Analysis
-
max time kernel
145s -
max time network
171s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
23-07-2021 22:20
Static task
static1
Behavioral task
behavioral1
Sample
new order.exe
Resource
win7v20210408
General
-
Target
new order.exe
-
Size
574KB
-
MD5
383b8177e9f7c5e2d771d4bb5b4dd0fd
-
SHA1
9ccb9fdcf54623c18fe39189fdb3fe0ff53d814a
-
SHA256
d47e0508ebe3d03a2fe75479c2a17b3cee5adc099facd5da777b9d090d010907
-
SHA512
fa98bf545af68c9b0a9fbec46a9e502d34978da627468574d36496b418af35b0996a5ee23a4fdde98aa46f90a83614b32815c405b96e6e96fbbba7b058480443
Malware Config
Extracted
formbook
4.1
http://www.prospertraining.info/ymmi/
terrapotencia.com
issytosou.net
samankapan.com
zzxitang.com
iapple-uk.com
robertcollinsrealtor.com
theweehero.com
jyotisagar.net
powerbi.fitness
nuoyilm.com
modelsara.com
langvietco.com
aplusroofer.com
isabelacalaca.com
bearhawk.one
exporaoverseas.com
box-appliance.com
walkingfishvod.com
onlyqna.com
feed-parser.com
elegantloungebyjvs.com
expoviviendavirtualgto.com
forgetsticks.com
bloodandteethartwork.com
tinytrailers4bigadventures.com
anal-liza.com
nakopisebe.com
han-chun.com
battybanter.com
resctub.com
biogenesisammendments.com
rajkotpostaldivision.com
akcharconsulting.com
khanmochicaocap.com
albareeparts.com
globalhomeopharma.com
globetrotter-blog.com
vdvozknj.icu
montecitobeachtown.com
staticker.com
vehicleheroes.com
marbellelingerie.com
relocanada.com
nigiwai-bangbuathong-sainoi.com
fuvies.com
ccd-creative.com
weiziyun.net
mylocal.pro
waterbabyisr.com
carmenschmidt.com
culturedlittlehumans.com
amorimcapital.com
1800articles.com
localbaajaar.com
tt-bid.com
suttonbankdc.com
ccacademyofmusic.com
gasteless.com
kamalaharrisfanclub.com
shenyingsuwu.com
edelweissestates.com
wiserfinances.com
freeaitrainingonline.com
xn--ftft-lzabbb.net
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/696-66-0x0000000000000000-mapping.dmp formbook behavioral1/memory/696-68-0x0000000010410000-0x000000001043E000-memory.dmp formbook behavioral1/memory/752-76-0x0000000000080000-0x00000000000AE000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
mshta.exehelp.exedescription pid process target process PID 696 set thread context of 1252 696 mshta.exe Explorer.EXE PID 696 set thread context of 1252 696 mshta.exe Explorer.EXE PID 752 set thread context of 1252 752 help.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
mshta.exehelp.exepid process 696 mshta.exe 696 mshta.exe 696 mshta.exe 752 help.exe 752 help.exe 752 help.exe 752 help.exe 752 help.exe 752 help.exe 752 help.exe 752 help.exe 752 help.exe 752 help.exe 752 help.exe 752 help.exe 752 help.exe 752 help.exe 752 help.exe 752 help.exe 752 help.exe 752 help.exe 752 help.exe 752 help.exe 752 help.exe 752 help.exe 752 help.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
mshta.exehelp.exepid process 696 mshta.exe 696 mshta.exe 696 mshta.exe 696 mshta.exe 752 help.exe 752 help.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
mshta.exehelp.exedescription pid process Token: SeDebugPrivilege 696 mshta.exe Token: SeDebugPrivilege 752 help.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1252 Explorer.EXE 1252 Explorer.EXE 1252 Explorer.EXE 1252 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1252 Explorer.EXE 1252 Explorer.EXE 1252 Explorer.EXE 1252 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
new order.exemshta.exehelp.exedescription pid process target process PID 368 wrote to memory of 696 368 new order.exe mshta.exe PID 368 wrote to memory of 696 368 new order.exe mshta.exe PID 368 wrote to memory of 696 368 new order.exe mshta.exe PID 368 wrote to memory of 696 368 new order.exe mshta.exe PID 368 wrote to memory of 696 368 new order.exe mshta.exe PID 368 wrote to memory of 696 368 new order.exe mshta.exe PID 368 wrote to memory of 696 368 new order.exe mshta.exe PID 696 wrote to memory of 752 696 mshta.exe help.exe PID 696 wrote to memory of 752 696 mshta.exe help.exe PID 696 wrote to memory of 752 696 mshta.exe help.exe PID 696 wrote to memory of 752 696 mshta.exe help.exe PID 752 wrote to memory of 664 752 help.exe cmd.exe PID 752 wrote to memory of 664 752 help.exe cmd.exe PID 752 wrote to memory of 664 752 help.exe cmd.exe PID 752 wrote to memory of 664 752 help.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\new order.exe"C:\Users\Admin\AppData\Local\Temp\new order.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mshta.exeC:\Windows\System32\mshta.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\mshta.exe"5⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/368-61-0x00000000003A0000-0x00000000003BA000-memory.dmpFilesize
104KB
-
memory/368-64-0x0000000000380000-0x0000000000381000-memory.dmpFilesize
4KB
-
memory/368-65-0x0000000075C71000-0x0000000075C73000-memory.dmpFilesize
8KB
-
memory/664-78-0x0000000000000000-mapping.dmp
-
memory/696-66-0x0000000000000000-mapping.dmp
-
memory/696-68-0x0000000010410000-0x000000001043E000-memory.dmpFilesize
184KB
-
memory/696-67-0x00000000000A0000-0x00000000000A1000-memory.dmpFilesize
4KB
-
memory/696-70-0x0000000000590000-0x00000000005A4000-memory.dmpFilesize
80KB
-
memory/696-69-0x0000000001FD0000-0x00000000022D3000-memory.dmpFilesize
3.0MB
-
memory/696-72-0x0000000000610000-0x0000000000624000-memory.dmpFilesize
80KB
-
memory/752-76-0x0000000000080000-0x00000000000AE000-memory.dmpFilesize
184KB
-
memory/752-74-0x0000000000000000-mapping.dmp
-
memory/752-75-0x0000000000220000-0x0000000000226000-memory.dmpFilesize
24KB
-
memory/752-77-0x00000000008E0000-0x0000000000BE3000-memory.dmpFilesize
3.0MB
-
memory/752-79-0x00000000002D0000-0x0000000000363000-memory.dmpFilesize
588KB
-
memory/1252-73-0x0000000007210000-0x000000000735A000-memory.dmpFilesize
1.3MB
-
memory/1252-71-0x0000000006580000-0x00000000066BB000-memory.dmpFilesize
1.2MB
-
memory/1252-80-0x0000000006B90000-0x0000000006C6B000-memory.dmpFilesize
876KB