Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
27-07-2021 19:58
Static task
static1
Behavioral task
behavioral1
Sample
Shipping documents PDF.exe
Resource
win7v20210410
General
-
Target
Shipping documents PDF.exe
-
Size
831KB
-
MD5
81b0bdef857aa70ba8bfe0cb6d02f727
-
SHA1
328ce667e6d7fff59c3f27c0fcda338159c37c6f
-
SHA256
ecc540938addc1a440ef6ceb7714a0b45153c04c28df4395e3de18181439341a
-
SHA512
2b9c6596589265ed4a849d14e10cebff7fdac9a9a0bf7b4a6e33b41b38151a6f63aeb78b4c69e74b6a90be07c470bb86d8da2db988e2863f778780e4c07e238b
Malware Config
Extracted
formbook
4.1
http://w����5 �@q[*��S=���m
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/412-120-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/412-121-0x000000000041EAC0-mapping.dmp formbook behavioral2/memory/632-128-0x0000000002D50000-0x0000000002D7E000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Shipping documents PDF.exeShipping documents PDF.exehelp.exedescription pid process target process PID 4648 set thread context of 412 4648 Shipping documents PDF.exe Shipping documents PDF.exe PID 412 set thread context of 3048 412 Shipping documents PDF.exe Explorer.EXE PID 632 set thread context of 3048 632 help.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
Shipping documents PDF.exeShipping documents PDF.exehelp.exepid process 4648 Shipping documents PDF.exe 4648 Shipping documents PDF.exe 4648 Shipping documents PDF.exe 4648 Shipping documents PDF.exe 412 Shipping documents PDF.exe 412 Shipping documents PDF.exe 412 Shipping documents PDF.exe 412 Shipping documents PDF.exe 632 help.exe 632 help.exe 632 help.exe 632 help.exe 632 help.exe 632 help.exe 632 help.exe 632 help.exe 632 help.exe 632 help.exe 632 help.exe 632 help.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Shipping documents PDF.exehelp.exepid process 412 Shipping documents PDF.exe 412 Shipping documents PDF.exe 412 Shipping documents PDF.exe 632 help.exe 632 help.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Shipping documents PDF.exeShipping documents PDF.exehelp.exedescription pid process Token: SeDebugPrivilege 4648 Shipping documents PDF.exe Token: SeDebugPrivilege 412 Shipping documents PDF.exe Token: SeDebugPrivilege 632 help.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Shipping documents PDF.exeExplorer.EXEhelp.exedescription pid process target process PID 4648 wrote to memory of 4184 4648 Shipping documents PDF.exe schtasks.exe PID 4648 wrote to memory of 4184 4648 Shipping documents PDF.exe schtasks.exe PID 4648 wrote to memory of 4184 4648 Shipping documents PDF.exe schtasks.exe PID 4648 wrote to memory of 412 4648 Shipping documents PDF.exe Shipping documents PDF.exe PID 4648 wrote to memory of 412 4648 Shipping documents PDF.exe Shipping documents PDF.exe PID 4648 wrote to memory of 412 4648 Shipping documents PDF.exe Shipping documents PDF.exe PID 4648 wrote to memory of 412 4648 Shipping documents PDF.exe Shipping documents PDF.exe PID 4648 wrote to memory of 412 4648 Shipping documents PDF.exe Shipping documents PDF.exe PID 4648 wrote to memory of 412 4648 Shipping documents PDF.exe Shipping documents PDF.exe PID 3048 wrote to memory of 632 3048 Explorer.EXE help.exe PID 3048 wrote to memory of 632 3048 Explorer.EXE help.exe PID 3048 wrote to memory of 632 3048 Explorer.EXE help.exe PID 632 wrote to memory of 1012 632 help.exe cmd.exe PID 632 wrote to memory of 1012 632 help.exe cmd.exe PID 632 wrote to memory of 1012 632 help.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Shipping documents PDF.exe"C:\Users\Admin\AppData\Local\Temp\Shipping documents PDF.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tFqKFDvgHq" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1E23.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Shipping documents PDF.exe"C:\Users\Admin\AppData\Local\Temp\Shipping documents PDF.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Shipping documents PDF.exe"3⤵
-
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exeC:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp1E23.tmpMD5
38ed44b24d8c84611abd1eb74cfa976f
SHA11eede321a8983ca9e7e635c0867c1e4e9c47230e
SHA256ae745b46969488f1f889c5b513920d68d601711a71773b3fba6c5c1bbe1d9274
SHA5122a51da8cc9cf68980364332790a571085bd84b56ebe4e53d4fda72ce401253efa2413e3ef177bb1865ee8846c18177bf17395a46adf38d35645ef5da0819fa34
-
memory/412-120-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/412-121-0x000000000041EAC0-mapping.dmp
-
memory/412-122-0x00000000018A0000-0x0000000001BC0000-memory.dmpFilesize
3.1MB
-
memory/412-123-0x0000000001860000-0x0000000001874000-memory.dmpFilesize
80KB
-
memory/632-125-0x0000000000000000-mapping.dmp
-
memory/632-130-0x0000000003350000-0x00000000033E3000-memory.dmpFilesize
588KB
-
memory/632-128-0x0000000002D50000-0x0000000002D7E000-memory.dmpFilesize
184KB
-
memory/632-129-0x0000000003450000-0x0000000003770000-memory.dmpFilesize
3.1MB
-
memory/632-127-0x0000000000920000-0x0000000000927000-memory.dmpFilesize
28KB
-
memory/1012-126-0x0000000000000000-mapping.dmp
-
memory/3048-124-0x00000000051C0000-0x0000000005327000-memory.dmpFilesize
1.4MB
-
memory/3048-131-0x0000000005330000-0x0000000005484000-memory.dmpFilesize
1.3MB
-
memory/3364-115-0x00000000016B0000-0x00000000016B2000-memory.dmpFilesize
8KB
-
memory/4184-118-0x0000000000000000-mapping.dmp
-
memory/4648-114-0x0000000002540000-0x0000000002541000-memory.dmpFilesize
4KB
-
memory/4648-117-0x000000007EDA0000-0x000000007EDA1000-memory.dmpFilesize
4KB
-
memory/4648-116-0x0000000002541000-0x0000000002542000-memory.dmpFilesize
4KB