Analysis
-
max time kernel
150s -
max time network
185s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 11:37
Static task
static1
Behavioral task
behavioral1
Sample
order specifications.exe
Resource
win7-20220414-en
General
-
Target
order specifications.exe
-
Size
657KB
-
MD5
2c2b342897c2693632051bde77ef39a8
-
SHA1
f19572d227a440b36d202343b9a6ab20ada5f2b3
-
SHA256
2ca55ed1af922548fc6abdb7b49386a6d62edd7b6d5609d45f1c369de4fa9269
-
SHA512
e80f335bef303ebe49279e8035b14d71aaa5c6a79d0b058df5ed22ec5f9d02fe1e59cc0ddd56b1a2e89119b540a61bfcb18dcfef2c47c051a8cbc9d08319a127
Malware Config
Extracted
formbook
4.1
kvsz
okashyns.com
sbsgamedaejeon-two.com
drb77.com
top5dating.com
websprings.online
voizers.com
zenith.site
lahistoriade.com
qv85.com
armandonieto.com
priestvedic.com
jessandjeff.net
magic-desktop.com
jitaji.com
ldmeili.com
yuwanqingmy.com
buzhouorg.com
chaiseloungereviews.com
m2g8way.com
freespin-support.com
bocapvang.net
315px.com
eugeniobarros.tech
sif.email
xn--oorv2aj6bj7cds0d6p4b.com
polychips.com
grouptulip.win
landbank.site
bet365c.win
inbonz.com
outofthepark.today
jeaniney.com
weeip.com
dmoneylife.com
rticlubs.com
reisedating.com
marijuanadogbone.com
funippon.com
banknotesync.com
alexandre-boissard.com
valorartetattoo.com
savetheverse.com
specificpcshop.online
h0jt1y.accountant
jiqing3.com
alfaranakle.com
saft-store.com
wanderingcollective.com
santandermobi.online
557023.top
loulancaster.com
vedattelekom.com
jatinangorcity.com
goldencanaries.com
edgaralanbro.com
levelretail.com
taylorsandbek.com
upbeatnewyork.com
motoreselectricoschihuahua.com
hotair.wales
getawomantodoit.com
xiaoxiong365.com
cloudboxsupport.com
vecteur-u-shop.com
fex-tracks.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1164-64-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1164-65-0x000000000041ECA0-mapping.dmp formbook behavioral1/memory/1916-73-0x0000000000080000-0x00000000000AE000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
order specifications.exeRegSvcs.exesvchost.exedescription pid process target process PID 1704 set thread context of 1164 1704 order specifications.exe RegSvcs.exe PID 1164 set thread context of 1260 1164 RegSvcs.exe Explorer.EXE PID 1916 set thread context of 1260 1916 svchost.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
order specifications.exeRegSvcs.exesvchost.exepid process 1704 order specifications.exe 1164 RegSvcs.exe 1164 RegSvcs.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe 1916 svchost.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.exesvchost.exepid process 1164 RegSvcs.exe 1164 RegSvcs.exe 1164 RegSvcs.exe 1916 svchost.exe 1916 svchost.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
order specifications.exeRegSvcs.exesvchost.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1704 order specifications.exe Token: SeDebugPrivilege 1164 RegSvcs.exe Token: SeDebugPrivilege 1916 svchost.exe Token: SeShutdownPrivilege 1260 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1260 Explorer.EXE 1260 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1260 Explorer.EXE 1260 Explorer.EXE -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
order specifications.exeExplorer.EXEsvchost.exedescription pid process target process PID 1704 wrote to memory of 2044 1704 order specifications.exe schtasks.exe PID 1704 wrote to memory of 2044 1704 order specifications.exe schtasks.exe PID 1704 wrote to memory of 2044 1704 order specifications.exe schtasks.exe PID 1704 wrote to memory of 2044 1704 order specifications.exe schtasks.exe PID 1704 wrote to memory of 1164 1704 order specifications.exe RegSvcs.exe PID 1704 wrote to memory of 1164 1704 order specifications.exe RegSvcs.exe PID 1704 wrote to memory of 1164 1704 order specifications.exe RegSvcs.exe PID 1704 wrote to memory of 1164 1704 order specifications.exe RegSvcs.exe PID 1704 wrote to memory of 1164 1704 order specifications.exe RegSvcs.exe PID 1704 wrote to memory of 1164 1704 order specifications.exe RegSvcs.exe PID 1704 wrote to memory of 1164 1704 order specifications.exe RegSvcs.exe PID 1704 wrote to memory of 1164 1704 order specifications.exe RegSvcs.exe PID 1704 wrote to memory of 1164 1704 order specifications.exe RegSvcs.exe PID 1704 wrote to memory of 1164 1704 order specifications.exe RegSvcs.exe PID 1260 wrote to memory of 1916 1260 Explorer.EXE svchost.exe PID 1260 wrote to memory of 1916 1260 Explorer.EXE svchost.exe PID 1260 wrote to memory of 1916 1260 Explorer.EXE svchost.exe PID 1260 wrote to memory of 1916 1260 Explorer.EXE svchost.exe PID 1916 wrote to memory of 976 1916 svchost.exe cmd.exe PID 1916 wrote to memory of 976 1916 svchost.exe cmd.exe PID 1916 wrote to memory of 976 1916 svchost.exe cmd.exe PID 1916 wrote to memory of 976 1916 svchost.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\order specifications.exe"C:\Users\Admin\AppData\Local\Temp\order specifications.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OElfQVLpgn" /XML "C:\Users\Admin\AppData\Local\Temp\tmp95DA.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp95DA.tmpFilesize
1KB
MD5a082484f8ecbe1ba0848e56094f7265a
SHA1d1e8c079a4f996b0816c247cc499b04c6c432b3c
SHA25646736a56d0f17cb5e22458ff6e9195ada9983d7f8444b9c8d9fb3fbafcee90d2
SHA51243fb52b904ad8d62bcd33b6541a44193ab36c6837bd3dead79cd78be750b0bad405e351c5f7456335c4c35cad910452e19b37a3e1cf78cd056ed48d31b2a5622
-
memory/976-71-0x0000000000000000-mapping.dmp
-
memory/1164-65-0x000000000041ECA0-mapping.dmp
-
memory/1164-67-0x00000000008A0000-0x0000000000BA3000-memory.dmpFilesize
3.0MB
-
memory/1164-68-0x0000000000260000-0x0000000000274000-memory.dmpFilesize
80KB
-
memory/1164-64-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1164-62-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1164-61-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1260-76-0x0000000004B50000-0x0000000004C67000-memory.dmpFilesize
1.1MB
-
memory/1260-69-0x0000000004190000-0x0000000004292000-memory.dmpFilesize
1.0MB
-
memory/1704-55-0x0000000075781000-0x0000000075783000-memory.dmpFilesize
8KB
-
memory/1704-54-0x0000000000BF0000-0x0000000000C9A000-memory.dmpFilesize
680KB
-
memory/1704-57-0x00000000047A0000-0x0000000004810000-memory.dmpFilesize
448KB
-
memory/1704-58-0x00000000020A0000-0x00000000020E4000-memory.dmpFilesize
272KB
-
memory/1704-56-0x0000000000370000-0x0000000000380000-memory.dmpFilesize
64KB
-
memory/1916-70-0x0000000000000000-mapping.dmp
-
memory/1916-72-0x0000000000720000-0x0000000000728000-memory.dmpFilesize
32KB
-
memory/1916-73-0x0000000000080000-0x00000000000AE000-memory.dmpFilesize
184KB
-
memory/1916-74-0x0000000000730000-0x0000000000A33000-memory.dmpFilesize
3.0MB
-
memory/1916-75-0x00000000004B0000-0x0000000000543000-memory.dmpFilesize
588KB
-
memory/2044-59-0x0000000000000000-mapping.dmp