Analysis
- max time kernel
158s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
31/01/2022, 15:18
Static task
static1
Behavioral task
behavioral1
Sample
Order_CF00128.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target Order_CF00128.exe
- Size 249KB
- Sample220131-spl7haheem
- SHA256 46eb08598db36bbd56aa97a864deb6e81b1a4f335cab69c02a163c7621f1d7e4
- MD5 3354c90e93804da5b59c5e037bde0e0e
- SHA1 ed6b364621233b681788f4598ff17268d15c2729
- SHA512 fb72d0af999edc22712e517fa850f7ef22494734835ae1873abff5610ae890518479232c1cd41365b5fc8f04613b0570d45362e9c1c479e9a1565c38555c5b4f
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
Version
-
4.1
Campaign
-
os16
Decoy
-
nautic-experts-hageboelling.com
-
fullharvestfundraising.com
-
xbdsm.club
-
duocaterers.com
-
prizebuddy.club
-
nillprive.com
-
firebreathingpenguin.com
-
buxledger.com
-
annual-journals.com
-
mydemosite0.com
-
noaoka.com
-
eblaghe-iran.xyz
-
globalyuncang.com
-
jacqueson-autocars.com
-
asiafinances.com
-
howtomakearesume.space
-
modernwarfaresecrets.com
-
dualamaquinaria.com
-
thrili.com
-
gracing-up.com
-
jcrealtydesigns.com
-
southaustinmarket.com
-
dp-yszxwbhc.com
-
cryptolux.store
-
yourtechyadda.com
-
yogamat-turban.com
-
fykori.xyz
-
bitherders.com
-
strelingcollectibles.com
-
undershieldz.com
-
youcarboneutral.com
-
meetjaykinder.com
-
wicked-smokes.com
-
wy-bride.com
-
dunespro.com
-
sallyandterry.com
-
theamalfiswim.com
-
eleynworld.com
-
dreamsinbloomphotography.com
-
anaccommodation.com
-
slingactivt.com
-
rxd-ereecd.com
-
immovableproperty.online
-
ramziflowers.com
-
anthropophony.com
-
uncle.finance
-
ialife.info
-
kennascookies.com
-
meta-medical.info
-
sexcommittee.com
-
royalfountainlogistics.com
-
thedefinitionteam.store
-
dragonflyessence.com
-
momubeauty.com
-
alraedest.com
-
alcmjd.xyz
-
massagecon.com
-
nicoletian.com
-
rapslearning.online
-
dlapi.xyz
-
52economics.com
-
neurochirurgie-eisner.com
-
mbbfocean.xyz
-
greenlightiim.com
-
foodgw.com
Signatures
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Formbook Payload 3 IoCs
resource yara_rule behavioral2/memory/1632-131-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3520-137-0x00000000027C0000-0x00000000027EF000-memory.dmp formbook behavioral2/memory/3520-138-0x0000000002CD0000-0x0000000004C1A000-memory.dmp formbook - Sets service image path in registry 2 TTPs
- Loads dropped DLL 1 IoCs
pid Process 3744 Order_CF00128.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3744 set thread context of 1632 3744 Order_CF00128.exe 52 PID 1632 set thread context of 2316 1632 Order_CF00128.exe 13 PID 3520 set thread context of 2316 3520 rundll32.exe 13 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies data under HKEY_USERS 41 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe - Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 1632 Order_CF00128.exe 1632 Order_CF00128.exe 1632 Order_CF00128.exe 1632 Order_CF00128.exe 3520 rundll32.exe 3520 rundll32.exe 3520 rundll32.exe 3520 rundll32.exe 3520 rundll32.exe 3520 rundll32.exe 3520 rundll32.exe 3520 rundll32.exe 3520 rundll32.exe 3520 rundll32.exe 3520 rundll32.exe 3520 rundll32.exe 3520 rundll32.exe 3520 rundll32.exe 3520 rundll32.exe 3520 rundll32.exe 3520 rundll32.exe 3520 rundll32.exe 3520 rundll32.exe 3520 rundll32.exe 3520 rundll32.exe 3520 rundll32.exe 3520 rundll32.exe 3520 rundll32.exe 3520 rundll32.exe 3520 rundll32.exe 3520 rundll32.exe 3520 rundll32.exe 3520 rundll32.exe 3520 rundll32.exe 3520 rundll32.exe 3520 rundll32.exe 3520 rundll32.exe 3520 rundll32.exe 3520 rundll32.exe 3520 rundll32.exe 3520 rundll32.exe 3520 rundll32.exe 3520 rundll32.exe 3520 rundll32.exe 3520 rundll32.exe 3520 rundll32.exe 3520 rundll32.exe 3520 rundll32.exe 3520 rundll32.exe 3520 rundll32.exe 3520 rundll32.exe 3520 rundll32.exe 3520 rundll32.exe 3520 rundll32.exe 3520 rundll32.exe 3520 rundll32.exe 3520 rundll32.exe 3520 rundll32.exe 3520 rundll32.exe 3520 rundll32.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2316 Explorer.EXE - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 1632 Order_CF00128.exe 1632 Order_CF00128.exe 1632 Order_CF00128.exe 3520 rundll32.exe 3520 rundll32.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1632 Order_CF00128.exe Token: SeDebugPrivilege 3520 rundll32.exe Token: SeShutdownPrivilege 2316 Explorer.EXE Token: SeCreatePagefilePrivilege 2316 Explorer.EXE - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3744 wrote to memory of 1632 3744 Order_CF00128.exe 52 PID 3744 wrote to memory of 1632 3744 Order_CF00128.exe 52 PID 3744 wrote to memory of 1632 3744 Order_CF00128.exe 52 PID 3744 wrote to memory of 1632 3744 Order_CF00128.exe 52 PID 3744 wrote to memory of 1632 3744 Order_CF00128.exe 52 PID 3744 wrote to memory of 1632 3744 Order_CF00128.exe 52 PID 2316 wrote to memory of 3520 2316 Explorer.EXE 55 PID 2316 wrote to memory of 3520 2316 Explorer.EXE 55 PID 2316 wrote to memory of 3520 2316 Explorer.EXE 55 PID 3520 wrote to memory of 3700 3520 rundll32.exe 60 PID 3520 wrote to memory of 3700 3520 rundll32.exe 60 PID 3520 wrote to memory of 3700 3520 rundll32.exe 60
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\Order_CF00128.exe"C:\Users\Admin\AppData\Local\Temp\Order_CF00128.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\Order_CF00128.exe"C:\Users\Admin\AppData\Local\Temp\Order_CF00128.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1632
-
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:3348
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Order_CF00128.exe"3⤵PID:3700
-
-
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe dd8306afede2dc44535d9b6d4749f47c VsQyJh57YUu1dc/cdndsNA.0.1.0.0.01⤵
- Modifies data under HKEY_USERS
PID:3688