHA256bf8823d58e7a374fec3f69a38ec91e93c0598e0bf27c9aa4c2a21aaca05a77e9
SHA5129d4bb287ca55d2cc486bb5c51a438443828f5891497b196a2da0f9ca349742680c3a6022b742c137adb9fbc8892b46afa97407593b1d2f492a27e6525b9387fb
-
C:\Users\Admin\57992106\ummvhsex.pifMD5
6b57334b6cde8f40e11ad21b9e878adf
SHA14a6e4ad50297b3d941a392fac503a6731fab6eac
SHA2560ce3edfd31e07ed4e16495a92e107ca5b60e2e6ae938de2a57a565d2d7d256db
SHA5128d0fb7a156d07b416b4d102eabb0ba06cac3696ca3205f0d69a21077c6011adf192cc30530c3716ad0fba92cfeb50d9dbf96f6a65c4955fde093a37d167e05ff
-
\Users\Admin\57992106\ummvhsex.pifMD5
6b57334b6cde8f40e11ad21b9e878adf
SHA14a6e4ad50297b3d941a392fac503a6731fab6eac
SHA2560ce3edfd31e07ed4e16495a92e107ca5b60e2e6ae938de2a57a565d2d7d256db
SHA5128d0fb7a156d07b416b4d102eabb0ba06cac3696ca3205f0d69a21077c6011adf192cc30530c3716ad0fba92cfeb50d9dbf96f6a65c4955fde093a37d167e05ff
-
\Users\Admin\57992106\ummvhsex.pifMD5
6b57334b6cde8f40e11ad21b9e878adf
SHA14a6e4ad50297b3d941a392fac503a6731fab6eac
SHA2560ce3edfd31e07ed4e16495a92e107ca5b60e2e6ae938de2a57a565d2d7d256db
SHA5128d0fb7a156d07b416b4d102eabb0ba06cac3696ca3205f0d69a21077c6011adf192cc30530c3716ad0fba92cfeb50d9dbf96f6a65c4955fde093a37d167e05ff
-
\Users\Admin\57992106\ummvhsex.pifMD5
6b57334b6cde8f40e11ad21b9e878adf
SHA14a6e4ad50297b3d941a392fac503a6731fab6eac
SHA2560ce3edfd31e07ed4e16495a92e107ca5b60e2e6ae938de2a57a565d2d7d256db
SHA5128d0fb7a156d07b416b4d102eabb0ba06cac3696ca3205f0d69a21077c6011adf192cc30530c3716ad0fba92cfeb50d9dbf96f6a65c4955fde093a37d167e05ff
-
\Users\Admin\57992106\ummvhsex.pifMD5
6b57334b6cde8f40e11ad21b9e878adf
SHA14a6e4ad50297b3d941a392fac503a6731fab6eac
SHA2560ce3edfd31e07ed4e16495a92e107ca5b60e2e6ae938de2a57a565d2d7d256db
SHA5128d0fb7a156d07b416b4d102eabb0ba06cac3696ca3205f0d69a21077c6011adf192cc30530c3716ad0fba92cfeb50d9dbf96f6a65c4955fde093a37d167e05ff
-
memory/824-83-0x0000000000AF0000-0x0000000000B83000-memory.dmpFilesize
588KB
-
memory/824-81-0x0000000002270000-0x0000000002573000-memory.dmpFilesize
3.0MB
-
memory/824-77-0x0000000000000000-mapping.dmp
-
memory/824-80-0x0000000000110000-0x000000000013E000-memory.dmpFilesize
184KB
-
memory/824-79-0x0000000000CC0000-0x0000000000CD4000-memory.dmpFilesize
80KB
-
memory/836-69-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/836-70-0x000000000041EBB0-mapping.dmp
-
memory/836-72-0x0000000000910000-0x0000000000C13000-memory.dmpFilesize
3.0MB
-
memory/836-73-0x0000000000190000-0x00000000001A4000-memory.dmpFilesize
80KB
-
memory/836-75-0x00000000001E0000-0x00000000001F4000-memory.dmpFilesize
80KB
-
memory/932-82-0x0000000000000000-mapping.dmp
-
memory/1084-59-0x00000000752F1000-0x00000000752F3000-memory.dmpFilesize
8KB
-
memory/1288-76-0x00000000049A0000-0x0000000004A8A000-memory.dmpFilesize
936KB
-
memory/1288-74-0x0000000004FF0000-0x0000000005121000-memory.dmpFilesize
1.2MB
-
memory/1288-84-0x0000000006F50000-0x0000000007050000-memory.dmpFilesize
1024KB
-
memory/1996-64-0x0000000000000000-mapping.dmp