Analysis
-
max time kernel
191s -
max time network
206s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 11:17
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order-0096005.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Purchase Order-0096005.exe
Resource
win10v2004-20220414-en
General
-
Target
Purchase Order-0096005.exe
-
Size
574KB
-
MD5
e90d5fb481511c5d3c844529fe20ee00
-
SHA1
8f03158dbe6edd2a6fdbedbf860f5905030202e1
-
SHA256
89819dbac176147b14b878250b43d1954844e6f0d4bace8b4607bad4405ca96b
-
SHA512
dd1d22fe8b35bdf1c9cc1dfc926666b58e454425fcee33c2168a604a6c852b7137592b896e38cd35caeb1215b7073beb7e5e9aa6d53ff55e6eabcb69d6fb6ff7
Malware Config
Extracted
formbook
4.1
q5e
2177.ltd
thanxiety.com
max-width.com
fixti.net
mostmaj.com
mobilteknolojiuzmani.com
historyannals.com
wheelchairmotion.com
mossandmoonstonestudio.com
kastellifournis.com
axokey.net
peekl.com
metsteeshirt.com
abcfinancial-inc.com
btxrsp.com
amydh.com
ccoauthority.com
lumacorretora.com
kimfelixrealtor.com
iconext.biz
giftstgg.com
imonsanto.com
invoicefor.com
qfhxlw.com
wsykyy.com
gladius.network
peliculaslatino.online
timookflour.com
gxkuangjian.com
utvklj.men
rabota-v-avon.online
sheashealingway.com
thoitrangaoda.com
rytechweb.com
circuit69.com
crowd-design.biz
carosiandrhee.com
778d88.com
calvinkl.com
cjkit.com
jgkwhgxe.com
sanitascuadromedico.com
mellorangello.com
whiteinnocence.com
medtechdesignstudio.net
nurturingskin.com
guardyourweb.net
juw2017.com
jnheroes.com
damicosoftwaresystems.com
gesband.com
onwardsandupwards.info
gopropackaging.com
centerforaunts.com
sarrahshewdesign.com
intelligentcoach.net
iasisf.agency
products-news.com
calvinspring.com
100zan.site
9mahina.com
saleaustralianboots.com
floatinginfotech.com
calcinoneweek.com
yofdyk.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2028-62-0x000000000041E2A0-mapping.dmp formbook behavioral1/memory/2028-61-0x0000000000400000-0x000000000042D000-memory.dmp formbook behavioral1/memory/2028-64-0x0000000000400000-0x000000000042D000-memory.dmp formbook behavioral1/memory/1868-72-0x0000000000080000-0x00000000000AD000-memory.dmp formbook -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
control.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run control.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\JR8XNT2HKTE = "C:\\Program Files (x86)\\Kt4b8_r50\\winubr.exe" control.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1820 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Purchase Order-0096005.exePurchase Order-0096005.execontrol.exedescription pid process target process PID 972 set thread context of 2028 972 Purchase Order-0096005.exe Purchase Order-0096005.exe PID 2028 set thread context of 1220 2028 Purchase Order-0096005.exe Explorer.EXE PID 1868 set thread context of 1220 1868 control.exe Explorer.EXE -
Drops file in Program Files directory 1 IoCs
Processes:
control.exedescription ioc process File opened for modification C:\Program Files (x86)\Kt4b8_r50\winubr.exe control.exe -
Processes:
control.exedescription ioc process Key created \Registry\User\S-1-5-21-1083475884-596052423-1669053738-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 control.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
Purchase Order-0096005.exePurchase Order-0096005.execontrol.exepid process 972 Purchase Order-0096005.exe 972 Purchase Order-0096005.exe 972 Purchase Order-0096005.exe 2028 Purchase Order-0096005.exe 2028 Purchase Order-0096005.exe 1868 control.exe 1868 control.exe 1868 control.exe 1868 control.exe 1868 control.exe 1868 control.exe 1868 control.exe 1868 control.exe 1868 control.exe 1868 control.exe 1868 control.exe 1868 control.exe 1868 control.exe 1868 control.exe 1868 control.exe 1868 control.exe 1868 control.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
Purchase Order-0096005.execontrol.exepid process 2028 Purchase Order-0096005.exe 2028 Purchase Order-0096005.exe 2028 Purchase Order-0096005.exe 1868 control.exe 1868 control.exe 1868 control.exe 1868 control.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
Purchase Order-0096005.exePurchase Order-0096005.execontrol.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 972 Purchase Order-0096005.exe Token: SeDebugPrivilege 2028 Purchase Order-0096005.exe Token: SeDebugPrivilege 1868 control.exe Token: SeShutdownPrivilege 1220 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1220 Explorer.EXE 1220 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1220 Explorer.EXE 1220 Explorer.EXE -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
Purchase Order-0096005.exeExplorer.EXEcontrol.exedescription pid process target process PID 972 wrote to memory of 2028 972 Purchase Order-0096005.exe Purchase Order-0096005.exe PID 972 wrote to memory of 2028 972 Purchase Order-0096005.exe Purchase Order-0096005.exe PID 972 wrote to memory of 2028 972 Purchase Order-0096005.exe Purchase Order-0096005.exe PID 972 wrote to memory of 2028 972 Purchase Order-0096005.exe Purchase Order-0096005.exe PID 972 wrote to memory of 2028 972 Purchase Order-0096005.exe Purchase Order-0096005.exe PID 972 wrote to memory of 2028 972 Purchase Order-0096005.exe Purchase Order-0096005.exe PID 972 wrote to memory of 2028 972 Purchase Order-0096005.exe Purchase Order-0096005.exe PID 1220 wrote to memory of 1868 1220 Explorer.EXE control.exe PID 1220 wrote to memory of 1868 1220 Explorer.EXE control.exe PID 1220 wrote to memory of 1868 1220 Explorer.EXE control.exe PID 1220 wrote to memory of 1868 1220 Explorer.EXE control.exe PID 1868 wrote to memory of 1820 1868 control.exe cmd.exe PID 1868 wrote to memory of 1820 1868 control.exe cmd.exe PID 1868 wrote to memory of 1820 1868 control.exe cmd.exe PID 1868 wrote to memory of 1820 1868 control.exe cmd.exe PID 1868 wrote to memory of 760 1868 control.exe Firefox.exe PID 1868 wrote to memory of 760 1868 control.exe Firefox.exe PID 1868 wrote to memory of 760 1868 control.exe Firefox.exe PID 1868 wrote to memory of 760 1868 control.exe Firefox.exe PID 1868 wrote to memory of 760 1868 control.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order-0096005.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order-0096005.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order-0096005.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Adds policy Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Purchase Order-0096005.exe"3⤵
- Deletes itself
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\17MAR21T\17Mlogim.jpegFilesize
56KB
MD5ba92adf8e2d9aec97a43bb9eaccf5ef4
SHA1f4f00681ed840885ba553194419fcf46a79376cb
SHA256bcd47554e495f06fb5164c9ddc06069fc83e9f12e06f5f66b938628a613f8e55
SHA512f21ef4389a0be361694111151c3384e73116b6e734db062ffe23acf0309b9b341963d6fcedaf5ecf2f238f7737dfae00c75db5624b15388bd7695e554a04c157
-
C:\Users\Admin\AppData\Roaming\17MAR21T\17Mlogri.iniFilesize
40B
MD5d63a82e5d81e02e399090af26db0b9cb
SHA191d0014c8f54743bba141fd60c9d963f869d76c9
SHA256eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae
SHA51238afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad
-
C:\Users\Admin\AppData\Roaming\17MAR21T\17Mlogrv.iniFilesize
40B
MD5ba3b6bc807d4f76794c4b81b09bb9ba5
SHA124cb89501f0212ff3095ecc0aba97dd563718fb1
SHA2566eebf968962745b2e9de2ca969af7c424916d4e3fe3cc0bb9b3d414abfce9507
SHA512ecd07e601fc9e3cfc39addd7bd6f3d7f7ff3253afb40bf536e9eaac5a4c243e5ec40fbfd7b216cb0ea29f2517419601e335e33ba19dea4a46f65e38694d465bf
-
memory/972-55-0x0000000000200000-0x0000000000208000-memory.dmpFilesize
32KB
-
memory/972-56-0x0000000000D00000-0x0000000000D66000-memory.dmpFilesize
408KB
-
memory/972-57-0x0000000000670000-0x00000000006AE000-memory.dmpFilesize
248KB
-
memory/972-54-0x00000000012B0000-0x0000000001344000-memory.dmpFilesize
592KB
-
memory/1220-75-0x0000000004CE0000-0x0000000004E08000-memory.dmpFilesize
1.2MB
-
memory/1220-67-0x0000000004020000-0x00000000040E2000-memory.dmpFilesize
776KB
-
memory/1820-70-0x0000000000000000-mapping.dmp
-
memory/1868-72-0x0000000000080000-0x00000000000AD000-memory.dmpFilesize
180KB
-
memory/1868-74-0x00000000009B0000-0x0000000000A43000-memory.dmpFilesize
588KB
-
memory/1868-73-0x00000000020A0000-0x00000000023A3000-memory.dmpFilesize
3.0MB
-
memory/1868-68-0x0000000000000000-mapping.dmp
-
memory/1868-69-0x00000000764C1000-0x00000000764C3000-memory.dmpFilesize
8KB
-
memory/1868-71-0x0000000000C80000-0x0000000000C9F000-memory.dmpFilesize
124KB
-
memory/2028-59-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/2028-66-0x0000000000180000-0x0000000000194000-memory.dmpFilesize
80KB
-
memory/2028-65-0x0000000000870000-0x0000000000B73000-memory.dmpFilesize
3.0MB
-
memory/2028-64-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/2028-61-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/2028-62-0x000000000041E2A0-mapping.dmp
-
memory/2028-58-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB