Analysis
-
max time kernel
156s -
max time network
165s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
31-01-2022 08:38
Static task
static1
Behavioral task
behavioral1
Sample
PAN OCEAN CO LTD-pdf.exe
Resource
win7-en-20211208
General
-
Target
PAN OCEAN CO LTD-pdf.exe
-
Size
505KB
-
MD5
bbe4df3ac05fc6d8da76097b48671892
-
SHA1
dac9a8db9bc9cb91c0977b4477e62ffa77f3969d
-
SHA256
bcba0056c80d1a5c320dd74fea9caba51cc2f41c4d05215df1ab825a5ca10de4
-
SHA512
fd090c93491f62cca7ee47abf92dba5425f9933e6291fbd4b63cbf725671f524f0b3f4c2ad7e0863591bd91eee903168220838d0027ffba3ee0b39ec32c1f648
Malware Config
Extracted
formbook
4.1
m17y
dental-implants-us-prices.site
eolegends.online
drskinstudio.com
miamivideomapping.com
cqytwater.com
fesfe.net
dlautostore.com
wwwpledge.com
trynutiliti.com
551milesoak.com
jemmetalfab.com
teamtrinitysellsncarolina.com
injurypersonallawyer.com
r3qcf2.xyz
djellaba-boutique.com
t6fwagd.xyz
lm-upto100.com
shyashijz.com
classicbasilicata.com
exactias.com
veocap.xyz
jf-cap.com
oldtraditionstattooparlor.com
egyptshipping.xyz
bdcuhg.com
stecmedia.com
pornvideohall.com
3scy.com
ltmyj.com
supercarniceriasgonvi.com
sdjiahengjixie.com
silvertiaras.com
sedahet.com
peinturefleuri.com
rainfall3d.com
warezhq.com
hsdayp.com
ukhtanytm.com
womensboxing.club
cathayspacific.com
4442tv.com
mekanoshos.com
nomihhealth.com
j3gscd.xyz
kamagranorx.com
hillsidefirm.com
basebastill.com
pureoemo.com
indebtednotable.xyz
odrowiwad.xyz
thenatlali.com
tradeonlink.com
illinimidgets.com
dvtrskgsn.com
efcapcongress.com
girlbest.store
langcustomhomes.net
oncehua.com
corendonnorway.com
streetport.info
3696666.com
ivmmo.biz
doctorfinder.icu
deliriumvery.com
dty191.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/940-66-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1624-76-0x00000000000D0000-0x00000000000FF000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1284 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
PAN OCEAN CO LTD-pdf.exePAN OCEAN CO LTD-pdf.exeNAPSTAT.EXEdescription pid process target process PID 952 set thread context of 940 952 PAN OCEAN CO LTD-pdf.exe PAN OCEAN CO LTD-pdf.exe PID 940 set thread context of 1400 940 PAN OCEAN CO LTD-pdf.exe Explorer.EXE PID 1624 set thread context of 1400 1624 NAPSTAT.EXE Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
PAN OCEAN CO LTD-pdf.exeNAPSTAT.EXEpowershell.exepid process 940 PAN OCEAN CO LTD-pdf.exe 940 PAN OCEAN CO LTD-pdf.exe 1624 NAPSTAT.EXE 960 powershell.exe 1624 NAPSTAT.EXE 1624 NAPSTAT.EXE 1624 NAPSTAT.EXE 1624 NAPSTAT.EXE 1624 NAPSTAT.EXE 1624 NAPSTAT.EXE 1624 NAPSTAT.EXE 1624 NAPSTAT.EXE 1624 NAPSTAT.EXE 1624 NAPSTAT.EXE 1624 NAPSTAT.EXE 1624 NAPSTAT.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
PAN OCEAN CO LTD-pdf.exeNAPSTAT.EXEpid process 940 PAN OCEAN CO LTD-pdf.exe 940 PAN OCEAN CO LTD-pdf.exe 940 PAN OCEAN CO LTD-pdf.exe 1624 NAPSTAT.EXE 1624 NAPSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
PAN OCEAN CO LTD-pdf.exeNAPSTAT.EXEpowershell.exedescription pid process Token: SeDebugPrivilege 940 PAN OCEAN CO LTD-pdf.exe Token: SeDebugPrivilege 1624 NAPSTAT.EXE Token: SeDebugPrivilege 960 powershell.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1400 Explorer.EXE 1400 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1400 Explorer.EXE 1400 Explorer.EXE -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
PAN OCEAN CO LTD-pdf.exeExplorer.EXENAPSTAT.EXEdescription pid process target process PID 952 wrote to memory of 960 952 PAN OCEAN CO LTD-pdf.exe powershell.exe PID 952 wrote to memory of 960 952 PAN OCEAN CO LTD-pdf.exe powershell.exe PID 952 wrote to memory of 960 952 PAN OCEAN CO LTD-pdf.exe powershell.exe PID 952 wrote to memory of 960 952 PAN OCEAN CO LTD-pdf.exe powershell.exe PID 952 wrote to memory of 1820 952 PAN OCEAN CO LTD-pdf.exe schtasks.exe PID 952 wrote to memory of 1820 952 PAN OCEAN CO LTD-pdf.exe schtasks.exe PID 952 wrote to memory of 1820 952 PAN OCEAN CO LTD-pdf.exe schtasks.exe PID 952 wrote to memory of 1820 952 PAN OCEAN CO LTD-pdf.exe schtasks.exe PID 952 wrote to memory of 940 952 PAN OCEAN CO LTD-pdf.exe PAN OCEAN CO LTD-pdf.exe PID 952 wrote to memory of 940 952 PAN OCEAN CO LTD-pdf.exe PAN OCEAN CO LTD-pdf.exe PID 952 wrote to memory of 940 952 PAN OCEAN CO LTD-pdf.exe PAN OCEAN CO LTD-pdf.exe PID 952 wrote to memory of 940 952 PAN OCEAN CO LTD-pdf.exe PAN OCEAN CO LTD-pdf.exe PID 952 wrote to memory of 940 952 PAN OCEAN CO LTD-pdf.exe PAN OCEAN CO LTD-pdf.exe PID 952 wrote to memory of 940 952 PAN OCEAN CO LTD-pdf.exe PAN OCEAN CO LTD-pdf.exe PID 952 wrote to memory of 940 952 PAN OCEAN CO LTD-pdf.exe PAN OCEAN CO LTD-pdf.exe PID 1400 wrote to memory of 1624 1400 Explorer.EXE NAPSTAT.EXE PID 1400 wrote to memory of 1624 1400 Explorer.EXE NAPSTAT.EXE PID 1400 wrote to memory of 1624 1400 Explorer.EXE NAPSTAT.EXE PID 1400 wrote to memory of 1624 1400 Explorer.EXE NAPSTAT.EXE PID 1624 wrote to memory of 1284 1624 NAPSTAT.EXE cmd.exe PID 1624 wrote to memory of 1284 1624 NAPSTAT.EXE cmd.exe PID 1624 wrote to memory of 1284 1624 NAPSTAT.EXE cmd.exe PID 1624 wrote to memory of 1284 1624 NAPSTAT.EXE cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PAN OCEAN CO LTD-pdf.exe"C:\Users\Admin\AppData\Local\Temp\PAN OCEAN CO LTD-pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\QEDNxgSjLwGfZi.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QEDNxgSjLwGfZi" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6ECA.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\PAN OCEAN CO LTD-pdf.exe"C:\Users\Admin\AppData\Local\Temp\PAN OCEAN CO LTD-pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\NAPSTAT.EXE"C:\Windows\SysWOW64\NAPSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PAN OCEAN CO LTD-pdf.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp6ECA.tmpMD5
65c2a59d366737fcae135254be1b133f
SHA116ca3e4d124e46bc45986dd8fa14fb64a649cbae
SHA256533267bf9be3905814c3c5bd29b0dc43fb4753c4d951c74facaea09c55084e42
SHA5124d40790c8f866d0b6c8374d388a6fbddac66ecd0c65b944471181c94621a47e7b69344dd489ee6c82539b00197b25636bc9db1152e642c2a2a21f5cc0c31c841
-
memory/940-69-0x0000000000280000-0x0000000000295000-memory.dmpFilesize
84KB
-
memory/940-68-0x0000000000890000-0x0000000000F93000-memory.dmpFilesize
7.0MB
-
memory/940-64-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/940-65-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/940-66-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/952-59-0x00000000042D0000-0x0000000004336000-memory.dmpFilesize
408KB
-
memory/952-56-0x0000000076B81000-0x0000000076B83000-memory.dmpFilesize
8KB
-
memory/952-58-0x00000000002B0000-0x00000000002C4000-memory.dmpFilesize
80KB
-
memory/952-57-0x0000000004D60000-0x0000000004D61000-memory.dmpFilesize
4KB
-
memory/952-55-0x0000000000C00000-0x0000000000C84000-memory.dmpFilesize
528KB
-
memory/960-73-0x0000000002390000-0x0000000002FDA000-memory.dmpFilesize
12.3MB
-
memory/960-71-0x0000000002390000-0x0000000002FDA000-memory.dmpFilesize
12.3MB
-
memory/960-72-0x0000000002390000-0x0000000002FDA000-memory.dmpFilesize
12.3MB
-
memory/1400-78-0x0000000004960000-0x0000000004A01000-memory.dmpFilesize
644KB
-
memory/1400-70-0x00000000071E0000-0x0000000007348000-memory.dmpFilesize
1.4MB
-
memory/1624-75-0x0000000000CA0000-0x0000000000CE6000-memory.dmpFilesize
280KB
-
memory/1624-74-0x00000000020F0000-0x00000000023F3000-memory.dmpFilesize
3.0MB
-
memory/1624-76-0x00000000000D0000-0x00000000000FF000-memory.dmpFilesize
188KB
-
memory/1624-77-0x0000000000360000-0x00000000003F4000-memory.dmpFilesize
592KB