Analysis
-
max time kernel
154s -
max time network
125s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
07-02-2022 12:21
Static task
static1
Behavioral task
behavioral1
Sample
yeni sipariş pdf.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
yeni sipariş pdf.exe
Resource
win10v2004-en-20220113
General
-
Target
yeni sipariş pdf.exe
-
Size
822KB
-
MD5
41d2899a4441944b48daba79bfb70dd0
-
SHA1
463778a640b327918d8e67cd2f9fa949be3b04e8
-
SHA256
7480e4ba962590b3f14f4516861bb1aa80ffa08223a944ee6599cfe3b4e89bce
-
SHA512
cb5b11e73fb06ffe3e1c4f91658899d82c8da6c6db9f3b3c126840bfb728b6ee862f8b45c903366ab37c2570baff6c298af41f4ffbd92e624579e8c4bc380104
Malware Config
Extracted
formbook
4.1
g2m3
stocktonfingerprinting.com
metaaiqr.com
junicy.com
libertymutualgrou.com
jklhs7gl.xyz
alex-covalcova.space
socialfiguild.com
drnicholasreid.com
androidappprogrammierie.com
relatingtohumans.com
jitsystems.com
gbwpmz.com
lesaventuresdecocomango.com
wu8ggqdv077p.xyz
autnvg.com
wghakt016.xyz
lagosian.store
hilldoor.com
oculos-ajustavel-br.xyz
nameniboothac.com
lifuyao.com
cardinalsplayerstore.com
pholoniex-an.xyz
clarensis.com
wu8d616yyt6z.xyz
uidrp.com
gents.style
npwpkl.com
xn--kinsithrapeute-dkbe.xyz
cruzinu.xyz
raverwren.net
veuology.com
armbandtas.com
77xy.xyz
racingsilks-nft.com
academiademujerespro.com
makciakla.com
hopejustmade.com
catrionatowriss.com
kcebtaz.xyz
hongjunwuliu.com
vegecru.com
sidesofthenorth.com
buytacpyshop.xyz
nexuslanka.com
benormxukraine.xyz
hnart-child.com
globalrockstar.xyz
ilovesinglemoms.com
ollorhythm.com
ozkonyalikebap.com
kenmark-inc.com
recuerdosoxidados.com
interviewacomicnerd.com
have4grand.com
mcattoneys.com
ksherill.com
greenelectricmotors.com
matercenter.com
anwisystems.com
buylowatlanta.com
1stuebc.com
topbunkconsulting.com
heathlytrim.com
autnvg.com
Signatures
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/752-67-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1256-74-0x0000000000120000-0x000000000014F000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
yeni sipariş pdf.exeRegSvcs.exeraserver.exedescription pid process target process PID 1108 set thread context of 752 1108 yeni sipariş pdf.exe RegSvcs.exe PID 752 set thread context of 1384 752 RegSvcs.exe Explorer.EXE PID 1256 set thread context of 1384 1256 raserver.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
yeni sipariş pdf.exepowershell.exeRegSvcs.exeraserver.exepid process 1108 yeni sipariş pdf.exe 1108 yeni sipariş pdf.exe 1108 yeni sipariş pdf.exe 276 powershell.exe 1108 yeni sipariş pdf.exe 1108 yeni sipariş pdf.exe 1108 yeni sipariş pdf.exe 1108 yeni sipariş pdf.exe 752 RegSvcs.exe 752 RegSvcs.exe 1256 raserver.exe 1256 raserver.exe 1256 raserver.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.exeraserver.exepid process 752 RegSvcs.exe 752 RegSvcs.exe 752 RegSvcs.exe 1256 raserver.exe 1256 raserver.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
yeni sipariş pdf.exepowershell.exeRegSvcs.exeraserver.exedescription pid process Token: SeDebugPrivilege 1108 yeni sipariş pdf.exe Token: SeDebugPrivilege 276 powershell.exe Token: SeDebugPrivilege 752 RegSvcs.exe Token: SeDebugPrivilege 1256 raserver.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
yeni sipariş pdf.exeExplorer.EXEraserver.exedescription pid process target process PID 1108 wrote to memory of 276 1108 yeni sipariş pdf.exe powershell.exe PID 1108 wrote to memory of 276 1108 yeni sipariş pdf.exe powershell.exe PID 1108 wrote to memory of 276 1108 yeni sipariş pdf.exe powershell.exe PID 1108 wrote to memory of 276 1108 yeni sipariş pdf.exe powershell.exe PID 1108 wrote to memory of 804 1108 yeni sipariş pdf.exe schtasks.exe PID 1108 wrote to memory of 804 1108 yeni sipariş pdf.exe schtasks.exe PID 1108 wrote to memory of 804 1108 yeni sipariş pdf.exe schtasks.exe PID 1108 wrote to memory of 804 1108 yeni sipariş pdf.exe schtasks.exe PID 1108 wrote to memory of 752 1108 yeni sipariş pdf.exe RegSvcs.exe PID 1108 wrote to memory of 752 1108 yeni sipariş pdf.exe RegSvcs.exe PID 1108 wrote to memory of 752 1108 yeni sipariş pdf.exe RegSvcs.exe PID 1108 wrote to memory of 752 1108 yeni sipariş pdf.exe RegSvcs.exe PID 1108 wrote to memory of 752 1108 yeni sipariş pdf.exe RegSvcs.exe PID 1108 wrote to memory of 752 1108 yeni sipariş pdf.exe RegSvcs.exe PID 1108 wrote to memory of 752 1108 yeni sipariş pdf.exe RegSvcs.exe PID 1108 wrote to memory of 752 1108 yeni sipariş pdf.exe RegSvcs.exe PID 1108 wrote to memory of 752 1108 yeni sipariş pdf.exe RegSvcs.exe PID 1108 wrote to memory of 752 1108 yeni sipariş pdf.exe RegSvcs.exe PID 1384 wrote to memory of 1256 1384 Explorer.EXE raserver.exe PID 1384 wrote to memory of 1256 1384 Explorer.EXE raserver.exe PID 1384 wrote to memory of 1256 1384 Explorer.EXE raserver.exe PID 1384 wrote to memory of 1256 1384 Explorer.EXE raserver.exe PID 1256 wrote to memory of 1504 1256 raserver.exe cmd.exe PID 1256 wrote to memory of 1504 1256 raserver.exe cmd.exe PID 1256 wrote to memory of 1504 1256 raserver.exe cmd.exe PID 1256 wrote to memory of 1504 1256 raserver.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\yeni sipariş pdf.exe"C:\Users\Admin\AppData\Local\Temp\yeni sipariş pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\oifnpghsFyo.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\oifnpghsFyo" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDA18.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpDA18.tmpMD5
cdecd81c8dc02b28c6ed5fa4b0f9680d
SHA1d172b4bc0ccf4b062457027974c439f72d2e2e0d
SHA25681282ec8c7d438093486fffaa9b6942d4b8c32ad6b4fcd6282d796dfe1f541ac
SHA512be880d434f3fa2c01fd3efb6a80bd6d98c25ac62130ff703d5f8ff3134c5bb3665253f5e0730472be658a21041153614c278b79ef41839bbe245bf2396d2be51
-
memory/276-64-0x0000000002310000-0x0000000002F5A000-memory.dmpFilesize
12.3MB
-
memory/276-63-0x0000000002310000-0x0000000002F5A000-memory.dmpFilesize
12.3MB
-
memory/276-62-0x0000000002310000-0x0000000002F5A000-memory.dmpFilesize
12.3MB
-
memory/752-66-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/752-65-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/752-70-0x0000000000190000-0x00000000001A4000-memory.dmpFilesize
80KB
-
memory/752-69-0x0000000000A00000-0x0000000000D03000-memory.dmpFilesize
3.0MB
-
memory/752-67-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1108-56-0x0000000075801000-0x0000000075803000-memory.dmpFilesize
8KB
-
memory/1108-55-0x0000000001340000-0x0000000001414000-memory.dmpFilesize
848KB
-
memory/1108-59-0x0000000004820000-0x00000000048CA000-memory.dmpFilesize
680KB
-
memory/1108-57-0x0000000004EB0000-0x0000000004EB1000-memory.dmpFilesize
4KB
-
memory/1108-58-0x00000000002E0000-0x00000000002EC000-memory.dmpFilesize
48KB
-
memory/1256-73-0x0000000000050000-0x000000000006C000-memory.dmpFilesize
112KB
-
memory/1256-74-0x0000000000120000-0x000000000014F000-memory.dmpFilesize
188KB
-
memory/1256-75-0x0000000001EA0000-0x00000000021A3000-memory.dmpFilesize
3.0MB
-
memory/1256-76-0x00000000003B0000-0x0000000001E91000-memory.dmpFilesize
26.9MB
-
memory/1384-71-0x0000000004880000-0x0000000004947000-memory.dmpFilesize
796KB
-
memory/1384-77-0x0000000005090000-0x000000000518A000-memory.dmpFilesize
1000KB