Analysis
-
max time kernel
150s -
max time network
137s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
21-10-2021 17:28
Static task
static1
Behavioral task
behavioral1
Sample
order 0091.com.exe
Resource
win7-en-20210920
General
-
Target
order 0091.com.exe
-
Size
427KB
-
MD5
c6d40c961c2a1940c29ff433fc9217ee
-
SHA1
a55d2f584620864fe9eb49e7647bb86fc2c20050
-
SHA256
cf0d36f933310c07f1554db7e6e8a2e79c01ee933717e13f96ae841302306512
-
SHA512
97c9df9f0492303c86a94e0fb25edac5cbd23e30cc4bcddc00ef47f7b70a7642da57f144bfa505a3ef0cad2de7f8d4fe464e58df931aeb54861e57c84f65fff7
Malware Config
Extracted
formbook
4.1
dn7r
http://www.yourherogarden.net/dn7r/
eventphotographerdfw.com
thehalalcoinstaking.com
philipfaziofineart.com
intercoh.com
gaiaseyephotography.com
chatbotforrealestate.com
lovelancemg.com
marlieskasberger.com
elcongoenespanol.info
lepirecredit.com
distribution-concept.com
e99game.com
exit11festival.com
twodollartoothbrushclub.com
cocktailsandlawn.com
performimprove.network
24horas-telefono-11840.com
cosmossify.com
kellenleote.com
perovskite.energy
crosschain.services
xiwanghe.com
mollycayton.com
bonipay.com
uuwyxc.com
viberiokno-online.com
mobceo.com
menzelna.com
tiffaniefoster.com
premiumautowesthartford.com
ownhome.house
bestmartinshop.com
splashstoreofficial.com
guidemining.com
ecshopdemo.com
bestprinting1.com
s-circle2020.com
ncagency.info
easydigitalzone.com
reikiforthecollective.com
theknottteam.com
evolvedpixel.com
japxo.online
ryansqualityrenovations.com
dentimagenquito.net
pantherprints.co.uk
apoporangi.com
thietkemietvuon.net
ifernshop.com
casaruralesgranada.com
camp-3saumons.com
eddsucks.com
blwcd.com
deldlab.com
susanperb.com
autosanitizingsolutions.com
femhouse.com
ironcageclash.com
thekinghealer.com
shaghayeghbovand.com
advertfaces.com
lonriley.com
mased-world.online
mythicspacex.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/628-56-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/628-57-0x000000000041F200-mapping.dmp formbook behavioral1/memory/1700-64-0x0000000000110000-0x000000000013F000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1288 cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
order 0091.com.exepid process 1100 order 0091.com.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
order 0091.com.exeorder 0091.com.exesystray.exedescription pid process target process PID 1100 set thread context of 628 1100 order 0091.com.exe order 0091.com.exe PID 628 set thread context of 1400 628 order 0091.com.exe Explorer.EXE PID 1700 set thread context of 1400 1700 systray.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 31 IoCs
Processes:
order 0091.com.exesystray.exepid process 628 order 0091.com.exe 628 order 0091.com.exe 1700 systray.exe 1700 systray.exe 1700 systray.exe 1700 systray.exe 1700 systray.exe 1700 systray.exe 1700 systray.exe 1700 systray.exe 1700 systray.exe 1700 systray.exe 1700 systray.exe 1700 systray.exe 1700 systray.exe 1700 systray.exe 1700 systray.exe 1700 systray.exe 1700 systray.exe 1700 systray.exe 1700 systray.exe 1700 systray.exe 1700 systray.exe 1700 systray.exe 1700 systray.exe 1700 systray.exe 1700 systray.exe 1700 systray.exe 1700 systray.exe 1700 systray.exe 1700 systray.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1400 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
order 0091.com.exesystray.exepid process 628 order 0091.com.exe 628 order 0091.com.exe 628 order 0091.com.exe 1700 systray.exe 1700 systray.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
order 0091.com.exesystray.exedescription pid process Token: SeDebugPrivilege 628 order 0091.com.exe Token: SeDebugPrivilege 1700 systray.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1400 Explorer.EXE 1400 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1400 Explorer.EXE 1400 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
order 0091.com.exeExplorer.EXEsystray.exedescription pid process target process PID 1100 wrote to memory of 628 1100 order 0091.com.exe order 0091.com.exe PID 1100 wrote to memory of 628 1100 order 0091.com.exe order 0091.com.exe PID 1100 wrote to memory of 628 1100 order 0091.com.exe order 0091.com.exe PID 1100 wrote to memory of 628 1100 order 0091.com.exe order 0091.com.exe PID 1100 wrote to memory of 628 1100 order 0091.com.exe order 0091.com.exe PID 1100 wrote to memory of 628 1100 order 0091.com.exe order 0091.com.exe PID 1100 wrote to memory of 628 1100 order 0091.com.exe order 0091.com.exe PID 1400 wrote to memory of 1700 1400 Explorer.EXE systray.exe PID 1400 wrote to memory of 1700 1400 Explorer.EXE systray.exe PID 1400 wrote to memory of 1700 1400 Explorer.EXE systray.exe PID 1400 wrote to memory of 1700 1400 Explorer.EXE systray.exe PID 1700 wrote to memory of 1288 1700 systray.exe cmd.exe PID 1700 wrote to memory of 1288 1700 systray.exe cmd.exe PID 1700 wrote to memory of 1288 1700 systray.exe cmd.exe PID 1700 wrote to memory of 1288 1700 systray.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\order 0091.com.exe"C:\Users\Admin\AppData\Local\Temp\order 0091.com.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\order 0091.com.exe"C:\Users\Admin\AppData\Local\Temp\order 0091.com.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\order 0091.com.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nstC7A4.tmp\brfrqelhtqi.dllMD5
08f8c05553706af957306d9cce346ebb
SHA1bc1ccb5f00c582752d4a5103b122fe5299dad8d4
SHA256628e6ecd0231ccdefd6d684a8d0f07ff16f0213ae04e29adb7ff94853cce2cc3
SHA5123dd9ea6672f45734931e194b066fe042a4d79e6cdd8a8999b874b7a4eaacf09d123e77d996be795b0d6e131fd9555e17fd4af445c1ad8c9a9cd3cb5f0ec1e0a1
-
memory/628-59-0x0000000000890000-0x0000000000B93000-memory.dmpFilesize
3.0MB
-
memory/628-56-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/628-57-0x000000000041F200-mapping.dmp
-
memory/628-60-0x0000000000340000-0x0000000000355000-memory.dmpFilesize
84KB
-
memory/1100-54-0x00000000751A1000-0x00000000751A3000-memory.dmpFilesize
8KB
-
memory/1288-65-0x0000000000000000-mapping.dmp
-
memory/1400-61-0x0000000006A30000-0x0000000006B29000-memory.dmpFilesize
996KB
-
memory/1400-68-0x0000000007980000-0x0000000007AAA000-memory.dmpFilesize
1.2MB
-
memory/1700-62-0x0000000000000000-mapping.dmp
-
memory/1700-63-0x0000000000490000-0x0000000000495000-memory.dmpFilesize
20KB
-
memory/1700-64-0x0000000000110000-0x000000000013F000-memory.dmpFilesize
188KB
-
memory/1700-66-0x0000000001E00000-0x0000000002103000-memory.dmpFilesize
3.0MB
-
memory/1700-67-0x0000000000540000-0x00000000005D4000-memory.dmpFilesize
592KB