Analysis
- max time kernel
166s - max time network
171s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
04/02/2022, 10:51
Static task
static1
Behavioral task
behavioral1
Sample
Factura_834.pdf.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target Factura_834.pdf.exe
- Size 248KB
- Sample220204-mxtcwshebk
- SHA256 945f67ae677681e14db036f753f47333556fea6f3837bef7399e440e6bc167d5
- MD5 e6829416fc3898252388037593d99d44
- SHA1 679943b9e71caf6af6d1930b3347dd6478e0d8dd
- SHA512 267edbff89189222e91238829d32ebfe9316d93c5fabe27fe6a351e7d02ef128065cd564bf8e54022deac8d49d6233b22114e881e828032cbd003910e051b296
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
Version
-
4.1
Campaign
-
g12n
Decoy
-
qutecty.com
-
pro-skingg.com
-
amrepresentacao.com
-
phonepolis.com
-
peacefulpandas.xyz
-
filmyplanet.website
-
modestus.store
-
v01cemod.com
-
northpoleobserver.com
-
living4thesun.net
-
smartwall-e.com
-
astudioetc.com
-
climateconfessions.com
-
southfillmorepm.com
-
unipak.xyz
-
tp-sala.com
-
bestcosmeticverse.com
-
grkadvisors.com
-
francycassetta.online
-
listen2yourheart073.rest
-
trendisstudio.com
-
buzzafriq.com
-
anwarpedia.com
-
grandluxfurniture.com
-
t1mespace.com
-
simonfenton.com
-
almozaina.com
-
thibaudbucquet.info
-
kejiadayuan.com
-
smalltownsofny.info
-
52sjmj.com
-
sanderarchitect.com
-
casinox-slots.xyz
-
stardollproxy.com
-
betterhealthct.com
-
instant-finance-deals.com
-
next-company-builder.com
-
chasesicksheiran.com
-
rajasthangk.xyz
-
gzc12.xyz
-
vn-vips.xyz
-
deanloades.com
-
belltekplus.com
-
susanscruisincuisine.com
-
hmautw.space
-
minnesotadoctorloan.com
-
napeerased.com
-
dirums.online
-
km5qgwp6.xyz
-
veryrhonda.com
-
newsongs4u.xyz
-
8ily.com
-
manhattanlcsw.com
-
jhdelivers.com
-
naijahealthhub.com
-
refundsecure.com
-
oneclickprintshop.com
-
georgiagohunt.com
-
deltaprintlimited.com
-
ptmuxs.com
-
perryhomevalue.com
-
havasuflavors.com
-
phaply161.com
-
topsplay.com
-
dowellashwell.com
Signatures
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Formbook Payload 2 IoCs
resource yara_rule behavioral2/memory/2728-198-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1836-261-0x00000000029A0000-0x00000000029CF000-memory.dmp formbook - Sets service image path in registry 2 TTPs
- Loads dropped DLL 1 IoCs
pid Process 3048 Factura_834.pdf.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3048 set thread context of 2728 3048 Factura_834.pdf.exe 67 PID 2728 set thread context of 2444 2728 Factura_834.pdf.exe 38 PID 1836 set thread context of 2444 1836 wscript.exe 38 - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat svchost.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotifyIcon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotifyIcon.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.013132" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4128" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132886219405258465" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "5.714129" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe - Suspicious behavior: EnumeratesProcesses 52 IoCs
pid Process 2728 Factura_834.pdf.exe 2728 Factura_834.pdf.exe 2728 Factura_834.pdf.exe 2728 Factura_834.pdf.exe 1836 wscript.exe 1836 wscript.exe 1836 wscript.exe 1836 wscript.exe 1836 wscript.exe 1836 wscript.exe 1836 wscript.exe 1836 wscript.exe 1836 wscript.exe 1836 wscript.exe 1836 wscript.exe 1836 wscript.exe 1836 wscript.exe 1836 wscript.exe 1836 wscript.exe 1836 wscript.exe 1836 wscript.exe 1836 wscript.exe 1836 wscript.exe 1836 wscript.exe 1836 wscript.exe 1836 wscript.exe 1836 wscript.exe 1836 wscript.exe 1836 wscript.exe 1836 wscript.exe 1836 wscript.exe 1836 wscript.exe 1836 wscript.exe 1836 wscript.exe 1836 wscript.exe 1836 wscript.exe 1836 wscript.exe 1836 wscript.exe 1836 wscript.exe 1836 wscript.exe 1836 wscript.exe 1836 wscript.exe 1836 wscript.exe 1836 wscript.exe 1836 wscript.exe 1836 wscript.exe 1836 wscript.exe 1836 wscript.exe 1836 wscript.exe 1836 wscript.exe 1836 wscript.exe 1836 wscript.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2444 Explorer.EXE - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 2728 Factura_834.pdf.exe 2728 Factura_834.pdf.exe 2728 Factura_834.pdf.exe 1836 wscript.exe 1836 wscript.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2728 Factura_834.pdf.exe Token: SeDebugPrivilege 1836 wscript.exe Token: SeShutdownPrivilege 2444 Explorer.EXE Token: SeCreatePagefilePrivilege 2444 Explorer.EXE - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3048 wrote to memory of 2728 3048 Factura_834.pdf.exe 67 PID 3048 wrote to memory of 2728 3048 Factura_834.pdf.exe 67 PID 3048 wrote to memory of 2728 3048 Factura_834.pdf.exe 67 PID 3048 wrote to memory of 2728 3048 Factura_834.pdf.exe 67 PID 3048 wrote to memory of 2728 3048 Factura_834.pdf.exe 67 PID 3048 wrote to memory of 2728 3048 Factura_834.pdf.exe 67 PID 2444 wrote to memory of 1836 2444 Explorer.EXE 68 PID 2444 wrote to memory of 1836 2444 Explorer.EXE 68 PID 2444 wrote to memory of 1836 2444 Explorer.EXE 68 PID 1836 wrote to memory of 3536 1836 wscript.exe 69 PID 1836 wrote to memory of 3536 1836 wscript.exe 69 PID 1836 wrote to memory of 3536 1836 wscript.exe 69
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\Factura_834.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Factura_834.pdf.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\Factura_834.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Factura_834.pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2728
-
-
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Factura_834.pdf.exe"3⤵PID:3536
-
-
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
PID:580
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe fbbbc8c2efcb7a98d939f67aaa094939 RP78vIE5NkOboxlMGJ9eNw.0.1.0.0.01⤵
- Modifies data under HKEY_USERS
PID:3960
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:464