Analysis
-
max time kernel
146s -
max time network
142s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
25-10-2021 17:41
Static task
static1
Behavioral task
behavioral1
Sample
Nueva orden de compra.Pdf.exe
Resource
win7-en-20210920
General
-
Target
Nueva orden de compra.Pdf.exe
-
Size
365KB
-
MD5
59fc1e1a88d9c4968b50d8c07711da9b
-
SHA1
4f5ed7418b6af7e875608604efe3c7aec58fba92
-
SHA256
478d38451c9a4af35bb5de2ada58dfe7495a224d122d9639c6d68fc55c4bf411
-
SHA512
edc96bbfa0e1fb9a3711d3d59349ed281674f21a0da3474c1179ea075171d55f0d37363a028e4266c3d87fe166dd15186f11d11c0c97f3a1a893e9c44342d3a8
Malware Config
Extracted
formbook
4.1
dv9n
http://www.elianedefalco.com/dv9n/
nblvqing.com
delmegebuildingproducts.com
xiongba8.com
latuawebreputation.online
nowcloud.tech
cckghs.com
tradeoo.ltd
ppapo.com
tphoaphuongdo.club
whitefoxy.site
bottle-sentences.net
computersewa.com
lushberryholidays.com
motobotz.com
shadurj.com
amazonlexdeveloper.com
shunli178.xyz
sjzzlmh.com
6eu09rp.xyz
novinmes.com
elizabethdouglas.net
heathy.xyz
forsmarthings.com
mskstyle-77.store
henhencaol.xyz
palncakeswap.com
osflogistics.com
14rinapo45.com
jordinandaustin.com
natsmartultimatebest.rest
perfectelopements.com
xinsaiou.com
92billion.com
hb4um.com
amneatni.xyz
pirigame.com
93335t.xyz
forwardvalley.com
contacttracingusa.com
americanexpress2214.creditcard
gurume-naruki.com
cdminstructors.com
posetac.online
suzhouyscl.com
bakarusgroup.com
epicureanadventuretours.com
goldengooses-outlet.com
glitchking411.com
8xroe84.xyz
https29dgi.xyz
sweetspendingwholesalersllc.com
bitopvip.com
sheraton-international.com
ajansclubturkey.site
communityskiswap.com
sauna-kuu.com
stephkingspilates.com
rosnewmarkextension.net
100daysofml.com
nexbot.biz
ahhhpop.com
marfalow.com
project-candles.com
topdogiadung.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1216-62-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1216-63-0x000000000041F190-mapping.dmp formbook behavioral1/memory/1064-72-0x0000000000090000-0x00000000000BF000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Nueva orden de compra.Pdf.exeRegSvcs.exemsiexec.exedescription pid process target process PID 740 set thread context of 1216 740 Nueva orden de compra.Pdf.exe RegSvcs.exe PID 1216 set thread context of 1404 1216 RegSvcs.exe Explorer.EXE PID 1064 set thread context of 1404 1064 msiexec.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
Nueva orden de compra.Pdf.exeRegSvcs.exemsiexec.exepid process 740 Nueva orden de compra.Pdf.exe 740 Nueva orden de compra.Pdf.exe 1216 RegSvcs.exe 1216 RegSvcs.exe 1064 msiexec.exe 1064 msiexec.exe 1064 msiexec.exe 1064 msiexec.exe 1064 msiexec.exe 1064 msiexec.exe 1064 msiexec.exe 1064 msiexec.exe 1064 msiexec.exe 1064 msiexec.exe 1064 msiexec.exe 1064 msiexec.exe 1064 msiexec.exe 1064 msiexec.exe 1064 msiexec.exe 1064 msiexec.exe 1064 msiexec.exe 1064 msiexec.exe 1064 msiexec.exe 1064 msiexec.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.exemsiexec.exepid process 1216 RegSvcs.exe 1216 RegSvcs.exe 1216 RegSvcs.exe 1064 msiexec.exe 1064 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Nueva orden de compra.Pdf.exeRegSvcs.exemsiexec.exedescription pid process Token: SeDebugPrivilege 740 Nueva orden de compra.Pdf.exe Token: SeDebugPrivilege 1216 RegSvcs.exe Token: SeDebugPrivilege 1064 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1404 Explorer.EXE 1404 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1404 Explorer.EXE 1404 Explorer.EXE -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
Nueva orden de compra.Pdf.exeExplorer.EXEmsiexec.exedescription pid process target process PID 740 wrote to memory of 1804 740 Nueva orden de compra.Pdf.exe schtasks.exe PID 740 wrote to memory of 1804 740 Nueva orden de compra.Pdf.exe schtasks.exe PID 740 wrote to memory of 1804 740 Nueva orden de compra.Pdf.exe schtasks.exe PID 740 wrote to memory of 1804 740 Nueva orden de compra.Pdf.exe schtasks.exe PID 740 wrote to memory of 1216 740 Nueva orden de compra.Pdf.exe RegSvcs.exe PID 740 wrote to memory of 1216 740 Nueva orden de compra.Pdf.exe RegSvcs.exe PID 740 wrote to memory of 1216 740 Nueva orden de compra.Pdf.exe RegSvcs.exe PID 740 wrote to memory of 1216 740 Nueva orden de compra.Pdf.exe RegSvcs.exe PID 740 wrote to memory of 1216 740 Nueva orden de compra.Pdf.exe RegSvcs.exe PID 740 wrote to memory of 1216 740 Nueva orden de compra.Pdf.exe RegSvcs.exe PID 740 wrote to memory of 1216 740 Nueva orden de compra.Pdf.exe RegSvcs.exe PID 740 wrote to memory of 1216 740 Nueva orden de compra.Pdf.exe RegSvcs.exe PID 740 wrote to memory of 1216 740 Nueva orden de compra.Pdf.exe RegSvcs.exe PID 740 wrote to memory of 1216 740 Nueva orden de compra.Pdf.exe RegSvcs.exe PID 1404 wrote to memory of 1064 1404 Explorer.EXE msiexec.exe PID 1404 wrote to memory of 1064 1404 Explorer.EXE msiexec.exe PID 1404 wrote to memory of 1064 1404 Explorer.EXE msiexec.exe PID 1404 wrote to memory of 1064 1404 Explorer.EXE msiexec.exe PID 1404 wrote to memory of 1064 1404 Explorer.EXE msiexec.exe PID 1404 wrote to memory of 1064 1404 Explorer.EXE msiexec.exe PID 1404 wrote to memory of 1064 1404 Explorer.EXE msiexec.exe PID 1064 wrote to memory of 1516 1064 msiexec.exe cmd.exe PID 1064 wrote to memory of 1516 1064 msiexec.exe cmd.exe PID 1064 wrote to memory of 1516 1064 msiexec.exe cmd.exe PID 1064 wrote to memory of 1516 1064 msiexec.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Nueva orden de compra.Pdf.exe"C:\Users\Admin\AppData\Local\Temp\Nueva orden de compra.Pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QvxslQsYkA" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6AB5.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/740-56-0x0000000000230000-0x0000000000237000-memory.dmpFilesize
28KB
-
memory/740-57-0x0000000004B60000-0x0000000004B61000-memory.dmpFilesize
4KB
-
memory/740-58-0x0000000000F00000-0x0000000000F50000-memory.dmpFilesize
320KB
-
memory/740-54-0x00000000012B0000-0x00000000012B1000-memory.dmpFilesize
4KB
-
memory/1064-68-0x0000000000000000-mapping.dmp
-
memory/1064-74-0x0000000000B70000-0x0000000000C03000-memory.dmpFilesize
588KB
-
memory/1064-73-0x00000000021B0000-0x00000000024B3000-memory.dmpFilesize
3.0MB
-
memory/1064-72-0x0000000000090000-0x00000000000BF000-memory.dmpFilesize
188KB
-
memory/1064-71-0x00000000001D0000-0x00000000001E4000-memory.dmpFilesize
80KB
-
memory/1064-69-0x00000000751D1000-0x00000000751D3000-memory.dmpFilesize
8KB
-
memory/1216-60-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1216-65-0x0000000000B60000-0x0000000000E63000-memory.dmpFilesize
3.0MB
-
memory/1216-66-0x00000000001A0000-0x00000000001B4000-memory.dmpFilesize
80KB
-
memory/1216-63-0x000000000041F190-mapping.dmp
-
memory/1216-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1216-62-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1404-67-0x0000000006A60000-0x0000000006BA9000-memory.dmpFilesize
1.3MB
-
memory/1404-75-0x00000000065C0000-0x0000000006674000-memory.dmpFilesize
720KB
-
memory/1516-70-0x0000000000000000-mapping.dmp
-
memory/1804-59-0x0000000000000000-mapping.dmp