Analysis
-
max time kernel
147s -
max time network
144s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
30-04-2021 13:31
General
-
Target
89002.msi
-
Size
256KB
-
MD5
a75dd7431fff6664e2a12263881315ef
-
SHA1
b28f29e87fe4b79bc87fe860d21a16780d31069c
-
SHA256
6120294360629da33cd6f897de16401325be12ae2cd9dcc03857de7e0b4f94e4
-
SHA512
dcef03d5e4678aa23d98284cc4c93d535885d6c6b3d2454f12803042393323275db7b32c0d7a553853fffba899d63a5d58fb92e75116d317533879fc28ebcc83
Malware Config
Extracted
formbook
4.1
http://www.111bjs.com/ccr/
abdullahlodhi.com
jevya.com
knoxvillerestaurant.com
mekarauroko7389.com
cricketspowder.net
johannchirinos.com
orangeorganical.com
libero-tt.com
lorenaegianluca.com
wintab.net
modernmillievintage.com
zgdqcyw.com
jeffabildgaardmd.com
nurulfikrimakassar.com
findyourchef.com
innovationsservicegroup.com
destek-taleplerimiz.com
whfqqco.icu
kosmetikmadeingermany.com
dieteticos.net
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload 2 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of SetThreadContext 3 IoCs
-
Drops file in Windows directory 8 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NSIS installer 6 IoCs
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 52 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\89002.msi2⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Installer\MSIB1E3.tmp"3⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Installer\MSIB1E3.tmp"C:\Windows\Installer\MSIB1E3.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Installer\MSIB1E3.tmp"C:\Windows\Installer\MSIB1E3.tmp"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
4f7763bf413f2e070a154ed73dc14ee0
SHA1d088a5e16d0a634cca9be31630e0743722be7804
SHA2565e29e1f268987df8f3a74504ee4926ad1a82c11f016d9aad8818f89202d102ad
SHA5120e2735d69847b9fb6522e0af22e2225246ee74e6899a23c2d814e4e4b7f907545c00e6162321296f7cd1c53169482b11e106c9e3b721ad63bb19acfd99c45755
-
MD5
4f7763bf413f2e070a154ed73dc14ee0
SHA1d088a5e16d0a634cca9be31630e0743722be7804
SHA2565e29e1f268987df8f3a74504ee4926ad1a82c11f016d9aad8818f89202d102ad
SHA5120e2735d69847b9fb6522e0af22e2225246ee74e6899a23c2d814e4e4b7f907545c00e6162321296f7cd1c53169482b11e106c9e3b721ad63bb19acfd99c45755
-
MD5
4f7763bf413f2e070a154ed73dc14ee0
SHA1d088a5e16d0a634cca9be31630e0743722be7804
SHA2565e29e1f268987df8f3a74504ee4926ad1a82c11f016d9aad8818f89202d102ad
SHA5120e2735d69847b9fb6522e0af22e2225246ee74e6899a23c2d814e4e4b7f907545c00e6162321296f7cd1c53169482b11e106c9e3b721ad63bb19acfd99c45755
-
MD5
0efb96fbd5d4765e6d151a23773c15e3
SHA1026cd414eb14d7ea38b88ad2de783ad6bc8cfb4d
SHA2566fcc5d7be9284c5c3954f720c18b12860a65d3a0c418f9769574dc7cf2d26a2b
SHA512ab19270f5a079eb54015f6bee833b2cd695df63e344ebf1d5d217eaea1e18244ec2d1b226cf68f540d8ac81d12a5db1d8ed8e012f8ea94e43ce590ed7ef05e98
-
MD5
939663dd2c8cdc821359e6c80a6797f9
SHA1425fa6af476381ca79d88be32e1070710a6c8da0
SHA2562b78fb04b9d6dd9e542c043a0fa9ce38049715156a592325a97d857ac70b9f27
SHA5124e40df4386b2dee5424a684da2983b0474732a491eed85c4f6a261b4d78de7aeb36798bdb01efb6af469330d9fac39ee166845a76f7de48ec03a994f928c1cb9
-
MD5
c44409c99eee911adfed34a93895b98d
SHA14093cbb2cbba39ce5093fffc3dca7c091780d0c1
SHA25600b12204f9f4d1f3079dfdcb17ea31aa4c975ee452a6688e168ba37a623114f4
SHA5120ab0e60c8c7f797f7b92714db6cf97475df26b0ea7752d78fbd453575630df34e89a178026c2ed0104b44996f9e397d951f5632942c688c194713c714d49822d
-
Filesize
3.1MB
-
-
Filesize
80KB
-
Filesize
184KB
-
Filesize
3.1MB
-
-
Filesize
588KB
-
Filesize
184KB
-
Filesize
1.4MB
-
-
Filesize
724KB
-
Filesize
1.2MB
-
Filesize
412KB
-
-