Analysis
-
max time kernel
147s -
max time network
141s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
05-05-2021 11:47
Static task
static1
Behavioral task
behavioral1
Sample
Booking Declined.scr
Resource
win7v20210410
General
-
Target
Booking Declined.scr
-
Size
1.1MB
-
MD5
72014c837d630e0eb8b79d0995166d47
-
SHA1
57ea4b26a34c0779ae9767cc957452883475cadc
-
SHA256
2deb22be02f4464416048e124a39c1a8df4f29ba90d783d27bfcefa29ddce161
-
SHA512
c74de6fc4b35c52b25062ca5d82f93e93f5978eebacac89fc6e473d6c52141b0737fccbd7810820a5c31ad08ad7288b86f6784b7e9ced821bab13d4a2c8b4c69
Malware Config
Extracted
formbook
4.1
http://www.evolvekitchendesign.com/ffw/
unmutedgenerations.com
localmoversuae.com
centralrea.com
geyyfphzoe.com
silverpackfactory.com
techtronixx.com
shop-deinen-deal.com
buehne.cloud
inspirefreedomtoday.com
chapelcouture.com
easton-taiwan.com
quanaonudep.store
merzigomusic.com
wpzoomin.com
service-lkytrsahdfpedf.com
yeasuc.com
mydogtrainingservice.com
galeribisnisonline.com
cscremodeling.com
bom-zzxx.com
ensobet88.com
vegancto.com
digivisiol.com
advancetools.net
gzqyjd.com
xtgnsl.com
ftfortmyers.com
g-siqueira.com
ufdzbhrxk.icu
tiekotiin.com
youschrutedit.com
takahatadenkikouji.com
goodfastco.com
jtelitetraining.com
planet-hype.com
gigwindow.com
levelxpr.com
besttechmobcomm.info
funneldesigngenie.com
mylisting.cloud
alltwoyou.com
mortgagesandprotection.online
monthlydigest.info
senlangdq.com
postphenomenon.com
slymwhite.com
masonpreschool.com
wahooshop.com
meridiangummies.com
samsungpartsdept.com
saludbellezaybienestar.net
vickifoxproductions.com
shawandwesson.info
nutrepele.com
gorillatanks.com
praktijkinfinity.online
lanteredam.com
refinedmanagement.com
tiwapay.com
fruitsinbeers.com
charliekay.net
realironart.com
sonsofmari.com
kedingtonni.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1188-66-0x000000000041EB50-mapping.dmp formbook behavioral1/memory/1188-65-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/996-75-0x00000000000C0000-0x00000000000EE000-memory.dmp formbook -
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Looks for VMWare Tools registry key 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Booking Declined.scrdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Booking Declined.scr Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Booking Declined.scr -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1016 cmd.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
Booking Declined.scrdescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum Booking Declined.scr Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 Booking Declined.scr -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Booking Declined.scrBooking Declined.scrmsdt.exedescription pid process target process PID 1864 set thread context of 1188 1864 Booking Declined.scr Booking Declined.scr PID 1188 set thread context of 1224 1188 Booking Declined.scr Explorer.EXE PID 996 set thread context of 1224 996 msdt.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
Booking Declined.scrmsdt.exepid process 1188 Booking Declined.scr 1188 Booking Declined.scr 996 msdt.exe 996 msdt.exe 996 msdt.exe 996 msdt.exe 996 msdt.exe 996 msdt.exe 996 msdt.exe 996 msdt.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Booking Declined.scrmsdt.exepid process 1188 Booking Declined.scr 1188 Booking Declined.scr 1188 Booking Declined.scr 996 msdt.exe 996 msdt.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Booking Declined.scrmsdt.exedescription pid process Token: SeDebugPrivilege 1188 Booking Declined.scr Token: SeDebugPrivilege 996 msdt.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Booking Declined.scrExplorer.EXEmsdt.exedescription pid process target process PID 1864 wrote to memory of 1188 1864 Booking Declined.scr Booking Declined.scr PID 1864 wrote to memory of 1188 1864 Booking Declined.scr Booking Declined.scr PID 1864 wrote to memory of 1188 1864 Booking Declined.scr Booking Declined.scr PID 1864 wrote to memory of 1188 1864 Booking Declined.scr Booking Declined.scr PID 1864 wrote to memory of 1188 1864 Booking Declined.scr Booking Declined.scr PID 1864 wrote to memory of 1188 1864 Booking Declined.scr Booking Declined.scr PID 1864 wrote to memory of 1188 1864 Booking Declined.scr Booking Declined.scr PID 1224 wrote to memory of 996 1224 Explorer.EXE msdt.exe PID 1224 wrote to memory of 996 1224 Explorer.EXE msdt.exe PID 1224 wrote to memory of 996 1224 Explorer.EXE msdt.exe PID 1224 wrote to memory of 996 1224 Explorer.EXE msdt.exe PID 996 wrote to memory of 1016 996 msdt.exe cmd.exe PID 996 wrote to memory of 1016 996 msdt.exe cmd.exe PID 996 wrote to memory of 1016 996 msdt.exe cmd.exe PID 996 wrote to memory of 1016 996 msdt.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Booking Declined.scr"C:\Users\Admin\AppData\Local\Temp\Booking Declined.scr" /S2⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Booking Declined.scr"C:\Users\Admin\AppData\Local\Temp\Booking Declined.scr"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Booking Declined.scr"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/996-71-0x0000000000000000-mapping.dmp
-
memory/996-77-0x0000000002120000-0x00000000021B3000-memory.dmpFilesize
588KB
-
memory/996-75-0x00000000000C0000-0x00000000000EE000-memory.dmpFilesize
184KB
-
memory/996-76-0x0000000002210000-0x0000000002513000-memory.dmpFilesize
3.0MB
-
memory/996-74-0x0000000000B80000-0x0000000000C74000-memory.dmpFilesize
976KB
-
memory/996-72-0x0000000076A81000-0x0000000076A83000-memory.dmpFilesize
8KB
-
memory/1016-73-0x0000000000000000-mapping.dmp
-
memory/1188-68-0x00000000008B0000-0x0000000000BB3000-memory.dmpFilesize
3.0MB
-
memory/1188-69-0x00000000002C0000-0x00000000002D4000-memory.dmpFilesize
80KB
-
memory/1188-65-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1188-66-0x000000000041EB50-mapping.dmp
-
memory/1224-70-0x0000000004190000-0x0000000004289000-memory.dmpFilesize
996KB
-
memory/1224-78-0x0000000006350000-0x00000000064A3000-memory.dmpFilesize
1.3MB
-
memory/1864-59-0x0000000001260000-0x0000000001261000-memory.dmpFilesize
4KB
-
memory/1864-64-0x0000000004780000-0x00000000047E6000-memory.dmpFilesize
408KB
-
memory/1864-63-0x00000000050A0000-0x000000000514C000-memory.dmpFilesize
688KB
-
memory/1864-62-0x0000000000490000-0x000000000049E000-memory.dmpFilesize
56KB
-
memory/1864-61-0x00000000047F0000-0x00000000047F1000-memory.dmpFilesize
4KB