Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
04-05-2021 18:21
Static task
static1
Behavioral task
behavioral1
Sample
Nuevo orden pdf.exe
Resource
win7v20210408
General
-
Target
Nuevo orden pdf.exe
-
Size
886KB
-
MD5
02a32cc05efbf5236a8c0928d3c9170e
-
SHA1
fa3a639f15116da149b14d832b9255528f0bfe65
-
SHA256
5930cfa7dd5664e104c299fce83451021349922b6b02774235eae6bd14fad464
-
SHA512
22c8ba32af4a695410652d2d6fcbf79e1804eb9ffd4328f5377e20485052366f53467fc6691070787ae750d8c5b8304e446df803b0375ca45268bc1e264f26ea
Malware Config
Extracted
formbook
4.1
http://www.lovetarot.online/sqxs/
creid-network.com
dinningatcastlehill.com
fundadilla.com
fashionmdeasy.com
magentos6.com
pushpartybdp.com
streamingnetwork.xyz
sevenredwalls.com
hsuehsun.space
leanbirthdaycake.com
rocketmortgagedeceit.com
cashflowdb.com
smilebringerdesign.com
naomicoleclinic.com
wingsforklift.com
newsounding.com
48hrbusinessrescue.pro
101osthoff456.com
attleticgreens.com
xx233.xyz
niziuantena.com
photosbyamandajdaniels.com
udharworld.com
astrolmass.com
wzht88.com
victoriasessionsheroes.com
thefuture101.com
sihe08.com
webingnar.com
influentialgood.com
jobdoctorplacements.com
bankrotstvostavropol.pro
gracefulfari.com
bluevistainvestments.com
poopertroopersct.com
link-glue.com
barbequeterie.com
ajbkscw.com
janek-sales-training.net
salesjump.xyz
whatthefountain.com
centre-pour-formation.com
aiocoin.net
thefreemaskstore.com
localwow.net
steven-ross.com
perennialhh.com
luxebeautylash.com
aswahorganic.com
businesshouse5asidejm.com
zowjain.com
mediatraining-toronto.com
ashtangaway.com
solutiirecentedemarketing.club
zgzuqw.com
timerma.com
aguaalcalinamexico.com
tacostio1.com
karitaz.com
bismillahbodyoil.com
c2p.life
kacgt.com
fastcincincinnatioffer.com
michaels.house
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/748-69-0x000000000041ED40-mapping.dmp formbook behavioral1/memory/748-68-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1736-77-0x00000000000E0000-0x000000000010E000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Nuevo orden pdf.exeRegSvcs.exewininit.exedescription pid process target process PID 1088 set thread context of 748 1088 Nuevo orden pdf.exe RegSvcs.exe PID 748 set thread context of 1352 748 RegSvcs.exe Explorer.EXE PID 1736 set thread context of 1352 1736 wininit.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
RegSvcs.exewininit.exepid process 748 RegSvcs.exe 748 RegSvcs.exe 1736 wininit.exe 1736 wininit.exe 1736 wininit.exe 1736 wininit.exe 1736 wininit.exe 1736 wininit.exe 1736 wininit.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.exewininit.exepid process 748 RegSvcs.exe 748 RegSvcs.exe 748 RegSvcs.exe 1736 wininit.exe 1736 wininit.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
RegSvcs.exewininit.exedescription pid process Token: SeDebugPrivilege 748 RegSvcs.exe Token: SeDebugPrivilege 1736 wininit.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
Nuevo orden pdf.exeExplorer.EXEwininit.exedescription pid process target process PID 1088 wrote to memory of 976 1088 Nuevo orden pdf.exe schtasks.exe PID 1088 wrote to memory of 976 1088 Nuevo orden pdf.exe schtasks.exe PID 1088 wrote to memory of 976 1088 Nuevo orden pdf.exe schtasks.exe PID 1088 wrote to memory of 976 1088 Nuevo orden pdf.exe schtasks.exe PID 1088 wrote to memory of 748 1088 Nuevo orden pdf.exe RegSvcs.exe PID 1088 wrote to memory of 748 1088 Nuevo orden pdf.exe RegSvcs.exe PID 1088 wrote to memory of 748 1088 Nuevo orden pdf.exe RegSvcs.exe PID 1088 wrote to memory of 748 1088 Nuevo orden pdf.exe RegSvcs.exe PID 1088 wrote to memory of 748 1088 Nuevo orden pdf.exe RegSvcs.exe PID 1088 wrote to memory of 748 1088 Nuevo orden pdf.exe RegSvcs.exe PID 1088 wrote to memory of 748 1088 Nuevo orden pdf.exe RegSvcs.exe PID 1088 wrote to memory of 748 1088 Nuevo orden pdf.exe RegSvcs.exe PID 1088 wrote to memory of 748 1088 Nuevo orden pdf.exe RegSvcs.exe PID 1088 wrote to memory of 748 1088 Nuevo orden pdf.exe RegSvcs.exe PID 1352 wrote to memory of 1736 1352 Explorer.EXE wininit.exe PID 1352 wrote to memory of 1736 1352 Explorer.EXE wininit.exe PID 1352 wrote to memory of 1736 1352 Explorer.EXE wininit.exe PID 1352 wrote to memory of 1736 1352 Explorer.EXE wininit.exe PID 1736 wrote to memory of 828 1736 wininit.exe cmd.exe PID 1736 wrote to memory of 828 1736 wininit.exe cmd.exe PID 1736 wrote to memory of 828 1736 wininit.exe cmd.exe PID 1736 wrote to memory of 828 1736 wininit.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Nuevo orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\Nuevo orden pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NkwKQPLeekw" /XML "C:\Users\Admin\AppData\Local\Temp\tmp27FA.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wininit.exe"C:\Windows\SysWOW64\wininit.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp27FA.tmpMD5
7125a6eaeb926b02555e333e1b98d343
SHA1ffa914785b9b95a2815bd5920c44643b62ff7b87
SHA256f88be3e1886fd3c8ff18b2ba97cb4fa286b4b96a3ee2f3c60d5af1fb5bf603fb
SHA5127ef0b6fb3d8486356abb13e4cdc51e6cbbbb764ae107528abb17ce80bed6d9251da7a86c082f2010168c45dcfaeac86bf89e037f80c0ac71113f05a2b59e2b2a
-
memory/748-69-0x000000000041ED40-mapping.dmp
-
memory/748-72-0x0000000000150000-0x0000000000164000-memory.dmpFilesize
80KB
-
memory/748-71-0x0000000000AE0000-0x0000000000DE3000-memory.dmpFilesize
3.0MB
-
memory/748-68-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/828-75-0x0000000000000000-mapping.dmp
-
memory/976-66-0x0000000000000000-mapping.dmp
-
memory/1088-65-0x0000000004DF0000-0x0000000004E55000-memory.dmpFilesize
404KB
-
memory/1088-60-0x00000000000F0000-0x00000000000F1000-memory.dmpFilesize
4KB
-
memory/1088-64-0x0000000005020000-0x00000000050CB000-memory.dmpFilesize
684KB
-
memory/1088-63-0x0000000000470000-0x000000000047E000-memory.dmpFilesize
56KB
-
memory/1088-62-0x0000000002250000-0x0000000002251000-memory.dmpFilesize
4KB
-
memory/1352-73-0x0000000004A90000-0x0000000004B5A000-memory.dmpFilesize
808KB
-
memory/1352-80-0x0000000006D10000-0x0000000006E6C000-memory.dmpFilesize
1.4MB
-
memory/1736-74-0x0000000000000000-mapping.dmp
-
memory/1736-76-0x0000000000C70000-0x0000000000C8A000-memory.dmpFilesize
104KB
-
memory/1736-78-0x0000000002090000-0x0000000002393000-memory.dmpFilesize
3.0MB
-
memory/1736-77-0x00000000000E0000-0x000000000010E000-memory.dmpFilesize
184KB
-
memory/1736-79-0x0000000000850000-0x00000000008E3000-memory.dmpFilesize
588KB