Analysis
-
max time kernel
148s -
max time network
186s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
27-07-2021 19:58
Static task
static1
Behavioral task
behavioral1
Sample
Shipping documents PDF.exe
Resource
win7v20210410
General
-
Target
Shipping documents PDF.exe
-
Size
831KB
-
MD5
81b0bdef857aa70ba8bfe0cb6d02f727
-
SHA1
328ce667e6d7fff59c3f27c0fcda338159c37c6f
-
SHA256
ecc540938addc1a440ef6ceb7714a0b45153c04c28df4395e3de18181439341a
-
SHA512
2b9c6596589265ed4a849d14e10cebff7fdac9a9a0bf7b4a6e33b41b38151a6f63aeb78b4c69e74b6a90be07c470bb86d8da2db988e2863f778780e4c07e238b
Malware Config
Extracted
formbook
4.1
http://w����5 �@q[*��S=���m
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1672-65-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1672-66-0x000000000041EAC0-mapping.dmp formbook behavioral1/memory/1944-74-0x0000000000080000-0x00000000000AE000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 276 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Shipping documents PDF.exeShipping documents PDF.execolorcpl.exedescription pid process target process PID 1932 set thread context of 1672 1932 Shipping documents PDF.exe Shipping documents PDF.exe PID 1672 set thread context of 1288 1672 Shipping documents PDF.exe Explorer.EXE PID 1944 set thread context of 1288 1944 colorcpl.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
Shipping documents PDF.exeShipping documents PDF.execolorcpl.exepid process 1932 Shipping documents PDF.exe 1932 Shipping documents PDF.exe 1932 Shipping documents PDF.exe 1672 Shipping documents PDF.exe 1672 Shipping documents PDF.exe 1944 colorcpl.exe 1944 colorcpl.exe 1944 colorcpl.exe 1944 colorcpl.exe 1944 colorcpl.exe 1944 colorcpl.exe 1944 colorcpl.exe 1944 colorcpl.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Shipping documents PDF.execolorcpl.exepid process 1672 Shipping documents PDF.exe 1672 Shipping documents PDF.exe 1672 Shipping documents PDF.exe 1944 colorcpl.exe 1944 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Shipping documents PDF.exeShipping documents PDF.execolorcpl.exedescription pid process Token: SeDebugPrivilege 1932 Shipping documents PDF.exe Token: SeDebugPrivilege 1672 Shipping documents PDF.exe Token: SeDebugPrivilege 1944 colorcpl.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
Shipping documents PDF.exeExplorer.EXEcolorcpl.exedescription pid process target process PID 1932 wrote to memory of 340 1932 Shipping documents PDF.exe schtasks.exe PID 1932 wrote to memory of 340 1932 Shipping documents PDF.exe schtasks.exe PID 1932 wrote to memory of 340 1932 Shipping documents PDF.exe schtasks.exe PID 1932 wrote to memory of 340 1932 Shipping documents PDF.exe schtasks.exe PID 1932 wrote to memory of 1672 1932 Shipping documents PDF.exe Shipping documents PDF.exe PID 1932 wrote to memory of 1672 1932 Shipping documents PDF.exe Shipping documents PDF.exe PID 1932 wrote to memory of 1672 1932 Shipping documents PDF.exe Shipping documents PDF.exe PID 1932 wrote to memory of 1672 1932 Shipping documents PDF.exe Shipping documents PDF.exe PID 1932 wrote to memory of 1672 1932 Shipping documents PDF.exe Shipping documents PDF.exe PID 1932 wrote to memory of 1672 1932 Shipping documents PDF.exe Shipping documents PDF.exe PID 1932 wrote to memory of 1672 1932 Shipping documents PDF.exe Shipping documents PDF.exe PID 1288 wrote to memory of 1944 1288 Explorer.EXE colorcpl.exe PID 1288 wrote to memory of 1944 1288 Explorer.EXE colorcpl.exe PID 1288 wrote to memory of 1944 1288 Explorer.EXE colorcpl.exe PID 1288 wrote to memory of 1944 1288 Explorer.EXE colorcpl.exe PID 1944 wrote to memory of 276 1944 colorcpl.exe cmd.exe PID 1944 wrote to memory of 276 1944 colorcpl.exe cmd.exe PID 1944 wrote to memory of 276 1944 colorcpl.exe cmd.exe PID 1944 wrote to memory of 276 1944 colorcpl.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Shipping documents PDF.exe"C:\Users\Admin\AppData\Local\Temp\Shipping documents PDF.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tFqKFDvgHq" /XML "C:\Users\Admin\AppData\Local\Temp\tmp53FA.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Shipping documents PDF.exe"C:\Users\Admin\AppData\Local\Temp\Shipping documents PDF.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Shipping documents PDF.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp53FA.tmpMD5
e1591eda1eaa5be908428ffd78793bdf
SHA14ce384294d23143ac86f038d290a3a19c5d9ae95
SHA2562acca89133912be935c597d5f1b2cd48089868fcb18fd6a62f3c94f9c8a18c88
SHA512a9cb647796b314845af63901edc08e08f97b7aaf029f0c5ac27aaed173c82e9cfec938e22649d3f4222fa946ad8a5ec41e3b00d9fbafd5b367c27c87e2ef0377
-
memory/276-72-0x0000000000000000-mapping.dmp
-
memory/340-63-0x0000000000000000-mapping.dmp
-
memory/1288-69-0x0000000003B60000-0x0000000003C16000-memory.dmpFilesize
728KB
-
memory/1288-77-0x0000000007090000-0x00000000071DF000-memory.dmpFilesize
1.3MB
-
memory/1672-68-0x0000000000350000-0x0000000000364000-memory.dmpFilesize
80KB
-
memory/1672-65-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1672-66-0x000000000041EAC0-mapping.dmp
-
memory/1672-67-0x0000000000970000-0x0000000000C73000-memory.dmpFilesize
3.0MB
-
memory/1932-62-0x000000007EF40000-0x000000007EF41000-memory.dmpFilesize
4KB
-
memory/1932-61-0x0000000000B41000-0x0000000000B42000-memory.dmpFilesize
4KB
-
memory/1932-60-0x0000000000B40000-0x0000000000B41000-memory.dmpFilesize
4KB
-
memory/1932-59-0x0000000074FB1000-0x0000000074FB3000-memory.dmpFilesize
8KB
-
memory/1944-70-0x0000000000000000-mapping.dmp
-
memory/1944-73-0x0000000000880000-0x0000000000898000-memory.dmpFilesize
96KB
-
memory/1944-75-0x0000000001FE0000-0x00000000022E3000-memory.dmpFilesize
3.0MB
-
memory/1944-74-0x0000000000080000-0x00000000000AE000-memory.dmpFilesize
184KB
-
memory/1944-76-0x0000000001E30000-0x0000000001EC3000-memory.dmpFilesize
588KB