Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 23:50
Static task
static1
Behavioral task
behavioral1
Sample
orden de compra.exe
Resource
win7-20220414-en
General
-
Target
orden de compra.exe
-
Size
385KB
-
MD5
e496718a8033ca85b0a6ff3ea197828c
-
SHA1
6e150649bd44e3c8023589eaadd2633b09a14d81
-
SHA256
bc207dbe79daf9a2da67fd90beef3fbe5db670288fd9c1da72ccda9c65d3d028
-
SHA512
05b483ec56adef219d6e273d9b1882898121d1d3d0c3df1b87f384a2583cf4ff8189f07608f1ee4a3e6152a175dda6de1fc1bffd85071b91626ea9b2c00c6831
Malware Config
Extracted
formbook
4.1
kvsz
okashyns.com
sbsgamedaejeon-two.com
drb77.com
top5dating.com
websprings.online
voizers.com
zenith.site
lahistoriade.com
qv85.com
armandonieto.com
priestvedic.com
jessandjeff.net
magic-desktop.com
jitaji.com
ldmeili.com
yuwanqingmy.com
buzhouorg.com
chaiseloungereviews.com
m2g8way.com
freespin-support.com
bocapvang.net
315px.com
eugeniobarros.tech
sif.email
xn--oorv2aj6bj7cds0d6p4b.com
polychips.com
grouptulip.win
landbank.site
bet365c.win
inbonz.com
outofthepark.today
jeaniney.com
weeip.com
dmoneylife.com
rticlubs.com
reisedating.com
marijuanadogbone.com
funippon.com
banknotesync.com
alexandre-boissard.com
valorartetattoo.com
savetheverse.com
specificpcshop.online
h0jt1y.accountant
jiqing3.com
alfaranakle.com
saft-store.com
wanderingcollective.com
santandermobi.online
557023.top
loulancaster.com
vedattelekom.com
jatinangorcity.com
goldencanaries.com
edgaralanbro.com
levelretail.com
taylorsandbek.com
upbeatnewyork.com
motoreselectricoschihuahua.com
hotair.wales
getawomantodoit.com
xiaoxiong365.com
cloudboxsupport.com
vecteur-u-shop.com
fex-tracks.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/568-64-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/568-65-0x000000000041ECA0-mapping.dmp formbook behavioral1/memory/568-67-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1932-77-0x00000000000C0000-0x00000000000EE000-memory.dmp formbook -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
cmmon32.exedescription ioc process Key created \Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run cmmon32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DRMPANTPOL = "C:\\Program Files (x86)\\Mmrwlrv_\\ThumbCachejpmxv4sh.exe" cmmon32.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
orden de compra.exeRegSvcs.execmmon32.exedescription pid process target process PID 1392 set thread context of 568 1392 orden de compra.exe RegSvcs.exe PID 568 set thread context of 1312 568 RegSvcs.exe Explorer.EXE PID 568 set thread context of 1312 568 RegSvcs.exe Explorer.EXE PID 1932 set thread context of 1312 1932 cmmon32.exe Explorer.EXE -
Drops file in Program Files directory 1 IoCs
Processes:
cmmon32.exedescription ioc process File opened for modification C:\Program Files (x86)\Mmrwlrv_\ThumbCachejpmxv4sh.exe cmmon32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Processes:
cmmon32.exedescription ioc process Key created \Registry\User\S-1-5-21-1083475884-596052423-1669053738-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 cmmon32.exe -
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
orden de compra.exeRegSvcs.execmmon32.exepid process 1392 orden de compra.exe 1392 orden de compra.exe 1392 orden de compra.exe 568 RegSvcs.exe 568 RegSvcs.exe 568 RegSvcs.exe 1932 cmmon32.exe 1932 cmmon32.exe 1932 cmmon32.exe 1932 cmmon32.exe 1932 cmmon32.exe 1932 cmmon32.exe 1932 cmmon32.exe 1932 cmmon32.exe 1932 cmmon32.exe 1932 cmmon32.exe 1932 cmmon32.exe 1932 cmmon32.exe 1932 cmmon32.exe 1932 cmmon32.exe 1932 cmmon32.exe -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
RegSvcs.execmmon32.exepid process 568 RegSvcs.exe 568 RegSvcs.exe 568 RegSvcs.exe 568 RegSvcs.exe 1932 cmmon32.exe 1932 cmmon32.exe 1932 cmmon32.exe 1932 cmmon32.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
orden de compra.exeRegSvcs.execmmon32.exedescription pid process Token: SeDebugPrivilege 1392 orden de compra.exe Token: SeDebugPrivilege 568 RegSvcs.exe Token: SeDebugPrivilege 1932 cmmon32.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1312 Explorer.EXE 1312 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1312 Explorer.EXE 1312 Explorer.EXE -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
orden de compra.exeExplorer.EXEcmmon32.exedescription pid process target process PID 1392 wrote to memory of 952 1392 orden de compra.exe schtasks.exe PID 1392 wrote to memory of 952 1392 orden de compra.exe schtasks.exe PID 1392 wrote to memory of 952 1392 orden de compra.exe schtasks.exe PID 1392 wrote to memory of 952 1392 orden de compra.exe schtasks.exe PID 1392 wrote to memory of 568 1392 orden de compra.exe RegSvcs.exe PID 1392 wrote to memory of 568 1392 orden de compra.exe RegSvcs.exe PID 1392 wrote to memory of 568 1392 orden de compra.exe RegSvcs.exe PID 1392 wrote to memory of 568 1392 orden de compra.exe RegSvcs.exe PID 1392 wrote to memory of 568 1392 orden de compra.exe RegSvcs.exe PID 1392 wrote to memory of 568 1392 orden de compra.exe RegSvcs.exe PID 1392 wrote to memory of 568 1392 orden de compra.exe RegSvcs.exe PID 1392 wrote to memory of 568 1392 orden de compra.exe RegSvcs.exe PID 1392 wrote to memory of 568 1392 orden de compra.exe RegSvcs.exe PID 1392 wrote to memory of 568 1392 orden de compra.exe RegSvcs.exe PID 1312 wrote to memory of 1932 1312 Explorer.EXE cmmon32.exe PID 1312 wrote to memory of 1932 1312 Explorer.EXE cmmon32.exe PID 1312 wrote to memory of 1932 1312 Explorer.EXE cmmon32.exe PID 1312 wrote to memory of 1932 1312 Explorer.EXE cmmon32.exe PID 1932 wrote to memory of 1148 1932 cmmon32.exe cmd.exe PID 1932 wrote to memory of 1148 1932 cmmon32.exe cmd.exe PID 1932 wrote to memory of 1148 1932 cmmon32.exe cmd.exe PID 1932 wrote to memory of 1148 1932 cmmon32.exe cmd.exe PID 1932 wrote to memory of 916 1932 cmmon32.exe Firefox.exe PID 1932 wrote to memory of 916 1932 cmmon32.exe Firefox.exe PID 1932 wrote to memory of 916 1932 cmmon32.exe Firefox.exe PID 1932 wrote to memory of 916 1932 cmmon32.exe Firefox.exe PID 1932 wrote to memory of 916 1932 cmmon32.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\orden de compra.exe"C:\Users\Admin\AppData\Local\Temp\orden de compra.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\zDhkri" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEC82.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpEC82.tmpFilesize
1KB
MD578ceb1a128488195b028f6cec19d9d73
SHA185ca5e4311620e3656378214cd16138fd40c2389
SHA25648aa41a07af7794fd8a2724ea4d94dedc78bb6957abcca3f8a22987ae9fcd61c
SHA512f23b6221e393724efd0f74a3afd0b54646eb700a0e211c8299422f50229a16779308109d91d871ef246cd4894c8c242753cdc8373e4c9746aa6edf899e0600bc
-
memory/568-68-0x00000000008D0000-0x0000000000BD3000-memory.dmpFilesize
3.0MB
-
memory/568-65-0x000000000041ECA0-mapping.dmp
-
memory/568-67-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/568-72-0x00000000001F0000-0x0000000000204000-memory.dmpFilesize
80KB
-
memory/568-61-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/568-62-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/568-64-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/568-69-0x0000000000190000-0x00000000001A4000-memory.dmpFilesize
80KB
-
memory/952-59-0x0000000000000000-mapping.dmp
-
memory/1148-75-0x0000000000000000-mapping.dmp
-
memory/1312-80-0x0000000003D60000-0x0000000003E20000-memory.dmpFilesize
768KB
-
memory/1312-70-0x0000000006210000-0x0000000006301000-memory.dmpFilesize
964KB
-
memory/1312-73-0x0000000006310000-0x0000000006402000-memory.dmpFilesize
968KB
-
memory/1392-56-0x0000000000310000-0x000000000031A000-memory.dmpFilesize
40KB
-
memory/1392-57-0x0000000000650000-0x00000000006A8000-memory.dmpFilesize
352KB
-
memory/1392-55-0x0000000075951000-0x0000000075953000-memory.dmpFilesize
8KB
-
memory/1392-58-0x0000000000420000-0x0000000000454000-memory.dmpFilesize
208KB
-
memory/1392-54-0x0000000000C10000-0x0000000000C76000-memory.dmpFilesize
408KB
-
memory/1932-74-0x0000000000000000-mapping.dmp
-
memory/1932-77-0x00000000000C0000-0x00000000000EE000-memory.dmpFilesize
184KB
-
memory/1932-76-0x0000000000310000-0x000000000031D000-memory.dmpFilesize
52KB
-
memory/1932-78-0x0000000001FC0000-0x00000000022C3000-memory.dmpFilesize
3.0MB
-
memory/1932-79-0x0000000000880000-0x0000000000913000-memory.dmpFilesize
588KB