Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 22:31
Static task
static1
Behavioral task
behavioral1
Sample
orden de compra.exe
Resource
win7-20220414-en
General
-
Target
orden de compra.exe
-
Size
380KB
-
MD5
2a30abd4d6db32bfc49a069c56ceb45c
-
SHA1
dc1411169ccfac189b4370ce8342779051a65753
-
SHA256
2f9d83d844287396dcaf52b5c15c1dacc92bc4ae2e2777d24c8d09465037ace3
-
SHA512
fa5110812d55c02e597b4ec890b6f40bcb23e66ecb79189f4d0e461cb87c40f4fb3a36cf6f3edf47b9c4ab9b784702751338399a5cfe14e9bd31ba3b8917403f
Malware Config
Extracted
formbook
4.1
kvsz
okashyns.com
sbsgamedaejeon-two.com
drb77.com
top5dating.com
websprings.online
voizers.com
zenith.site
lahistoriade.com
qv85.com
armandonieto.com
priestvedic.com
jessandjeff.net
magic-desktop.com
jitaji.com
ldmeili.com
yuwanqingmy.com
buzhouorg.com
chaiseloungereviews.com
m2g8way.com
freespin-support.com
bocapvang.net
315px.com
eugeniobarros.tech
sif.email
xn--oorv2aj6bj7cds0d6p4b.com
polychips.com
grouptulip.win
landbank.site
bet365c.win
inbonz.com
outofthepark.today
jeaniney.com
weeip.com
dmoneylife.com
rticlubs.com
reisedating.com
marijuanadogbone.com
funippon.com
banknotesync.com
alexandre-boissard.com
valorartetattoo.com
savetheverse.com
specificpcshop.online
h0jt1y.accountant
jiqing3.com
alfaranakle.com
saft-store.com
wanderingcollective.com
santandermobi.online
557023.top
loulancaster.com
vedattelekom.com
jatinangorcity.com
goldencanaries.com
edgaralanbro.com
levelretail.com
taylorsandbek.com
upbeatnewyork.com
motoreselectricoschihuahua.com
hotair.wales
getawomantodoit.com
xiaoxiong365.com
cloudboxsupport.com
vecteur-u-shop.com
fex-tracks.com
Signatures
-
Formbook Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1232-64-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1232-65-0x000000000041ECA0-mapping.dmp formbook behavioral1/memory/1232-67-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1708-78-0x00000000000C0000-0x00000000000EE000-memory.dmp formbook -
Suspicious use of SetThreadContext 4 IoCs
Processes:
orden de compra.exeRegSvcs.exeexplorer.exedescription pid process target process PID 1308 set thread context of 1232 1308 orden de compra.exe RegSvcs.exe PID 1232 set thread context of 1396 1232 RegSvcs.exe Explorer.EXE PID 1232 set thread context of 1396 1232 RegSvcs.exe Explorer.EXE PID 1708 set thread context of 1396 1708 explorer.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
orden de compra.exeRegSvcs.exeexplorer.exepid process 1308 orden de compra.exe 1308 orden de compra.exe 1308 orden de compra.exe 1232 RegSvcs.exe 1232 RegSvcs.exe 1232 RegSvcs.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
RegSvcs.exeexplorer.exepid process 1232 RegSvcs.exe 1232 RegSvcs.exe 1232 RegSvcs.exe 1232 RegSvcs.exe 1708 explorer.exe 1708 explorer.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
orden de compra.exeRegSvcs.exeexplorer.exedescription pid process Token: SeDebugPrivilege 1308 orden de compra.exe Token: SeDebugPrivilege 1232 RegSvcs.exe Token: SeDebugPrivilege 1708 explorer.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1396 Explorer.EXE 1396 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1396 Explorer.EXE 1396 Explorer.EXE -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
orden de compra.exeExplorer.EXEexplorer.exedescription pid process target process PID 1308 wrote to memory of 1612 1308 orden de compra.exe schtasks.exe PID 1308 wrote to memory of 1612 1308 orden de compra.exe schtasks.exe PID 1308 wrote to memory of 1612 1308 orden de compra.exe schtasks.exe PID 1308 wrote to memory of 1612 1308 orden de compra.exe schtasks.exe PID 1308 wrote to memory of 1232 1308 orden de compra.exe RegSvcs.exe PID 1308 wrote to memory of 1232 1308 orden de compra.exe RegSvcs.exe PID 1308 wrote to memory of 1232 1308 orden de compra.exe RegSvcs.exe PID 1308 wrote to memory of 1232 1308 orden de compra.exe RegSvcs.exe PID 1308 wrote to memory of 1232 1308 orden de compra.exe RegSvcs.exe PID 1308 wrote to memory of 1232 1308 orden de compra.exe RegSvcs.exe PID 1308 wrote to memory of 1232 1308 orden de compra.exe RegSvcs.exe PID 1308 wrote to memory of 1232 1308 orden de compra.exe RegSvcs.exe PID 1308 wrote to memory of 1232 1308 orden de compra.exe RegSvcs.exe PID 1308 wrote to memory of 1232 1308 orden de compra.exe RegSvcs.exe PID 1396 wrote to memory of 1708 1396 Explorer.EXE explorer.exe PID 1396 wrote to memory of 1708 1396 Explorer.EXE explorer.exe PID 1396 wrote to memory of 1708 1396 Explorer.EXE explorer.exe PID 1396 wrote to memory of 1708 1396 Explorer.EXE explorer.exe PID 1708 wrote to memory of 1144 1708 explorer.exe cmd.exe PID 1708 wrote to memory of 1144 1708 explorer.exe cmd.exe PID 1708 wrote to memory of 1144 1708 explorer.exe cmd.exe PID 1708 wrote to memory of 1144 1708 explorer.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\orden de compra.exe"C:\Users\Admin\AppData\Local\Temp\orden de compra.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\soPSGUbyne" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD318.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpD318.tmpFilesize
1KB
MD5e76c1a99a732cdca67d0b8c79e50f4ba
SHA13785520d89f5a47010131aa800fde48de8bf74dd
SHA256737e82eab061c84503fc12dcc7381240c2aa28636262d51e1206a61361aab52b
SHA51294214aa46f926568f04e7050209c0b0e5925a32a6ddf7ae0abc68c188c999033d1b6a6cd3ea6c44f74ecc8b4adb075ce1c0203d237e269b6a53f00e8f28c3eab
-
memory/1144-79-0x0000000000000000-mapping.dmp
-
memory/1232-68-0x0000000000970000-0x0000000000C73000-memory.dmpFilesize
3.0MB
-
memory/1232-72-0x0000000000370000-0x0000000000384000-memory.dmpFilesize
80KB
-
memory/1232-69-0x00000000002A0000-0x00000000002B4000-memory.dmpFilesize
80KB
-
memory/1232-61-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1232-62-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1232-64-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1232-65-0x000000000041ECA0-mapping.dmp
-
memory/1232-67-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1308-54-0x00000000001F0000-0x0000000000256000-memory.dmpFilesize
408KB
-
memory/1308-56-0x0000000000280000-0x000000000028A000-memory.dmpFilesize
40KB
-
memory/1308-55-0x0000000075261000-0x0000000075263000-memory.dmpFilesize
8KB
-
memory/1308-58-0x00000000006A0000-0x00000000006D4000-memory.dmpFilesize
208KB
-
memory/1308-57-0x00000000003C0000-0x000000000041A000-memory.dmpFilesize
360KB
-
memory/1396-82-0x0000000006910000-0x0000000006A12000-memory.dmpFilesize
1.0MB
-
memory/1396-73-0x00000000072B0000-0x000000000744B000-memory.dmpFilesize
1.6MB
-
memory/1396-70-0x0000000007110000-0x00000000072AD000-memory.dmpFilesize
1.6MB
-
memory/1612-59-0x0000000000000000-mapping.dmp
-
memory/1708-74-0x0000000000000000-mapping.dmp
-
memory/1708-76-0x0000000074C41000-0x0000000074C43000-memory.dmpFilesize
8KB
-
memory/1708-77-0x0000000000C90000-0x0000000000F11000-memory.dmpFilesize
2.5MB
-
memory/1708-78-0x00000000000C0000-0x00000000000EE000-memory.dmpFilesize
184KB
-
memory/1708-80-0x0000000002320000-0x0000000002623000-memory.dmpFilesize
3.0MB
-
memory/1708-81-0x0000000000940000-0x00000000009D3000-memory.dmpFilesize
588KB