Analysis
-
max time kernel
146s -
max time network
137s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
29-01-2022 08:48
Static task
static1
Behavioral task
behavioral1
Sample
Confirmarea platii.Pdf.exe
Resource
win7-en-20211208
General
-
Target
Confirmarea platii.Pdf.exe
-
Size
821KB
-
MD5
c93940644125559a6aa5f89f532066b8
-
SHA1
9e80136c79abe4072b9629fb57f19c2692dc33a8
-
SHA256
b76cdf3f203937fdd5a57710faf9c4d78281f4b893e8caff17a5053bb741bffc
-
SHA512
2c5eee79d2b488cdf1ec10d0fe295dc87fcb3383665bd072174571cdc6feeb7531a329861eaabd9838799fca633203b5dc7d98a535123bd7a4ba458c5f42c0af
Malware Config
Extracted
formbook
4.1
d2g7
inviteonlyme.com
noashopping.com
raysyoutube.com
chicagp.com
brnguatemala.com
speechboutique.com
philippinepodcastdirectory.com
konnecio.com
9q1ng6.icu
treez.info
appleiclou.com
pettras.com
txherz.icu
freearcae.com
mindpetalsoftwaresolutions.com
my-beautiful-switzerland.com
hpzebike.online
fadsekclub.xyz
newcastledhaka.com
varidsk.com
micursodebelleza.com
neoikos.com
dansilhavy.com
tuagenciademarketing.com
lennyjewelry.com
nomorewinters.life
hvmoon.com
showmethemoneyy.com
the180legacy.com
bearberry-extract.com
leophorm.com
designitumudah.com
212mask.com
globalsky.zone
chincoteagueebikerentals.com
yunsfu.com
kellerwilliambenefits.com
klaunster.com
lk5d3.com
wathft.online
stayweightfree.com
pouchseat.com
lebensraum-beratung.com
luokaihao.art
weldtechinstitute.com
howdy.chat
timioscorp.com
clientes-ayuda-numero.site
motorcycleinsuranc.com
hwbuc.icu
divinggarden.com
favorru.com
hospitalbe.com
cencat.net
saos45.com
cardealsherein.com
kelp.email
orderrosysmexicanrestaurant.com
nexxtgencorporation.com
5ghfbdfgerg.com
theannunziatagroup.com
swisshoneybee.com
4799cf.com
kingfisherexperience.com
freshlyhair.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2024-65-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/304-67-0x00000000023A0000-0x0000000002FEA000-memory.dmp formbook behavioral1/memory/972-75-0x00000000000C0000-0x00000000000EF000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Confirmarea platii.Pdf.exeRegSvcs.execolorcpl.exedescription pid process target process PID 880 set thread context of 2024 880 Confirmarea platii.Pdf.exe RegSvcs.exe PID 2024 set thread context of 1268 2024 RegSvcs.exe Explorer.EXE PID 972 set thread context of 1268 972 colorcpl.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
Confirmarea platii.Pdf.exeRegSvcs.exepowershell.execolorcpl.exepid process 880 Confirmarea platii.Pdf.exe 880 Confirmarea platii.Pdf.exe 880 Confirmarea platii.Pdf.exe 880 Confirmarea platii.Pdf.exe 2024 RegSvcs.exe 2024 RegSvcs.exe 304 powershell.exe 972 colorcpl.exe 972 colorcpl.exe 972 colorcpl.exe 972 colorcpl.exe 972 colorcpl.exe 972 colorcpl.exe 972 colorcpl.exe 972 colorcpl.exe 972 colorcpl.exe 972 colorcpl.exe 972 colorcpl.exe 972 colorcpl.exe 972 colorcpl.exe 972 colorcpl.exe 972 colorcpl.exe 972 colorcpl.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.execolorcpl.exepid process 2024 RegSvcs.exe 2024 RegSvcs.exe 2024 RegSvcs.exe 972 colorcpl.exe 972 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
Confirmarea platii.Pdf.exeRegSvcs.exepowershell.execolorcpl.exedescription pid process Token: SeDebugPrivilege 880 Confirmarea platii.Pdf.exe Token: SeDebugPrivilege 2024 RegSvcs.exe Token: SeDebugPrivilege 304 powershell.exe Token: SeDebugPrivilege 972 colorcpl.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
Confirmarea platii.Pdf.exeExplorer.EXEcolorcpl.exedescription pid process target process PID 880 wrote to memory of 304 880 Confirmarea platii.Pdf.exe powershell.exe PID 880 wrote to memory of 304 880 Confirmarea platii.Pdf.exe powershell.exe PID 880 wrote to memory of 304 880 Confirmarea platii.Pdf.exe powershell.exe PID 880 wrote to memory of 304 880 Confirmarea platii.Pdf.exe powershell.exe PID 880 wrote to memory of 1484 880 Confirmarea platii.Pdf.exe schtasks.exe PID 880 wrote to memory of 1484 880 Confirmarea platii.Pdf.exe schtasks.exe PID 880 wrote to memory of 1484 880 Confirmarea platii.Pdf.exe schtasks.exe PID 880 wrote to memory of 1484 880 Confirmarea platii.Pdf.exe schtasks.exe PID 880 wrote to memory of 2024 880 Confirmarea platii.Pdf.exe RegSvcs.exe PID 880 wrote to memory of 2024 880 Confirmarea platii.Pdf.exe RegSvcs.exe PID 880 wrote to memory of 2024 880 Confirmarea platii.Pdf.exe RegSvcs.exe PID 880 wrote to memory of 2024 880 Confirmarea platii.Pdf.exe RegSvcs.exe PID 880 wrote to memory of 2024 880 Confirmarea platii.Pdf.exe RegSvcs.exe PID 880 wrote to memory of 2024 880 Confirmarea platii.Pdf.exe RegSvcs.exe PID 880 wrote to memory of 2024 880 Confirmarea platii.Pdf.exe RegSvcs.exe PID 880 wrote to memory of 2024 880 Confirmarea platii.Pdf.exe RegSvcs.exe PID 880 wrote to memory of 2024 880 Confirmarea platii.Pdf.exe RegSvcs.exe PID 880 wrote to memory of 2024 880 Confirmarea platii.Pdf.exe RegSvcs.exe PID 1268 wrote to memory of 972 1268 Explorer.EXE colorcpl.exe PID 1268 wrote to memory of 972 1268 Explorer.EXE colorcpl.exe PID 1268 wrote to memory of 972 1268 Explorer.EXE colorcpl.exe PID 1268 wrote to memory of 972 1268 Explorer.EXE colorcpl.exe PID 972 wrote to memory of 596 972 colorcpl.exe cmd.exe PID 972 wrote to memory of 596 972 colorcpl.exe cmd.exe PID 972 wrote to memory of 596 972 colorcpl.exe cmd.exe PID 972 wrote to memory of 596 972 colorcpl.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Confirmarea platii.Pdf.exe"C:\Users\Admin\AppData\Local\Temp\Confirmarea platii.Pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ClmeTculHDsCcc.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ClmeTculHDsCcc" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF3E0.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpF3E0.tmpMD5
67957315a90bf8ce03d57f627f3e02c9
SHA18524c021ce95f3f5bf5244cef44c330745c231b3
SHA25657759679888c59622a35248831532bb1fd95f931447b281ffe598f715fa30153
SHA512b3bd69099ef448708ae45e2ea440665123dccb5825f053700c7b478e2ac30ee83eed8f8e39c4584b1df66004d068a7c13077d06bfbe1adc3a7bcdbbdd5362d35
-
memory/304-67-0x00000000023A0000-0x0000000002FEA000-memory.dmpFilesize
12.3MB
-
memory/304-72-0x00000000023A0000-0x0000000002FEA000-memory.dmpFilesize
12.3MB
-
memory/304-69-0x00000000023A0000-0x0000000002FEA000-memory.dmpFilesize
12.3MB
-
memory/880-55-0x0000000075B11000-0x0000000075B13000-memory.dmpFilesize
8KB
-
memory/880-56-0x0000000004BF0000-0x0000000004BF1000-memory.dmpFilesize
4KB
-
memory/880-57-0x00000000006D0000-0x00000000006DC000-memory.dmpFilesize
48KB
-
memory/880-58-0x00000000052B0000-0x0000000005316000-memory.dmpFilesize
408KB
-
memory/880-54-0x0000000000850000-0x0000000000924000-memory.dmpFilesize
848KB
-
memory/972-74-0x0000000000C50000-0x0000000000C68000-memory.dmpFilesize
96KB
-
memory/972-75-0x00000000000C0000-0x00000000000EF000-memory.dmpFilesize
188KB
-
memory/972-76-0x0000000002070000-0x0000000002373000-memory.dmpFilesize
3.0MB
-
memory/972-77-0x00000000008B0000-0x0000000000943000-memory.dmpFilesize
588KB
-
memory/1268-71-0x0000000004DB0000-0x0000000004E70000-memory.dmpFilesize
768KB
-
memory/1268-78-0x0000000004060000-0x000000000412B000-memory.dmpFilesize
812KB
-
memory/2024-68-0x0000000000920000-0x0000000000C23000-memory.dmpFilesize
3.0MB
-
memory/2024-65-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2024-70-0x00000000003E0000-0x00000000003F4000-memory.dmpFilesize
80KB
-
memory/2024-64-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2024-63-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB