Overview
overview
10Static
static
Order.exe
windows7_x64
5Order.exe
windows10_x64
5????? ????...DF.exe
windows7_x64
10????? ????...DF.exe
windows10_x64
1087597.exe
windows7_x64
1087597.exe
windows10_x64
1029146c1ccd...70.exe
windows7_x64
729146c1ccd...70.exe
windows10_x64
72cc3b42957...8e.exe
windows7_x64
102cc3b42957...8e.exe
windows10_x64
10RICHIESTA ...TA.exe
windows7_x64
10RICHIESTA ...TA.exe
windows10_x64
1039c1e12e0a...25c.js
windows7_x64
139c1e12e0a...25c.js
windows10_x64
13f46e10e5f...3b.exe
windows7_x64
53f46e10e5f...3b.exe
windows10_x64
553074094ad...95dbec
linux_mipsel
685dce7a17...03.exe
windows7_x64
10685dce7a17...03.exe
windows10_x64
106c4aab4c3b...e2.exe
windows7_x64
106c4aab4c3b...e2.exe
windows10_x64
1073a52a4c60...c0.exe
windows7_x64
373a52a4c60...c0.exe
windows10_x64
3Inv_7623980.exe
windows7_x64
10Inv_7623980.exe
windows10_x64
108954739d96...a8.ps1
windows7_x64
88954739d96...a8.ps1
windows10_x64
8USD $.exe
windows7_x64
10USD $.exe
windows10_x64
1091d079d937...b9.exe
windows7_x64
91d079d937...b9.exe
windows10_x64
9706247fdb...89.exe
windows7_x64
Analysis
-
max time kernel
148s -
max time network
140s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
30-07-2021 15:25
Static task
static1
Behavioral task
behavioral1
Sample
Order.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
Order.exe
Resource
win10v20210410
Behavioral task
behavioral3
Sample
????? ?????? ????#454326_PDF.exe
Resource
win7v20210408
Behavioral task
behavioral4
Sample
????? ?????? ????#454326_PDF.exe
Resource
win10v20210410
Behavioral task
behavioral5
Sample
87597.exe
Resource
win7v20210410
Behavioral task
behavioral6
Sample
87597.exe
Resource
win10v20210408
Behavioral task
behavioral7
Sample
29146c1ccdf280c8ac9d0c861f8bd222d2d93777c8a822da4d72c64fc3f78670.exe
Resource
win7v20210410
Behavioral task
behavioral8
Sample
29146c1ccdf280c8ac9d0c861f8bd222d2d93777c8a822da4d72c64fc3f78670.exe
Resource
win10v20210408
Behavioral task
behavioral9
Sample
2cc3b4295747aeeb5a54b923fdbc9be766ee156c8914f5c07663f7cb1055068e.exe
Resource
win7v20210410
Behavioral task
behavioral10
Sample
2cc3b4295747aeeb5a54b923fdbc9be766ee156c8914f5c07663f7cb1055068e.exe
Resource
win10v20210410
Behavioral task
behavioral11
Sample
RICHIESTA DI OFFERTA.exe
Resource
win7v20210408
Behavioral task
behavioral12
Sample
RICHIESTA DI OFFERTA.exe
Resource
win10v20210410
Behavioral task
behavioral13
Sample
39c1e12e0ada85fa835b623a4698345bf95372bea57a7d3a5070ea1d5d5d825c.js
Resource
win7v20210408
Behavioral task
behavioral14
Sample
39c1e12e0ada85fa835b623a4698345bf95372bea57a7d3a5070ea1d5d5d825c.js
Resource
win10v20210410
Behavioral task
behavioral15
Sample
3f46e10e5fe376b995e2947d1be21955aa8341f39d80cca737109fcf2cf2bf3b.exe
Resource
win7v20210408
Behavioral task
behavioral16
Sample
3f46e10e5fe376b995e2947d1be21955aa8341f39d80cca737109fcf2cf2bf3b.exe
Resource
win10v20210410
Behavioral task
behavioral17
Sample
53074094addc55786936f3d67d7fe36554a7c4f4f96c06252ae768707295dbec
Resource
debian9-mipsel
Behavioral task
behavioral18
Sample
685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe
Resource
win7v20210408
Behavioral task
behavioral19
Sample
685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe
Resource
win10v20210410
Behavioral task
behavioral20
Sample
6c4aab4c3bd1ba8f77a781d70ecbc1b4c7dfd9d3c7ad60158fb8d35d1d4246e2.exe
Resource
win7v20210408
Behavioral task
behavioral21
Sample
6c4aab4c3bd1ba8f77a781d70ecbc1b4c7dfd9d3c7ad60158fb8d35d1d4246e2.exe
Resource
win10v20210410
Behavioral task
behavioral22
Sample
73a52a4c60d253ccdb79e5d50814d1689a49fd85f9e0a40a0dc57ba7fb54e5c0.exe
Resource
win7v20210408
Behavioral task
behavioral23
Sample
73a52a4c60d253ccdb79e5d50814d1689a49fd85f9e0a40a0dc57ba7fb54e5c0.exe
Resource
win10v20210410
Behavioral task
behavioral24
Sample
Inv_7623980.exe
Resource
win7v20210410
Behavioral task
behavioral25
Sample
Inv_7623980.exe
Resource
win10v20210408
Behavioral task
behavioral26
Sample
8954739d960eecd84aa64e657aed72d40567764023ba14e048778d0ebf24cba8.ps1
Resource
win7v20210410
Behavioral task
behavioral27
Sample
8954739d960eecd84aa64e657aed72d40567764023ba14e048778d0ebf24cba8.ps1
Resource
win10v20210408
Behavioral task
behavioral28
Sample
USD $.exe
Resource
win7v20210410
Behavioral task
behavioral29
Sample
USD $.exe
Resource
win10v20210408
Behavioral task
behavioral30
Sample
91d079d9371fa53227e4bb2207ba4d3aa4733feee607773b696779c5e87846b9.exe
Resource
win7v20210410
Behavioral task
behavioral31
Sample
91d079d9371fa53227e4bb2207ba4d3aa4733feee607773b696779c5e87846b9.exe
Resource
win10v20210410
Behavioral task
behavioral32
Sample
9706247fdb847874ca3fad6229787e37299be25d938af865a8e5b132bf313b89.exe
Resource
win7v20210408
General
-
Target
????? ?????? ????#454326_PDF.exe
-
Size
899KB
-
MD5
8ffb5b1aba6759d623f20a9744de4dd0
-
SHA1
969a580a9e874f8e5a38d7fb4db664be1aa35ce5
-
SHA256
8674688f673421c41dd39734f690c3b1b0aa8aceb5adeb057cf8b21d8f2e41a6
-
SHA512
3713871db07036eca5846ca681432e63dbf1951a47186c1f8458a3395da57b53ab796f5b44025bb277cb6f281fecf401d090bc8618fa72b9ea20fce8991a538c
Malware Config
Extracted
formbook
4.1
http://www.constructioncleanup.pro/vd9n/
theunwrappedcollective.com
seckj-ic.com
tyresandover.com
thetrophyworld.com
fonggrconstruction.com
hopiproject.com
sktitle.com
charlotteobscurer.com
qjuhe.com
girlzglitter.com
createmylawn.com
hempcbgpill.com
zzdfdzkj.com
shreehariessential.com
226sm.com
getcupscall.com
neuralviolin.com
sanskaar.life
xn--fhqrm54yyukopc.com
togetherx4fantasy5star.today
buyonlinesaree.com
percyshandman.site
hatchethangout.com
rugpat.com
zen-gizmo.com
vipmomali.com
lacerasavall.cat
aqueouso.com
mkolgems.com
sevenhundredseventysix.fund
fotografhannaneret.com
mitravy.com
bmtrans.net
linterpreting.com
izquay.com
sawaturkey.com
marche-maman.com
eemygf.com
animenovel.com
travelssimply.com
montecitobutterfly.com
volebahis.com
daniela.red
ramseyedk12.com
leyterealestate.info
patriotstrong.net
vkgcrew.com
nadhiradeebaazkiya.online
hotelcarre.com
myfabulouscollection.com
stellantis-luxury-rent.com
hn2020.xyz
emilyscopes.com
lotosouq.com
lovecord.date
stconstant.online
volkite-culverin.net
allwaysautism.com
sheisnatashasimone.com
sepantaceram.com
ishopgrady.com
lifestorycard.com
sexybbwavailable.website
domainbaycapital.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral3/memory/364-68-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral3/memory/364-69-0x000000000041EBD0-mapping.dmp formbook behavioral3/memory/1652-76-0x00000000000E0000-0x000000000010E000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
_____ ______ ____#454326_PDF.exeRegSvcs.exesvchost.exedescription pid process target process PID 1608 set thread context of 364 1608 _____ ______ ____#454326_PDF.exe RegSvcs.exe PID 364 set thread context of 1212 364 RegSvcs.exe Explorer.EXE PID 1652 set thread context of 1212 1652 svchost.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
_____ ______ ____#454326_PDF.exeRegSvcs.exesvchost.exepid process 1608 _____ ______ ____#454326_PDF.exe 1608 _____ ______ ____#454326_PDF.exe 364 RegSvcs.exe 364 RegSvcs.exe 1652 svchost.exe 1652 svchost.exe 1652 svchost.exe 1652 svchost.exe 1652 svchost.exe 1652 svchost.exe 1652 svchost.exe 1652 svchost.exe 1652 svchost.exe 1652 svchost.exe 1652 svchost.exe 1652 svchost.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.exesvchost.exepid process 364 RegSvcs.exe 364 RegSvcs.exe 364 RegSvcs.exe 1652 svchost.exe 1652 svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
_____ ______ ____#454326_PDF.exeRegSvcs.exesvchost.exedescription pid process Token: SeDebugPrivilege 1608 _____ ______ ____#454326_PDF.exe Token: SeDebugPrivilege 364 RegSvcs.exe Token: SeDebugPrivilege 1652 svchost.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
_____ ______ ____#454326_PDF.exeExplorer.EXEsvchost.exedescription pid process target process PID 1608 wrote to memory of 1628 1608 _____ ______ ____#454326_PDF.exe schtasks.exe PID 1608 wrote to memory of 1628 1608 _____ ______ ____#454326_PDF.exe schtasks.exe PID 1608 wrote to memory of 1628 1608 _____ ______ ____#454326_PDF.exe schtasks.exe PID 1608 wrote to memory of 1628 1608 _____ ______ ____#454326_PDF.exe schtasks.exe PID 1608 wrote to memory of 1700 1608 _____ ______ ____#454326_PDF.exe RegSvcs.exe PID 1608 wrote to memory of 1700 1608 _____ ______ ____#454326_PDF.exe RegSvcs.exe PID 1608 wrote to memory of 1700 1608 _____ ______ ____#454326_PDF.exe RegSvcs.exe PID 1608 wrote to memory of 1700 1608 _____ ______ ____#454326_PDF.exe RegSvcs.exe PID 1608 wrote to memory of 1700 1608 _____ ______ ____#454326_PDF.exe RegSvcs.exe PID 1608 wrote to memory of 1700 1608 _____ ______ ____#454326_PDF.exe RegSvcs.exe PID 1608 wrote to memory of 1700 1608 _____ ______ ____#454326_PDF.exe RegSvcs.exe PID 1608 wrote to memory of 364 1608 _____ ______ ____#454326_PDF.exe RegSvcs.exe PID 1608 wrote to memory of 364 1608 _____ ______ ____#454326_PDF.exe RegSvcs.exe PID 1608 wrote to memory of 364 1608 _____ ______ ____#454326_PDF.exe RegSvcs.exe PID 1608 wrote to memory of 364 1608 _____ ______ ____#454326_PDF.exe RegSvcs.exe PID 1608 wrote to memory of 364 1608 _____ ______ ____#454326_PDF.exe RegSvcs.exe PID 1608 wrote to memory of 364 1608 _____ ______ ____#454326_PDF.exe RegSvcs.exe PID 1608 wrote to memory of 364 1608 _____ ______ ____#454326_PDF.exe RegSvcs.exe PID 1608 wrote to memory of 364 1608 _____ ______ ____#454326_PDF.exe RegSvcs.exe PID 1608 wrote to memory of 364 1608 _____ ______ ____#454326_PDF.exe RegSvcs.exe PID 1608 wrote to memory of 364 1608 _____ ______ ____#454326_PDF.exe RegSvcs.exe PID 1212 wrote to memory of 1652 1212 Explorer.EXE svchost.exe PID 1212 wrote to memory of 1652 1212 Explorer.EXE svchost.exe PID 1212 wrote to memory of 1652 1212 Explorer.EXE svchost.exe PID 1212 wrote to memory of 1652 1212 Explorer.EXE svchost.exe PID 1652 wrote to memory of 2016 1652 svchost.exe cmd.exe PID 1652 wrote to memory of 2016 1652 svchost.exe cmd.exe PID 1652 wrote to memory of 2016 1652 svchost.exe cmd.exe PID 1652 wrote to memory of 2016 1652 svchost.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\_____ ______ ____#454326_PDF.exe"C:\Users\Admin\AppData\Local\Temp\_____ ______ ____#454326_PDF.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tUlSEv" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDD73.tmp"3⤵
- Creates scheduled task(s)
PID:1628 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵PID:1700
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:364 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵PID:2016
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
43cb1c32af4e2e2dde7dc771ec2b0c44
SHA1c975a4c28be5eb7864f6dfef58638b0707e7791b
SHA2560ea611bb91ed3a9aac67da012266a0cca65754ede293b165ff0426d7e362aaf0
SHA5121a3e99dbd3da60a31058711da3b4cad3be7cbf4a67de9977c28565a68afd9f3d0eb18c8cc00d73a496c058549942956510f969fdd502e95dfeeacc67436cdb5f