Analysis
-
max time kernel
150s -
max time network
137s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
04-05-2021 18:21
Static task
static1
Behavioral task
behavioral1
Sample
Nuevo orden pdf.exe
Resource
win7v20210408
General
-
Target
Nuevo orden pdf.exe
-
Size
886KB
-
MD5
02a32cc05efbf5236a8c0928d3c9170e
-
SHA1
fa3a639f15116da149b14d832b9255528f0bfe65
-
SHA256
5930cfa7dd5664e104c299fce83451021349922b6b02774235eae6bd14fad464
-
SHA512
22c8ba32af4a695410652d2d6fcbf79e1804eb9ffd4328f5377e20485052366f53467fc6691070787ae750d8c5b8304e446df803b0375ca45268bc1e264f26ea
Malware Config
Extracted
formbook
4.1
http://www.lovetarot.online/sqxs/
creid-network.com
dinningatcastlehill.com
fundadilla.com
fashionmdeasy.com
magentos6.com
pushpartybdp.com
streamingnetwork.xyz
sevenredwalls.com
hsuehsun.space
leanbirthdaycake.com
rocketmortgagedeceit.com
cashflowdb.com
smilebringerdesign.com
naomicoleclinic.com
wingsforklift.com
newsounding.com
48hrbusinessrescue.pro
101osthoff456.com
attleticgreens.com
xx233.xyz
niziuantena.com
photosbyamandajdaniels.com
udharworld.com
astrolmass.com
wzht88.com
victoriasessionsheroes.com
thefuture101.com
sihe08.com
webingnar.com
influentialgood.com
jobdoctorplacements.com
bankrotstvostavropol.pro
gracefulfari.com
bluevistainvestments.com
poopertroopersct.com
link-glue.com
barbequeterie.com
ajbkscw.com
janek-sales-training.net
salesjump.xyz
whatthefountain.com
centre-pour-formation.com
aiocoin.net
thefreemaskstore.com
localwow.net
steven-ross.com
perennialhh.com
luxebeautylash.com
aswahorganic.com
businesshouse5asidejm.com
zowjain.com
mediatraining-toronto.com
ashtangaway.com
solutiirecentedemarketing.club
zgzuqw.com
timerma.com
aguaalcalinamexico.com
tacostio1.com
karitaz.com
bismillahbodyoil.com
c2p.life
kacgt.com
fastcincincinnatioffer.com
michaels.house
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3484-127-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/3484-128-0x000000000041ED40-mapping.dmp formbook behavioral2/memory/2564-136-0x0000000000580000-0x00000000005AE000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Nuevo orden pdf.exeRegSvcs.execmd.exedescription pid process target process PID 348 set thread context of 3484 348 Nuevo orden pdf.exe RegSvcs.exe PID 3484 set thread context of 3060 3484 RegSvcs.exe Explorer.EXE PID 2564 set thread context of 3060 2564 cmd.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
Nuevo orden pdf.exeRegSvcs.execmd.exepid process 348 Nuevo orden pdf.exe 3484 RegSvcs.exe 3484 RegSvcs.exe 3484 RegSvcs.exe 3484 RegSvcs.exe 2564 cmd.exe 2564 cmd.exe 2564 cmd.exe 2564 cmd.exe 2564 cmd.exe 2564 cmd.exe 2564 cmd.exe 2564 cmd.exe 2564 cmd.exe 2564 cmd.exe 2564 cmd.exe 2564 cmd.exe 2564 cmd.exe 2564 cmd.exe 2564 cmd.exe 2564 cmd.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.execmd.exepid process 3484 RegSvcs.exe 3484 RegSvcs.exe 3484 RegSvcs.exe 2564 cmd.exe 2564 cmd.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Nuevo orden pdf.exeRegSvcs.execmd.exedescription pid process Token: SeDebugPrivilege 348 Nuevo orden pdf.exe Token: SeDebugPrivilege 3484 RegSvcs.exe Token: SeDebugPrivilege 2564 cmd.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Nuevo orden pdf.exeExplorer.EXEcmd.exedescription pid process target process PID 348 wrote to memory of 3204 348 Nuevo orden pdf.exe schtasks.exe PID 348 wrote to memory of 3204 348 Nuevo orden pdf.exe schtasks.exe PID 348 wrote to memory of 3204 348 Nuevo orden pdf.exe schtasks.exe PID 348 wrote to memory of 3484 348 Nuevo orden pdf.exe RegSvcs.exe PID 348 wrote to memory of 3484 348 Nuevo orden pdf.exe RegSvcs.exe PID 348 wrote to memory of 3484 348 Nuevo orden pdf.exe RegSvcs.exe PID 348 wrote to memory of 3484 348 Nuevo orden pdf.exe RegSvcs.exe PID 348 wrote to memory of 3484 348 Nuevo orden pdf.exe RegSvcs.exe PID 348 wrote to memory of 3484 348 Nuevo orden pdf.exe RegSvcs.exe PID 3060 wrote to memory of 2564 3060 Explorer.EXE cmd.exe PID 3060 wrote to memory of 2564 3060 Explorer.EXE cmd.exe PID 3060 wrote to memory of 2564 3060 Explorer.EXE cmd.exe PID 2564 wrote to memory of 2832 2564 cmd.exe cmd.exe PID 2564 wrote to memory of 2832 2564 cmd.exe cmd.exe PID 2564 wrote to memory of 2832 2564 cmd.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Nuevo orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\Nuevo orden pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NkwKQPLeekw" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA326.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpA326.tmpMD5
bb872f0aedacc51c3bf08387534339d7
SHA12b563964b2e0294ea816dca78f99ba869511980b
SHA256536b95b0a32022e786b4e0351ed923762e1a125282180407dc1dc27329e14c28
SHA51214f5f66870f467a4e541e61b1bd40589124e253fbd35cbe98e91d9039018553fcdeabec1431c6e01163f1e9edfb7bab6d2d821373b7668995ea4e7b12ed0a661
-
memory/348-123-0x0000000006670000-0x000000000671B000-memory.dmpFilesize
684KB
-
memory/348-124-0x0000000008BD0000-0x0000000008C35000-memory.dmpFilesize
404KB
-
memory/348-118-0x0000000005970000-0x0000000005971000-memory.dmpFilesize
4KB
-
memory/348-119-0x0000000005800000-0x0000000005801000-memory.dmpFilesize
4KB
-
memory/348-120-0x0000000005B10000-0x0000000005B11000-memory.dmpFilesize
4KB
-
memory/348-121-0x0000000005970000-0x0000000005E6E000-memory.dmpFilesize
5.0MB
-
memory/348-117-0x0000000005E70000-0x0000000005E71000-memory.dmpFilesize
4KB
-
memory/348-114-0x0000000000F10000-0x0000000000F11000-memory.dmpFilesize
4KB
-
memory/348-122-0x0000000005AF0000-0x0000000005AFE000-memory.dmpFilesize
56KB
-
memory/348-116-0x0000000005850000-0x0000000005851000-memory.dmpFilesize
4KB
-
memory/2564-138-0x0000000002D00000-0x0000000002D93000-memory.dmpFilesize
588KB
-
memory/2564-137-0x0000000002E00000-0x0000000003120000-memory.dmpFilesize
3.1MB
-
memory/2564-135-0x0000000000C00000-0x0000000000C59000-memory.dmpFilesize
356KB
-
memory/2564-136-0x0000000000580000-0x00000000005AE000-memory.dmpFilesize
184KB
-
memory/2564-133-0x0000000000000000-mapping.dmp
-
memory/2832-134-0x0000000000000000-mapping.dmp
-
memory/3060-132-0x00000000057F0000-0x000000000591F000-memory.dmpFilesize
1.2MB
-
memory/3060-139-0x0000000000430000-0x00000000004C7000-memory.dmpFilesize
604KB
-
memory/3204-125-0x0000000000000000-mapping.dmp
-
memory/3484-130-0x00000000016A0000-0x00000000019C0000-memory.dmpFilesize
3.1MB
-
memory/3484-131-0x0000000001100000-0x000000000124A000-memory.dmpFilesize
1.3MB
-
memory/3484-128-0x000000000041ED40-mapping.dmp
-
memory/3484-127-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB