Analysis
-
max time kernel
162s -
max time network
148s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
28-01-2022 08:30
Static task
static1
Behavioral task
behavioral1
Sample
LVvoucher.exe
Resource
win7-en-20211208
General
-
Target
LVvoucher.exe
-
Size
779KB
-
MD5
4f2cf362036af705349843df3419ae5d
-
SHA1
49dfd4b26e8c9f2cc76df24c55e6616f438bf422
-
SHA256
77604e2646be4fb59a16e33ca5e78a73ec5045b8f1cce6f5ba16c11304b1c2ee
-
SHA512
8b5682f5955cdb1e1218735d100234f571f27a2b793cedd68572e8e62a1cef0cf716327b44fbaa3f29bc792a5e842bbfc8320ed175580333dc57eff8cf7fb586
Malware Config
Extracted
formbook
4.1
oh75
denizgidam.com
6cc06.com
charlottewaldburgzeil.com
medijanus.com
qingdaoyiersan.com
datcabilgisayar.xyz
111439d.com
xn--1ruo40k.com
wu6enxwcx5h3.xyz
vnscloud.net
brtka.xyz
showztime.com
promocoesdedezenbro.com
wokpy.com
chnowuk.online
rockshotscafe.com
pelrjy.com
nato-riness.com
feixiang-chem.com
thcoinexchange.com
fuelrescuereponse.com
digitaltunic.com
cellefill.com
paulbau.com
camillebeckman.xyz
ilico-media.com
603sa.com
firstechfedcu.com
koreaglp.com
thebeardedbrocksblends.com
musumeya-kotora.com
tocoteacanada.com
travelwitharden.com
diversamenteclinica.com
bw613.com
qe46.com
spectrumelectrolysis.com
maloyenterprises.com
inovasyon.xyz
remijoe.com
petsgallie.com
metagiphydownload.online
tigerdieect.com
jamedomp.com
peninsularbottling.com
1383fx.com
pandeymasala.online
spoilnet.com
itweu.com
ankxbi.icu
lm-safe-keepingyuchand92.xyz
dreamdsjoceo.com
providentview.com
newchinafortpayne.com
wu6bvnrlz4ra.xyz
intrasvp.com
ghoul-ambrose.com
alltenexpress.com
oniray.com
sistemaparadrogaria.com
zeidrei514-nifty.xyz
excaliburteacher.com
jennyandsteven.com
zakcotransportationllc.com
wwwccsuresults.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/752-63-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1124-75-0x00000000000D0000-0x00000000000FF000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 920 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
LVvoucher.exeLVvoucher.execolorcpl.exedescription pid process target process PID 1592 set thread context of 752 1592 LVvoucher.exe LVvoucher.exe PID 752 set thread context of 1396 752 LVvoucher.exe Explorer.EXE PID 1124 set thread context of 1396 1124 colorcpl.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
powershell.exeLVvoucher.execolorcpl.exepid process 924 powershell.exe 752 LVvoucher.exe 752 LVvoucher.exe 1124 colorcpl.exe 1124 colorcpl.exe 1124 colorcpl.exe 1124 colorcpl.exe 1124 colorcpl.exe 1124 colorcpl.exe 1124 colorcpl.exe 1124 colorcpl.exe 1124 colorcpl.exe 1124 colorcpl.exe 1124 colorcpl.exe 1124 colorcpl.exe 1124 colorcpl.exe 1124 colorcpl.exe 1124 colorcpl.exe 1124 colorcpl.exe 1124 colorcpl.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
LVvoucher.execolorcpl.exepid process 752 LVvoucher.exe 752 LVvoucher.exe 752 LVvoucher.exe 1124 colorcpl.exe 1124 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exeLVvoucher.execolorcpl.exedescription pid process Token: SeDebugPrivilege 924 powershell.exe Token: SeDebugPrivilege 752 LVvoucher.exe Token: SeDebugPrivilege 1124 colorcpl.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1396 Explorer.EXE 1396 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1396 Explorer.EXE 1396 Explorer.EXE -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
LVvoucher.exeExplorer.EXEcolorcpl.exedescription pid process target process PID 1592 wrote to memory of 924 1592 LVvoucher.exe powershell.exe PID 1592 wrote to memory of 924 1592 LVvoucher.exe powershell.exe PID 1592 wrote to memory of 924 1592 LVvoucher.exe powershell.exe PID 1592 wrote to memory of 924 1592 LVvoucher.exe powershell.exe PID 1592 wrote to memory of 1520 1592 LVvoucher.exe schtasks.exe PID 1592 wrote to memory of 1520 1592 LVvoucher.exe schtasks.exe PID 1592 wrote to memory of 1520 1592 LVvoucher.exe schtasks.exe PID 1592 wrote to memory of 1520 1592 LVvoucher.exe schtasks.exe PID 1592 wrote to memory of 752 1592 LVvoucher.exe LVvoucher.exe PID 1592 wrote to memory of 752 1592 LVvoucher.exe LVvoucher.exe PID 1592 wrote to memory of 752 1592 LVvoucher.exe LVvoucher.exe PID 1592 wrote to memory of 752 1592 LVvoucher.exe LVvoucher.exe PID 1592 wrote to memory of 752 1592 LVvoucher.exe LVvoucher.exe PID 1592 wrote to memory of 752 1592 LVvoucher.exe LVvoucher.exe PID 1592 wrote to memory of 752 1592 LVvoucher.exe LVvoucher.exe PID 1396 wrote to memory of 1124 1396 Explorer.EXE colorcpl.exe PID 1396 wrote to memory of 1124 1396 Explorer.EXE colorcpl.exe PID 1396 wrote to memory of 1124 1396 Explorer.EXE colorcpl.exe PID 1396 wrote to memory of 1124 1396 Explorer.EXE colorcpl.exe PID 1124 wrote to memory of 920 1124 colorcpl.exe cmd.exe PID 1124 wrote to memory of 920 1124 colorcpl.exe cmd.exe PID 1124 wrote to memory of 920 1124 colorcpl.exe cmd.exe PID 1124 wrote to memory of 920 1124 colorcpl.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\LVvoucher.exe"C:\Users\Admin\AppData\Local\Temp\LVvoucher.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\UcgxBJ.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UcgxBJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp24A0.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\LVvoucher.exe"C:\Users\Admin\AppData\Local\Temp\LVvoucher.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\LVvoucher.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp24A0.tmpMD5
0844c8162e61ac7b12151cfdad0fc627
SHA1b7be8446adf1ae750771978da6f33b6a0e6b235c
SHA25606eaa857ac42144a5d42b8fdbdf3db4bfbb2ae6dabb68385df2e40cdf7892385
SHA512fd687c38c8ca74d5e3a3e859ae2ef522b78394bf383aad68fbb50ee1951f9121a69a17c60b1019bb59b90f39f47377ae7ddf91ed597c71f7bfba23ce10a22fc7
-
memory/752-67-0x0000000000A20000-0x0000000000D23000-memory.dmpFilesize
3.0MB
-
memory/752-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/752-70-0x0000000000190000-0x00000000001A4000-memory.dmpFilesize
80KB
-
memory/752-63-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/752-62-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/924-72-0x0000000002620000-0x000000000326A000-memory.dmpFilesize
12.3MB
-
memory/924-66-0x0000000002620000-0x000000000326A000-memory.dmpFilesize
12.3MB
-
memory/924-69-0x0000000002620000-0x000000000326A000-memory.dmpFilesize
12.3MB
-
memory/1124-74-0x0000000000A00000-0x0000000000A18000-memory.dmpFilesize
96KB
-
memory/1124-77-0x0000000001EC0000-0x0000000001F53000-memory.dmpFilesize
588KB
-
memory/1124-76-0x0000000001FB0000-0x00000000022B3000-memory.dmpFilesize
3.0MB
-
memory/1124-75-0x00000000000D0000-0x00000000000FF000-memory.dmpFilesize
188KB
-
memory/1396-78-0x0000000003FC0000-0x000000000406A000-memory.dmpFilesize
680KB
-
memory/1396-71-0x0000000003EF0000-0x0000000003FBB000-memory.dmpFilesize
812KB
-
memory/1592-56-0x0000000004DE0000-0x0000000004DE1000-memory.dmpFilesize
4KB
-
memory/1592-55-0x0000000076421000-0x0000000076423000-memory.dmpFilesize
8KB
-
memory/1592-57-0x00000000002C0000-0x00000000002CC000-memory.dmpFilesize
48KB
-
memory/1592-58-0x0000000005790000-0x00000000057FA000-memory.dmpFilesize
424KB
-
memory/1592-54-0x0000000000E90000-0x0000000000F5A000-memory.dmpFilesize
808KB