Analysis
-
max time kernel
149s -
max time network
145s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
05-05-2021 12:03
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order-070POR044127.exe
Resource
win7v20210410
General
-
Target
Purchase Order-070POR044127.exe
-
Size
755KB
-
MD5
86ac789b8bc139ec5dbc204e7a3dd589
-
SHA1
eadec8bb5cf57113589f456e4d237ae9610e242c
-
SHA256
e8baf97ad51faed006287d1f01f921df0f677d4f056d35697158d30aa24ace9b
-
SHA512
fca533d07a06337cb61bfe84cde9e7b1eb240e6a7d7f4ca001a232916c79465c6c908be5040c83e0218ac679f651e2a7209f7672ee08e41dcd413c9772e4c2d3
Malware Config
Extracted
formbook
4.1
http://www.magnumopuspro.com/nyr/
anemone-vintage.com
ironcitytools.com
joshandmatthew.com
breathtakingscenery.photos
karabakh-terror.com
micahelgall.com
entretiendesterrasses.com
mhgholdings.com
blewm.com
sidewalknotary.com
ytrs-elec.com
danhpham.com
ma21cle2henz.xyz
lotusforlease.com
shipleyphotoandfilm.com
bulktool.xyz
ouedzmala.com
yichengvpr.com
connectmygames.com
chjcsc.com
dope-chocolate.com
tacowench.com
projectsbay.com
xn--pgboc92d.com
royaldropofoil.com
ranguanglian.club
mobilne-kucice.com
buytsycon.com
goiasbets.net
blpetroleum.com
starrealms.net
exclusiveflooringcollection.com
kudalive.com
tienda-sky.com
drillinginsider.info
theglasshousenyc.com
vietnammoi.xyz
walterbenicio.com
zoomtvliveshows.xyz
boujiehoodbaby.com
yzyangyu.com
exploreecetera.com
sycord.com
waykifood.com
shadingconsultancy.com
precedentai.net
linhanhkitchen.com
expekt24.com
socialdating24.com
lubvim.com
floryi.com
alerist.com
maluss.com
hitbbq.com
alerrandrotattoo.com
algoplayer.com
idahooutsiders.com
qygmuakhk.club
neverpossible.com
winparadigm.com
toughdecorative.com
yourbuildmedia.com
summercrowd.com
josemvazquez.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/780-66-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/780-67-0x000000000041EBA0-mapping.dmp formbook behavioral1/memory/1904-77-0x0000000000070000-0x000000000009E000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1880 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Purchase Order-070POR044127.exePurchase Order-070POR044127.exewscript.exedescription pid process target process PID 1048 set thread context of 780 1048 Purchase Order-070POR044127.exe Purchase Order-070POR044127.exe PID 780 set thread context of 1208 780 Purchase Order-070POR044127.exe Explorer.EXE PID 780 set thread context of 1208 780 Purchase Order-070POR044127.exe Explorer.EXE PID 1904 set thread context of 1208 1904 wscript.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
Purchase Order-070POR044127.exewscript.exepid process 780 Purchase Order-070POR044127.exe 780 Purchase Order-070POR044127.exe 780 Purchase Order-070POR044127.exe 1904 wscript.exe 1904 wscript.exe 1904 wscript.exe 1904 wscript.exe 1904 wscript.exe 1904 wscript.exe 1904 wscript.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
Purchase Order-070POR044127.exewscript.exepid process 780 Purchase Order-070POR044127.exe 780 Purchase Order-070POR044127.exe 780 Purchase Order-070POR044127.exe 780 Purchase Order-070POR044127.exe 1904 wscript.exe 1904 wscript.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Purchase Order-070POR044127.exewscript.exedescription pid process Token: SeDebugPrivilege 780 Purchase Order-070POR044127.exe Token: SeDebugPrivilege 1904 wscript.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Purchase Order-070POR044127.exePurchase Order-070POR044127.exewscript.exedescription pid process target process PID 1048 wrote to memory of 780 1048 Purchase Order-070POR044127.exe Purchase Order-070POR044127.exe PID 1048 wrote to memory of 780 1048 Purchase Order-070POR044127.exe Purchase Order-070POR044127.exe PID 1048 wrote to memory of 780 1048 Purchase Order-070POR044127.exe Purchase Order-070POR044127.exe PID 1048 wrote to memory of 780 1048 Purchase Order-070POR044127.exe Purchase Order-070POR044127.exe PID 1048 wrote to memory of 780 1048 Purchase Order-070POR044127.exe Purchase Order-070POR044127.exe PID 1048 wrote to memory of 780 1048 Purchase Order-070POR044127.exe Purchase Order-070POR044127.exe PID 1048 wrote to memory of 780 1048 Purchase Order-070POR044127.exe Purchase Order-070POR044127.exe PID 780 wrote to memory of 1904 780 Purchase Order-070POR044127.exe wscript.exe PID 780 wrote to memory of 1904 780 Purchase Order-070POR044127.exe wscript.exe PID 780 wrote to memory of 1904 780 Purchase Order-070POR044127.exe wscript.exe PID 780 wrote to memory of 1904 780 Purchase Order-070POR044127.exe wscript.exe PID 1904 wrote to memory of 1880 1904 wscript.exe cmd.exe PID 1904 wrote to memory of 1880 1904 wscript.exe cmd.exe PID 1904 wrote to memory of 1880 1904 wscript.exe cmd.exe PID 1904 wrote to memory of 1880 1904 wscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order-070POR044127.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order-070POR044127.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order-070POR044127.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order-070POR044127.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Purchase Order-070POR044127.exe"5⤵
- Deletes itself
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/780-66-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/780-72-0x0000000000230000-0x0000000000244000-memory.dmpFilesize
80KB
-
memory/780-71-0x0000000000110000-0x0000000000124000-memory.dmpFilesize
80KB
-
memory/780-70-0x0000000000940000-0x0000000000C43000-memory.dmpFilesize
3.0MB
-
memory/780-67-0x000000000041EBA0-mapping.dmp
-
memory/1048-65-0x00000000042E0000-0x000000000434B000-memory.dmpFilesize
428KB
-
memory/1048-64-0x00000000050B0000-0x000000000515F000-memory.dmpFilesize
700KB
-
memory/1048-63-0x00000000003E0000-0x00000000003EE000-memory.dmpFilesize
56KB
-
memory/1048-62-0x0000000000400000-0x0000000000401000-memory.dmpFilesize
4KB
-
memory/1048-60-0x0000000000140000-0x0000000000141000-memory.dmpFilesize
4KB
-
memory/1208-80-0x0000000006580000-0x0000000006693000-memory.dmpFilesize
1.1MB
-
memory/1208-69-0x0000000004C10000-0x0000000004D6E000-memory.dmpFilesize
1.4MB
-
memory/1208-73-0x0000000005010000-0x0000000005110000-memory.dmpFilesize
1024KB
-
memory/1880-75-0x0000000000000000-mapping.dmp
-
memory/1904-74-0x0000000000000000-mapping.dmp
-
memory/1904-77-0x0000000000070000-0x000000000009E000-memory.dmpFilesize
184KB
-
memory/1904-78-0x0000000002140000-0x0000000002443000-memory.dmpFilesize
3.0MB
-
memory/1904-79-0x0000000001FB0000-0x0000000002043000-memory.dmpFilesize
588KB
-
memory/1904-76-0x0000000000500000-0x0000000000526000-memory.dmpFilesize
152KB