Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 12:02
Static task
static1
Behavioral task
behavioral1
Sample
Anekgroup Order.exe
Resource
win7-20220414-en
General
-
Target
Anekgroup Order.exe
-
Size
494KB
-
MD5
d2b789d2c98252774eb46369c122e862
-
SHA1
79d2d76e879bf3dc2d9c5c748fd69c37ce6c3d16
-
SHA256
823f72e280224715e6d4f7fff1f792d2c372d7633eab250f2308325eff114c18
-
SHA512
e2b217874575571d6159a35cc34be34de1ba078e17084e5965f56e4066b6ca8acbdf1bf40d4a30ed5c21a0716baa308778af1fdd02f2bbd1d9f7a036d44b1d84
Malware Config
Extracted
formbook
4.1
xwqs
miracledynamic.win
farshadzandi.com
cruisesociety.site
alluredecorate.com
topseptictanks.net
goodguysblogblack.com
xn--80aaexkk3ad8c.com
manbet22.net
ristohotelcastellani.com
vesinhvinhlong.com
fashion-phoenix.com
iferrara.expert
sellyourart.gallery
hayatmag.info
serafimasflowersparadise.com
4p1o3a.biz
maidonline.net
kuntaijinrong.com
makethebreastpumpnotsuck.com
europeansmartcapital.com
familyfolktales.com
thetowing.world
zulemalabra.com
yennyso.com
asmnb.com
aryabhisak.com
taqueriaelherradero.com
ilovebuz.cricket
streamone.studio
othreport.net
xvyhhx.download
stratz-consulting.com
flangeroofs.com
aspiresuccessconsulting.com
ohiorecoverypros.info
xn--igt54izq0a.com
mojzesz.email
ecosnus.com
robocroft.com
secengine.net
thczepam.com
studiopenelope.com
chrisrubino.net
immogecheck.com
pier39.news
studentcreditcardreviews.info
plombest.com
04sbw.com
vonkeppel.com
pastecolor.com
boot-kik.com
comegetsomevoip.com
arttextileduverdon.info
bestworldwatches.com
dimasjts.com
offerberg.com
cqchidu.com
luxeladybee.net
turismosaoluis.com
jubfps.site
bobandbertie.com
1i0fourapple.loan
pushinglovely.com
abacusfinancialgroupinc.com
mansiobok3.info
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1940-65-0x000000000041E350-mapping.dmp formbook behavioral1/memory/1940-64-0x0000000000400000-0x000000000042D000-memory.dmp formbook behavioral1/memory/1940-67-0x0000000000400000-0x000000000042D000-memory.dmp formbook behavioral1/memory/1276-74-0x00000000000E0000-0x000000000010D000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 820 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
colorcpl.exedescription ioc process Key created \Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run colorcpl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\YLUTQRPH7VZ = "C:\\Program Files (x86)\\Nldp\\colorcpl8pjxn.exe" colorcpl.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Anekgroup Order.exeAnekgroup Order.execolorcpl.exedescription pid process target process PID 1816 set thread context of 1940 1816 Anekgroup Order.exe Anekgroup Order.exe PID 1940 set thread context of 1260 1940 Anekgroup Order.exe Explorer.EXE PID 1276 set thread context of 1260 1276 colorcpl.exe Explorer.EXE -
Drops file in Program Files directory 1 IoCs
Processes:
colorcpl.exedescription ioc process File opened for modification C:\Program Files (x86)\Nldp\colorcpl8pjxn.exe colorcpl.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Processes:
colorcpl.exedescription ioc process Key created \Registry\User\S-1-5-21-2277218442-1199762539-2004043321-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 colorcpl.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
Anekgroup Order.exeAnekgroup Order.execolorcpl.exepid process 1816 Anekgroup Order.exe 1940 Anekgroup Order.exe 1940 Anekgroup Order.exe 1276 colorcpl.exe 1276 colorcpl.exe 1276 colorcpl.exe 1276 colorcpl.exe 1276 colorcpl.exe 1276 colorcpl.exe 1276 colorcpl.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
Anekgroup Order.execolorcpl.exepid process 1940 Anekgroup Order.exe 1940 Anekgroup Order.exe 1940 Anekgroup Order.exe 1276 colorcpl.exe 1276 colorcpl.exe 1276 colorcpl.exe 1276 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Anekgroup Order.exeAnekgroup Order.execolorcpl.exedescription pid process Token: SeDebugPrivilege 1816 Anekgroup Order.exe Token: SeDebugPrivilege 1940 Anekgroup Order.exe Token: SeDebugPrivilege 1276 colorcpl.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1260 Explorer.EXE 1260 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1260 Explorer.EXE 1260 Explorer.EXE -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
Anekgroup Order.exeExplorer.EXEcolorcpl.exedescription pid process target process PID 1816 wrote to memory of 1384 1816 Anekgroup Order.exe schtasks.exe PID 1816 wrote to memory of 1384 1816 Anekgroup Order.exe schtasks.exe PID 1816 wrote to memory of 1384 1816 Anekgroup Order.exe schtasks.exe PID 1816 wrote to memory of 1384 1816 Anekgroup Order.exe schtasks.exe PID 1816 wrote to memory of 1960 1816 Anekgroup Order.exe Anekgroup Order.exe PID 1816 wrote to memory of 1960 1816 Anekgroup Order.exe Anekgroup Order.exe PID 1816 wrote to memory of 1960 1816 Anekgroup Order.exe Anekgroup Order.exe PID 1816 wrote to memory of 1960 1816 Anekgroup Order.exe Anekgroup Order.exe PID 1816 wrote to memory of 1940 1816 Anekgroup Order.exe Anekgroup Order.exe PID 1816 wrote to memory of 1940 1816 Anekgroup Order.exe Anekgroup Order.exe PID 1816 wrote to memory of 1940 1816 Anekgroup Order.exe Anekgroup Order.exe PID 1816 wrote to memory of 1940 1816 Anekgroup Order.exe Anekgroup Order.exe PID 1816 wrote to memory of 1940 1816 Anekgroup Order.exe Anekgroup Order.exe PID 1816 wrote to memory of 1940 1816 Anekgroup Order.exe Anekgroup Order.exe PID 1816 wrote to memory of 1940 1816 Anekgroup Order.exe Anekgroup Order.exe PID 1260 wrote to memory of 1276 1260 Explorer.EXE colorcpl.exe PID 1260 wrote to memory of 1276 1260 Explorer.EXE colorcpl.exe PID 1260 wrote to memory of 1276 1260 Explorer.EXE colorcpl.exe PID 1260 wrote to memory of 1276 1260 Explorer.EXE colorcpl.exe PID 1276 wrote to memory of 820 1276 colorcpl.exe cmd.exe PID 1276 wrote to memory of 820 1276 colorcpl.exe cmd.exe PID 1276 wrote to memory of 820 1276 colorcpl.exe cmd.exe PID 1276 wrote to memory of 820 1276 colorcpl.exe cmd.exe PID 1276 wrote to memory of 1980 1276 colorcpl.exe Firefox.exe PID 1276 wrote to memory of 1980 1276 colorcpl.exe Firefox.exe PID 1276 wrote to memory of 1980 1276 colorcpl.exe Firefox.exe PID 1276 wrote to memory of 1980 1276 colorcpl.exe Firefox.exe PID 1276 wrote to memory of 1980 1276 colorcpl.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Anekgroup Order.exe"C:\Users\Admin\AppData\Local\Temp\Anekgroup Order.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DTSbqLcmux" /XML "C:\Users\Admin\AppData\Local\Temp\tmp18CF.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Anekgroup Order.exe"C:\Users\Admin\AppData\Local\Temp\Anekgroup Order.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Anekgroup Order.exe"C:\Users\Admin\AppData\Local\Temp\Anekgroup Order.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Anekgroup Order.exe"3⤵
- Deletes itself
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp18CF.tmpFilesize
1KB
MD5d496ce37c0d29e4a1b9de076a93ed1a1
SHA159101a3c9c8eae27591e78b9658e266aa251b794
SHA2566d0f7a47d0338deef67db414d9526bfded8de425d952d1d9c3a6d3697ae8d53f
SHA51215d422b079f9e5c68f983e46a1e7bc0e9bc6a4798e7d968478fb2038edbd830303f42de83558e3fa8b96a30e326d5d0f7b0474a4da3e966a01b328d3d8abb910
-
memory/820-76-0x0000000000000000-mapping.dmp
-
memory/1260-70-0x0000000006B90000-0x0000000006CFD000-memory.dmpFilesize
1.4MB
-
memory/1260-78-0x00000000072C0000-0x0000000007453000-memory.dmpFilesize
1.6MB
-
memory/1276-77-0x00000000008F0000-0x0000000000983000-memory.dmpFilesize
588KB
-
memory/1276-75-0x0000000001FF0000-0x00000000022F3000-memory.dmpFilesize
3.0MB
-
memory/1276-74-0x00000000000E0000-0x000000000010D000-memory.dmpFilesize
180KB
-
memory/1276-73-0x0000000000BD0000-0x0000000000BE8000-memory.dmpFilesize
96KB
-
memory/1276-71-0x0000000000000000-mapping.dmp
-
memory/1384-59-0x0000000000000000-mapping.dmp
-
memory/1816-54-0x0000000000E50000-0x0000000000ED2000-memory.dmpFilesize
520KB
-
memory/1816-58-0x0000000000C20000-0x0000000000C62000-memory.dmpFilesize
264KB
-
memory/1816-57-0x0000000004440000-0x00000000044AC000-memory.dmpFilesize
432KB
-
memory/1816-56-0x0000000000270000-0x0000000000278000-memory.dmpFilesize
32KB
-
memory/1816-55-0x0000000075D21000-0x0000000075D23000-memory.dmpFilesize
8KB
-
memory/1940-64-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/1940-67-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/1940-68-0x0000000000910000-0x0000000000C13000-memory.dmpFilesize
3.0MB
-
memory/1940-69-0x0000000000290000-0x00000000002A4000-memory.dmpFilesize
80KB
-
memory/1940-65-0x000000000041E350-mapping.dmp
-
memory/1940-62-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/1940-61-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB