Analysis
-
max time kernel
150s -
max time network
130s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
07-05-2021 09:54
General
-
Target
SecuriteInfo.com.Gen.Variant.Androm.29.9877.8691.msi
-
Size
252KB
-
MD5
e329a2ae51067a9ae8a508fb7dd34ca8
-
SHA1
e2371038a5cac558e52297cb808ead02c2150c36
-
SHA256
9de1892b227f07e8896b3dfa4d1f8b450bf2af962b1ec34f3075acc7a4187259
-
SHA512
e76add738078a81d9465e0e9f40638dc385b9909428d684d5048ae3c6549de040012d8a2310f05e10e94cef4528d3e08490a96774dbb848003ef31f70886febc
Malware Config
Extracted
formbook
4.1
http://www.111bjs.com/ccr/
abdullahlodhi.com
jevya.com
knoxvillerestaurant.com
mekarauroko7389.com
cricketspowder.net
johannchirinos.com
orangeorganical.com
libero-tt.com
lorenaegianluca.com
wintab.net
modernmillievintage.com
zgdqcyw.com
jeffabildgaardmd.com
nurulfikrimakassar.com
findyourchef.com
innovationsservicegroup.com
destek-taleplerimiz.com
whfqqco.icu
kosmetikmadeingermany.com
dieteticos.net
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload 2 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of SetThreadContext 3 IoCs
-
Drops file in Windows directory 8 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NSIS installer 6 IoCs
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 58 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Gen.Variant.Androm.29.9877.8691.msi2⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Installer\MSI432B.tmp"3⤵
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Installer\MSI432B.tmp"C:\Windows\Installer\MSI432B.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Installer\MSI432B.tmp"C:\Windows\Installer\MSI432B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
d8a19f13154e81e9d526077422655453
SHA1573e6aed1534203b36f9a8e5121c125b02e11b0f
SHA256b525832c63ea5d05a8afde822fcb39e5fb759497e7c2c986a5673fec721ed853
SHA512193344e672c7fb66fbd6acc2608c1d9acf360091ddf8086e5609e5a8ed511e1117fc2b7eb7cb43b56e984bf9f98f6a7648f8f1b0defc1416b2dca3c557ae39ae
-
MD5
d8a19f13154e81e9d526077422655453
SHA1573e6aed1534203b36f9a8e5121c125b02e11b0f
SHA256b525832c63ea5d05a8afde822fcb39e5fb759497e7c2c986a5673fec721ed853
SHA512193344e672c7fb66fbd6acc2608c1d9acf360091ddf8086e5609e5a8ed511e1117fc2b7eb7cb43b56e984bf9f98f6a7648f8f1b0defc1416b2dca3c557ae39ae
-
MD5
d8a19f13154e81e9d526077422655453
SHA1573e6aed1534203b36f9a8e5121c125b02e11b0f
SHA256b525832c63ea5d05a8afde822fcb39e5fb759497e7c2c986a5673fec721ed853
SHA512193344e672c7fb66fbd6acc2608c1d9acf360091ddf8086e5609e5a8ed511e1117fc2b7eb7cb43b56e984bf9f98f6a7648f8f1b0defc1416b2dca3c557ae39ae
-
MD5
f69927642f4fd62866696d4f6b581790
SHA18036cd0677d04d02088580f8397611b24fcb5e15
SHA2560c9cb2d2f96acabe91bdd040f4f677226a795c8994fe92ddc9996b10aae8d25f
SHA512613c0f27129b9baa6833fb0bdd3803a0e1b8c4a61e6e4fb97de82829fcafeb435dea9d2e42913e1a40a333cdcc1d9c68f32fee42217b3986ce1b4ac5801a32f3
-
MD5
547e9e4200c6277aae5d0df8d09eea22
SHA1ba6d074b70698c524f7463ef4ec17ca1a09f1194
SHA256fe9d5c57604f8f5b2df434dcf1142d7060d6a7c87e4158f2851b8e28ae2644bb
SHA51248065332d41c399b1ac2744a8b4846999c6c3a9f525484c396385cf2b504d69679b1eea731e3bbcceadd5571d69f38065ef5e37b6995302b93a7f46182bafd91
-
MD5
df8beafa8d4250032a73e261c80e35e3
SHA13ced0abd9f02d24d79ede5052f661108b01df997
SHA256a57717b0b91bb128761a4363d12cacd45431c7e512d5a8d307b40cf30e6a26da
SHA512bf9fd7009e3c4919b2b230748c8f3795423b4e7e57d82d531a31682916dfb589c2df2b20320a51b532e21dec98ce597a4a80589ec5fa442417274661e1c9d1ce
-
Filesize
920KB
-
Filesize
1.2MB
-
-
Filesize
8KB
-
Filesize
184KB
-
Filesize
3.1MB
-
Filesize
80KB
-
-
-
-
-
Filesize
124KB
-
Filesize
184KB
-
Filesize
3.1MB
-
Filesize
588KB