Analysis
- max time kernel
153s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
14/02/2022, 03:28
Static task
static1
Behavioral task
behavioral1
Sample
DHL Shipment_xlsx.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target DHL Shipment_xlsx.exe
- Size 290KB
- Sample220214-d1cd4seca8
- SHA256 a83afdd193623f46ac870f04455f2176d64466c5e2d3cd92eda0498de29f0417
- MD5 94f327c3dbb3880dfec7693a1e1ffd72
- SHA1 f3a3f8f53d2b7b751f461b5c04941a4740344511
- SHA512 04f770950f7cef42662f210a8b8793004b84605c5f60f2527c77dd27d04953030cc2b8ae1b6aaf608c7e05025fcfee7bb1720f870b66671446284a3cd56ba13a
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
Version
-
4.1
Campaign
-
by73
Decoy
-
advertencys.info
-
printableminis.com
-
mjahpr.icu
-
workremotehome.com
-
es-dailynews.info
-
zaryard.com
-
your-bakemark.com
-
metalypsis.com
-
primehomerealtyut.com
-
turbantechie.com
-
dd-mhgj.com
-
earnwithcryptocurrency.com
-
xn--8dbh2c.com
-
trainopia.com
-
plysec.xyz
-
avis-tente.com
-
pitabel.com
-
gabriannanails.com
-
thebipolarpenguin.com
-
alumistarcomponentes.com
-
unoevento.com
-
webceo.info
-
manukamortgages.ltd
-
tccanadapod.com
-
supersuds.info
-
brcsnow.club
-
beijing911.com
-
jinnkosolar.com
-
monanimes.com
-
depivony.space
-
webstergreenparking.com
-
sp2022.top
-
jenoediting.com
-
beautysurgepodcast.com
-
untitlednft.art
-
abmur.icu
-
albagroup.online
-
hunbrain.com
-
gmiinvestment.com
-
lumpwant.com
-
fr-kamagra.com
-
nightdate.club
-
onlineritual.com
-
shinaideba.com
-
craftsmenmasters.com
-
stock-file.com
-
queensmencocktails.com
-
megaconstructionofct.com
-
youcomway.com
-
multichannels247.com
-
pasti-lite.com
-
pokerfac.info
-
highpointquartet.com
-
smokinwaffles.com
-
ocoremioparis.com
-
decisivedevelopmentllc.com
-
diamondstormentertainment.com
-
vidacanela.com
-
hgwpoh.icu
-
eqajyxeg.space
-
easydocumentssolutions.com
-
perfect-calendar.com
-
oidepps.com
-
solastaacademy.com
-
activusrealtime.com
Signatures
- Formbook Payload 2 IoCs
resource yara_rule behavioral2/memory/5060-134-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4188-142-0x00000000012C0000-0x00000000012EF000-memory.dmp formbook - Executes dropped EXE 2 IoCs
pid Process 4724 uhdabgqf.exe 5060 uhdabgqf.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 4724 set thread context of 5060 4724 uhdabgqf.exe 82 PID 5060 set thread context of 2352 5060 uhdabgqf.exe 75 PID 4188 set thread context of 2352 4188 colorcpl.exe 75 - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 5060 uhdabgqf.exe 5060 uhdabgqf.exe 5060 uhdabgqf.exe 5060 uhdabgqf.exe 4188 colorcpl.exe 4188 colorcpl.exe 4188 colorcpl.exe 4188 colorcpl.exe 4188 colorcpl.exe 4188 colorcpl.exe 4188 colorcpl.exe 4188 colorcpl.exe 4188 colorcpl.exe 4188 colorcpl.exe 4188 colorcpl.exe 4188 colorcpl.exe 4188 colorcpl.exe 4188 colorcpl.exe 4188 colorcpl.exe 4188 colorcpl.exe 4188 colorcpl.exe 4188 colorcpl.exe 4188 colorcpl.exe 4188 colorcpl.exe 4188 colorcpl.exe 4188 colorcpl.exe 4188 colorcpl.exe 4188 colorcpl.exe 4188 colorcpl.exe 4188 colorcpl.exe 4188 colorcpl.exe 4188 colorcpl.exe 4188 colorcpl.exe 4188 colorcpl.exe 4188 colorcpl.exe 4188 colorcpl.exe 4188 colorcpl.exe 4188 colorcpl.exe 4188 colorcpl.exe 4188 colorcpl.exe 4188 colorcpl.exe 4188 colorcpl.exe 4188 colorcpl.exe 4188 colorcpl.exe 4188 colorcpl.exe 4188 colorcpl.exe 4188 colorcpl.exe 4188 colorcpl.exe 4188 colorcpl.exe 4188 colorcpl.exe 4188 colorcpl.exe 4188 colorcpl.exe 4188 colorcpl.exe 4188 colorcpl.exe 4188 colorcpl.exe 4188 colorcpl.exe 4188 colorcpl.exe 4188 colorcpl.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2352 Explorer.EXE - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 5060 uhdabgqf.exe 5060 uhdabgqf.exe 5060 uhdabgqf.exe 4188 colorcpl.exe 4188 colorcpl.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5060 uhdabgqf.exe Token: SeDebugPrivilege 4188 colorcpl.exe Token: SeShutdownPrivilege 4624 svchost.exe Token: SeCreatePagefilePrivilege 4624 svchost.exe Token: SeShutdownPrivilege 4624 svchost.exe Token: SeCreatePagefilePrivilege 4624 svchost.exe Token: SeShutdownPrivilege 4624 svchost.exe Token: SeCreatePagefilePrivilege 4624 svchost.exe Token: SeSecurityPrivilege 2984 TiWorker.exe Token: SeRestorePrivilege 2984 TiWorker.exe Token: SeBackupPrivilege 2984 TiWorker.exe Token: SeBackupPrivilege 2984 TiWorker.exe Token: SeRestorePrivilege 2984 TiWorker.exe Token: SeSecurityPrivilege 2984 TiWorker.exe Token: SeBackupPrivilege 2984 TiWorker.exe Token: SeRestorePrivilege 2984 TiWorker.exe Token: SeSecurityPrivilege 2984 TiWorker.exe Token: SeBackupPrivilege 2984 TiWorker.exe Token: SeRestorePrivilege 2984 TiWorker.exe Token: SeSecurityPrivilege 2984 TiWorker.exe Token: SeBackupPrivilege 2984 TiWorker.exe Token: SeRestorePrivilege 2984 TiWorker.exe Token: SeSecurityPrivilege 2984 TiWorker.exe Token: SeBackupPrivilege 2984 TiWorker.exe Token: SeRestorePrivilege 2984 TiWorker.exe Token: SeSecurityPrivilege 2984 TiWorker.exe Token: SeBackupPrivilege 2984 TiWorker.exe Token: SeRestorePrivilege 2984 TiWorker.exe Token: SeSecurityPrivilege 2984 TiWorker.exe Token: SeBackupPrivilege 2984 TiWorker.exe Token: SeRestorePrivilege 2984 TiWorker.exe Token: SeSecurityPrivilege 2984 TiWorker.exe Token: SeBackupPrivilege 2984 TiWorker.exe Token: SeRestorePrivilege 2984 TiWorker.exe Token: SeSecurityPrivilege 2984 TiWorker.exe Token: SeBackupPrivilege 2984 TiWorker.exe Token: SeRestorePrivilege 2984 TiWorker.exe Token: SeSecurityPrivilege 2984 TiWorker.exe Token: SeBackupPrivilege 2984 TiWorker.exe Token: SeRestorePrivilege 2984 TiWorker.exe Token: SeSecurityPrivilege 2984 TiWorker.exe Token: SeBackupPrivilege 2984 TiWorker.exe Token: SeRestorePrivilege 2984 TiWorker.exe Token: SeSecurityPrivilege 2984 TiWorker.exe Token: SeBackupPrivilege 2984 TiWorker.exe Token: SeRestorePrivilege 2984 TiWorker.exe Token: SeSecurityPrivilege 2984 TiWorker.exe Token: SeBackupPrivilege 2984 TiWorker.exe Token: SeRestorePrivilege 2984 TiWorker.exe Token: SeSecurityPrivilege 2984 TiWorker.exe Token: SeBackupPrivilege 2984 TiWorker.exe Token: SeRestorePrivilege 2984 TiWorker.exe Token: SeSecurityPrivilege 2984 TiWorker.exe Token: SeBackupPrivilege 2984 TiWorker.exe Token: SeRestorePrivilege 2984 TiWorker.exe Token: SeSecurityPrivilege 2984 TiWorker.exe Token: SeBackupPrivilege 2984 TiWorker.exe Token: SeRestorePrivilege 2984 TiWorker.exe Token: SeSecurityPrivilege 2984 TiWorker.exe Token: SeBackupPrivilege 2984 TiWorker.exe Token: SeRestorePrivilege 2984 TiWorker.exe Token: SeSecurityPrivilege 2984 TiWorker.exe Token: SeBackupPrivilege 2984 TiWorker.exe Token: SeRestorePrivilege 2984 TiWorker.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2352 Explorer.EXE 2352 Explorer.EXE - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1964 wrote to memory of 4724 1964 DHL Shipment_xlsx.exe 81 PID 1964 wrote to memory of 4724 1964 DHL Shipment_xlsx.exe 81 PID 1964 wrote to memory of 4724 1964 DHL Shipment_xlsx.exe 81 PID 4724 wrote to memory of 5060 4724 uhdabgqf.exe 82 PID 4724 wrote to memory of 5060 4724 uhdabgqf.exe 82 PID 4724 wrote to memory of 5060 4724 uhdabgqf.exe 82 PID 4724 wrote to memory of 5060 4724 uhdabgqf.exe 82 PID 4724 wrote to memory of 5060 4724 uhdabgqf.exe 82 PID 4724 wrote to memory of 5060 4724 uhdabgqf.exe 82 PID 2352 wrote to memory of 4188 2352 Explorer.EXE 86 PID 2352 wrote to memory of 4188 2352 Explorer.EXE 86 PID 2352 wrote to memory of 4188 2352 Explorer.EXE 86 PID 4188 wrote to memory of 3808 4188 colorcpl.exe 88 PID 4188 wrote to memory of 3808 4188 colorcpl.exe 88 PID 4188 wrote to memory of 3808 4188 colorcpl.exe 88
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\DHL Shipment_xlsx.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment_xlsx.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\uhdabgqf.exeC:\Users\Admin\AppData\Local\Temp\uhdabgqf.exe C:\Users\Admin\AppData\Local\Temp\sbdjq3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\uhdabgqf.exeC:\Users\Admin\AppData\Local\Temp\uhdabgqf.exe C:\Users\Admin\AppData\Local\Temp\sbdjq4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:5060
-
-
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:5068
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:4032
-
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\uhdabgqf.exe"3⤵PID:3808
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4624
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2984