Analysis
-
max time kernel
146s -
max time network
139s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
05-05-2021 15:27
Static task
static1
Behavioral task
behavioral1
Sample
original documents.exe
Resource
win7v20210410
General
-
Target
original documents.exe
-
Size
279KB
-
MD5
0f9a52111f8c63b86a08421f2fe42786
-
SHA1
b3b277e8f9d73636a87c6b09f50f63dcfb25b7dd
-
SHA256
37e98fef85aeb5097a5091d11fc844487642873e9e06a8d0734785dbe1ad1315
-
SHA512
0c157a405f24e59e2e6d00e419c83fd68fec1893fe642fe5d3c6168e0ec74b6f247d28f728fd9fb7eeb6fbba2ed1ebb335ba301784cdf4d2705d44dce62fa2a7
Malware Config
Extracted
formbook
4.1
http://www.knighttechinca.com/dxe/
sardarfarm.com
959tremont.com
privat-livecam.net
ansel-homebakery.com
joysupermarket.com
peninsulamatchmakers.net
northsytyle.com
radioconexaoubermusic.com
relocatingrealtor.com
desyrnan.com
onlinehoortoestel.online
enpointe.online
rvvikings.com
paulpoirier.com
shitarpa.net
kerneis.net
rokitreach.com
essentiallygaia.com
prestiged.net
fuerzaagavera.com
soukid.com
moderndatingcoach.com
mentalfreedom.guru
bullishsoftware.com
sectorulb.com
outletyana.com
fptplaybox.website
artinmemory.com
buyruon.com
ljd.xyz
mondaysmatters.com
spiritsoundart.net
ixiangzu.com
lacompagniadelfardello.com
bnctly.com
sarasvati-yoga.com
0055game.com
lagrangewildliferemoval.com
umlausa.com
chaytel.com
kkkc5.com
union-green.com
philreid4cc.com
theanimehat.com
redlightlegal.com
myaustraliarewards.com
barkinlot.com
mujahidservice.online
nugeneraonline.com
sopplugin.com
makemyroom.design
ferienschweden.com
fps2020dkasphotoop.com
stylezbykay.com
royalpropertiesgurugram.com
birzulova.com
cosmicmtn.com
kissanime.press
poweringprogress.today
omsamedic.com
drunkpoetsociety.com
hostbison.com
asapdecor.com
houseofsisson.com
Signatures
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1788-64-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1444-72-0x0000000000090000-0x00000000000BE000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1760 cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
original documents.exepid process 1052 original documents.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
original documents.exeoriginal documents.execmstp.exedescription pid process target process PID 1052 set thread context of 1788 1052 original documents.exe original documents.exe PID 1788 set thread context of 1208 1788 original documents.exe Explorer.EXE PID 1444 set thread context of 1208 1444 cmstp.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
original documents.execmstp.exepid process 1788 original documents.exe 1788 original documents.exe 1444 cmstp.exe 1444 cmstp.exe 1444 cmstp.exe 1444 cmstp.exe 1444 cmstp.exe 1444 cmstp.exe 1444 cmstp.exe 1444 cmstp.exe 1444 cmstp.exe 1444 cmstp.exe 1444 cmstp.exe 1444 cmstp.exe 1444 cmstp.exe 1444 cmstp.exe 1444 cmstp.exe 1444 cmstp.exe 1444 cmstp.exe 1444 cmstp.exe 1444 cmstp.exe 1444 cmstp.exe 1444 cmstp.exe 1444 cmstp.exe 1444 cmstp.exe 1444 cmstp.exe 1444 cmstp.exe 1444 cmstp.exe 1444 cmstp.exe 1444 cmstp.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1208 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
original documents.exeoriginal documents.execmstp.exepid process 1052 original documents.exe 1788 original documents.exe 1788 original documents.exe 1788 original documents.exe 1444 cmstp.exe 1444 cmstp.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
original documents.execmstp.exedescription pid process Token: SeDebugPrivilege 1788 original documents.exe Token: SeDebugPrivilege 1444 cmstp.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
original documents.exeExplorer.EXEcmstp.exedescription pid process target process PID 1052 wrote to memory of 1788 1052 original documents.exe original documents.exe PID 1052 wrote to memory of 1788 1052 original documents.exe original documents.exe PID 1052 wrote to memory of 1788 1052 original documents.exe original documents.exe PID 1052 wrote to memory of 1788 1052 original documents.exe original documents.exe PID 1052 wrote to memory of 1788 1052 original documents.exe original documents.exe PID 1208 wrote to memory of 1444 1208 Explorer.EXE cmstp.exe PID 1208 wrote to memory of 1444 1208 Explorer.EXE cmstp.exe PID 1208 wrote to memory of 1444 1208 Explorer.EXE cmstp.exe PID 1208 wrote to memory of 1444 1208 Explorer.EXE cmstp.exe PID 1208 wrote to memory of 1444 1208 Explorer.EXE cmstp.exe PID 1208 wrote to memory of 1444 1208 Explorer.EXE cmstp.exe PID 1208 wrote to memory of 1444 1208 Explorer.EXE cmstp.exe PID 1444 wrote to memory of 1760 1444 cmstp.exe cmd.exe PID 1444 wrote to memory of 1760 1444 cmstp.exe cmd.exe PID 1444 wrote to memory of 1760 1444 cmstp.exe cmd.exe PID 1444 wrote to memory of 1760 1444 cmstp.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\original documents.exe"C:\Users\Admin\AppData\Local\Temp\original documents.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\original documents.exe"C:\Users\Admin\AppData\Local\Temp\original documents.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\original documents.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsn61B.tmp\udsdj.dllMD5
053a82ea7d71e4171457a5be63c908f1
SHA115e4581e70de1535ba38ce5f2a7644d46dd8a1d9
SHA256ece3f18788154b249625d589c5e1101ed54a07f4ed09c8b8b9076c6fddf34922
SHA5122f850ddb917ebb8ca02c9954d879b77df16c1b6c88278ccd62b537d6f27a7dc767b6ccb433177ede4e347599e6399e0084332d15605e06cb6a5cd642af7e8223
-
memory/1052-62-0x00000000003C0000-0x00000000003C2000-memory.dmpFilesize
8KB
-
memory/1052-60-0x0000000075721000-0x0000000075723000-memory.dmpFilesize
8KB
-
memory/1208-75-0x0000000008060000-0x00000000081E2000-memory.dmpFilesize
1.5MB
-
memory/1208-67-0x0000000006FC0000-0x000000000712B000-memory.dmpFilesize
1.4MB
-
memory/1444-72-0x0000000000090000-0x00000000000BE000-memory.dmpFilesize
184KB
-
memory/1444-74-0x00000000004D0000-0x0000000000563000-memory.dmpFilesize
588KB
-
memory/1444-73-0x0000000002320000-0x0000000002623000-memory.dmpFilesize
3.0MB
-
memory/1444-68-0x0000000000000000-mapping.dmp
-
memory/1444-71-0x0000000000A50000-0x0000000000A68000-memory.dmpFilesize
96KB
-
memory/1760-70-0x0000000000000000-mapping.dmp
-
memory/1788-63-0x000000000041EAF0-mapping.dmp
-
memory/1788-65-0x0000000000770000-0x0000000000A73000-memory.dmpFilesize
3.0MB
-
memory/1788-66-0x00000000002D0000-0x00000000002E4000-memory.dmpFilesize
80KB
-
memory/1788-64-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB