Analysis
- max time kernel
150s - max time network
152s - platform
windows10_x64 - resource
win10v20210408 - submitted
04/10/2021, 15:17
Static task
static1
Behavioral task
behavioral1
Sample
bnvver12345.exe
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
General
- Target bnvver12345.exe
- Size 258KB
- Sample211004-sn34magee8
- SHA256 d16da4e6a63f26601dd3c961f31708db79be1aead7cf3834fafa47095b1a45a6
- MD5 81a3fbaed8ef79687f45554966985c20
- SHA1 256c21d905602953d3beff30aba518af5b9bef2f
- SHA512 589e4211fd177a11bffd16d5ae32abf646e94c3eb338a2ce9c3d8eb92581fd2a45daf03b22a26bf7347db4ed3280046c1d5f4c14d3b4f3a541fc6f947a8d54b4
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
Version
-
4.1
Campaign
-
rv9n
C2
-
http://www.cjspizza.net/rv9n/
Decoy
-
olivia-grace.show
-
zhuwww.com
-
keiretsu.xyz
-
olidnh.space
-
searuleansec.com
-
2fastrepair.com
-
brooklynmetalroof.com
-
scodol.com
-
novaprint.pro
-
the-loaner.com
-
nextroundscap.com
-
zbwlggs.com
-
internetautodealer.com
-
xn--tornrealestate-ekb.com
-
yunjiuhuo.com
-
skandinaviskakryptobanken.com
-
coxivarag.rest
-
ophthalmologylab.com
-
zzzzgjcdbqnn98.net
-
doeful.com
-
beatthebank.fund
-
deposit-pulsa2021.xyz
-
uptownsecuritysystems.com
-
thegroveonglendale.com
-
destinationth.com
-
healthcareuninsured.com
-
longhang.xyz
-
ypxwwxjqcqhutyp.com
-
ip-15-235-90.net
-
rancholachiquita.com
-
macblog.xyz
-
skillsbazar.com
-
beatyup.com
-
academiapinto.com
-
myguagua.com
-
fto8y.com
-
ohioleads.net
-
paravocebrasil.com
-
thecanyonmanor.com
-
acu-bps.com
-
comunicaretresessanta.net
-
schwa-bingcorp.com
-
discountcouponcodes-jp.space
-
kufazo.online
-
metaverge.club
-
800car.online
-
brendanbaehr.com
-
garfieldtoken.net
-
secretfoldr.com
-
13itcasino.com
-
marketingatelier.net
-
computersslide.com
-
marcastudios.com
-
thestreetsoflondon.life
-
maintaintest.com
-
cronicasdebia.com
-
apm-app.com
-
sepulchral.xyz
-
lodha-project.com
-
theartofsoulwork.com
-
swimminglessonsshop.com
-
klarnabet.com
-
control-of-space.net
-
heliumathletic.com
Signatures
- Formbook Payload 3 IoCs
resource yara_rule behavioral2/memory/904-115-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/904-116-0x000000000041F120-mapping.dmp formbook behavioral2/memory/868-122-0x0000000002BC0000-0x0000000002BEF000-memory.dmp formbook - Loads dropped DLL 1 IoCs
pid Process 644 bnvver12345.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 644 set thread context of 904 644 bnvver12345.exe 68 PID 904 set thread context of 3092 904 bnvver12345.exe 58 PID 868 set thread context of 3092 868 ipconfig.exe 58 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 868 ipconfig.exe - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance Explorer.EXE - Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 904 bnvver12345.exe 904 bnvver12345.exe 904 bnvver12345.exe 904 bnvver12345.exe 868 ipconfig.exe 868 ipconfig.exe 868 ipconfig.exe 868 ipconfig.exe 868 ipconfig.exe 868 ipconfig.exe 868 ipconfig.exe 868 ipconfig.exe 868 ipconfig.exe 868 ipconfig.exe 868 ipconfig.exe 868 ipconfig.exe 868 ipconfig.exe 868 ipconfig.exe 868 ipconfig.exe 868 ipconfig.exe 868 ipconfig.exe 868 ipconfig.exe 868 ipconfig.exe 868 ipconfig.exe 868 ipconfig.exe 868 ipconfig.exe 868 ipconfig.exe 868 ipconfig.exe 868 ipconfig.exe 868 ipconfig.exe 868 ipconfig.exe 868 ipconfig.exe 868 ipconfig.exe 868 ipconfig.exe 868 ipconfig.exe 868 ipconfig.exe 868 ipconfig.exe 868 ipconfig.exe 868 ipconfig.exe 868 ipconfig.exe 868 ipconfig.exe 868 ipconfig.exe 868 ipconfig.exe 868 ipconfig.exe 868 ipconfig.exe 868 ipconfig.exe 868 ipconfig.exe 868 ipconfig.exe 868 ipconfig.exe 868 ipconfig.exe 868 ipconfig.exe 868 ipconfig.exe 868 ipconfig.exe 868 ipconfig.exe 868 ipconfig.exe 868 ipconfig.exe 868 ipconfig.exe 868 ipconfig.exe 868 ipconfig.exe 868 ipconfig.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3092 Explorer.EXE - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 904 bnvver12345.exe 904 bnvver12345.exe 904 bnvver12345.exe 868 ipconfig.exe 868 ipconfig.exe - Suspicious use of AdjustPrivilegeToken 16 IoCs
description pid Process Token: SeDebugPrivilege 904 bnvver12345.exe Token: SeDebugPrivilege 868 ipconfig.exe Token: SeShutdownPrivilege 3092 Explorer.EXE Token: SeCreatePagefilePrivilege 3092 Explorer.EXE Token: SeShutdownPrivilege 3092 Explorer.EXE Token: SeCreatePagefilePrivilege 3092 Explorer.EXE Token: SeShutdownPrivilege 3092 Explorer.EXE Token: SeCreatePagefilePrivilege 3092 Explorer.EXE Token: SeShutdownPrivilege 3092 Explorer.EXE Token: SeCreatePagefilePrivilege 3092 Explorer.EXE Token: SeShutdownPrivilege 3092 Explorer.EXE Token: SeCreatePagefilePrivilege 3092 Explorer.EXE Token: SeShutdownPrivilege 3092 Explorer.EXE Token: SeCreatePagefilePrivilege 3092 Explorer.EXE Token: SeShutdownPrivilege 3092 Explorer.EXE Token: SeCreatePagefilePrivilege 3092 Explorer.EXE - Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 3092 Explorer.EXE 3092 Explorer.EXE 3092 Explorer.EXE 3092 Explorer.EXE 3092 Explorer.EXE 3092 Explorer.EXE 3092 Explorer.EXE 3092 Explorer.EXE - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 644 wrote to memory of 904 644 bnvver12345.exe 68 PID 644 wrote to memory of 904 644 bnvver12345.exe 68 PID 644 wrote to memory of 904 644 bnvver12345.exe 68 PID 644 wrote to memory of 904 644 bnvver12345.exe 68 PID 644 wrote to memory of 904 644 bnvver12345.exe 68 PID 644 wrote to memory of 904 644 bnvver12345.exe 68 PID 3092 wrote to memory of 868 3092 Explorer.EXE 69 PID 3092 wrote to memory of 868 3092 Explorer.EXE 69 PID 3092 wrote to memory of 868 3092 Explorer.EXE 69 PID 868 wrote to memory of 1208 868 ipconfig.exe 70 PID 868 wrote to memory of 1208 868 ipconfig.exe 70 PID 868 wrote to memory of 1208 868 ipconfig.exe 70
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\bnvver12345.exe"C:\Users\Admin\AppData\Local\Temp\bnvver12345.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Users\Admin\AppData\Local\Temp\bnvver12345.exe"C:\Users\Admin\AppData\Local\Temp\bnvver12345.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:904
-
-
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\bnvver12345.exe"3⤵PID:1208
-
-