Analysis
-
max time kernel
145s -
max time network
138s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
21-01-2021 04:16
Static task
static1
Behavioral task
behavioral1
Sample
PO20210120.exe
Resource
win7v20201028
General
-
Target
PO20210120.exe
-
Size
943KB
-
MD5
6fc44193a2a79ad1bd15606386bb0cb0
-
SHA1
d76e50ba12ea567584f9ee992b60bbf838be3c0a
-
SHA256
82c118d71fb0433b051b37a040f31f2455ceb3ddd01b7d314cf6b1f4648d454d
-
SHA512
554fa9c246a5284cf6f273cd13e744875150a5ac15d6443a46116a3e311ed60feafde4c9364f8d23dfef22bf1abb38a1bae2c21405c94a68489376a04a1c96ec
Malware Config
Extracted
formbook
http://www.adamjbrowne.com/knb/
nona-home.com
themundoverdeproject.com
nhlkrakenfans.com
mak-bauunternehmung.com
public-secret.com
exitumgestao.com
stopforeclosurenow.net
citestbiz1597776507.com
kythuatxetnghiemyhoc.com
longislandeventplanner.com
uaetechworld.com
centretabacstop.net
jomelvendivel.com
agricultureesm.com
successwithspencer.com
companywars.net
terrellhillsdirectory.com
ngldwyy.com
cwiprinting.net
lnstagramgetverifyaccounts.site
celerationeducation.com
moodrops.com
connorwill.com
jackwoodguitar.com
healthytreatsandmore.com
treasurespartyrental.com
completeservicos.com
byteart.club
kreationsbyittybitty.com
studiomaternofetal.com
fastecourses.com
mahlatblog.com
morkiehouse.com
livefreegoddess.love
asyadizicevirileri.com
xn--u2u404a3kr5xb.com
surptalb.xyz
stockbrokerpotential.xyz
arigibicalis.com
contactorsplan.com
huaxichenfei.com
856380163.xyz
martid-2006.com
inspirationalsblog.com
tienda-sky.com
higherresin.com
occasioncelebrations.com
mybeesplatform.com
elementary-farming.com
bandao56.com
fivebyfivefglobal.com
sandeepasblog.com
nirvanatopshelf.net
jncwjzgc.com
zauhaus.com
librasnacks.com
thefashiondaily.net
piecegig.com
astaxanthinsavedme.com
rileypm.com
the-champions-club.com
vkdeb.site
eco-decking.com
onlinecryptoforexminers.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/984-14-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/984-15-0x000000000041EC00-mapping.dmp formbook behavioral2/memory/540-26-0x00000000024B0000-0x00000000024DE000-memory.dmp formbook -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetThreadContext 4 IoCs
Processes:
PO20210120.exePO20210120.execolorcpl.exedescription pid process target process PID 988 set thread context of 984 988 PO20210120.exe PO20210120.exe PID 984 set thread context of 3128 984 PO20210120.exe Explorer.EXE PID 984 set thread context of 3128 984 PO20210120.exe Explorer.EXE PID 540 set thread context of 3128 540 colorcpl.exe Explorer.EXE -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 39 IoCs
Processes:
PO20210120.exePO20210120.execolorcpl.exepid process 988 PO20210120.exe 984 PO20210120.exe 984 PO20210120.exe 984 PO20210120.exe 984 PO20210120.exe 984 PO20210120.exe 984 PO20210120.exe 540 colorcpl.exe 540 colorcpl.exe 540 colorcpl.exe 540 colorcpl.exe 540 colorcpl.exe 540 colorcpl.exe 540 colorcpl.exe 540 colorcpl.exe 540 colorcpl.exe 540 colorcpl.exe 540 colorcpl.exe 540 colorcpl.exe 540 colorcpl.exe 540 colorcpl.exe 540 colorcpl.exe 540 colorcpl.exe 540 colorcpl.exe 540 colorcpl.exe 540 colorcpl.exe 540 colorcpl.exe 540 colorcpl.exe 540 colorcpl.exe 540 colorcpl.exe 540 colorcpl.exe 540 colorcpl.exe 540 colorcpl.exe 540 colorcpl.exe 540 colorcpl.exe 540 colorcpl.exe 540 colorcpl.exe 540 colorcpl.exe 540 colorcpl.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
PO20210120.execolorcpl.exepid process 984 PO20210120.exe 984 PO20210120.exe 984 PO20210120.exe 984 PO20210120.exe 540 colorcpl.exe 540 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
PO20210120.exePO20210120.exeExplorer.EXEcolorcpl.exedescription pid process Token: SeDebugPrivilege 988 PO20210120.exe Token: SeDebugPrivilege 984 PO20210120.exe Token: SeShutdownPrivilege 3128 Explorer.EXE Token: SeCreatePagefilePrivilege 3128 Explorer.EXE Token: SeDebugPrivilege 540 colorcpl.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
PO20210120.exePO20210120.execolorcpl.exedescription pid process target process PID 988 wrote to memory of 2876 988 PO20210120.exe schtasks.exe PID 988 wrote to memory of 2876 988 PO20210120.exe schtasks.exe PID 988 wrote to memory of 2876 988 PO20210120.exe schtasks.exe PID 988 wrote to memory of 984 988 PO20210120.exe PO20210120.exe PID 988 wrote to memory of 984 988 PO20210120.exe PO20210120.exe PID 988 wrote to memory of 984 988 PO20210120.exe PO20210120.exe PID 988 wrote to memory of 984 988 PO20210120.exe PO20210120.exe PID 988 wrote to memory of 984 988 PO20210120.exe PO20210120.exe PID 988 wrote to memory of 984 988 PO20210120.exe PO20210120.exe PID 984 wrote to memory of 540 984 PO20210120.exe colorcpl.exe PID 984 wrote to memory of 540 984 PO20210120.exe colorcpl.exe PID 984 wrote to memory of 540 984 PO20210120.exe colorcpl.exe PID 540 wrote to memory of 2136 540 colorcpl.exe cmd.exe PID 540 wrote to memory of 2136 540 colorcpl.exe cmd.exe PID 540 wrote to memory of 2136 540 colorcpl.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\PO20210120.exe"C:\Users\Admin\AppData\Local\Temp\PO20210120.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hTvBqiZhSaoi" /XML "C:\Users\Admin\AppData\Local\Temp\tmp180D.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\PO20210120.exe"C:\Users\Admin\AppData\Local\Temp\PO20210120.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO20210120.exe"5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp180D.tmpMD5
d5b78754b6f88a07c1d914fd732d9e37
SHA1a6e46f2f72d1e45317e63ec23f6872f35936ad41
SHA256fd40dd8cded6c5169f4fb61ce1c5b614bd49520c45692cf81f0dec0e283e6e11
SHA5120738bca29e31532d4f03a8f667832d5806d0195c5b742d86d35149ba97aff87990ebb6137a937b5d87c06f37f4a1ea4d7b27bfebfd2fce7a2da03199e0d6531f
-
memory/540-28-0x0000000004210000-0x00000000042A3000-memory.dmpFilesize
588KB
-
memory/540-27-0x00000000043B0000-0x00000000046D0000-memory.dmpFilesize
3.1MB
-
memory/540-26-0x00000000024B0000-0x00000000024DE000-memory.dmpFilesize
184KB
-
memory/540-25-0x00000000000A0000-0x00000000000B9000-memory.dmpFilesize
100KB
-
memory/540-23-0x0000000000000000-mapping.dmp
-
memory/984-15-0x000000000041EC00-mapping.dmp
-
memory/984-19-0x00000000013B0000-0x00000000013C4000-memory.dmpFilesize
80KB
-
memory/984-21-0x0000000001400000-0x0000000001414000-memory.dmpFilesize
80KB
-
memory/984-18-0x0000000001430000-0x0000000001750000-memory.dmpFilesize
3.1MB
-
memory/984-14-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/988-5-0x00000000081B0000-0x00000000081B1000-memory.dmpFilesize
4KB
-
memory/988-2-0x0000000073310000-0x00000000739FE000-memory.dmpFilesize
6.9MB
-
memory/988-9-0x0000000007DF0000-0x0000000007DF1000-memory.dmpFilesize
4KB
-
memory/988-10-0x0000000008000000-0x0000000008023000-memory.dmpFilesize
140KB
-
memory/988-11-0x0000000008A20000-0x0000000008A86000-memory.dmpFilesize
408KB
-
memory/988-3-0x0000000000F50000-0x0000000000F51000-memory.dmpFilesize
4KB
-
memory/988-8-0x0000000007E70000-0x0000000007E71000-memory.dmpFilesize
4KB
-
memory/988-7-0x0000000007E90000-0x0000000007E91000-memory.dmpFilesize
4KB
-
memory/988-6-0x0000000007D50000-0x0000000007D51000-memory.dmpFilesize
4KB
-
memory/2136-24-0x0000000000000000-mapping.dmp
-
memory/2876-12-0x0000000000000000-mapping.dmp
-
memory/3128-20-0x0000000005B00000-0x0000000005C46000-memory.dmpFilesize
1.3MB
-
memory/3128-22-0x0000000006CA0000-0x0000000006DD3000-memory.dmpFilesize
1.2MB
-
memory/3128-29-0x0000000005900000-0x0000000005A3A000-memory.dmpFilesize
1.2MB