Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 18:56
Static task
static1
Behavioral task
behavioral1
Sample
new.exe
Resource
win7-20220414-en
General
-
Target
new.exe
-
Size
268KB
-
MD5
a88e4bd1e3507132fcdd28f38a6751f7
-
SHA1
26e3eed8ee5b0e18cc401ed88b73b287c8ad8de7
-
SHA256
7527530d28c88ea0850926a24ba050a4a77983fb8271309c749ba43e7b10c695
-
SHA512
657b6c77d0d72945293978df4dc4bae3fb722978be866ddfe0ceb3fa6c604ed9c27ef516a77f159cc98dd577fb4a042fcf8c9406912f7985a8d5e8b3587682ae
Malware Config
Extracted
formbook
3.9
uw7
casa-miquela.com
phongcach8.com
tvdefrance.net
vipeorfresh.com
litsp.net
9dj2-ycg.biz
3157allen.com
newidea.site
merchandiserod.com
blueictbd.com
151manbetx.com
roehallwedding.com
huaruiju.com
sparkjoywithshannon.com
massif.biz
ochrebridge.com
r6t9.com
fuuvomoogmusic.net
perfectpawsdoggyboutique.com
nst-nri.com
dailyoldham.com
bsmithfotohaus.com
yueashitang.com
luisamorim.com
info-plastic.com
corporatelegallv.com
tableted-conalias.com
qiyefalv.net
ekdai.group
breakfasthelicopter.com
thefoodnerd.net
blmediasolutions.net
biasino.com
6199cccc.com
morgou.com
wellthywarrior.com
xn--slverdkm-tkb.com
aghanim-invest.com
sira.ltd
unitedthroughvalor.com
nvleaf.com
cloudnvr.net
devorius.com
minnsthings.com
eg9b23n-eqj.com
fashionchicmur.com
hfcjgd.com
sflandinc.com
cryptorawr.com
rustylimbs.com
computerscienceretreat.com
collegepassblack.com
santaandelfrun.com
itbagbrasil.com
tsangtwins.com
indiangateaerospaceacademy.com
pedrabrancafm104.net
kxycwn.info
thefashionclubs.com
bjxslsbh.com
amraaconsulting.com
poliformtehran.com
what-are-basic-necessities.site
sweaterbaba.com
binzom.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1056-56-0x0000000000590000-0x00000000005BA000-memory.dmp formbook behavioral1/memory/1056-57-0x0000000000590000-0x00000000005BA000-memory.dmp formbook behavioral1/memory/1236-66-0x0000000000070000-0x000000000009A000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2040 cmd.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
new.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum new.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 new.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
new.exewscript.exedescription pid process target process PID 1056 set thread context of 1220 1056 new.exe Explorer.EXE PID 1056 set thread context of 1220 1056 new.exe Explorer.EXE PID 1236 set thread context of 1220 1236 wscript.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
new.exewscript.exepid process 1056 new.exe 1056 new.exe 1056 new.exe 1236 wscript.exe 1236 wscript.exe 1236 wscript.exe 1236 wscript.exe 1236 wscript.exe 1236 wscript.exe 1236 wscript.exe 1236 wscript.exe 1236 wscript.exe 1236 wscript.exe 1236 wscript.exe 1236 wscript.exe 1236 wscript.exe 1236 wscript.exe 1236 wscript.exe 1236 wscript.exe 1236 wscript.exe 1236 wscript.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
new.exewscript.exepid process 1056 new.exe 1056 new.exe 1056 new.exe 1056 new.exe 1236 wscript.exe 1236 wscript.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
new.exewscript.exedescription pid process Token: SeDebugPrivilege 1056 new.exe Token: SeDebugPrivilege 1236 wscript.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1220 Explorer.EXE 1220 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1220 Explorer.EXE 1220 Explorer.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
new.exewscript.exedescription pid process target process PID 1056 wrote to memory of 1236 1056 new.exe wscript.exe PID 1056 wrote to memory of 1236 1056 new.exe wscript.exe PID 1056 wrote to memory of 1236 1056 new.exe wscript.exe PID 1056 wrote to memory of 1236 1056 new.exe wscript.exe PID 1236 wrote to memory of 2040 1236 wscript.exe cmd.exe PID 1236 wrote to memory of 2040 1236 wscript.exe cmd.exe PID 1236 wrote to memory of 2040 1236 wscript.exe cmd.exe PID 1236 wrote to memory of 2040 1236 wscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\new.exe"C:\Users\Admin\AppData\Local\Temp\new.exe"2⤵
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\new.exe"4⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1056-62-0x0000000000BB0000-0x0000000000BC4000-memory.dmpFilesize
80KB
-
memory/1056-55-0x00000000003B0000-0x00000000003E4000-memory.dmpFilesize
208KB
-
memory/1056-56-0x0000000000590000-0x00000000005BA000-memory.dmpFilesize
168KB
-
memory/1056-57-0x0000000000590000-0x00000000005BA000-memory.dmpFilesize
168KB
-
memory/1056-58-0x00000000054B0000-0x00000000057B3000-memory.dmpFilesize
3.0MB
-
memory/1056-59-0x0000000000AC0000-0x0000000000AD4000-memory.dmpFilesize
80KB
-
memory/1056-54-0x0000000000CD0000-0x0000000000D18000-memory.dmpFilesize
288KB
-
memory/1220-63-0x0000000004B20000-0x0000000004C5A000-memory.dmpFilesize
1.2MB
-
memory/1220-60-0x00000000040A0000-0x0000000004156000-memory.dmpFilesize
728KB
-
memory/1220-70-0x0000000004C60000-0x0000000004D47000-memory.dmpFilesize
924KB
-
memory/1236-64-0x0000000000000000-mapping.dmp
-
memory/1236-65-0x0000000000430000-0x0000000000456000-memory.dmpFilesize
152KB
-
memory/1236-66-0x0000000000070000-0x000000000009A000-memory.dmpFilesize
168KB
-
memory/1236-68-0x0000000002070000-0x0000000002373000-memory.dmpFilesize
3.0MB
-
memory/1236-69-0x0000000001E20000-0x0000000001EB3000-memory.dmpFilesize
588KB
-
memory/2040-67-0x0000000000000000-mapping.dmp