Analysis
-
max time kernel
151s -
max time network
135s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
04-05-2021 17:27
Static task
static1
Behavioral task
behavioral1
Sample
SHIPPING DOCUMENT.exe
Resource
win7v20210410
General
-
Target
SHIPPING DOCUMENT.exe
-
Size
228KB
-
MD5
25e847b9631bc2fe8d87fe4278fa142e
-
SHA1
641756a84fdce68e101a53cfa6809b68190b7ad7
-
SHA256
70dfd7bc81878d265e39803f73f55af96d7bf2a336408b52cc6005785fbe0415
-
SHA512
82c1e56fa6a6611c45057c80190d2d7d220294a690044a164cdda39bc5e26b8c35d76433e3b1d7d247ef464d3307911a4a4337e52163177f4322fbe67579dabd
Malware Config
Extracted
formbook
4.1
http://www.knighttechinca.com/dxe/
sardarfarm.com
959tremont.com
privat-livecam.net
ansel-homebakery.com
joysupermarket.com
peninsulamatchmakers.net
northsytyle.com
radioconexaoubermusic.com
relocatingrealtor.com
desyrnan.com
onlinehoortoestel.online
enpointe.online
rvvikings.com
paulpoirier.com
shitarpa.net
kerneis.net
rokitreach.com
essentiallygaia.com
prestiged.net
fuerzaagavera.com
soukid.com
moderndatingcoach.com
mentalfreedom.guru
bullishsoftware.com
sectorulb.com
outletyana.com
fptplaybox.website
artinmemory.com
buyruon.com
ljd.xyz
mondaysmatters.com
spiritsoundart.net
ixiangzu.com
lacompagniadelfardello.com
bnctly.com
sarasvati-yoga.com
0055game.com
lagrangewildliferemoval.com
umlausa.com
chaytel.com
kkkc5.com
union-green.com
philreid4cc.com
theanimehat.com
redlightlegal.com
myaustraliarewards.com
barkinlot.com
mujahidservice.online
nugeneraonline.com
sopplugin.com
makemyroom.design
ferienschweden.com
fps2020dkasphotoop.com
stylezbykay.com
royalpropertiesgurugram.com
birzulova.com
cosmicmtn.com
kissanime.press
poweringprogress.today
omsamedic.com
drunkpoetsociety.com
hostbison.com
asapdecor.com
houseofsisson.com
Signatures
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1984-64-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/520-71-0x00000000000C0000-0x00000000000EE000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 764 cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
SHIPPING DOCUMENT.exepid process 1200 SHIPPING DOCUMENT.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
SHIPPING DOCUMENT.exeSHIPPING DOCUMENT.exehelp.exedescription pid process target process PID 1200 set thread context of 1984 1200 SHIPPING DOCUMENT.exe SHIPPING DOCUMENT.exe PID 1984 set thread context of 1256 1984 SHIPPING DOCUMENT.exe Explorer.EXE PID 520 set thread context of 1256 520 help.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 31 IoCs
Processes:
SHIPPING DOCUMENT.exehelp.exepid process 1984 SHIPPING DOCUMENT.exe 1984 SHIPPING DOCUMENT.exe 520 help.exe 520 help.exe 520 help.exe 520 help.exe 520 help.exe 520 help.exe 520 help.exe 520 help.exe 520 help.exe 520 help.exe 520 help.exe 520 help.exe 520 help.exe 520 help.exe 520 help.exe 520 help.exe 520 help.exe 520 help.exe 520 help.exe 520 help.exe 520 help.exe 520 help.exe 520 help.exe 520 help.exe 520 help.exe 520 help.exe 520 help.exe 520 help.exe 520 help.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1256 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
SHIPPING DOCUMENT.exeSHIPPING DOCUMENT.exehelp.exepid process 1200 SHIPPING DOCUMENT.exe 1984 SHIPPING DOCUMENT.exe 1984 SHIPPING DOCUMENT.exe 1984 SHIPPING DOCUMENT.exe 520 help.exe 520 help.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
SHIPPING DOCUMENT.exehelp.exedescription pid process Token: SeDebugPrivilege 1984 SHIPPING DOCUMENT.exe Token: SeDebugPrivilege 520 help.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
SHIPPING DOCUMENT.exeExplorer.EXEhelp.exedescription pid process target process PID 1200 wrote to memory of 1984 1200 SHIPPING DOCUMENT.exe SHIPPING DOCUMENT.exe PID 1200 wrote to memory of 1984 1200 SHIPPING DOCUMENT.exe SHIPPING DOCUMENT.exe PID 1200 wrote to memory of 1984 1200 SHIPPING DOCUMENT.exe SHIPPING DOCUMENT.exe PID 1200 wrote to memory of 1984 1200 SHIPPING DOCUMENT.exe SHIPPING DOCUMENT.exe PID 1200 wrote to memory of 1984 1200 SHIPPING DOCUMENT.exe SHIPPING DOCUMENT.exe PID 1256 wrote to memory of 520 1256 Explorer.EXE help.exe PID 1256 wrote to memory of 520 1256 Explorer.EXE help.exe PID 1256 wrote to memory of 520 1256 Explorer.EXE help.exe PID 1256 wrote to memory of 520 1256 Explorer.EXE help.exe PID 520 wrote to memory of 764 520 help.exe cmd.exe PID 520 wrote to memory of 764 520 help.exe cmd.exe PID 520 wrote to memory of 764 520 help.exe cmd.exe PID 520 wrote to memory of 764 520 help.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCUMENT.exe"C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCUMENT.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCUMENT.exe"C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCUMENT.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCUMENT.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsx215.tmp\2x6gdfzk.dllMD5
45adfa33a0e6a780e55f543a36143542
SHA1540bbbf9ec26ddef911ba80ee0365cf23b687749
SHA2565299a5c9ba1296db0a9f804741b58ec7a0fedaef8937e3cdc21d3523e0449ee3
SHA5122ad608026d78dedd9f803b6a2f7e27e5590d9df5870adeccbdfc353b1d546450075743b499ebcf57f8d67886188db92ba8f968b4d71fed624fd948d3b047a0e3
-
memory/520-73-0x0000000000670000-0x0000000000703000-memory.dmpFilesize
588KB
-
memory/520-72-0x0000000000800000-0x0000000000B03000-memory.dmpFilesize
3.0MB
-
memory/520-71-0x00000000000C0000-0x00000000000EE000-memory.dmpFilesize
184KB
-
memory/520-70-0x0000000000BC0000-0x0000000000BC6000-memory.dmpFilesize
24KB
-
memory/520-68-0x0000000000000000-mapping.dmp
-
memory/764-69-0x0000000000000000-mapping.dmp
-
memory/1200-62-0x0000000000330000-0x0000000000332000-memory.dmpFilesize
8KB
-
memory/1200-60-0x00000000768B1000-0x00000000768B3000-memory.dmpFilesize
8KB
-
memory/1256-67-0x0000000006AD0000-0x0000000006C6A000-memory.dmpFilesize
1.6MB
-
memory/1256-74-0x0000000006DB0000-0x0000000006F24000-memory.dmpFilesize
1.5MB
-
memory/1984-64-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1984-66-0x0000000000340000-0x0000000000354000-memory.dmpFilesize
80KB
-
memory/1984-65-0x00000000008B0000-0x0000000000BB3000-memory.dmpFilesize
3.0MB
-
memory/1984-63-0x000000000041EAF0-mapping.dmp