Analysis
-
max time kernel
150s -
max time network
135s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
05-05-2021 14:23
Static task
static1
Behavioral task
behavioral1
Sample
PI ZB_2021_P070 R3.exe
Resource
win7v20210410
General
-
Target
PI ZB_2021_P070 R3.exe
-
Size
229KB
-
MD5
8c34da075c440fe80be7af580725b0e8
-
SHA1
5b7903ed7fcfef0189621390336efe359a39e908
-
SHA256
ad86b6dd3faef43b4ef56786e35a7d2b38a369e6082c72c3cac0267a5b8efc5a
-
SHA512
7d7504d10dba181aaab5d1fc7384719a05e16ed54c669b00a9c24ddb2e19e9b622e7bcc475dd2b6891d86d2e3e5a90fa70794075c7b65845a85946bff3773b57
Malware Config
Extracted
formbook
4.1
http://www.knighttechinca.com/dxe/
sardarfarm.com
959tremont.com
privat-livecam.net
ansel-homebakery.com
joysupermarket.com
peninsulamatchmakers.net
northsytyle.com
radioconexaoubermusic.com
relocatingrealtor.com
desyrnan.com
onlinehoortoestel.online
enpointe.online
rvvikings.com
paulpoirier.com
shitarpa.net
kerneis.net
rokitreach.com
essentiallygaia.com
prestiged.net
fuerzaagavera.com
soukid.com
moderndatingcoach.com
mentalfreedom.guru
bullishsoftware.com
sectorulb.com
outletyana.com
fptplaybox.website
artinmemory.com
buyruon.com
ljd.xyz
mondaysmatters.com
spiritsoundart.net
ixiangzu.com
lacompagniadelfardello.com
bnctly.com
sarasvati-yoga.com
0055game.com
lagrangewildliferemoval.com
umlausa.com
chaytel.com
kkkc5.com
union-green.com
philreid4cc.com
theanimehat.com
redlightlegal.com
myaustraliarewards.com
barkinlot.com
mujahidservice.online
nugeneraonline.com
sopplugin.com
makemyroom.design
ferienschweden.com
fps2020dkasphotoop.com
stylezbykay.com
royalpropertiesgurugram.com
birzulova.com
cosmicmtn.com
kissanime.press
poweringprogress.today
omsamedic.com
drunkpoetsociety.com
hostbison.com
asapdecor.com
houseofsisson.com
Signatures
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/876-64-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1732-71-0x00000000000C0000-0x00000000000EE000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1684 cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
PI ZB_2021_P070 R3.exepid process 1640 PI ZB_2021_P070 R3.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
PI ZB_2021_P070 R3.exePI ZB_2021_P070 R3.exeNETSTAT.EXEdescription pid process target process PID 1640 set thread context of 876 1640 PI ZB_2021_P070 R3.exe PI ZB_2021_P070 R3.exe PID 876 set thread context of 1220 876 PI ZB_2021_P070 R3.exe Explorer.EXE PID 1732 set thread context of 1220 1732 NETSTAT.EXE Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
NETSTAT.EXEpid process 1732 NETSTAT.EXE -
Suspicious behavior: EnumeratesProcesses 31 IoCs
Processes:
PI ZB_2021_P070 R3.exeNETSTAT.EXEpid process 876 PI ZB_2021_P070 R3.exe 876 PI ZB_2021_P070 R3.exe 1732 NETSTAT.EXE 1732 NETSTAT.EXE 1732 NETSTAT.EXE 1732 NETSTAT.EXE 1732 NETSTAT.EXE 1732 NETSTAT.EXE 1732 NETSTAT.EXE 1732 NETSTAT.EXE 1732 NETSTAT.EXE 1732 NETSTAT.EXE 1732 NETSTAT.EXE 1732 NETSTAT.EXE 1732 NETSTAT.EXE 1732 NETSTAT.EXE 1732 NETSTAT.EXE 1732 NETSTAT.EXE 1732 NETSTAT.EXE 1732 NETSTAT.EXE 1732 NETSTAT.EXE 1732 NETSTAT.EXE 1732 NETSTAT.EXE 1732 NETSTAT.EXE 1732 NETSTAT.EXE 1732 NETSTAT.EXE 1732 NETSTAT.EXE 1732 NETSTAT.EXE 1732 NETSTAT.EXE 1732 NETSTAT.EXE 1732 NETSTAT.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1220 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
PI ZB_2021_P070 R3.exePI ZB_2021_P070 R3.exeNETSTAT.EXEpid process 1640 PI ZB_2021_P070 R3.exe 876 PI ZB_2021_P070 R3.exe 876 PI ZB_2021_P070 R3.exe 876 PI ZB_2021_P070 R3.exe 1732 NETSTAT.EXE 1732 NETSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PI ZB_2021_P070 R3.exeNETSTAT.EXEdescription pid process Token: SeDebugPrivilege 876 PI ZB_2021_P070 R3.exe Token: SeDebugPrivilege 1732 NETSTAT.EXE -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
PI ZB_2021_P070 R3.exeExplorer.EXENETSTAT.EXEdescription pid process target process PID 1640 wrote to memory of 876 1640 PI ZB_2021_P070 R3.exe PI ZB_2021_P070 R3.exe PID 1640 wrote to memory of 876 1640 PI ZB_2021_P070 R3.exe PI ZB_2021_P070 R3.exe PID 1640 wrote to memory of 876 1640 PI ZB_2021_P070 R3.exe PI ZB_2021_P070 R3.exe PID 1640 wrote to memory of 876 1640 PI ZB_2021_P070 R3.exe PI ZB_2021_P070 R3.exe PID 1640 wrote to memory of 876 1640 PI ZB_2021_P070 R3.exe PI ZB_2021_P070 R3.exe PID 1220 wrote to memory of 1732 1220 Explorer.EXE NETSTAT.EXE PID 1220 wrote to memory of 1732 1220 Explorer.EXE NETSTAT.EXE PID 1220 wrote to memory of 1732 1220 Explorer.EXE NETSTAT.EXE PID 1220 wrote to memory of 1732 1220 Explorer.EXE NETSTAT.EXE PID 1732 wrote to memory of 1684 1732 NETSTAT.EXE cmd.exe PID 1732 wrote to memory of 1684 1732 NETSTAT.EXE cmd.exe PID 1732 wrote to memory of 1684 1732 NETSTAT.EXE cmd.exe PID 1732 wrote to memory of 1684 1732 NETSTAT.EXE cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PI ZB_2021_P070 R3.exe"C:\Users\Admin\AppData\Local\Temp\PI ZB_2021_P070 R3.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PI ZB_2021_P070 R3.exe"C:\Users\Admin\AppData\Local\Temp\PI ZB_2021_P070 R3.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PI ZB_2021_P070 R3.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsn1AD3.tmp\c9henai.dllMD5
6582e8fabdbec6c7696f94ff33dc6b6d
SHA1d6986e668b28edc49066013f1de9e1382d1a907d
SHA25625c43d3110644eb9a1712174ddf4f4851fcb7b1db8faa828baecaf3a2c75cd08
SHA51248a91f22e829a5f14db76426147f82324c8345137ddf02ba8564dccb29069ca7b928affcaa39f49d3653fd7437d1b3b34a302eb548de602ca633992797493210
-
memory/876-62-0x000000000041EAF0-mapping.dmp
-
memory/876-64-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/876-66-0x00000000003E0000-0x00000000003F4000-memory.dmpFilesize
80KB
-
memory/876-65-0x0000000000770000-0x0000000000A73000-memory.dmpFilesize
3.0MB
-
memory/1220-67-0x0000000004B10000-0x0000000004C6F000-memory.dmpFilesize
1.4MB
-
memory/1220-74-0x0000000003C80000-0x0000000003D29000-memory.dmpFilesize
676KB
-
memory/1640-63-0x00000000003E0000-0x00000000003E2000-memory.dmpFilesize
8KB
-
memory/1640-60-0x0000000075631000-0x0000000075633000-memory.dmpFilesize
8KB
-
memory/1684-69-0x0000000000000000-mapping.dmp
-
memory/1732-68-0x0000000000000000-mapping.dmp
-
memory/1732-70-0x00000000009E0000-0x00000000009E9000-memory.dmpFilesize
36KB
-
memory/1732-72-0x0000000002170000-0x0000000002473000-memory.dmpFilesize
3.0MB
-
memory/1732-71-0x00000000000C0000-0x00000000000EE000-memory.dmpFilesize
184KB
-
memory/1732-73-0x0000000001DF0000-0x0000000001E83000-memory.dmpFilesize
588KB