Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
20-04-2021 14:09
Static task
static1
Behavioral task
behavioral1
Sample
Invoice pdf.exe
Resource
win7v20210408
General
-
Target
Invoice pdf.exe
-
Size
661KB
-
MD5
95ad0de0d121d51993dc0e546f82772c
-
SHA1
e2830744f6497321e7b4c2a49d8270ea91b923c8
-
SHA256
494b892495fb6f002fd36477446bfc59f686fe73710d55dc782de8512452e535
-
SHA512
07b83558bd2269cdafd56ca91ddbe396b1d76cc5466fe13f2fff102ce49afedcb446b734922cd4dd6f8f9d2ac80bdcd8f9287ac11415c3c1d3f6dceaef8fe5ae
Malware Config
Extracted
formbook
4.1
http://w����5 �@q[*��S=���m
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3708-118-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/3708-119-0x000000000041EAC0-mapping.dmp formbook behavioral2/memory/3500-128-0x0000000002CA0000-0x0000000002CCE000-memory.dmp formbook -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Invoice pdf.exeInvoice pdf.exesystray.exedescription pid process target process PID 1824 set thread context of 3708 1824 Invoice pdf.exe Invoice pdf.exe PID 3708 set thread context of 1392 3708 Invoice pdf.exe Explorer.EXE PID 3708 set thread context of 1392 3708 Invoice pdf.exe Explorer.EXE PID 3500 set thread context of 1392 3500 systray.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
Invoice pdf.exeInvoice pdf.exesystray.exepid process 1824 Invoice pdf.exe 1824 Invoice pdf.exe 1824 Invoice pdf.exe 1824 Invoice pdf.exe 3708 Invoice pdf.exe 3708 Invoice pdf.exe 3708 Invoice pdf.exe 3708 Invoice pdf.exe 3708 Invoice pdf.exe 3708 Invoice pdf.exe 3500 systray.exe 3500 systray.exe 3500 systray.exe 3500 systray.exe 3500 systray.exe 3500 systray.exe 3500 systray.exe 3500 systray.exe 3500 systray.exe 3500 systray.exe 3500 systray.exe 3500 systray.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
Invoice pdf.exesystray.exepid process 3708 Invoice pdf.exe 3708 Invoice pdf.exe 3708 Invoice pdf.exe 3708 Invoice pdf.exe 3500 systray.exe 3500 systray.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Invoice pdf.exeInvoice pdf.exesystray.exedescription pid process Token: SeDebugPrivilege 1824 Invoice pdf.exe Token: SeDebugPrivilege 3708 Invoice pdf.exe Token: SeDebugPrivilege 3500 systray.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Invoice pdf.exeInvoice pdf.exesystray.exedescription pid process target process PID 1824 wrote to memory of 3236 1824 Invoice pdf.exe schtasks.exe PID 1824 wrote to memory of 3236 1824 Invoice pdf.exe schtasks.exe PID 1824 wrote to memory of 3236 1824 Invoice pdf.exe schtasks.exe PID 1824 wrote to memory of 3708 1824 Invoice pdf.exe Invoice pdf.exe PID 1824 wrote to memory of 3708 1824 Invoice pdf.exe Invoice pdf.exe PID 1824 wrote to memory of 3708 1824 Invoice pdf.exe Invoice pdf.exe PID 1824 wrote to memory of 3708 1824 Invoice pdf.exe Invoice pdf.exe PID 1824 wrote to memory of 3708 1824 Invoice pdf.exe Invoice pdf.exe PID 1824 wrote to memory of 3708 1824 Invoice pdf.exe Invoice pdf.exe PID 3708 wrote to memory of 3500 3708 Invoice pdf.exe systray.exe PID 3708 wrote to memory of 3500 3708 Invoice pdf.exe systray.exe PID 3708 wrote to memory of 3500 3708 Invoice pdf.exe systray.exe PID 3500 wrote to memory of 2384 3500 systray.exe cmd.exe PID 3500 wrote to memory of 2384 3500 systray.exe cmd.exe PID 3500 wrote to memory of 2384 3500 systray.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\Invoice pdf.exe"C:\Users\Admin\AppData\Local\Temp\Invoice pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gXUZJVkFviCTU" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9E92.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Invoice pdf.exe"C:\Users\Admin\AppData\Local\Temp\Invoice pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Invoice pdf.exe"5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp9E92.tmpMD5
866d9e36ff8786b19bd8b20acb3d5774
SHA154f6abc84743f6c19f54fc9b6a30b00e7cad1fa2
SHA256010a1ac25c5f3ba8bfc0d69a5c63678c88a287e9ba55f24a608bd7594b667820
SHA51232f1471ad44daea73444ebf3a220afde33ea11d44866cc28ed564496ec140204b71e2ab554d6f8727152e8dc97336d35a352c3a129552f5615ebfa98263d2382
-
memory/1392-123-0x0000000002B40000-0x0000000002C13000-memory.dmpFilesize
844KB
-
memory/1392-132-0x0000000006820000-0x0000000006979000-memory.dmpFilesize
1.3MB
-
memory/1392-125-0x0000000000B20000-0x0000000000BE9000-memory.dmpFilesize
804KB
-
memory/1824-115-0x000000007DF80000-0x000000007DF81000-memory.dmpFilesize
4KB
-
memory/1824-114-0x0000000003040000-0x0000000003041000-memory.dmpFilesize
4KB
-
memory/2384-129-0x0000000000000000-mapping.dmp
-
memory/3236-116-0x0000000000000000-mapping.dmp
-
memory/3500-127-0x0000000000370000-0x0000000000376000-memory.dmpFilesize
24KB
-
memory/3500-126-0x0000000000000000-mapping.dmp
-
memory/3500-128-0x0000000002CA0000-0x0000000002CCE000-memory.dmpFilesize
184KB
-
memory/3500-130-0x00000000046A0000-0x00000000049C0000-memory.dmpFilesize
3.1MB
-
memory/3500-131-0x00000000045C0000-0x0000000004653000-memory.dmpFilesize
588KB
-
memory/3708-124-0x0000000001480000-0x0000000001494000-memory.dmpFilesize
80KB
-
memory/3708-122-0x0000000001440000-0x0000000001454000-memory.dmpFilesize
80KB
-
memory/3708-121-0x0000000001770000-0x0000000001A90000-memory.dmpFilesize
3.1MB
-
memory/3708-119-0x000000000041EAC0-mapping.dmp
-
memory/3708-118-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB