Analysis
-
max time kernel
147s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 00:30
Static task
static1
Behavioral task
behavioral1
Sample
yeni sipari?.exe
Resource
win7-20220414-en
General
-
Target
yeni sipari?.exe
-
Size
648KB
-
MD5
9db7619bc23ec15cc6863948515acc4e
-
SHA1
90e5b2e78d2bcc1f6d78ff9bfd9e1ca16b94c605
-
SHA256
c2100ac52466885fcb64010897d0c7a4178a5c00c47e13261f66976b38f26aaf
-
SHA512
6676f9434bc4e2f2fe3e256a328554162020e156c576b63eaa7ec2f79f834ecf967610c1dace77f1931f0fd2110aafff656eabe20a76bda8b610e06cbe27cf62
Malware Config
Extracted
formbook
4.1
kvsz
okashyns.com
sbsgamedaejeon-two.com
drb77.com
top5dating.com
websprings.online
voizers.com
zenith.site
lahistoriade.com
qv85.com
armandonieto.com
priestvedic.com
jessandjeff.net
magic-desktop.com
jitaji.com
ldmeili.com
yuwanqingmy.com
buzhouorg.com
chaiseloungereviews.com
m2g8way.com
freespin-support.com
bocapvang.net
315px.com
eugeniobarros.tech
sif.email
xn--oorv2aj6bj7cds0d6p4b.com
polychips.com
grouptulip.win
landbank.site
bet365c.win
inbonz.com
outofthepark.today
jeaniney.com
weeip.com
dmoneylife.com
rticlubs.com
reisedating.com
marijuanadogbone.com
funippon.com
banknotesync.com
alexandre-boissard.com
valorartetattoo.com
savetheverse.com
specificpcshop.online
h0jt1y.accountant
jiqing3.com
alfaranakle.com
saft-store.com
wanderingcollective.com
santandermobi.online
557023.top
loulancaster.com
vedattelekom.com
jatinangorcity.com
goldencanaries.com
edgaralanbro.com
levelretail.com
taylorsandbek.com
upbeatnewyork.com
motoreselectricoschihuahua.com
hotair.wales
getawomantodoit.com
xiaoxiong365.com
cloudboxsupport.com
vecteur-u-shop.com
fex-tracks.com
Signatures
-
Formbook Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1284-64-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1284-65-0x000000000041ECA0-mapping.dmp formbook behavioral1/memory/1284-67-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1456-77-0x00000000000D0000-0x00000000000FE000-memory.dmp formbook -
Suspicious use of SetThreadContext 4 IoCs
Processes:
yeni sipari_.exeRegSvcs.execmmon32.exedescription pid process target process PID 1000 set thread context of 1284 1000 yeni sipari_.exe RegSvcs.exe PID 1284 set thread context of 1364 1284 RegSvcs.exe Explorer.EXE PID 1284 set thread context of 1364 1284 RegSvcs.exe Explorer.EXE PID 1456 set thread context of 1364 1456 cmmon32.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
yeni sipari_.exeRegSvcs.execmmon32.exepid process 1000 yeni sipari_.exe 1000 yeni sipari_.exe 1000 yeni sipari_.exe 1000 yeni sipari_.exe 1000 yeni sipari_.exe 1284 RegSvcs.exe 1284 RegSvcs.exe 1284 RegSvcs.exe 1456 cmmon32.exe 1456 cmmon32.exe 1456 cmmon32.exe 1456 cmmon32.exe 1456 cmmon32.exe 1456 cmmon32.exe 1456 cmmon32.exe 1456 cmmon32.exe 1456 cmmon32.exe 1456 cmmon32.exe 1456 cmmon32.exe 1456 cmmon32.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
RegSvcs.execmmon32.exepid process 1284 RegSvcs.exe 1284 RegSvcs.exe 1284 RegSvcs.exe 1284 RegSvcs.exe 1456 cmmon32.exe 1456 cmmon32.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
yeni sipari_.exeRegSvcs.execmmon32.exedescription pid process Token: SeDebugPrivilege 1000 yeni sipari_.exe Token: SeDebugPrivilege 1284 RegSvcs.exe Token: SeDebugPrivilege 1456 cmmon32.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1364 Explorer.EXE 1364 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1364 Explorer.EXE 1364 Explorer.EXE -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
yeni sipari_.exeExplorer.EXEcmmon32.exedescription pid process target process PID 1000 wrote to memory of 1396 1000 yeni sipari_.exe schtasks.exe PID 1000 wrote to memory of 1396 1000 yeni sipari_.exe schtasks.exe PID 1000 wrote to memory of 1396 1000 yeni sipari_.exe schtasks.exe PID 1000 wrote to memory of 1396 1000 yeni sipari_.exe schtasks.exe PID 1000 wrote to memory of 1284 1000 yeni sipari_.exe RegSvcs.exe PID 1000 wrote to memory of 1284 1000 yeni sipari_.exe RegSvcs.exe PID 1000 wrote to memory of 1284 1000 yeni sipari_.exe RegSvcs.exe PID 1000 wrote to memory of 1284 1000 yeni sipari_.exe RegSvcs.exe PID 1000 wrote to memory of 1284 1000 yeni sipari_.exe RegSvcs.exe PID 1000 wrote to memory of 1284 1000 yeni sipari_.exe RegSvcs.exe PID 1000 wrote to memory of 1284 1000 yeni sipari_.exe RegSvcs.exe PID 1000 wrote to memory of 1284 1000 yeni sipari_.exe RegSvcs.exe PID 1000 wrote to memory of 1284 1000 yeni sipari_.exe RegSvcs.exe PID 1000 wrote to memory of 1284 1000 yeni sipari_.exe RegSvcs.exe PID 1364 wrote to memory of 1456 1364 Explorer.EXE cmmon32.exe PID 1364 wrote to memory of 1456 1364 Explorer.EXE cmmon32.exe PID 1364 wrote to memory of 1456 1364 Explorer.EXE cmmon32.exe PID 1364 wrote to memory of 1456 1364 Explorer.EXE cmmon32.exe PID 1456 wrote to memory of 1656 1456 cmmon32.exe cmd.exe PID 1456 wrote to memory of 1656 1456 cmmon32.exe cmd.exe PID 1456 wrote to memory of 1656 1456 cmmon32.exe cmd.exe PID 1456 wrote to memory of 1656 1456 cmmon32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\yeni sipari_.exe"C:\Users\Admin\AppData\Local\Temp\yeni sipari_.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\&startupname&" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4A98.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp4A98.tmpFilesize
1KB
MD5d9b3fb55144055bf53049ae44e24a2b4
SHA1e01d7cbee7c35cac28b467f84e92b7a48d32d61e
SHA2567b950a718804352c3350d97782b2db4cd0e4fa78d1fded8b7f56edfa9df4a437
SHA512001c56ee85bf76eb22969026c4ddd0f784052c37144642d8124b4fe0db1893bba55b2f5c4739a5a8cb54cdab5b1ea37ad830b34c429fdac0b8f93a4d5acc052c
-
memory/1000-55-0x0000000075F21000-0x0000000075F23000-memory.dmpFilesize
8KB
-
memory/1000-56-0x00000000003E0000-0x00000000003EA000-memory.dmpFilesize
40KB
-
memory/1000-57-0x0000000004F30000-0x0000000004F98000-memory.dmpFilesize
416KB
-
memory/1000-58-0x0000000000AC0000-0x0000000000AFE000-memory.dmpFilesize
248KB
-
memory/1000-54-0x00000000010C0000-0x0000000001168000-memory.dmpFilesize
672KB
-
memory/1284-68-0x0000000000A50000-0x0000000000D53000-memory.dmpFilesize
3.0MB
-
memory/1284-72-0x0000000000370000-0x0000000000384000-memory.dmpFilesize
80KB
-
memory/1284-62-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1284-64-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1284-65-0x000000000041ECA0-mapping.dmp
-
memory/1284-67-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1284-61-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1284-69-0x00000000002B0000-0x00000000002C4000-memory.dmpFilesize
80KB
-
memory/1364-70-0x0000000004CA0000-0x0000000004D67000-memory.dmpFilesize
796KB
-
memory/1364-73-0x0000000004F70000-0x0000000005045000-memory.dmpFilesize
852KB
-
memory/1364-80-0x0000000006B60000-0x0000000006CD7000-memory.dmpFilesize
1.5MB
-
memory/1396-59-0x0000000000000000-mapping.dmp
-
memory/1456-74-0x0000000000000000-mapping.dmp
-
memory/1456-76-0x0000000000980000-0x000000000098D000-memory.dmpFilesize
52KB
-
memory/1456-77-0x00000000000D0000-0x00000000000FE000-memory.dmpFilesize
184KB
-
memory/1456-78-0x0000000001F20000-0x0000000002223000-memory.dmpFilesize
3.0MB
-
memory/1456-79-0x0000000000860000-0x00000000008F3000-memory.dmpFilesize
588KB
-
memory/1656-75-0x0000000000000000-mapping.dmp