Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
05-05-2021 12:01
Static task
static1
Behavioral task
behavioral1
Sample
Booking Declined.scr
Resource
win7v20210410
General
-
Target
Booking Declined.scr
-
Size
1.1MB
-
MD5
72014c837d630e0eb8b79d0995166d47
-
SHA1
57ea4b26a34c0779ae9767cc957452883475cadc
-
SHA256
2deb22be02f4464416048e124a39c1a8df4f29ba90d783d27bfcefa29ddce161
-
SHA512
c74de6fc4b35c52b25062ca5d82f93e93f5978eebacac89fc6e473d6c52141b0737fccbd7810820a5c31ad08ad7288b86f6784b7e9ced821bab13d4a2c8b4c69
Malware Config
Extracted
formbook
4.1
http://www.evolvekitchendesign.com/ffw/
unmutedgenerations.com
localmoversuae.com
centralrea.com
geyyfphzoe.com
silverpackfactory.com
techtronixx.com
shop-deinen-deal.com
buehne.cloud
inspirefreedomtoday.com
chapelcouture.com
easton-taiwan.com
quanaonudep.store
merzigomusic.com
wpzoomin.com
service-lkytrsahdfpedf.com
yeasuc.com
mydogtrainingservice.com
galeribisnisonline.com
cscremodeling.com
bom-zzxx.com
ensobet88.com
vegancto.com
digivisiol.com
advancetools.net
gzqyjd.com
xtgnsl.com
ftfortmyers.com
g-siqueira.com
ufdzbhrxk.icu
tiekotiin.com
youschrutedit.com
takahatadenkikouji.com
goodfastco.com
jtelitetraining.com
planet-hype.com
gigwindow.com
levelxpr.com
besttechmobcomm.info
funneldesigngenie.com
mylisting.cloud
alltwoyou.com
mortgagesandprotection.online
monthlydigest.info
senlangdq.com
postphenomenon.com
slymwhite.com
masonpreschool.com
wahooshop.com
meridiangummies.com
samsungpartsdept.com
saludbellezaybienestar.net
vickifoxproductions.com
shawandwesson.info
nutrepele.com
gorillatanks.com
praktijkinfinity.online
lanteredam.com
refinedmanagement.com
tiwapay.com
fruitsinbeers.com
charliekay.net
realironart.com
sonsofmari.com
kedingtonni.com
Signatures
-
Formbook Payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/1008-124-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/1008-125-0x000000000041EB50-mapping.dmp formbook behavioral2/memory/1008-128-0x0000000001500000-0x00000000015AE000-memory.dmp formbook behavioral2/memory/496-132-0x0000000000B10000-0x0000000000B3E000-memory.dmp formbook -
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Looks for VMWare Tools registry key 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Booking Declined.scrdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Booking Declined.scr Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Booking Declined.scr -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
Booking Declined.scrdescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0 Booking Declined.scr Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum Booking Declined.scr -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Booking Declined.scrBooking Declined.scrwscript.exedescription pid process target process PID 996 set thread context of 1008 996 Booking Declined.scr Booking Declined.scr PID 1008 set thread context of 2180 1008 Booking Declined.scr Explorer.EXE PID 496 set thread context of 2180 496 wscript.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 19 IoCs
Processes:
Booking Declined.scrBooking Declined.scrwscript.exepid process 996 Booking Declined.scr 1008 Booking Declined.scr 1008 Booking Declined.scr 1008 Booking Declined.scr 1008 Booking Declined.scr 496 wscript.exe 496 wscript.exe 496 wscript.exe 496 wscript.exe 496 wscript.exe 496 wscript.exe 496 wscript.exe 496 wscript.exe 496 wscript.exe 496 wscript.exe 496 wscript.exe 496 wscript.exe 496 wscript.exe 496 wscript.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Booking Declined.scrwscript.exepid process 1008 Booking Declined.scr 1008 Booking Declined.scr 1008 Booking Declined.scr 496 wscript.exe 496 wscript.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Booking Declined.scrBooking Declined.scrwscript.exedescription pid process Token: SeDebugPrivilege 996 Booking Declined.scr Token: SeDebugPrivilege 1008 Booking Declined.scr Token: SeDebugPrivilege 496 wscript.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Booking Declined.scrExplorer.EXEwscript.exedescription pid process target process PID 996 wrote to memory of 1008 996 Booking Declined.scr Booking Declined.scr PID 996 wrote to memory of 1008 996 Booking Declined.scr Booking Declined.scr PID 996 wrote to memory of 1008 996 Booking Declined.scr Booking Declined.scr PID 996 wrote to memory of 1008 996 Booking Declined.scr Booking Declined.scr PID 996 wrote to memory of 1008 996 Booking Declined.scr Booking Declined.scr PID 996 wrote to memory of 1008 996 Booking Declined.scr Booking Declined.scr PID 2180 wrote to memory of 496 2180 Explorer.EXE wscript.exe PID 2180 wrote to memory of 496 2180 Explorer.EXE wscript.exe PID 2180 wrote to memory of 496 2180 Explorer.EXE wscript.exe PID 496 wrote to memory of 1936 496 wscript.exe cmd.exe PID 496 wrote to memory of 1936 496 wscript.exe cmd.exe PID 496 wrote to memory of 1936 496 wscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Booking Declined.scr"C:\Users\Admin\AppData\Local\Temp\Booking Declined.scr" /S2⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Booking Declined.scr"C:\Users\Admin\AppData\Local\Temp\Booking Declined.scr"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Booking Declined.scr"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/496-130-0x0000000000000000-mapping.dmp
-
memory/496-135-0x0000000004E00000-0x0000000004E93000-memory.dmpFilesize
588KB
-
memory/496-134-0x0000000004AE0000-0x0000000004E00000-memory.dmpFilesize
3.1MB
-
memory/496-132-0x0000000000B10000-0x0000000000B3E000-memory.dmpFilesize
184KB
-
memory/496-131-0x0000000000C80000-0x0000000000CA7000-memory.dmpFilesize
156KB
-
memory/996-120-0x0000000006110000-0x0000000006111000-memory.dmpFilesize
4KB
-
memory/996-114-0x0000000000C00000-0x0000000000C01000-memory.dmpFilesize
4KB
-
memory/996-122-0x0000000005CF0000-0x0000000005D56000-memory.dmpFilesize
408KB
-
memory/996-123-0x000000000B880000-0x000000000B881000-memory.dmpFilesize
4KB
-
memory/996-121-0x00000000014E0000-0x000000000158C000-memory.dmpFilesize
688KB
-
memory/996-116-0x0000000005700000-0x0000000005701000-memory.dmpFilesize
4KB
-
memory/996-117-0x00000000057B0000-0x00000000057B1000-memory.dmpFilesize
4KB
-
memory/996-118-0x00000000058F0000-0x00000000058F1000-memory.dmpFilesize
4KB
-
memory/996-119-0x0000000005780000-0x000000000578E000-memory.dmpFilesize
56KB
-
memory/1008-124-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1008-128-0x0000000001500000-0x00000000015AE000-memory.dmpFilesize
696KB
-
memory/1008-127-0x0000000001AA0000-0x0000000001DC0000-memory.dmpFilesize
3.1MB
-
memory/1008-125-0x000000000041EB50-mapping.dmp
-
memory/1936-133-0x0000000000000000-mapping.dmp
-
memory/2180-129-0x00000000030F0000-0x00000000031D1000-memory.dmpFilesize
900KB
-
memory/2180-136-0x00000000064B0000-0x0000000006632000-memory.dmpFilesize
1.5MB