Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 00:42
Static task
static1
Behavioral task
behavioral1
Sample
nalog za kupovinu.exe
Resource
win7-20220414-en
General
-
Target
nalog za kupovinu.exe
-
Size
715KB
-
MD5
0d38fa5f3688fd03f6ed4a1185427d9c
-
SHA1
91f943a7793eb56c425693ff7f3bfa206cc64ea2
-
SHA256
7df633d240b956e23b7328ae7121f7efc2a80090dbe38f2e0138d90084a795fe
-
SHA512
bc5eef6f6dc81583810fd073c14318414d421124620f75fa94e2c0a9035a16f9e88eae44ab3b487044d4aa54ec793af69e73be041bd1cdfec12235e217290007
Malware Config
Extracted
formbook
4.1
kvsz
okashyns.com
sbsgamedaejeon-two.com
drb77.com
top5dating.com
websprings.online
voizers.com
zenith.site
lahistoriade.com
qv85.com
armandonieto.com
priestvedic.com
jessandjeff.net
magic-desktop.com
jitaji.com
ldmeili.com
yuwanqingmy.com
buzhouorg.com
chaiseloungereviews.com
m2g8way.com
freespin-support.com
bocapvang.net
315px.com
eugeniobarros.tech
sif.email
xn--oorv2aj6bj7cds0d6p4b.com
polychips.com
grouptulip.win
landbank.site
bet365c.win
inbonz.com
outofthepark.today
jeaniney.com
weeip.com
dmoneylife.com
rticlubs.com
reisedating.com
marijuanadogbone.com
funippon.com
banknotesync.com
alexandre-boissard.com
valorartetattoo.com
savetheverse.com
specificpcshop.online
h0jt1y.accountant
jiqing3.com
alfaranakle.com
saft-store.com
wanderingcollective.com
santandermobi.online
557023.top
loulancaster.com
vedattelekom.com
jatinangorcity.com
goldencanaries.com
edgaralanbro.com
levelretail.com
taylorsandbek.com
upbeatnewyork.com
motoreselectricoschihuahua.com
hotair.wales
getawomantodoit.com
xiaoxiong365.com
cloudboxsupport.com
vecteur-u-shop.com
fex-tracks.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1804-64-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1804-65-0x000000000041ECA0-mapping.dmp formbook behavioral1/memory/1804-67-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/320-75-0x0000000000080000-0x00000000000AE000-memory.dmp formbook -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
colorcpl.exedescription ioc process Key created \Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run colorcpl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\XJKDUFP8DN = "C:\\Program Files (x86)\\Lqz7dtx\\systray-z_.exe" colorcpl.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
nalog za kupovinu.exeRegSvcs.execolorcpl.exedescription pid process target process PID 1064 set thread context of 1804 1064 nalog za kupovinu.exe RegSvcs.exe PID 1804 set thread context of 1268 1804 RegSvcs.exe Explorer.EXE PID 320 set thread context of 1268 320 colorcpl.exe Explorer.EXE -
Drops file in Program Files directory 1 IoCs
Processes:
colorcpl.exedescription ioc process File opened for modification C:\Program Files (x86)\Lqz7dtx\systray-z_.exe colorcpl.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Processes:
colorcpl.exedescription ioc process Key created \Registry\User\S-1-5-21-1083475884-596052423-1669053738-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 colorcpl.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
nalog za kupovinu.exeRegSvcs.execolorcpl.exepid process 1064 nalog za kupovinu.exe 1064 nalog za kupovinu.exe 1064 nalog za kupovinu.exe 1064 nalog za kupovinu.exe 1064 nalog za kupovinu.exe 1804 RegSvcs.exe 1804 RegSvcs.exe 320 colorcpl.exe 320 colorcpl.exe 320 colorcpl.exe 320 colorcpl.exe 320 colorcpl.exe 320 colorcpl.exe 320 colorcpl.exe 320 colorcpl.exe 320 colorcpl.exe 320 colorcpl.exe 320 colorcpl.exe 320 colorcpl.exe 320 colorcpl.exe 320 colorcpl.exe 320 colorcpl.exe 320 colorcpl.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
RegSvcs.execolorcpl.exepid process 1804 RegSvcs.exe 1804 RegSvcs.exe 1804 RegSvcs.exe 320 colorcpl.exe 320 colorcpl.exe 320 colorcpl.exe 320 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
nalog za kupovinu.exeRegSvcs.execolorcpl.exedescription pid process Token: SeDebugPrivilege 1064 nalog za kupovinu.exe Token: SeDebugPrivilege 1804 RegSvcs.exe Token: SeDebugPrivilege 320 colorcpl.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
nalog za kupovinu.exeExplorer.EXEcolorcpl.exedescription pid process target process PID 1064 wrote to memory of 1700 1064 nalog za kupovinu.exe schtasks.exe PID 1064 wrote to memory of 1700 1064 nalog za kupovinu.exe schtasks.exe PID 1064 wrote to memory of 1700 1064 nalog za kupovinu.exe schtasks.exe PID 1064 wrote to memory of 1700 1064 nalog za kupovinu.exe schtasks.exe PID 1064 wrote to memory of 1804 1064 nalog za kupovinu.exe RegSvcs.exe PID 1064 wrote to memory of 1804 1064 nalog za kupovinu.exe RegSvcs.exe PID 1064 wrote to memory of 1804 1064 nalog za kupovinu.exe RegSvcs.exe PID 1064 wrote to memory of 1804 1064 nalog za kupovinu.exe RegSvcs.exe PID 1064 wrote to memory of 1804 1064 nalog za kupovinu.exe RegSvcs.exe PID 1064 wrote to memory of 1804 1064 nalog za kupovinu.exe RegSvcs.exe PID 1064 wrote to memory of 1804 1064 nalog za kupovinu.exe RegSvcs.exe PID 1064 wrote to memory of 1804 1064 nalog za kupovinu.exe RegSvcs.exe PID 1064 wrote to memory of 1804 1064 nalog za kupovinu.exe RegSvcs.exe PID 1064 wrote to memory of 1804 1064 nalog za kupovinu.exe RegSvcs.exe PID 1268 wrote to memory of 320 1268 Explorer.EXE colorcpl.exe PID 1268 wrote to memory of 320 1268 Explorer.EXE colorcpl.exe PID 1268 wrote to memory of 320 1268 Explorer.EXE colorcpl.exe PID 1268 wrote to memory of 320 1268 Explorer.EXE colorcpl.exe PID 320 wrote to memory of 1792 320 colorcpl.exe cmd.exe PID 320 wrote to memory of 1792 320 colorcpl.exe cmd.exe PID 320 wrote to memory of 1792 320 colorcpl.exe cmd.exe PID 320 wrote to memory of 1792 320 colorcpl.exe cmd.exe PID 320 wrote to memory of 1956 320 colorcpl.exe Firefox.exe PID 320 wrote to memory of 1956 320 colorcpl.exe Firefox.exe PID 320 wrote to memory of 1956 320 colorcpl.exe Firefox.exe PID 320 wrote to memory of 1956 320 colorcpl.exe Firefox.exe PID 320 wrote to memory of 1956 320 colorcpl.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\nalog za kupovinu.exe"C:\Users\Admin\AppData\Local\Temp\nalog za kupovinu.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\&startupname&" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA5B2.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpA5B2.tmpFilesize
1KB
MD5dc436ff5b60ef8168376c73a193ed25c
SHA10943c8a1a0851b7b79d31fadb488cce2e0444638
SHA256949ee6cece73e1304479fc963d79d2fd8e6410f451c1ce0ae6fd6e1b40b70705
SHA5121f66711762ef86444a1e4edd5e3105b2ca5e83ec72bc6c2e04c7b5a9de1f50df3a6a85c75fc54003e4ebb0c9d8061455a6ef2e544726536592fb32dbf99736bd
-
C:\Users\Admin\AppData\Roaming\4-6P1RQE\4-6logim.jpegFilesize
64KB
MD59c4223bee296c22f5f7286e3c66e1dea
SHA1daf2dd75a31c8074ef5b05a44133fb581245ace4
SHA256bf8ecdf635bb770d0972cd7d777cda1581b34e42c8feeed980c86c991bd72427
SHA512ec4d316b94116593949cb1e96c4ae42d98ad4c64bcee732593b758971ac6ec54422193eecdf39da2dfa37e3dcd73440748405e0c741507d508cf14a3708e5659
-
C:\Users\Admin\AppData\Roaming\4-6P1RQE\4-6logrf.iniFilesize
40B
MD52f245469795b865bdd1b956c23d7893d
SHA16ad80b974d3808f5a20ea1e766c7d2f88b9e5895
SHA2561662d01a2d47b875a34fc7a8cd92e78cb2ba7f34023c7fd2639cbb10b8d94361
SHA512909f189846a5d2db208a5eb2e7cb3042c0f164caf437e2b1b6de608c0a70e4f3510b81b85753dbeec1e211e6a83e6ea8c96aff896e9b6e8ed42014473a54dc4f
-
C:\Users\Admin\AppData\Roaming\4-6P1RQE\4-6logri.iniFilesize
40B
MD5d63a82e5d81e02e399090af26db0b9cb
SHA191d0014c8f54743bba141fd60c9d963f869d76c9
SHA256eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae
SHA51238afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad
-
C:\Users\Admin\AppData\Roaming\4-6P1RQE\4-6logrv.iniFilesize
40B
MD5ba3b6bc807d4f76794c4b81b09bb9ba5
SHA124cb89501f0212ff3095ecc0aba97dd563718fb1
SHA2566eebf968962745b2e9de2ca969af7c424916d4e3fe3cc0bb9b3d414abfce9507
SHA512ecd07e601fc9e3cfc39addd7bd6f3d7f7ff3253afb40bf536e9eaac5a4c243e5ec40fbfd7b216cb0ea29f2517419601e335e33ba19dea4a46f65e38694d465bf
-
memory/320-75-0x0000000000080000-0x00000000000AE000-memory.dmpFilesize
184KB
-
memory/320-77-0x00000000009E0000-0x0000000000A73000-memory.dmpFilesize
588KB
-
memory/320-76-0x00000000021A0000-0x00000000024A3000-memory.dmpFilesize
3.0MB
-
memory/320-71-0x0000000000000000-mapping.dmp
-
memory/320-74-0x0000000000BF0000-0x0000000000C08000-memory.dmpFilesize
96KB
-
memory/1064-54-0x0000000000C50000-0x0000000000D0A000-memory.dmpFilesize
744KB
-
memory/1064-55-0x0000000000300000-0x0000000000308000-memory.dmpFilesize
32KB
-
memory/1064-56-0x0000000000B60000-0x0000000000BC8000-memory.dmpFilesize
416KB
-
memory/1064-57-0x00000000009D0000-0x0000000000A0E000-memory.dmpFilesize
248KB
-
memory/1064-58-0x00000000769D1000-0x00000000769D3000-memory.dmpFilesize
8KB
-
memory/1268-78-0x0000000004130000-0x0000000004205000-memory.dmpFilesize
852KB
-
memory/1268-70-0x0000000005FF0000-0x000000000613B000-memory.dmpFilesize
1.3MB
-
memory/1700-59-0x0000000000000000-mapping.dmp
-
memory/1792-73-0x0000000000000000-mapping.dmp
-
memory/1804-69-0x00000000002A0000-0x00000000002B4000-memory.dmpFilesize
80KB
-
memory/1804-68-0x0000000000920000-0x0000000000C23000-memory.dmpFilesize
3.0MB
-
memory/1804-67-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1804-65-0x000000000041ECA0-mapping.dmp
-
memory/1804-64-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1804-62-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1804-61-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB