Analysis
-
max time kernel
147s -
max time network
176s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 03:18
Static task
static1
Behavioral task
behavioral1
Sample
ORDER INQUIRY.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
ORDER INQUIRY.exe
Resource
win10v2004-20220414-en
General
-
Target
ORDER INQUIRY.exe
-
Size
279KB
-
MD5
6bd95e18dbd55ab2bb32d2bdef0c88e6
-
SHA1
5fb95f1577c4d4c810a2a663db4a87704031126e
-
SHA256
27379cbd39dae5d145ff292ffd71387a5508bba83997177272742b486cb4e662
-
SHA512
483301dd5b6198feab4dbaf0b17039a7b99e423a0c2eeaff609a1973d9b66cb3f22c1afab28769fb9a4530a2e3bb5b19ab3b2a62233807630db3ec6ffcb4fb32
Malware Config
Extracted
formbook
3.9
20w
cofounder.technology
mrbajaf.com
xn--w9s874cfjq5fk.com
haliciogluhali.net
vanessadunfordhere.com
lookguy.win
91javac.com
goldennd.com
nwatheeliteteam.net
tumpukganda.com
clarservicios.com
koghana.com
workingwithroland.com
yellowsocialbox.com
under-dawg.com
sdtjtzyz.com
banditaerialproductions.com
newssmog.com
tefnmp.men
rebelialabel.com
shubhankarthinks.com
weldlngwarehouseinc.com
cxwlkjgs.com
sfbtadvertising.com
just-climb-it.com
abigailstales.net
erreapeworld.com
ujoi0cb3td.com
adhitshet.com
loi-mezard-invest.com
shimanami-guesthouse.com
5bu3.com
koszr.info
shopgoperinnovation.com
matthiasdittert.com
stiffeducation.com
projectoverflowinc.com
v5rayp.club
dqklfr.info
jacobsonfordl.com
chicagobps.biz
bsateenalsharq.com
238bifa.com
kairui.ink
lai2151.com
simplysavvysolutions.com
watertable.win
robotica.tech
avggrfx.com
teleportcafe.com
712roofing.com
07hosting.com
quiltlux.com
implantcyrkonowy.com
gnbaccelerator.com
negusangel.com
best1caratdiamondrings.com
elizabethlampertpr.net
pinpointlocalsacramento.com
skinstradesarea.com
morganhelps.com
divarium.com
njswd.com
bfmjgame.com
nyoxibwer.com
Signatures
-
CoreEntity .NET Packer 1 IoCs
A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
Processes:
resource yara_rule behavioral1/memory/1792-56-0x00000000002C0000-0x00000000002C8000-memory.dmp coreentity -
Formbook Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/620-63-0x0000000000400000-0x000000000042A000-memory.dmp formbook behavioral1/memory/620-64-0x000000000041B680-mapping.dmp formbook behavioral1/memory/620-66-0x0000000000400000-0x000000000042A000-memory.dmp formbook behavioral1/memory/872-77-0x00000000000C0000-0x00000000000EA000-memory.dmp formbook -
ReZer0 packer 1 IoCs
Detects ReZer0, a packer with multiple versions used in various campaigns.
Processes:
resource yara_rule behavioral1/memory/1792-57-0x0000000004780000-0x00000000047B8000-memory.dmp rezer0 -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 4 IoCs
Processes:
ORDER INQUIRY.exevbc.exemstsc.exedescription pid process target process PID 1792 set thread context of 620 1792 ORDER INQUIRY.exe vbc.exe PID 620 set thread context of 1204 620 vbc.exe Explorer.EXE PID 620 set thread context of 1204 620 vbc.exe Explorer.EXE PID 872 set thread context of 1204 872 mstsc.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 25 IoCs
Processes:
ORDER INQUIRY.exevbc.exemstsc.exepid process 1792 ORDER INQUIRY.exe 1792 ORDER INQUIRY.exe 1792 ORDER INQUIRY.exe 1792 ORDER INQUIRY.exe 1792 ORDER INQUIRY.exe 1792 ORDER INQUIRY.exe 620 vbc.exe 620 vbc.exe 620 vbc.exe 872 mstsc.exe 872 mstsc.exe 872 mstsc.exe 872 mstsc.exe 872 mstsc.exe 872 mstsc.exe 872 mstsc.exe 872 mstsc.exe 872 mstsc.exe 872 mstsc.exe 872 mstsc.exe 872 mstsc.exe 872 mstsc.exe 872 mstsc.exe 872 mstsc.exe 872 mstsc.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
vbc.exemstsc.exepid process 620 vbc.exe 620 vbc.exe 620 vbc.exe 620 vbc.exe 872 mstsc.exe 872 mstsc.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
ORDER INQUIRY.exevbc.exemstsc.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1792 ORDER INQUIRY.exe Token: SeDebugPrivilege 620 vbc.exe Token: SeDebugPrivilege 872 mstsc.exe Token: SeShutdownPrivilege 1204 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1204 Explorer.EXE 1204 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1204 Explorer.EXE 1204 Explorer.EXE -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
ORDER INQUIRY.exeExplorer.EXEmstsc.exedescription pid process target process PID 1792 wrote to memory of 1316 1792 ORDER INQUIRY.exe schtasks.exe PID 1792 wrote to memory of 1316 1792 ORDER INQUIRY.exe schtasks.exe PID 1792 wrote to memory of 1316 1792 ORDER INQUIRY.exe schtasks.exe PID 1792 wrote to memory of 1316 1792 ORDER INQUIRY.exe schtasks.exe PID 1792 wrote to memory of 1700 1792 ORDER INQUIRY.exe vbc.exe PID 1792 wrote to memory of 1700 1792 ORDER INQUIRY.exe vbc.exe PID 1792 wrote to memory of 1700 1792 ORDER INQUIRY.exe vbc.exe PID 1792 wrote to memory of 1700 1792 ORDER INQUIRY.exe vbc.exe PID 1792 wrote to memory of 1980 1792 ORDER INQUIRY.exe vbc.exe PID 1792 wrote to memory of 1980 1792 ORDER INQUIRY.exe vbc.exe PID 1792 wrote to memory of 1980 1792 ORDER INQUIRY.exe vbc.exe PID 1792 wrote to memory of 1980 1792 ORDER INQUIRY.exe vbc.exe PID 1792 wrote to memory of 1768 1792 ORDER INQUIRY.exe vbc.exe PID 1792 wrote to memory of 1768 1792 ORDER INQUIRY.exe vbc.exe PID 1792 wrote to memory of 1768 1792 ORDER INQUIRY.exe vbc.exe PID 1792 wrote to memory of 1768 1792 ORDER INQUIRY.exe vbc.exe PID 1792 wrote to memory of 620 1792 ORDER INQUIRY.exe vbc.exe PID 1792 wrote to memory of 620 1792 ORDER INQUIRY.exe vbc.exe PID 1792 wrote to memory of 620 1792 ORDER INQUIRY.exe vbc.exe PID 1792 wrote to memory of 620 1792 ORDER INQUIRY.exe vbc.exe PID 1792 wrote to memory of 620 1792 ORDER INQUIRY.exe vbc.exe PID 1792 wrote to memory of 620 1792 ORDER INQUIRY.exe vbc.exe PID 1792 wrote to memory of 620 1792 ORDER INQUIRY.exe vbc.exe PID 1204 wrote to memory of 872 1204 Explorer.EXE mstsc.exe PID 1204 wrote to memory of 872 1204 Explorer.EXE mstsc.exe PID 1204 wrote to memory of 872 1204 Explorer.EXE mstsc.exe PID 1204 wrote to memory of 872 1204 Explorer.EXE mstsc.exe PID 872 wrote to memory of 1696 872 mstsc.exe cmd.exe PID 872 wrote to memory of 1696 872 mstsc.exe cmd.exe PID 872 wrote to memory of 1696 872 mstsc.exe cmd.exe PID 872 wrote to memory of 1696 872 mstsc.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ORDER INQUIRY.exe"C:\Users\Admin\AppData\Local\Temp\ORDER INQUIRY.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rsYfak" /XML "C:\Users\Admin\AppData\Local\Temp\tmp70FC.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"{path}"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"{path}"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"{path}"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp70FC.tmpFilesize
1KB
MD58609d968e92eeed74b1893b68da12980
SHA1d1fc2daf37ca5036567259c4711ebf5a70b6b6f7
SHA2561dfefec3f589e5bd44b616b6359745d53bf21437955ecbd6de3ad2713dd6d5de
SHA512706ab49b96ff0cc570e73741ce813504fc3be18b28c48ff5b7d05787ae3e0d219546d4f574b8f493ce6b72a44bccec93c2c842b8d603c17c792ce42400a644b8
-
memory/620-66-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/620-71-0x00000000002D0000-0x00000000002E4000-memory.dmpFilesize
80KB
-
memory/620-67-0x0000000000910000-0x0000000000C13000-memory.dmpFilesize
3.0MB
-
memory/620-64-0x000000000041B680-mapping.dmp
-
memory/620-68-0x0000000000180000-0x0000000000194000-memory.dmpFilesize
80KB
-
memory/620-60-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/620-61-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/620-63-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/872-79-0x0000000001F90000-0x0000000002023000-memory.dmpFilesize
588KB
-
memory/872-78-0x0000000002180000-0x0000000002483000-memory.dmpFilesize
3.0MB
-
memory/872-76-0x0000000000710000-0x0000000000814000-memory.dmpFilesize
1.0MB
-
memory/872-73-0x0000000000000000-mapping.dmp
-
memory/872-77-0x00000000000C0000-0x00000000000EA000-memory.dmpFilesize
168KB
-
memory/1204-69-0x0000000002A50000-0x0000000002B46000-memory.dmpFilesize
984KB
-
memory/1204-80-0x0000000006EF0000-0x0000000007044000-memory.dmpFilesize
1.3MB
-
memory/1204-72-0x00000000068D0000-0x0000000006A4D000-memory.dmpFilesize
1.5MB
-
memory/1316-58-0x0000000000000000-mapping.dmp
-
memory/1696-75-0x0000000000000000-mapping.dmp
-
memory/1792-56-0x00000000002C0000-0x00000000002C8000-memory.dmpFilesize
32KB
-
memory/1792-57-0x0000000004780000-0x00000000047B8000-memory.dmpFilesize
224KB
-
memory/1792-54-0x0000000000220000-0x000000000026C000-memory.dmpFilesize
304KB
-
memory/1792-55-0x0000000076461000-0x0000000076463000-memory.dmpFilesize
8KB