Analysis
-
max time kernel
146s -
max time network
142s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
28-01-2022 14:44
Static task
static1
Behavioral task
behavioral1
Sample
Quotation-pdf.exe
Resource
win7-en-20211208
General
-
Target
Quotation-pdf.exe
-
Size
573KB
-
MD5
43be7a6cfb1c2fae6ad5c9e0440be4f8
-
SHA1
af4be0100e8c2b00ec1d821d72d15174ab2197e4
-
SHA256
0337d7784d4021b8467b2652f8c6ca9703732a0f132a1aebcafae37673db026d
-
SHA512
18a88af955dda3fbfc44a44ee72f8dcd32aefcc1d998316980bb235b485de6b6fee09b1322a5bd863cab5036c6b9b16c6a8aaf30c918ba5862c5b83b29406643
Malware Config
Extracted
formbook
4.1
m17y
dental-implants-us-prices.site
eolegends.online
drskinstudio.com
miamivideomapping.com
cqytwater.com
fesfe.net
dlautostore.com
wwwpledge.com
trynutiliti.com
551milesoak.com
jemmetalfab.com
teamtrinitysellsncarolina.com
injurypersonallawyer.com
r3qcf2.xyz
djellaba-boutique.com
t6fwagd.xyz
lm-upto100.com
shyashijz.com
classicbasilicata.com
exactias.com
veocap.xyz
jf-cap.com
oldtraditionstattooparlor.com
egyptshipping.xyz
bdcuhg.com
stecmedia.com
pornvideohall.com
3scy.com
ltmyj.com
supercarniceriasgonvi.com
sdjiahengjixie.com
silvertiaras.com
sedahet.com
peinturefleuri.com
rainfall3d.com
warezhq.com
hsdayp.com
ukhtanytm.com
womensboxing.club
cathayspacific.com
4442tv.com
mekanoshos.com
nomihhealth.com
j3gscd.xyz
kamagranorx.com
hillsidefirm.com
basebastill.com
pureoemo.com
indebtednotable.xyz
odrowiwad.xyz
thenatlali.com
tradeonlink.com
illinimidgets.com
dvtrskgsn.com
efcapcongress.com
girlbest.store
langcustomhomes.net
oncehua.com
corendonnorway.com
streetport.info
3696666.com
ivmmo.biz
doctorfinder.icu
deliriumvery.com
dty191.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1804-63-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1804-73-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1836-78-0x0000000000090000-0x00000000000BF000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1784 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Quotation-pdf.exeQuotation-pdf.exemsiexec.exedescription pid process target process PID 1732 set thread context of 1804 1732 Quotation-pdf.exe Quotation-pdf.exe PID 1804 set thread context of 1368 1804 Quotation-pdf.exe Explorer.EXE PID 1804 set thread context of 1368 1804 Quotation-pdf.exe Explorer.EXE PID 1836 set thread context of 1368 1836 msiexec.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 19 IoCs
Processes:
Quotation-pdf.exepowershell.exemsiexec.exepid process 1804 Quotation-pdf.exe 1804 Quotation-pdf.exe 688 powershell.exe 1804 Quotation-pdf.exe 1836 msiexec.exe 1836 msiexec.exe 1836 msiexec.exe 1836 msiexec.exe 1836 msiexec.exe 1836 msiexec.exe 1836 msiexec.exe 1836 msiexec.exe 1836 msiexec.exe 1836 msiexec.exe 1836 msiexec.exe 1836 msiexec.exe 1836 msiexec.exe 1836 msiexec.exe 1836 msiexec.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
Quotation-pdf.exemsiexec.exepid process 1804 Quotation-pdf.exe 1804 Quotation-pdf.exe 1804 Quotation-pdf.exe 1804 Quotation-pdf.exe 1836 msiexec.exe 1836 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Quotation-pdf.exepowershell.exemsiexec.exedescription pid process Token: SeDebugPrivilege 1804 Quotation-pdf.exe Token: SeDebugPrivilege 688 powershell.exe Token: SeDebugPrivilege 1836 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1368 Explorer.EXE 1368 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1368 Explorer.EXE 1368 Explorer.EXE -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
Quotation-pdf.exeExplorer.EXEmsiexec.exedescription pid process target process PID 1732 wrote to memory of 688 1732 Quotation-pdf.exe powershell.exe PID 1732 wrote to memory of 688 1732 Quotation-pdf.exe powershell.exe PID 1732 wrote to memory of 688 1732 Quotation-pdf.exe powershell.exe PID 1732 wrote to memory of 688 1732 Quotation-pdf.exe powershell.exe PID 1732 wrote to memory of 648 1732 Quotation-pdf.exe schtasks.exe PID 1732 wrote to memory of 648 1732 Quotation-pdf.exe schtasks.exe PID 1732 wrote to memory of 648 1732 Quotation-pdf.exe schtasks.exe PID 1732 wrote to memory of 648 1732 Quotation-pdf.exe schtasks.exe PID 1732 wrote to memory of 1804 1732 Quotation-pdf.exe Quotation-pdf.exe PID 1732 wrote to memory of 1804 1732 Quotation-pdf.exe Quotation-pdf.exe PID 1732 wrote to memory of 1804 1732 Quotation-pdf.exe Quotation-pdf.exe PID 1732 wrote to memory of 1804 1732 Quotation-pdf.exe Quotation-pdf.exe PID 1732 wrote to memory of 1804 1732 Quotation-pdf.exe Quotation-pdf.exe PID 1732 wrote to memory of 1804 1732 Quotation-pdf.exe Quotation-pdf.exe PID 1732 wrote to memory of 1804 1732 Quotation-pdf.exe Quotation-pdf.exe PID 1368 wrote to memory of 1836 1368 Explorer.EXE msiexec.exe PID 1368 wrote to memory of 1836 1368 Explorer.EXE msiexec.exe PID 1368 wrote to memory of 1836 1368 Explorer.EXE msiexec.exe PID 1368 wrote to memory of 1836 1368 Explorer.EXE msiexec.exe PID 1368 wrote to memory of 1836 1368 Explorer.EXE msiexec.exe PID 1368 wrote to memory of 1836 1368 Explorer.EXE msiexec.exe PID 1368 wrote to memory of 1836 1368 Explorer.EXE msiexec.exe PID 1836 wrote to memory of 1784 1836 msiexec.exe cmd.exe PID 1836 wrote to memory of 1784 1836 msiexec.exe cmd.exe PID 1836 wrote to memory of 1784 1836 msiexec.exe cmd.exe PID 1836 wrote to memory of 1784 1836 msiexec.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Quotation-pdf.exe"C:\Users\Admin\AppData\Local\Temp\Quotation-pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\IfvVzYPE.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IfvVzYPE" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC8DB.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Quotation-pdf.exe"C:\Users\Admin\AppData\Local\Temp\Quotation-pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Quotation-pdf.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpC8DB.tmpMD5
6eceacfc1b8435e47e443d422fb18561
SHA160a8dfebf704053886bfb1014438816453bfad36
SHA256b885c897568a29dc0cb2bb50d8a522c821028e59f6f0589977c8f6ff46ef73c9
SHA512eb04b19e2088a975542b434561a6b14a6922a44f3815196030b26e8d61aa14b433e189ab3f7ce8fa247fc614a2658ed0a36b9e7f9e318f115668da2b65edfedb
-
memory/688-72-0x00000000023B0000-0x0000000002FFA000-memory.dmpFilesize
12.3MB
-
memory/688-71-0x00000000023B0000-0x0000000002FFA000-memory.dmpFilesize
12.3MB
-
memory/688-70-0x00000000023B0000-0x0000000002FFA000-memory.dmpFilesize
12.3MB
-
memory/1368-66-0x0000000004C10000-0x0000000004CDC000-memory.dmpFilesize
816KB
-
memory/1368-75-0x00000000068F0000-0x0000000006A37000-memory.dmpFilesize
1.3MB
-
memory/1368-81-0x0000000006B00000-0x0000000006C11000-memory.dmpFilesize
1.1MB
-
memory/1732-56-0x0000000004D80000-0x0000000004D81000-memory.dmpFilesize
4KB
-
memory/1732-57-0x0000000000490000-0x000000000049C000-memory.dmpFilesize
48KB
-
memory/1732-55-0x0000000074F11000-0x0000000074F13000-memory.dmpFilesize
8KB
-
memory/1732-54-0x0000000000E50000-0x0000000000EE6000-memory.dmpFilesize
600KB
-
memory/1732-58-0x0000000005340000-0x00000000053AA000-memory.dmpFilesize
424KB
-
memory/1804-67-0x0000000000360000-0x0000000000375000-memory.dmpFilesize
84KB
-
memory/1804-63-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1804-65-0x00000000008B0000-0x0000000000BB3000-memory.dmpFilesize
3.0MB
-
memory/1804-73-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1804-74-0x00000000003A0000-0x00000000003B5000-memory.dmpFilesize
84KB
-
memory/1804-62-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1804-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1836-77-0x00000000003F0000-0x0000000000404000-memory.dmpFilesize
80KB
-
memory/1836-78-0x0000000000090000-0x00000000000BF000-memory.dmpFilesize
188KB
-
memory/1836-79-0x00000000021B0000-0x00000000024B3000-memory.dmpFilesize
3.0MB
-
memory/1836-80-0x00000000020C0000-0x0000000002154000-memory.dmpFilesize
592KB