Analysis
-
max time kernel
151s -
max time network
14s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
03-05-2021 06:09
Static task
static1
Behavioral task
behavioral1
Sample
0BX91W1MA.scr
Resource
win7v20210408
General
-
Target
0BX91W1MA.scr
-
Size
770KB
-
MD5
f39afbe1c85c716c173a20017b94319c
-
SHA1
56398ed8fab138969bfa478e28d82f77e0ecd463
-
SHA256
8f0337a6ceabb0f235950c20db817d766d4b9e5cf8831e60ef766c82f33f7dec
-
SHA512
bbdec959a7d3299d93a6ec77980b23625f52a002e0231cb095a71a870db2819aca0d60a9c1f0eec4b5f3656c92d252a61b6ae63fb914755dc8fe74b6eddd0de8
Malware Config
Extracted
formbook
4.1
http://www.evolvekitchendesign.com/ffw/
unmutedgenerations.com
localmoversuae.com
centralrea.com
geyyfphzoe.com
silverpackfactory.com
techtronixx.com
shop-deinen-deal.com
buehne.cloud
inspirefreedomtoday.com
chapelcouture.com
easton-taiwan.com
quanaonudep.store
merzigomusic.com
wpzoomin.com
service-lkytrsahdfpedf.com
yeasuc.com
mydogtrainingservice.com
galeribisnisonline.com
cscremodeling.com
bom-zzxx.com
ensobet88.com
vegancto.com
digivisiol.com
advancetools.net
gzqyjd.com
xtgnsl.com
ftfortmyers.com
g-siqueira.com
ufdzbhrxk.icu
tiekotiin.com
youschrutedit.com
takahatadenkikouji.com
goodfastco.com
jtelitetraining.com
planet-hype.com
gigwindow.com
levelxpr.com
besttechmobcomm.info
funneldesigngenie.com
mylisting.cloud
alltwoyou.com
mortgagesandprotection.online
monthlydigest.info
senlangdq.com
postphenomenon.com
slymwhite.com
masonpreschool.com
wahooshop.com
meridiangummies.com
samsungpartsdept.com
saludbellezaybienestar.net
vickifoxproductions.com
shawandwesson.info
nutrepele.com
gorillatanks.com
praktijkinfinity.online
lanteredam.com
refinedmanagement.com
tiwapay.com
fruitsinbeers.com
charliekay.net
realironart.com
sonsofmari.com
kedingtonni.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1852-66-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1852-67-0x000000000041EB50-mapping.dmp formbook behavioral1/memory/864-77-0x0000000000080000-0x00000000000AE000-memory.dmp formbook -
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Looks for VMWare Tools registry key 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
0BX91W1MA.scrdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 0BX91W1MA.scr Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 0BX91W1MA.scr -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1284 cmd.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
0BX91W1MA.scrdescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 0BX91W1MA.scr Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 0BX91W1MA.scr -
Suspicious use of SetThreadContext 3 IoCs
Processes:
0BX91W1MA.scr0BX91W1MA.screxplorer.exedescription pid process target process PID 1840 set thread context of 1852 1840 0BX91W1MA.scr 0BX91W1MA.scr PID 1852 set thread context of 1212 1852 0BX91W1MA.scr Explorer.EXE PID 864 set thread context of 1212 864 explorer.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
0BX91W1MA.scr0BX91W1MA.screxplorer.exepid process 1840 0BX91W1MA.scr 1852 0BX91W1MA.scr 1852 0BX91W1MA.scr 864 explorer.exe 864 explorer.exe 864 explorer.exe 864 explorer.exe 864 explorer.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
0BX91W1MA.screxplorer.exepid process 1852 0BX91W1MA.scr 1852 0BX91W1MA.scr 1852 0BX91W1MA.scr 864 explorer.exe 864 explorer.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
0BX91W1MA.scr0BX91W1MA.screxplorer.exedescription pid process Token: SeDebugPrivilege 1840 0BX91W1MA.scr Token: SeDebugPrivilege 1852 0BX91W1MA.scr Token: SeDebugPrivilege 864 explorer.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
0BX91W1MA.scrExplorer.EXEexplorer.exedescription pid process target process PID 1840 wrote to memory of 1852 1840 0BX91W1MA.scr 0BX91W1MA.scr PID 1840 wrote to memory of 1852 1840 0BX91W1MA.scr 0BX91W1MA.scr PID 1840 wrote to memory of 1852 1840 0BX91W1MA.scr 0BX91W1MA.scr PID 1840 wrote to memory of 1852 1840 0BX91W1MA.scr 0BX91W1MA.scr PID 1840 wrote to memory of 1852 1840 0BX91W1MA.scr 0BX91W1MA.scr PID 1840 wrote to memory of 1852 1840 0BX91W1MA.scr 0BX91W1MA.scr PID 1840 wrote to memory of 1852 1840 0BX91W1MA.scr 0BX91W1MA.scr PID 1212 wrote to memory of 864 1212 Explorer.EXE explorer.exe PID 1212 wrote to memory of 864 1212 Explorer.EXE explorer.exe PID 1212 wrote to memory of 864 1212 Explorer.EXE explorer.exe PID 1212 wrote to memory of 864 1212 Explorer.EXE explorer.exe PID 864 wrote to memory of 1284 864 explorer.exe cmd.exe PID 864 wrote to memory of 1284 864 explorer.exe cmd.exe PID 864 wrote to memory of 1284 864 explorer.exe cmd.exe PID 864 wrote to memory of 1284 864 explorer.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0BX91W1MA.scr"C:\Users\Admin\AppData\Local\Temp\0BX91W1MA.scr" /S2⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0BX91W1MA.scr"C:\Users\Admin\AppData\Local\Temp\0BX91W1MA.scr"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\0BX91W1MA.scr"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/864-72-0x0000000000000000-mapping.dmp
-
memory/864-79-0x0000000000A00000-0x0000000000A93000-memory.dmpFilesize
588KB
-
memory/864-76-0x0000000000AC0000-0x0000000000D41000-memory.dmpFilesize
2.5MB
-
memory/864-78-0x0000000002520000-0x0000000002823000-memory.dmpFilesize
3.0MB
-
memory/864-77-0x0000000000080000-0x00000000000AE000-memory.dmpFilesize
184KB
-
memory/864-74-0x00000000744B1000-0x00000000744B3000-memory.dmpFilesize
8KB
-
memory/864-73-0x0000000074D91000-0x0000000074D93000-memory.dmpFilesize
8KB
-
memory/1212-80-0x0000000004DF0000-0x0000000004EB6000-memory.dmpFilesize
792KB
-
memory/1212-71-0x0000000004F40000-0x00000000050EA000-memory.dmpFilesize
1.7MB
-
memory/1284-75-0x0000000000000000-mapping.dmp
-
memory/1840-65-0x0000000001370000-0x00000000013D9000-memory.dmpFilesize
420KB
-
memory/1840-60-0x00000000013E0000-0x00000000013E1000-memory.dmpFilesize
4KB
-
memory/1840-64-0x0000000005340000-0x00000000053F1000-memory.dmpFilesize
708KB
-
memory/1840-63-0x0000000000260000-0x000000000026E000-memory.dmpFilesize
56KB
-
memory/1840-62-0x0000000004EA0000-0x0000000004EA1000-memory.dmpFilesize
4KB
-
memory/1852-70-0x0000000000190000-0x00000000001A4000-memory.dmpFilesize
80KB
-
memory/1852-69-0x00000000009E0000-0x0000000000CE3000-memory.dmpFilesize
3.0MB
-
memory/1852-67-0x000000000041EB50-mapping.dmp
-
memory/1852-66-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB