Analysis
-
max time kernel
147s -
max time network
142s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
18-10-2021 07:59
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exe
Resource
win7-en-20210920
General
-
Target
SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exe
-
Size
417KB
-
MD5
cdda5b2580b9392c15f9dbf31e194a48
-
SHA1
8f74a7b387f298192730c46b837d6821d50a915b
-
SHA256
5c4023944c61d2985cc5c50811481eb3cd64d4e3caba1e4f96d8fcc7adf7c72a
-
SHA512
d0d2cfae7ca0da54d30dd32aa02639affb538e2b025a58a0558b258e4ae9a35b159b46259429b04d7aaa5d74d32bd35630782f777a6c2c40b2cdfcdcdaeb12c9
Malware Config
Extracted
formbook
4.1
mynd
http://www.dtcu0ng.com/mynd/
bbluedot3dwdbuy.com
aucworks.com
seekselflove.com
thebrandolphcollection.com
saint-daniel.info
covidtestcharleston.com
buniy.com
welprosol.com
focusedbusinesspartners.com
ichikawa.ltd
nieght.com
beediecandleco.com
gracobby.com
nowipe.club
meherconsultancy.com
didonghanquocxachtay.online
snovythailand.com
onetimecreditscore.net
hayosiapa.com
dumpstersforsellers.com
kopfimtopf.com
churchofmanifestation.com
scoopeer.com
givrees.com
giftmystyle.com
enovadis.com
blackcreativeslab.com
juamd.com
yaktaichicks.com
tamquin.net
themaskedstitcher.com
puresed.com
magadir.com
hiptopip.com
surgicalcaseoa.com
yanrk-ht586c.com
online-us.online
salonsuitesofcharleston.com
treeremovalcocoa.com
thewhiskeydisco.com
speaknativechinese.com
e-nokutan.com
mantra613.com
flatrenovation.site
servingdivisiion.com
jemimabdebrito.com
patrington-healthandfitness.com
pandemiyardimbildirim-tr.com
espejitia.com
natasciaedera.com
allcostpk.com
r10288.com
sabzi.uk
astitchinthyme.com
uniq-logistic.online
refreshingtherapy.com
pppdebtrisk.com
jejucash.net
ftfss.com
saintesproe.com
zfcarwholesalers.com
raben-p.site
sundaymorning.media
gatezless.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1856-62-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1856-63-0x000000000041EB00-mapping.dmp formbook behavioral1/memory/1368-71-0x0000000000170000-0x000000000019E000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exeRegSvcs.execscript.exedescription pid process target process PID 1364 set thread context of 1856 1364 SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exe RegSvcs.exe PID 1856 set thread context of 1212 1856 RegSvcs.exe Explorer.EXE PID 1368 set thread context of 1212 1368 cscript.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 27 IoCs
Processes:
SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exeRegSvcs.execscript.exepid process 1364 SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exe 1364 SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exe 1364 SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exe 1364 SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exe 1856 RegSvcs.exe 1856 RegSvcs.exe 1368 cscript.exe 1368 cscript.exe 1368 cscript.exe 1368 cscript.exe 1368 cscript.exe 1368 cscript.exe 1368 cscript.exe 1368 cscript.exe 1368 cscript.exe 1368 cscript.exe 1368 cscript.exe 1368 cscript.exe 1368 cscript.exe 1368 cscript.exe 1368 cscript.exe 1368 cscript.exe 1368 cscript.exe 1368 cscript.exe 1368 cscript.exe 1368 cscript.exe 1368 cscript.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.execscript.exepid process 1856 RegSvcs.exe 1856 RegSvcs.exe 1856 RegSvcs.exe 1368 cscript.exe 1368 cscript.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exeRegSvcs.execscript.exedescription pid process Token: SeDebugPrivilege 1364 SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exe Token: SeDebugPrivilege 1856 RegSvcs.exe Token: SeDebugPrivilege 1368 cscript.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1212 Explorer.EXE 1212 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1212 Explorer.EXE 1212 Explorer.EXE -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exeExplorer.EXEcscript.exedescription pid process target process PID 1364 wrote to memory of 1056 1364 SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exe schtasks.exe PID 1364 wrote to memory of 1056 1364 SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exe schtasks.exe PID 1364 wrote to memory of 1056 1364 SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exe schtasks.exe PID 1364 wrote to memory of 1056 1364 SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exe schtasks.exe PID 1364 wrote to memory of 1512 1364 SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exe RegSvcs.exe PID 1364 wrote to memory of 1512 1364 SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exe RegSvcs.exe PID 1364 wrote to memory of 1512 1364 SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exe RegSvcs.exe PID 1364 wrote to memory of 1512 1364 SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exe RegSvcs.exe PID 1364 wrote to memory of 1512 1364 SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exe RegSvcs.exe PID 1364 wrote to memory of 1512 1364 SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exe RegSvcs.exe PID 1364 wrote to memory of 1512 1364 SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exe RegSvcs.exe PID 1364 wrote to memory of 976 1364 SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exe RegSvcs.exe PID 1364 wrote to memory of 976 1364 SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exe RegSvcs.exe PID 1364 wrote to memory of 976 1364 SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exe RegSvcs.exe PID 1364 wrote to memory of 976 1364 SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exe RegSvcs.exe PID 1364 wrote to memory of 976 1364 SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exe RegSvcs.exe PID 1364 wrote to memory of 976 1364 SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exe RegSvcs.exe PID 1364 wrote to memory of 976 1364 SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exe RegSvcs.exe PID 1364 wrote to memory of 1856 1364 SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exe RegSvcs.exe PID 1364 wrote to memory of 1856 1364 SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exe RegSvcs.exe PID 1364 wrote to memory of 1856 1364 SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exe RegSvcs.exe PID 1364 wrote to memory of 1856 1364 SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exe RegSvcs.exe PID 1364 wrote to memory of 1856 1364 SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exe RegSvcs.exe PID 1364 wrote to memory of 1856 1364 SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exe RegSvcs.exe PID 1364 wrote to memory of 1856 1364 SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exe RegSvcs.exe PID 1364 wrote to memory of 1856 1364 SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exe RegSvcs.exe PID 1364 wrote to memory of 1856 1364 SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exe RegSvcs.exe PID 1364 wrote to memory of 1856 1364 SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exe RegSvcs.exe PID 1212 wrote to memory of 1368 1212 Explorer.EXE cscript.exe PID 1212 wrote to memory of 1368 1212 Explorer.EXE cscript.exe PID 1212 wrote to memory of 1368 1212 Explorer.EXE cscript.exe PID 1212 wrote to memory of 1368 1212 Explorer.EXE cscript.exe PID 1368 wrote to memory of 1164 1368 cscript.exe cmd.exe PID 1368 wrote to memory of 1164 1368 cscript.exe cmd.exe PID 1368 wrote to memory of 1164 1368 cscript.exe cmd.exe PID 1368 wrote to memory of 1164 1368 cscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.17696.9430.31863.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dXrTRQPXdHjjEj" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7983.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1056-59-0x0000000000000000-mapping.dmp
-
memory/1164-69-0x0000000000000000-mapping.dmp
-
memory/1212-67-0x0000000004B00000-0x0000000004C17000-memory.dmpFilesize
1.1MB
-
memory/1212-74-0x0000000004CE0000-0x0000000004DEC000-memory.dmpFilesize
1.0MB
-
memory/1364-55-0x0000000075651000-0x0000000075653000-memory.dmpFilesize
8KB
-
memory/1364-56-0x0000000004E80000-0x0000000004E81000-memory.dmpFilesize
4KB
-
memory/1364-57-0x0000000000890000-0x0000000000898000-memory.dmpFilesize
32KB
-
memory/1364-58-0x00000000010D0000-0x0000000001120000-memory.dmpFilesize
320KB
-
memory/1364-53-0x0000000001120000-0x0000000001121000-memory.dmpFilesize
4KB
-
memory/1368-70-0x00000000001F0000-0x0000000000212000-memory.dmpFilesize
136KB
-
memory/1368-68-0x0000000000000000-mapping.dmp
-
memory/1368-71-0x0000000000170000-0x000000000019E000-memory.dmpFilesize
184KB
-
memory/1368-72-0x0000000001F20000-0x0000000002223000-memory.dmpFilesize
3.0MB
-
memory/1368-73-0x0000000001D90000-0x0000000001E23000-memory.dmpFilesize
588KB
-
memory/1856-66-0x0000000000260000-0x0000000000274000-memory.dmpFilesize
80KB
-
memory/1856-65-0x0000000000AC0000-0x0000000000DC3000-memory.dmpFilesize
3.0MB
-
memory/1856-63-0x000000000041EB00-mapping.dmp
-
memory/1856-62-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1856-61-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1856-60-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB