Analysis
-
max time kernel
151s -
max time network
136s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
07-05-2021 09:43
Static task
static1
Behavioral task
behavioral1
Sample
Order Euro 890,000.exe
Resource
win7v20210410
General
-
Target
Order Euro 890,000.exe
-
Size
393KB
-
MD5
972c8502ec6351a57fa5ae84fd39e185
-
SHA1
ea02ba185facd60978f365dae414326e920ec5a7
-
SHA256
1893345e891ce74b4cfd82071d82f7566e3c44d8bf0e7a33f4207aa8d941632c
-
SHA512
ecde556d4c6e769dcc6b81eddc507f3018387e3d017edf2df26e7432140765e97621e7e297f9a16b4cf921d2a52f44d4c82c7114616f6eb6f86164549929e893
Malware Config
Extracted
formbook
4.1
http://www.owcbangalore.club/nbg/
yogabaydioxil.xyz
ngdnwgtse.club
tsusocialisback.com
racialfires.com
sotomatch.com
tourdelacey.com
gracefullygiven.com
hyggespaceco.com
kinohhooite7.site
labellebrune.com
maniupwithapril.com
superstitionintuition.com
cuidao.net
cavitefreewifi.com
cortex-link.com
plantasmarketing.com
greenpower247.com
lemonaster.com
impact-health.com
winyourmillion.com
beijingcryo.com
lbcbba.com
interlanbank.com
thesodomy.com
feetvideoshow.com
beardeco.com
topdispatchtowitnesstoday.info
powerhousetruckingpros.com
reallyopen.com
floryi.com
tataskyplans.com
317318.net
peakpicture.com
catfishoutofwater.com
horizon-sa19.com
gimmiegears.com
goodcakesshop.com
spraime.com
vapirental.com
spaceiq.space
draflorines.com
a2dot.com
hzitta.com
dragoonzz.com
xprtmedia.com
anvistanes.com
bitaam.online
sripechiamman.online
originalindigofurniture.co.uk
zago.xyz
johnjluo.com
qlfkyzyyz.icu
perthpanelbeaters.com
teamforceindia.com
katescomicshop.com
swensongroupcareers.com
mon-coaching-cetogene-lt.com
salonandspaworld.com
figocollectionco.com
sumantaclicks.com
hi-body.info
yopimaru-diary.com
thenovawave.com
lybowenguan.com
Signatures
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1424-63-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1772-71-0x0000000000080000-0x00000000000AE000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1652 cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
Order Euro 890,000.exepid process 1732 Order Euro 890,000.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Order Euro 890,000.exeOrder Euro 890,000.execolorcpl.exedescription pid process target process PID 1732 set thread context of 1424 1732 Order Euro 890,000.exe Order Euro 890,000.exe PID 1424 set thread context of 1260 1424 Order Euro 890,000.exe Explorer.EXE PID 1772 set thread context of 1260 1772 colorcpl.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 31 IoCs
Processes:
Order Euro 890,000.execolorcpl.exepid process 1424 Order Euro 890,000.exe 1424 Order Euro 890,000.exe 1772 colorcpl.exe 1772 colorcpl.exe 1772 colorcpl.exe 1772 colorcpl.exe 1772 colorcpl.exe 1772 colorcpl.exe 1772 colorcpl.exe 1772 colorcpl.exe 1772 colorcpl.exe 1772 colorcpl.exe 1772 colorcpl.exe 1772 colorcpl.exe 1772 colorcpl.exe 1772 colorcpl.exe 1772 colorcpl.exe 1772 colorcpl.exe 1772 colorcpl.exe 1772 colorcpl.exe 1772 colorcpl.exe 1772 colorcpl.exe 1772 colorcpl.exe 1772 colorcpl.exe 1772 colorcpl.exe 1772 colorcpl.exe 1772 colorcpl.exe 1772 colorcpl.exe 1772 colorcpl.exe 1772 colorcpl.exe 1772 colorcpl.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1260 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
Order Euro 890,000.exeOrder Euro 890,000.execolorcpl.exepid process 1732 Order Euro 890,000.exe 1424 Order Euro 890,000.exe 1424 Order Euro 890,000.exe 1424 Order Euro 890,000.exe 1772 colorcpl.exe 1772 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Order Euro 890,000.execolorcpl.exedescription pid process Token: SeDebugPrivilege 1424 Order Euro 890,000.exe Token: SeDebugPrivilege 1772 colorcpl.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1260 Explorer.EXE 1260 Explorer.EXE 1260 Explorer.EXE 1260 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1260 Explorer.EXE 1260 Explorer.EXE 1260 Explorer.EXE 1260 Explorer.EXE -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
Order Euro 890,000.exeExplorer.EXEcolorcpl.exedescription pid process target process PID 1732 wrote to memory of 1424 1732 Order Euro 890,000.exe Order Euro 890,000.exe PID 1732 wrote to memory of 1424 1732 Order Euro 890,000.exe Order Euro 890,000.exe PID 1732 wrote to memory of 1424 1732 Order Euro 890,000.exe Order Euro 890,000.exe PID 1732 wrote to memory of 1424 1732 Order Euro 890,000.exe Order Euro 890,000.exe PID 1732 wrote to memory of 1424 1732 Order Euro 890,000.exe Order Euro 890,000.exe PID 1260 wrote to memory of 1772 1260 Explorer.EXE colorcpl.exe PID 1260 wrote to memory of 1772 1260 Explorer.EXE colorcpl.exe PID 1260 wrote to memory of 1772 1260 Explorer.EXE colorcpl.exe PID 1260 wrote to memory of 1772 1260 Explorer.EXE colorcpl.exe PID 1772 wrote to memory of 1652 1772 colorcpl.exe cmd.exe PID 1772 wrote to memory of 1652 1772 colorcpl.exe cmd.exe PID 1772 wrote to memory of 1652 1772 colorcpl.exe cmd.exe PID 1772 wrote to memory of 1652 1772 colorcpl.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Order Euro 890,000.exe"C:\Users\Admin\AppData\Local\Temp\Order Euro 890,000.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Order Euro 890,000.exe"C:\Users\Admin\AppData\Local\Temp\Order Euro 890,000.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Order Euro 890,000.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsi13FF.tmp\dofls4.dllMD5
5af6fd2c67592b9be8c2ae98cddbc738
SHA165b245355f18116d9837217f63f4157fd065ac06
SHA256b96f6d8fb3daf46f60ef2b284edffdbdbbfcf87ee8631b652993c8afae86b53b
SHA512599c3770c6fbb63fd0fbecace62187a307c67a0b7924ec1c26f88bf0e33f7f555aa790d9112c7574e6bc98cbc402ec04fab52c5260392ec157e7fdba7fda1aec
-
memory/1260-66-0x0000000004F70000-0x00000000050D7000-memory.dmpFilesize
1.4MB
-
memory/1260-74-0x0000000004DF0000-0x0000000004EDE000-memory.dmpFilesize
952KB
-
memory/1424-65-0x0000000000710000-0x0000000000724000-memory.dmpFilesize
80KB
-
memory/1424-63-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1424-64-0x0000000000770000-0x0000000000A73000-memory.dmpFilesize
3.0MB
-
memory/1424-62-0x000000000041EB20-mapping.dmp
-
memory/1652-69-0x0000000000000000-mapping.dmp
-
memory/1732-59-0x0000000075161000-0x0000000075163000-memory.dmpFilesize
8KB
-
memory/1732-61-0x00000000004A0000-0x00000000004A2000-memory.dmpFilesize
8KB
-
memory/1772-67-0x0000000000000000-mapping.dmp
-
memory/1772-70-0x0000000000CA0000-0x0000000000CB8000-memory.dmpFilesize
96KB
-
memory/1772-71-0x0000000000080000-0x00000000000AE000-memory.dmpFilesize
184KB
-
memory/1772-72-0x00000000020C0000-0x00000000023C3000-memory.dmpFilesize
3.0MB
-
memory/1772-73-0x0000000000550000-0x00000000005E3000-memory.dmpFilesize
588KB