Analysis
- max time kernel
152s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
20/01/2022, 08:42
Static task
static1
Behavioral task
behavioral1
Sample
COVID FORM1.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target COVID FORM1.exe
- Size 440KB
- Sample220120-kl1xgshbc3
- SHA256 bc09ecf5cb6364f4d053ec0420282fa6e7a1649a8a5ca2af2ca933aa27f8b90c
- MD5 ba0522ceb915a084ac7b8f3e7d8868c6
- SHA1 39764b91316a1fa172c7b5db9e4f6e58dacec306
- SHA512 98fe103661ce1013f57e7f8ed410e5147148c74a9d206927751cd9a299972572485d829378a89bc11d3e18994190b234b3a29bbb683387e092ed305d6b89b3a1
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
Version
-
4.1
Campaign
-
b3n1
Decoy
-
alexandragrows.com
-
shellload.com
-
stanleyrorke.com
-
glasurit.us
-
facebookismetaverse.com
-
astoundingaffairs.com
-
facom.us
-
dysonsaleoutlet.us
-
obtengaunitedhealthcare.com
-
sebastianroofrepairs.com
-
saltvent.com
-
littleonesclub.com
-
webamazoncardshopmail.xyz
-
lutam.xyz
-
myfirstpsgame.com
-
comline.cloud
-
valueinsightfororacle.com
-
congregacionansestral.com.co
-
paypal-uk.xyz
-
facebookversuzmeta.com
-
hyveone.com
-
metaisfacebook.com
-
wordpressversnellen.com
-
sunnyleoneporn.xyz
-
firstfrontstudios.com
-
heytechmarketing.com
-
metaversefacebook.net
-
zirsys.com
-
pmstnly.com
-
metafacebooksnewname.com
-
theagency.black
-
freemetasitebuilder.com
-
tesla88.vin
-
thebitcoinfuturesetfs.com
-
mygiftedaffairs.com
-
qrbconsulting.info
-
gpactive.com
-
facebookvsmeta.com
-
poele-shop.fr
-
firstcallindia.xyz
-
uhcecetr.xyz
-
informital.com
-
areyouongoogle.com
-
lymou.com
-
firstlightadventuretour.com
-
feed-supportives.com
-
chasesecurobanking.com
-
prestigioinformativo.com
-
blogkaisebanayehindimejane.com
-
freedomto.co
-
oneonemeta.com
-
joinclosify.co
-
unitedkingdommeta.com
-
alexandrathiele.com
-
xn--wellsfarg-o7a.com
-
rockstarsyard.com
-
acd-informatique.fr
-
firststopbusinesses.com
-
loisirs-et-spectacles.com
-
babymassage.us
-
5ggooglecloud.com
-
gameone10668.com
-
parkdomainforsale.com
-
riverbcastmake.net
-
teslabotnews.com
Signatures
- Formbook Payload 2 IoCs
resource yara_rule behavioral2/memory/3008-131-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1648-137-0x0000000000140000-0x000000000016F000-memory.dmp formbook - Sets service image path in registry 2 TTPs
- Loads dropped DLL 1 IoCs
pid Process 2144 COVID FORM1.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2144 set thread context of 3008 2144 COVID FORM1.exe 52 PID 3008 set thread context of 2416 3008 COVID FORM1.exe 28 PID 1648 set thread context of 2416 1648 wscript.exe 28 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies data under HKEY_USERS 41 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe - Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 3008 COVID FORM1.exe 3008 COVID FORM1.exe 3008 COVID FORM1.exe 3008 COVID FORM1.exe 1648 wscript.exe 1648 wscript.exe 1648 wscript.exe 1648 wscript.exe 1648 wscript.exe 1648 wscript.exe 1648 wscript.exe 1648 wscript.exe 1648 wscript.exe 1648 wscript.exe 1648 wscript.exe 1648 wscript.exe 1648 wscript.exe 1648 wscript.exe 1648 wscript.exe 1648 wscript.exe 1648 wscript.exe 1648 wscript.exe 1648 wscript.exe 1648 wscript.exe 1648 wscript.exe 1648 wscript.exe 1648 wscript.exe 1648 wscript.exe 1648 wscript.exe 1648 wscript.exe 1648 wscript.exe 1648 wscript.exe 1648 wscript.exe 1648 wscript.exe 1648 wscript.exe 1648 wscript.exe 1648 wscript.exe 1648 wscript.exe 1648 wscript.exe 1648 wscript.exe 1648 wscript.exe 1648 wscript.exe 1648 wscript.exe 1648 wscript.exe 1648 wscript.exe 1648 wscript.exe 1648 wscript.exe 1648 wscript.exe 1648 wscript.exe 1648 wscript.exe 1648 wscript.exe 1648 wscript.exe 1648 wscript.exe 1648 wscript.exe 1648 wscript.exe 1648 wscript.exe 1648 wscript.exe 1648 wscript.exe 1648 wscript.exe 1648 wscript.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2416 Explorer.EXE - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 3008 COVID FORM1.exe 3008 COVID FORM1.exe 3008 COVID FORM1.exe 1648 wscript.exe 1648 wscript.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3008 COVID FORM1.exe Token: SeDebugPrivilege 1648 wscript.exe Token: SeShutdownPrivilege 2416 Explorer.EXE Token: SeCreatePagefilePrivilege 2416 Explorer.EXE - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2144 wrote to memory of 3008 2144 COVID FORM1.exe 52 PID 2144 wrote to memory of 3008 2144 COVID FORM1.exe 52 PID 2144 wrote to memory of 3008 2144 COVID FORM1.exe 52 PID 2144 wrote to memory of 3008 2144 COVID FORM1.exe 52 PID 2144 wrote to memory of 3008 2144 COVID FORM1.exe 52 PID 2144 wrote to memory of 3008 2144 COVID FORM1.exe 52 PID 2416 wrote to memory of 1648 2416 Explorer.EXE 53 PID 2416 wrote to memory of 1648 2416 Explorer.EXE 53 PID 2416 wrote to memory of 1648 2416 Explorer.EXE 53 PID 1648 wrote to memory of 2368 1648 wscript.exe 54 PID 1648 wrote to memory of 2368 1648 wscript.exe 54 PID 1648 wrote to memory of 2368 1648 wscript.exe 54
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\COVID FORM1.exe"C:\Users\Admin\AppData\Local\Temp\COVID FORM1.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\COVID FORM1.exe"C:\Users\Admin\AppData\Local\Temp\COVID FORM1.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3008
-
-
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\COVID FORM1.exe"3⤵PID:2368
-
-
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe baaa62c1d1a32e33bb687541f954ca86 M47BRkgQTUyhsRmoBvSRng.0.1.0.0.01⤵
- Modifies data under HKEY_USERS
PID:2948