Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
27-01-2022 13:07
Static task
static1
Behavioral task
behavioral1
Sample
Orden N° 067.exe
Resource
win7-en-20211208
General
-
Target
Orden N° 067.exe
-
Size
247KB
-
MD5
b36ce18bb9f5d208ebef0620b525baf7
-
SHA1
045951540bd833078efb46ee7a38af86dac7764f
-
SHA256
cd4537fc71b075714c040194ba6caba7b0d1bf8b8614f0d7b1868f4941e4cb06
-
SHA512
755732c0d6c89180f9d7fa08361b221011dd014938abc1ee65ce62062ba22422fa74d29cabe6e4ca35093911788d622445bced9ea56659fd29c2e30834bee493
Malware Config
Extracted
formbook
4.1
os16
nautic-experts-hageboelling.com
fullharvestfundraising.com
xbdsm.club
duocaterers.com
prizebuddy.club
nillprive.com
firebreathingpenguin.com
buxledger.com
annual-journals.com
mydemosite0.com
noaoka.com
eblaghe-iran.xyz
globalyuncang.com
jacqueson-autocars.com
asiafinances.com
howtomakearesume.space
modernwarfaresecrets.com
dualamaquinaria.com
thrili.com
gracing-up.com
jcrealtydesigns.com
southaustinmarket.com
dp-yszxwbhc.com
cryptolux.store
yourtechyadda.com
yogamat-turban.com
fykori.xyz
bitherders.com
strelingcollectibles.com
undershieldz.com
youcarboneutral.com
meetjaykinder.com
wicked-smokes.com
wy-bride.com
dunespro.com
sallyandterry.com
theamalfiswim.com
eleynworld.com
dreamsinbloomphotography.com
anaccommodation.com
slingactivt.com
rxd-ereecd.com
immovableproperty.online
ramziflowers.com
anthropophony.com
uncle.finance
ialife.info
kennascookies.com
meta-medical.info
sexcommittee.com
royalfountainlogistics.com
thedefinitionteam.store
dragonflyessence.com
momubeauty.com
alraedest.com
alcmjd.xyz
massagecon.com
nicoletian.com
rapslearning.online
dlapi.xyz
52economics.com
neurochirurgie-eisner.com
mbbfocean.xyz
greenlightiim.com
foodgw.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1596-56-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1248-62-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 560 cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
Orden N° 067.exepid process 952 Orden N° 067.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Orden N° 067.exeOrden N° 067.exewlanext.exedescription pid process target process PID 952 set thread context of 1596 952 Orden N° 067.exe Orden N° 067.exe PID 1596 set thread context of 1412 1596 Orden N° 067.exe Explorer.EXE PID 1248 set thread context of 1412 1248 wlanext.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
Orden N° 067.exewlanext.exepid process 1596 Orden N° 067.exe 1596 Orden N° 067.exe 1248 wlanext.exe 1248 wlanext.exe 1248 wlanext.exe 1248 wlanext.exe 1248 wlanext.exe 1248 wlanext.exe 1248 wlanext.exe 1248 wlanext.exe 1248 wlanext.exe 1248 wlanext.exe 1248 wlanext.exe 1248 wlanext.exe 1248 wlanext.exe 1248 wlanext.exe 1248 wlanext.exe 1248 wlanext.exe 1248 wlanext.exe 1248 wlanext.exe 1248 wlanext.exe 1248 wlanext.exe 1248 wlanext.exe 1248 wlanext.exe 1248 wlanext.exe 1248 wlanext.exe 1248 wlanext.exe 1248 wlanext.exe 1248 wlanext.exe 1248 wlanext.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1412 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Orden N° 067.exewlanext.exepid process 1596 Orden N° 067.exe 1596 Orden N° 067.exe 1596 Orden N° 067.exe 1248 wlanext.exe 1248 wlanext.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Orden N° 067.exewlanext.exedescription pid process Token: SeDebugPrivilege 1596 Orden N° 067.exe Token: SeDebugPrivilege 1248 wlanext.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1412 Explorer.EXE 1412 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1412 Explorer.EXE 1412 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Orden N° 067.exeExplorer.EXEwlanext.exedescription pid process target process PID 952 wrote to memory of 1596 952 Orden N° 067.exe Orden N° 067.exe PID 952 wrote to memory of 1596 952 Orden N° 067.exe Orden N° 067.exe PID 952 wrote to memory of 1596 952 Orden N° 067.exe Orden N° 067.exe PID 952 wrote to memory of 1596 952 Orden N° 067.exe Orden N° 067.exe PID 952 wrote to memory of 1596 952 Orden N° 067.exe Orden N° 067.exe PID 952 wrote to memory of 1596 952 Orden N° 067.exe Orden N° 067.exe PID 952 wrote to memory of 1596 952 Orden N° 067.exe Orden N° 067.exe PID 1412 wrote to memory of 1248 1412 Explorer.EXE wlanext.exe PID 1412 wrote to memory of 1248 1412 Explorer.EXE wlanext.exe PID 1412 wrote to memory of 1248 1412 Explorer.EXE wlanext.exe PID 1412 wrote to memory of 1248 1412 Explorer.EXE wlanext.exe PID 1248 wrote to memory of 560 1248 wlanext.exe cmd.exe PID 1248 wrote to memory of 560 1248 wlanext.exe cmd.exe PID 1248 wrote to memory of 560 1248 wlanext.exe cmd.exe PID 1248 wrote to memory of 560 1248 wlanext.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Orden N° 067.exe"C:\Users\Admin\AppData\Local\Temp\Orden N° 067.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Orden N° 067.exe"C:\Users\Admin\AppData\Local\Temp\Orden N° 067.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Orden N° 067.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsyD970.tmp\attiqkrutig.dllMD5
7a1555a55a8122f0dc242098c2b2e6e1
SHA1e4d0a98a54d806cdc19277d85bf0f7eca4544b4b
SHA256f3ad56b193b11181634b44e6bff6e2e34cc171a86412cae53f19088596214f00
SHA512dc2a01c605bbe6277b150fe3d1f163302f4b598e441dab428493576f01d25a36713dd8f92d2d27016cc171cbad2ffa6eef0692e90002e8b5524deeac382fe05c
-
memory/952-54-0x0000000076491000-0x0000000076493000-memory.dmpFilesize
8KB
-
memory/1248-61-0x0000000000E10000-0x0000000000E26000-memory.dmpFilesize
88KB
-
memory/1248-62-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/1248-63-0x00000000009B0000-0x0000000000CB3000-memory.dmpFilesize
3.0MB
-
memory/1248-64-0x0000000000880000-0x0000000000913000-memory.dmpFilesize
588KB
-
memory/1412-60-0x0000000006410000-0x0000000006523000-memory.dmpFilesize
1.1MB
-
memory/1412-65-0x0000000003E30000-0x0000000003F14000-memory.dmpFilesize
912KB
-
memory/1596-56-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1596-57-0x0000000000700000-0x0000000000A03000-memory.dmpFilesize
3.0MB
-
memory/1596-59-0x0000000000580000-0x0000000000594000-memory.dmpFilesize
80KB