Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
05-05-2021 11:47
Static task
static1
Behavioral task
behavioral1
Sample
Booking Declined.scr
Resource
win7v20210410
General
-
Target
Booking Declined.scr
-
Size
1.1MB
-
MD5
72014c837d630e0eb8b79d0995166d47
-
SHA1
57ea4b26a34c0779ae9767cc957452883475cadc
-
SHA256
2deb22be02f4464416048e124a39c1a8df4f29ba90d783d27bfcefa29ddce161
-
SHA512
c74de6fc4b35c52b25062ca5d82f93e93f5978eebacac89fc6e473d6c52141b0737fccbd7810820a5c31ad08ad7288b86f6784b7e9ced821bab13d4a2c8b4c69
Malware Config
Extracted
formbook
4.1
http://www.evolvekitchendesign.com/ffw/
unmutedgenerations.com
localmoversuae.com
centralrea.com
geyyfphzoe.com
silverpackfactory.com
techtronixx.com
shop-deinen-deal.com
buehne.cloud
inspirefreedomtoday.com
chapelcouture.com
easton-taiwan.com
quanaonudep.store
merzigomusic.com
wpzoomin.com
service-lkytrsahdfpedf.com
yeasuc.com
mydogtrainingservice.com
galeribisnisonline.com
cscremodeling.com
bom-zzxx.com
ensobet88.com
vegancto.com
digivisiol.com
advancetools.net
gzqyjd.com
xtgnsl.com
ftfortmyers.com
g-siqueira.com
ufdzbhrxk.icu
tiekotiin.com
youschrutedit.com
takahatadenkikouji.com
goodfastco.com
jtelitetraining.com
planet-hype.com
gigwindow.com
levelxpr.com
besttechmobcomm.info
funneldesigngenie.com
mylisting.cloud
alltwoyou.com
mortgagesandprotection.online
monthlydigest.info
senlangdq.com
postphenomenon.com
slymwhite.com
masonpreschool.com
wahooshop.com
meridiangummies.com
samsungpartsdept.com
saludbellezaybienestar.net
vickifoxproductions.com
shawandwesson.info
nutrepele.com
gorillatanks.com
praktijkinfinity.online
lanteredam.com
refinedmanagement.com
tiwapay.com
fruitsinbeers.com
charliekay.net
realironart.com
sonsofmari.com
kedingtonni.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3728-124-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/3728-125-0x000000000041EB50-mapping.dmp formbook behavioral2/memory/864-134-0x0000000000400000-0x000000000042E000-memory.dmp formbook -
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Looks for VMWare Tools registry key 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Booking Declined.scrdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Booking Declined.scr Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Booking Declined.scr -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
Booking Declined.scrdescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum Booking Declined.scr Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0 Booking Declined.scr -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Booking Declined.scrBooking Declined.screxplorer.exedescription pid process target process PID 3656 set thread context of 3728 3656 Booking Declined.scr Booking Declined.scr PID 3728 set thread context of 3040 3728 Booking Declined.scr Explorer.EXE PID 3728 set thread context of 3040 3728 Booking Declined.scr Explorer.EXE PID 864 set thread context of 3040 864 explorer.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
Booking Declined.scrBooking Declined.screxplorer.exepid process 3656 Booking Declined.scr 3656 Booking Declined.scr 3656 Booking Declined.scr 3728 Booking Declined.scr 3728 Booking Declined.scr 3728 Booking Declined.scr 3728 Booking Declined.scr 3728 Booking Declined.scr 3728 Booking Declined.scr 864 explorer.exe 864 explorer.exe 864 explorer.exe 864 explorer.exe 864 explorer.exe 864 explorer.exe 864 explorer.exe 864 explorer.exe 864 explorer.exe 864 explorer.exe 864 explorer.exe 864 explorer.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
Booking Declined.screxplorer.exepid process 3728 Booking Declined.scr 3728 Booking Declined.scr 3728 Booking Declined.scr 3728 Booking Declined.scr 864 explorer.exe 864 explorer.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Booking Declined.scrBooking Declined.screxplorer.exedescription pid process Token: SeDebugPrivilege 3656 Booking Declined.scr Token: SeDebugPrivilege 3728 Booking Declined.scr Token: SeDebugPrivilege 864 explorer.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Booking Declined.scrBooking Declined.screxplorer.exedescription pid process target process PID 3656 wrote to memory of 2108 3656 Booking Declined.scr Booking Declined.scr PID 3656 wrote to memory of 2108 3656 Booking Declined.scr Booking Declined.scr PID 3656 wrote to memory of 2108 3656 Booking Declined.scr Booking Declined.scr PID 3656 wrote to memory of 3728 3656 Booking Declined.scr Booking Declined.scr PID 3656 wrote to memory of 3728 3656 Booking Declined.scr Booking Declined.scr PID 3656 wrote to memory of 3728 3656 Booking Declined.scr Booking Declined.scr PID 3656 wrote to memory of 3728 3656 Booking Declined.scr Booking Declined.scr PID 3656 wrote to memory of 3728 3656 Booking Declined.scr Booking Declined.scr PID 3656 wrote to memory of 3728 3656 Booking Declined.scr Booking Declined.scr PID 3728 wrote to memory of 864 3728 Booking Declined.scr explorer.exe PID 3728 wrote to memory of 864 3728 Booking Declined.scr explorer.exe PID 3728 wrote to memory of 864 3728 Booking Declined.scr explorer.exe PID 864 wrote to memory of 2424 864 explorer.exe cmd.exe PID 864 wrote to memory of 2424 864 explorer.exe cmd.exe PID 864 wrote to memory of 2424 864 explorer.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\Booking Declined.scr"C:\Users\Admin\AppData\Local\Temp\Booking Declined.scr" /S2⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Booking Declined.scr"C:\Users\Admin\AppData\Local\Temp\Booking Declined.scr"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Booking Declined.scr"C:\Users\Admin\AppData\Local\Temp\Booking Declined.scr"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Booking Declined.scr"5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/864-134-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/864-132-0x0000000000000000-mapping.dmp
-
memory/864-133-0x0000000000B60000-0x0000000000F9F000-memory.dmpFilesize
4.2MB
-
memory/864-136-0x00000000048C0000-0x0000000004BE0000-memory.dmpFilesize
3.1MB
-
memory/864-137-0x0000000004630000-0x00000000046C3000-memory.dmpFilesize
588KB
-
memory/2424-135-0x0000000000000000-mapping.dmp
-
memory/3040-138-0x0000000003280000-0x0000000003336000-memory.dmpFilesize
728KB
-
memory/3040-131-0x0000000006A40000-0x0000000006B59000-memory.dmpFilesize
1.1MB
-
memory/3040-129-0x00000000070E0000-0x0000000007286000-memory.dmpFilesize
1.6MB
-
memory/3656-119-0x0000000004BF0000-0x0000000004BFE000-memory.dmpFilesize
56KB
-
memory/3656-114-0x0000000000170000-0x0000000000171000-memory.dmpFilesize
4KB
-
memory/3656-123-0x000000000ADF0000-0x000000000ADF1000-memory.dmpFilesize
4KB
-
memory/3656-122-0x0000000000A30000-0x0000000000A96000-memory.dmpFilesize
408KB
-
memory/3656-121-0x0000000005390000-0x000000000543C000-memory.dmpFilesize
688KB
-
memory/3656-120-0x0000000005540000-0x0000000005541000-memory.dmpFilesize
4KB
-
memory/3656-118-0x0000000002370000-0x0000000002371000-memory.dmpFilesize
4KB
-
memory/3656-117-0x0000000004CA0000-0x0000000004CA1000-memory.dmpFilesize
4KB
-
memory/3656-116-0x0000000004C00000-0x0000000004C01000-memory.dmpFilesize
4KB
-
memory/3728-125-0x000000000041EB50-mapping.dmp
-
memory/3728-130-0x0000000003100000-0x0000000003114000-memory.dmpFilesize
80KB
-
memory/3728-128-0x00000000017F0000-0x0000000001804000-memory.dmpFilesize
80KB
-
memory/3728-127-0x0000000001300000-0x0000000001620000-memory.dmpFilesize
3.1MB
-
memory/3728-124-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB