Analysis
-
max time kernel
148s -
max time network
145s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
07-05-2021 09:53
General
-
Target
SecuriteInfo.com.Gen.Variant.Androm.29.27447.31261.msi
-
Size
252KB
-
MD5
2e8b3260047d829ba61205befbaf93fd
-
SHA1
cc2a109e5faa29d3465c5262edbe2775e8da4bf7
-
SHA256
1171bee7f280dad2201f6be582f08bf56771c54e4e0912964d93d320f4b1f32a
-
SHA512
7b0d8d7bf7f08a2c6aa44bbee7da16322a0361df1f3254d31b5e5aa618aa57d9bf45ac296cab05746337f45b863e9f7efc57c3c6e25999e85bd1e4102e9a9964
Malware Config
Extracted
formbook
4.1
http://www.craftsman-vail.com/cca/
whenpigsflyhigh.com
artistiklounge.com
tinytrendstique.com
projektpartner-ag.com
charvelevh.com
easycompliances.net
zengheqiye.com
professionalmallorca.com
bonzerstudio.com
nelivo.com
yangxeric.com
aredntech.com
twincitieshousingmarket.com
allshadesunscreen.com
xiang-life.net
qmcp00011.com
lindsayeandmarkv.com
fbcsbvsbvsjbvjs.com
saveonthrivelife.com
newdpo.com
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload 2 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of SetThreadContext 3 IoCs
-
Drops file in Windows directory 8 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NSIS installer 6 IoCs
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 52 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Gen.Variant.Androm.29.27447.31261.msi2⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Installer\MSIEE8E.tmp"3⤵
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Installer\MSIEE8E.tmp"C:\Windows\Installer\MSIEE8E.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Installer\MSIEE8E.tmp"C:\Windows\Installer\MSIEE8E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
32b4cdd8df63b6e2fd06d9c3f70983e2
SHA156a0cb8f39d7740fa2eb4a3803b20235a9750eb4
SHA2565432639b7cf4aff9b0511e5afa6ef16e5eff79cd7236562c15ea681973569f61
SHA512b89c80661d1240df84a71c2c4bff66e86d41bcc61c9cc1263c0be2dbb64fbc0f7907468faf4098f7ae3eb8f6386aaab2a568747549431cbc7987eb95ba696bde
-
MD5
32b4cdd8df63b6e2fd06d9c3f70983e2
SHA156a0cb8f39d7740fa2eb4a3803b20235a9750eb4
SHA2565432639b7cf4aff9b0511e5afa6ef16e5eff79cd7236562c15ea681973569f61
SHA512b89c80661d1240df84a71c2c4bff66e86d41bcc61c9cc1263c0be2dbb64fbc0f7907468faf4098f7ae3eb8f6386aaab2a568747549431cbc7987eb95ba696bde
-
MD5
32b4cdd8df63b6e2fd06d9c3f70983e2
SHA156a0cb8f39d7740fa2eb4a3803b20235a9750eb4
SHA2565432639b7cf4aff9b0511e5afa6ef16e5eff79cd7236562c15ea681973569f61
SHA512b89c80661d1240df84a71c2c4bff66e86d41bcc61c9cc1263c0be2dbb64fbc0f7907468faf4098f7ae3eb8f6386aaab2a568747549431cbc7987eb95ba696bde
-
MD5
b2fe19ab63b496d10dc37460bb3eb845
SHA18b2ec12e99a871c1ee55cce45d3b8f73146f16dc
SHA256a409bfe8f4356bada86d700c16056906e60812b2950c22069859bf4d967614ae
SHA512948c64e6b7f355c98c9806fcfe3e1ac3a6c81af3d11609a08861ec4596b8fbf34b579201e46ba9dd4854c12bb7b2511760a625c713285cfae61d8de9893ee030
-
MD5
578070e58e44c35b626a29689564785d
SHA14bbeb6e1ab6c9917cbb0e20b4d5134457744e07f
SHA2560d0ef92564b2fe04b837b35f7ddfbb8badf7eae1af0589ce1b23c86a7e2c7a3d
SHA51275af58d12af33ab6f709932cb0e54d4bf162a044cfeca2d5515f1b0c61aec20e083f20c009894d8b958e7bac348f36ebe57d6f6f1c9c940bde210149e0ec5e0b
-
MD5
c0903517afa29eb5aa5ce627b447f031
SHA1b337659ad551e409836e5d51e161ae5b46269378
SHA2564bd83d6b82767ff08aaade6bee60bdb5717b1462dac53997adf2ae831ae0f462
SHA5125e086cbac7010f6a88ac7c2dfcd8dce6dcf1e459434fac1536424921660a7bb8390a14103821e6db007c3846907fb7dc904312fc25b1519e40215a754903656d
-
-
Filesize
184KB
-
Filesize
80KB
-
Filesize
3.1MB
-
-
-
Filesize
8KB
-
-
Filesize
1.4MB
-
Filesize
1.5MB
-
Filesize
124KB
-
Filesize
3.1MB
-
Filesize
184KB
-
-
Filesize
588KB