Analysis
-
max time kernel
149s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 18:54
Static task
static1
Behavioral task
behavioral1
Sample
New order.exe
Resource
win7-20220414-en
General
-
Target
New order.exe
-
Size
268KB
-
MD5
77fbec0f83df3e347cd28c4c3c18a926
-
SHA1
908709218882a96882ced2a71556740017d37b77
-
SHA256
0f028665a6f71c72b5dded557cf9e0b33f44133134a695b867bc66df9f5202bf
-
SHA512
26a5623e420067a3e2b5580c4fd9e379bc8790fab8b8b99d7afe63b7ebe46c6fafdb0510e4ff34c1f9e46b1a9cd022eb4ba1d2ca5b30f7741957f26b5dc06036
Malware Config
Extracted
formbook
3.9
m6x
990939.top
dhluxuryconsulting.com
muapnvnsfr.com
homder.com
valveiran.com
alkhaleejtrading.net
jekweiss.com
kevinklasmanmusic.com
buyilovebacon.com
nq227.com
cryptrproject.com
medicine.mba
nufilter.info
highway99restorations.com
phytohealthkits.com
accentuatephotography.com
tradeclimber.com
yasseralm.com
ito-agri.com
divandaman.com
raihtn.site
solyetrfademven.com
tepire.net
cointicket.online
johnhevank.com
pxskin.com
528jr.net
kovachnation.com
marstroy.info
1xsort.com
ugrowvancouverisland.com
sprintstats.com
furkankarakus.com
seo-caen.net
yclm1051.com
floydcountybaseball.com
privewin5.com
donaldjtrumpjr.chat
coloral.biz
xj9x.com
stichtingkind.com
tv16429.info
forgatheredhealth.com
waldheim-heslach.com
huimin26.com
mxfbyym.com
goveritas.com
newexpertise.biz
qqfyt.com
invictussociety.com
mmgan19.com
meileefu.com
profitpk.com
koolkitchendezigns.com
tubesluitmachine.com
mypussy.online
land8531.com
zhekou115.com
greenlandeventsntours.com
sydneycohn.net
bibs-bobs.com
zghz6688.com
wujing.group
motoucai.com
hearxy.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1948-56-0x0000000000610000-0x000000000063A000-memory.dmp formbook behavioral1/memory/1948-57-0x0000000000610000-0x000000000063A000-memory.dmp formbook behavioral1/memory/1536-64-0x0000000000080000-0x00000000000AA000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1368 cmd.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
New order.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum New order.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 New order.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
New order.exesystray.exedescription pid process target process PID 1948 set thread context of 1256 1948 New order.exe Explorer.EXE PID 1536 set thread context of 1256 1536 systray.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
New order.exesystray.exepid process 1948 New order.exe 1948 New order.exe 1536 systray.exe 1536 systray.exe 1536 systray.exe 1536 systray.exe 1536 systray.exe 1536 systray.exe 1536 systray.exe 1536 systray.exe 1536 systray.exe 1536 systray.exe 1536 systray.exe 1536 systray.exe 1536 systray.exe 1536 systray.exe 1536 systray.exe 1536 systray.exe 1536 systray.exe 1536 systray.exe 1536 systray.exe 1536 systray.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
New order.exesystray.exepid process 1948 New order.exe 1948 New order.exe 1948 New order.exe 1536 systray.exe 1536 systray.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
New order.exesystray.exedescription pid process Token: SeDebugPrivilege 1948 New order.exe Token: SeDebugPrivilege 1536 systray.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1256 Explorer.EXE 1256 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1256 Explorer.EXE 1256 Explorer.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
Explorer.EXEsystray.exedescription pid process target process PID 1256 wrote to memory of 1536 1256 Explorer.EXE systray.exe PID 1256 wrote to memory of 1536 1256 Explorer.EXE systray.exe PID 1256 wrote to memory of 1536 1256 Explorer.EXE systray.exe PID 1256 wrote to memory of 1536 1256 Explorer.EXE systray.exe PID 1536 wrote to memory of 1368 1536 systray.exe cmd.exe PID 1536 wrote to memory of 1368 1536 systray.exe cmd.exe PID 1536 wrote to memory of 1368 1536 systray.exe cmd.exe PID 1536 wrote to memory of 1368 1536 systray.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\New order.exe"C:\Users\Admin\AppData\Local\Temp\New order.exe"2⤵
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\New order.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1256-60-0x0000000006D00000-0x0000000006E86000-memory.dmpFilesize
1.5MB
-
memory/1256-67-0x00000000043D0000-0x0000000004481000-memory.dmpFilesize
708KB
-
memory/1368-62-0x0000000000000000-mapping.dmp
-
memory/1536-63-0x0000000000470000-0x0000000000475000-memory.dmpFilesize
20KB
-
memory/1536-61-0x0000000000000000-mapping.dmp
-
memory/1536-64-0x0000000000080000-0x00000000000AA000-memory.dmpFilesize
168KB
-
memory/1536-65-0x0000000001E90000-0x0000000002193000-memory.dmpFilesize
3.0MB
-
memory/1536-66-0x0000000001CB0000-0x0000000001D43000-memory.dmpFilesize
588KB
-
memory/1948-58-0x0000000005470000-0x0000000005773000-memory.dmpFilesize
3.0MB
-
memory/1948-59-0x0000000000970000-0x0000000000984000-memory.dmpFilesize
80KB
-
memory/1948-57-0x0000000000610000-0x000000000063A000-memory.dmpFilesize
168KB
-
memory/1948-56-0x0000000000610000-0x000000000063A000-memory.dmpFilesize
168KB
-
memory/1948-54-0x0000000001100000-0x0000000001148000-memory.dmpFilesize
288KB
-
memory/1948-55-0x00000000005E0000-0x0000000000614000-memory.dmpFilesize
208KB