Analysis
-
max time kernel
157s -
max time network
156s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
27-01-2022 13:07
Static task
static1
Behavioral task
behavioral1
Sample
comandă de achiziție pdf.exe
Resource
win7-en-20211208
General
-
Target
comandă de achiziție pdf.exe
-
Size
409KB
-
MD5
6d1c90c44010cfd2f785c5d415a5cd18
-
SHA1
37a88f4f80b5e8e4345eefbbb9f2b23df08de18a
-
SHA256
3d28df7c5fa301b4e6d80f4bbc9dfa70bec762ca5ef085bcc8373b4b359b177f
-
SHA512
ace2fe025f112cf2bff848f5c6e8709b6db239d919d1b3ae0c63edcc2cdbe4ea941f7d2012e99d50ef80df36c36d630bc709ea8f59672416bffacbca6d09d32c
Malware Config
Extracted
formbook
4.1
g2m3
stocktonfingerprinting.com
metaaiqr.com
junicy.com
libertymutualgrou.com
jklhs7gl.xyz
alex-covalcova.space
socialfiguild.com
drnicholasreid.com
androidappprogrammierie.com
relatingtohumans.com
jitsystems.com
gbwpmz.com
lesaventuresdecocomango.com
wu8ggqdv077p.xyz
autnvg.com
wghakt016.xyz
lagosian.store
hilldoor.com
oculos-ajustavel-br.xyz
nameniboothac.com
lifuyao.com
cardinalsplayerstore.com
pholoniex-an.xyz
clarensis.com
wu8d616yyt6z.xyz
uidrp.com
gents.style
npwpkl.com
xn--kinsithrapeute-dkbe.xyz
cruzinu.xyz
raverwren.net
veuology.com
armbandtas.com
77xy.xyz
racingsilks-nft.com
academiademujerespro.com
makciakla.com
hopejustmade.com
catrionatowriss.com
kcebtaz.xyz
hongjunwuliu.com
vegecru.com
sidesofthenorth.com
buytacpyshop.xyz
nexuslanka.com
benormxukraine.xyz
hnart-child.com
globalrockstar.xyz
ilovesinglemoms.com
ollorhythm.com
ozkonyalikebap.com
kenmark-inc.com
recuerdosoxidados.com
interviewacomicnerd.com
have4grand.com
mcattoneys.com
ksherill.com
greenelectricmotors.com
matercenter.com
anwisystems.com
buylowatlanta.com
1stuebc.com
topbunkconsulting.com
heathlytrim.com
autnvg.com
Signatures
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/752-64-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1176-70-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
comandă de achiziție pdf.exeRegSvcs.exesystray.exedescription pid process target process PID 1148 set thread context of 752 1148 comandă de achiziție pdf.exe RegSvcs.exe PID 752 set thread context of 1356 752 RegSvcs.exe Explorer.EXE PID 1176 set thread context of 1356 1176 systray.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
comandă de achiziție pdf.exeRegSvcs.exesystray.exepowershell.exepid process 1148 comandă de achiziție pdf.exe 1148 comandă de achiziție pdf.exe 1148 comandă de achiziție pdf.exe 1148 comandă de achiziție pdf.exe 1148 comandă de achiziție pdf.exe 1148 comandă de achiziție pdf.exe 1148 comandă de achiziție pdf.exe 1148 comandă de achiziție pdf.exe 1148 comandă de achiziție pdf.exe 752 RegSvcs.exe 752 RegSvcs.exe 1176 systray.exe 1176 systray.exe 1176 systray.exe 436 powershell.exe 1176 systray.exe 1176 systray.exe 1176 systray.exe 1176 systray.exe 1176 systray.exe 1176 systray.exe 1176 systray.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.exesystray.exepid process 752 RegSvcs.exe 752 RegSvcs.exe 752 RegSvcs.exe 1176 systray.exe 1176 systray.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
comandă de achiziție pdf.exeRegSvcs.exesystray.exepowershell.exedescription pid process Token: SeDebugPrivilege 1148 comandă de achiziție pdf.exe Token: SeDebugPrivilege 752 RegSvcs.exe Token: SeDebugPrivilege 1176 systray.exe Token: SeDebugPrivilege 436 powershell.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1356 Explorer.EXE 1356 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1356 Explorer.EXE 1356 Explorer.EXE -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
comandă de achiziție pdf.exeExplorer.EXEsystray.exedescription pid process target process PID 1148 wrote to memory of 436 1148 comandă de achiziție pdf.exe powershell.exe PID 1148 wrote to memory of 436 1148 comandă de achiziție pdf.exe powershell.exe PID 1148 wrote to memory of 436 1148 comandă de achiziție pdf.exe powershell.exe PID 1148 wrote to memory of 436 1148 comandă de achiziție pdf.exe powershell.exe PID 1148 wrote to memory of 2040 1148 comandă de achiziție pdf.exe schtasks.exe PID 1148 wrote to memory of 2040 1148 comandă de achiziție pdf.exe schtasks.exe PID 1148 wrote to memory of 2040 1148 comandă de achiziție pdf.exe schtasks.exe PID 1148 wrote to memory of 2040 1148 comandă de achiziție pdf.exe schtasks.exe PID 1148 wrote to memory of 1896 1148 comandă de achiziție pdf.exe RegSvcs.exe PID 1148 wrote to memory of 1896 1148 comandă de achiziție pdf.exe RegSvcs.exe PID 1148 wrote to memory of 1896 1148 comandă de achiziție pdf.exe RegSvcs.exe PID 1148 wrote to memory of 1896 1148 comandă de achiziție pdf.exe RegSvcs.exe PID 1148 wrote to memory of 1896 1148 comandă de achiziție pdf.exe RegSvcs.exe PID 1148 wrote to memory of 1896 1148 comandă de achiziție pdf.exe RegSvcs.exe PID 1148 wrote to memory of 1896 1148 comandă de achiziție pdf.exe RegSvcs.exe PID 1148 wrote to memory of 752 1148 comandă de achiziție pdf.exe RegSvcs.exe PID 1148 wrote to memory of 752 1148 comandă de achiziție pdf.exe RegSvcs.exe PID 1148 wrote to memory of 752 1148 comandă de achiziție pdf.exe RegSvcs.exe PID 1148 wrote to memory of 752 1148 comandă de achiziție pdf.exe RegSvcs.exe PID 1148 wrote to memory of 752 1148 comandă de achiziție pdf.exe RegSvcs.exe PID 1148 wrote to memory of 752 1148 comandă de achiziție pdf.exe RegSvcs.exe PID 1148 wrote to memory of 752 1148 comandă de achiziție pdf.exe RegSvcs.exe PID 1148 wrote to memory of 752 1148 comandă de achiziție pdf.exe RegSvcs.exe PID 1148 wrote to memory of 752 1148 comandă de achiziție pdf.exe RegSvcs.exe PID 1148 wrote to memory of 752 1148 comandă de achiziție pdf.exe RegSvcs.exe PID 1356 wrote to memory of 1176 1356 Explorer.EXE systray.exe PID 1356 wrote to memory of 1176 1356 Explorer.EXE systray.exe PID 1356 wrote to memory of 1176 1356 Explorer.EXE systray.exe PID 1356 wrote to memory of 1176 1356 Explorer.EXE systray.exe PID 1176 wrote to memory of 1900 1176 systray.exe cmd.exe PID 1176 wrote to memory of 1900 1176 systray.exe cmd.exe PID 1176 wrote to memory of 1900 1176 systray.exe cmd.exe PID 1176 wrote to memory of 1900 1176 systray.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\comandă de achiziție pdf.exe"C:\Users\Admin\AppData\Local\Temp\comandă de achiziție pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\IJwFJArDPTvJz.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IJwFJArDPTvJz" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5090.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp5090.tmpMD5
f732f7c6faee466d02d1ab9cfa4d5c2c
SHA1626519fee1836f1fb5bdc77f97cb5e642bd01532
SHA25642bd9368ce172fdfbc0b05ce68b592ab561b5f8b551a24a229e1da95872b0965
SHA5128270c05c2249615b81735d7a763ae7323ef2dda6f6f1447142e4671e3df59d89077ac4e5050209428aacc0f0bf065cd86a745dd65ae55e31f5605146e5ab426b
-
memory/436-75-0x00000000024F0000-0x000000000313A000-memory.dmpFilesize
12.3MB
-
memory/436-72-0x00000000024F0000-0x000000000313A000-memory.dmpFilesize
12.3MB
-
memory/752-64-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/752-67-0x00000000001F0000-0x0000000000204000-memory.dmpFilesize
80KB
-
memory/752-66-0x0000000000840000-0x0000000000B43000-memory.dmpFilesize
3.0MB
-
memory/752-63-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/752-62-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1148-59-0x00000000056C0000-0x000000000572A000-memory.dmpFilesize
424KB
-
memory/1148-55-0x0000000001010000-0x000000000107C000-memory.dmpFilesize
432KB
-
memory/1148-58-0x0000000000390000-0x000000000039C000-memory.dmpFilesize
48KB
-
memory/1148-57-0x0000000004DB0000-0x0000000004DB1000-memory.dmpFilesize
4KB
-
memory/1148-56-0x0000000076511000-0x0000000076513000-memory.dmpFilesize
8KB
-
memory/1176-69-0x0000000000D40000-0x0000000000D45000-memory.dmpFilesize
20KB
-
memory/1176-70-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/1176-71-0x0000000000A30000-0x0000000000D33000-memory.dmpFilesize
3.0MB
-
memory/1176-73-0x0000000000920000-0x00000000009B3000-memory.dmpFilesize
588KB
-
memory/1356-68-0x0000000006B80000-0x0000000006CCE000-memory.dmpFilesize
1.3MB
-
memory/1356-74-0x0000000006D90000-0x0000000006F08000-memory.dmpFilesize
1.5MB