Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
05-05-2021 15:06
Static task
static1
Behavioral task
behavioral1
Sample
PI ZB_2021_P070 R3.exe
Resource
win7v20210408
General
-
Target
PI ZB_2021_P070 R3.exe
-
Size
229KB
-
MD5
8c34da075c440fe80be7af580725b0e8
-
SHA1
5b7903ed7fcfef0189621390336efe359a39e908
-
SHA256
ad86b6dd3faef43b4ef56786e35a7d2b38a369e6082c72c3cac0267a5b8efc5a
-
SHA512
7d7504d10dba181aaab5d1fc7384719a05e16ed54c669b00a9c24ddb2e19e9b622e7bcc475dd2b6891d86d2e3e5a90fa70794075c7b65845a85946bff3773b57
Malware Config
Extracted
formbook
4.1
http://www.knighttechinca.com/dxe/
sardarfarm.com
959tremont.com
privat-livecam.net
ansel-homebakery.com
joysupermarket.com
peninsulamatchmakers.net
northsytyle.com
radioconexaoubermusic.com
relocatingrealtor.com
desyrnan.com
onlinehoortoestel.online
enpointe.online
rvvikings.com
paulpoirier.com
shitarpa.net
kerneis.net
rokitreach.com
essentiallygaia.com
prestiged.net
fuerzaagavera.com
soukid.com
moderndatingcoach.com
mentalfreedom.guru
bullishsoftware.com
sectorulb.com
outletyana.com
fptplaybox.website
artinmemory.com
buyruon.com
ljd.xyz
mondaysmatters.com
spiritsoundart.net
ixiangzu.com
lacompagniadelfardello.com
bnctly.com
sarasvati-yoga.com
0055game.com
lagrangewildliferemoval.com
umlausa.com
chaytel.com
kkkc5.com
union-green.com
philreid4cc.com
theanimehat.com
redlightlegal.com
myaustraliarewards.com
barkinlot.com
mujahidservice.online
nugeneraonline.com
sopplugin.com
makemyroom.design
ferienschweden.com
fps2020dkasphotoop.com
stylezbykay.com
royalpropertiesgurugram.com
birzulova.com
cosmicmtn.com
kissanime.press
poweringprogress.today
omsamedic.com
drunkpoetsociety.com
hostbison.com
asapdecor.com
houseofsisson.com
Signatures
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2440-117-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/2380-126-0x0000000000BA0000-0x0000000000BCE000-memory.dmp formbook -
Loads dropped DLL 1 IoCs
Processes:
PI ZB_2021_P070 R3.exepid process 2256 PI ZB_2021_P070 R3.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
PI ZB_2021_P070 R3.exePI ZB_2021_P070 R3.exewscript.exedescription pid process target process PID 2256 set thread context of 2440 2256 PI ZB_2021_P070 R3.exe PI ZB_2021_P070 R3.exe PID 2440 set thread context of 3040 2440 PI ZB_2021_P070 R3.exe Explorer.EXE PID 2440 set thread context of 3040 2440 PI ZB_2021_P070 R3.exe Explorer.EXE PID 2380 set thread context of 3040 2380 wscript.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 60 IoCs
Processes:
PI ZB_2021_P070 R3.exewscript.exepid process 2440 PI ZB_2021_P070 R3.exe 2440 PI ZB_2021_P070 R3.exe 2440 PI ZB_2021_P070 R3.exe 2440 PI ZB_2021_P070 R3.exe 2440 PI ZB_2021_P070 R3.exe 2440 PI ZB_2021_P070 R3.exe 2380 wscript.exe 2380 wscript.exe 2380 wscript.exe 2380 wscript.exe 2380 wscript.exe 2380 wscript.exe 2380 wscript.exe 2380 wscript.exe 2380 wscript.exe 2380 wscript.exe 2380 wscript.exe 2380 wscript.exe 2380 wscript.exe 2380 wscript.exe 2380 wscript.exe 2380 wscript.exe 2380 wscript.exe 2380 wscript.exe 2380 wscript.exe 2380 wscript.exe 2380 wscript.exe 2380 wscript.exe 2380 wscript.exe 2380 wscript.exe 2380 wscript.exe 2380 wscript.exe 2380 wscript.exe 2380 wscript.exe 2380 wscript.exe 2380 wscript.exe 2380 wscript.exe 2380 wscript.exe 2380 wscript.exe 2380 wscript.exe 2380 wscript.exe 2380 wscript.exe 2380 wscript.exe 2380 wscript.exe 2380 wscript.exe 2380 wscript.exe 2380 wscript.exe 2380 wscript.exe 2380 wscript.exe 2380 wscript.exe 2380 wscript.exe 2380 wscript.exe 2380 wscript.exe 2380 wscript.exe 2380 wscript.exe 2380 wscript.exe 2380 wscript.exe 2380 wscript.exe 2380 wscript.exe 2380 wscript.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3040 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
PI ZB_2021_P070 R3.exePI ZB_2021_P070 R3.exewscript.exepid process 2256 PI ZB_2021_P070 R3.exe 2440 PI ZB_2021_P070 R3.exe 2440 PI ZB_2021_P070 R3.exe 2440 PI ZB_2021_P070 R3.exe 2440 PI ZB_2021_P070 R3.exe 2380 wscript.exe 2380 wscript.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PI ZB_2021_P070 R3.exewscript.exedescription pid process Token: SeDebugPrivilege 2440 PI ZB_2021_P070 R3.exe Token: SeDebugPrivilege 2380 wscript.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3040 Explorer.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
PI ZB_2021_P070 R3.exeExplorer.EXEwscript.exedescription pid process target process PID 2256 wrote to memory of 2440 2256 PI ZB_2021_P070 R3.exe PI ZB_2021_P070 R3.exe PID 2256 wrote to memory of 2440 2256 PI ZB_2021_P070 R3.exe PI ZB_2021_P070 R3.exe PID 2256 wrote to memory of 2440 2256 PI ZB_2021_P070 R3.exe PI ZB_2021_P070 R3.exe PID 2256 wrote to memory of 2440 2256 PI ZB_2021_P070 R3.exe PI ZB_2021_P070 R3.exe PID 3040 wrote to memory of 2380 3040 Explorer.EXE wscript.exe PID 3040 wrote to memory of 2380 3040 Explorer.EXE wscript.exe PID 3040 wrote to memory of 2380 3040 Explorer.EXE wscript.exe PID 2380 wrote to memory of 2676 2380 wscript.exe cmd.exe PID 2380 wrote to memory of 2676 2380 wscript.exe cmd.exe PID 2380 wrote to memory of 2676 2380 wscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PI ZB_2021_P070 R3.exe"C:\Users\Admin\AppData\Local\Temp\PI ZB_2021_P070 R3.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PI ZB_2021_P070 R3.exe"C:\Users\Admin\AppData\Local\Temp\PI ZB_2021_P070 R3.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PI ZB_2021_P070 R3.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsr261D.tmp\c9henai.dllMD5
6582e8fabdbec6c7696f94ff33dc6b6d
SHA1d6986e668b28edc49066013f1de9e1382d1a907d
SHA25625c43d3110644eb9a1712174ddf4f4851fcb7b1db8faa828baecaf3a2c75cd08
SHA51248a91f22e829a5f14db76426147f82324c8345137ddf02ba8564dccb29069ca7b928affcaa39f49d3653fd7437d1b3b34a302eb548de602ca633992797493210
-
memory/2256-115-0x0000000000970000-0x0000000000993000-memory.dmpFilesize
140KB
-
memory/2380-123-0x0000000000000000-mapping.dmp
-
memory/2380-128-0x0000000004B00000-0x0000000004B93000-memory.dmpFilesize
588KB
-
memory/2380-127-0x0000000004CA0000-0x0000000004FC0000-memory.dmpFilesize
3.1MB
-
memory/2380-126-0x0000000000BA0000-0x0000000000BCE000-memory.dmpFilesize
184KB
-
memory/2380-125-0x0000000001100000-0x0000000001127000-memory.dmpFilesize
156KB
-
memory/2440-118-0x0000000000A10000-0x0000000000D30000-memory.dmpFilesize
3.1MB
-
memory/2440-121-0x00000000009F0000-0x0000000000A04000-memory.dmpFilesize
80KB
-
memory/2440-119-0x00000000009B0000-0x00000000009C4000-memory.dmpFilesize
80KB
-
memory/2440-117-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/2440-116-0x000000000041EAF0-mapping.dmp
-
memory/2676-124-0x0000000000000000-mapping.dmp
-
memory/3040-122-0x0000000005890000-0x000000000594E000-memory.dmpFilesize
760KB
-
memory/3040-120-0x00000000057D0000-0x0000000005882000-memory.dmpFilesize
712KB
-
memory/3040-129-0x0000000005950000-0x0000000005A46000-memory.dmpFilesize
984KB