Analysis
-
max time kernel
146s -
max time network
43s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
29-06-2022 16:10
Static task
static1
Behavioral task
behavioral1
Sample
Ordem de compra para julho.pdf.exe
Resource
win7-20220414-en
General
-
Target
Ordem de compra para julho.pdf.exe
-
Size
687KB
-
MD5
01ac3fb5a4476de95369f325ea906ea5
-
SHA1
e291db506ea6b82f60b1b5e035f764595d6b7f3c
-
SHA256
b6426721805cf7ba17f04f3ab2540c182758682a0b6397ee277f4f3aa3709bd1
-
SHA512
548686caf1858bb22aaebee04c0ee0a8fef3d4f4577a6700dbbfe213d34654e621be09927bbddff418c61c33c9380c8a6f92ffe3ae202ab53c149d5f80dd40ca
Malware Config
Extracted
formbook
4.1
de08
retirecloudyyard.com
fabiyan.xyz
chrisarlyde.com
selapex.com
vivalosgales.com
specialty-medicine.com
contasesolucoes.com
satunusanews.net
allyibc.com
alameda1876.com
artofdala.com
yukoidusp.xyz
steeldrumbandnearme.com
stonewedgetechnology.com
kentonai.com
macquarie-private.com
ddgwy.com
megagreenhousekits.com
descomplicaomarketing.com
inclusiverealtor.com
themummyfront.club
computerfashiondesigns.com
ericparlatore.com
whathappened2me.com
baksomail.xyz
mugupplatform.com
shopsolutely.com
gymcservices.com
qianshunchina.com
zoomsbshab.icu
esrmtech.com
966211.com
stockinsidepr.com
df-wh.com
smartshopapps.com
kayseriadsl.com
acedesserts.com
205qs.com
ei8i.com
aibtly.com
kpviewllc.net
nnehandebol.com
torontonianapparel.ca
therealgoldenganjagang.com
mingxiang99.com
rewkagcompany.xyz
ahmee4.com
valen.info
vacuumfun.parts
fabiyan.xyz
psncareersolutions.com
escobargroups.com
michigandice.com
ey3solutions.com
li-n.info
puingkehancuran.xyz
bilt-green.com
dfysuitetech.xyz
abdoomar.com
actsaka.xyz
justsweatitout.com
axabank.life
billyyaka.com
mypatchtools.com
epulsive.com
Signatures
-
Formbook Payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/588-67-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/588-68-0x000000000041F120-mapping.dmp formbook behavioral1/memory/588-70-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/600-79-0x0000000000080000-0x00000000000AF000-memory.dmp formbook behavioral1/memory/600-82-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Ordem de compra para julho.pdf.exeRegSvcs.exechkdsk.exedescription pid process target process PID 1416 set thread context of 588 1416 Ordem de compra para julho.pdf.exe RegSvcs.exe PID 588 set thread context of 1220 588 RegSvcs.exe Explorer.EXE PID 600 set thread context of 1220 600 chkdsk.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
RegSvcs.exepowershell.exechkdsk.exepid process 588 RegSvcs.exe 588 RegSvcs.exe 1732 powershell.exe 600 chkdsk.exe 600 chkdsk.exe 600 chkdsk.exe 600 chkdsk.exe 600 chkdsk.exe 600 chkdsk.exe 600 chkdsk.exe 600 chkdsk.exe 600 chkdsk.exe 600 chkdsk.exe 600 chkdsk.exe 600 chkdsk.exe 600 chkdsk.exe 600 chkdsk.exe 600 chkdsk.exe 600 chkdsk.exe 600 chkdsk.exe 600 chkdsk.exe 600 chkdsk.exe 600 chkdsk.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.exechkdsk.exepid process 588 RegSvcs.exe 588 RegSvcs.exe 588 RegSvcs.exe 600 chkdsk.exe 600 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
RegSvcs.exepowershell.exechkdsk.exedescription pid process Token: SeDebugPrivilege 588 RegSvcs.exe Token: SeDebugPrivilege 1732 powershell.exe Token: SeDebugPrivilege 600 chkdsk.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
Ordem de compra para julho.pdf.exeExplorer.EXEchkdsk.exedescription pid process target process PID 1416 wrote to memory of 1732 1416 Ordem de compra para julho.pdf.exe powershell.exe PID 1416 wrote to memory of 1732 1416 Ordem de compra para julho.pdf.exe powershell.exe PID 1416 wrote to memory of 1732 1416 Ordem de compra para julho.pdf.exe powershell.exe PID 1416 wrote to memory of 1732 1416 Ordem de compra para julho.pdf.exe powershell.exe PID 1416 wrote to memory of 1236 1416 Ordem de compra para julho.pdf.exe schtasks.exe PID 1416 wrote to memory of 1236 1416 Ordem de compra para julho.pdf.exe schtasks.exe PID 1416 wrote to memory of 1236 1416 Ordem de compra para julho.pdf.exe schtasks.exe PID 1416 wrote to memory of 1236 1416 Ordem de compra para julho.pdf.exe schtasks.exe PID 1416 wrote to memory of 588 1416 Ordem de compra para julho.pdf.exe RegSvcs.exe PID 1416 wrote to memory of 588 1416 Ordem de compra para julho.pdf.exe RegSvcs.exe PID 1416 wrote to memory of 588 1416 Ordem de compra para julho.pdf.exe RegSvcs.exe PID 1416 wrote to memory of 588 1416 Ordem de compra para julho.pdf.exe RegSvcs.exe PID 1416 wrote to memory of 588 1416 Ordem de compra para julho.pdf.exe RegSvcs.exe PID 1416 wrote to memory of 588 1416 Ordem de compra para julho.pdf.exe RegSvcs.exe PID 1416 wrote to memory of 588 1416 Ordem de compra para julho.pdf.exe RegSvcs.exe PID 1416 wrote to memory of 588 1416 Ordem de compra para julho.pdf.exe RegSvcs.exe PID 1416 wrote to memory of 588 1416 Ordem de compra para julho.pdf.exe RegSvcs.exe PID 1416 wrote to memory of 588 1416 Ordem de compra para julho.pdf.exe RegSvcs.exe PID 1220 wrote to memory of 600 1220 Explorer.EXE chkdsk.exe PID 1220 wrote to memory of 600 1220 Explorer.EXE chkdsk.exe PID 1220 wrote to memory of 600 1220 Explorer.EXE chkdsk.exe PID 1220 wrote to memory of 600 1220 Explorer.EXE chkdsk.exe PID 600 wrote to memory of 1488 600 chkdsk.exe cmd.exe PID 600 wrote to memory of 1488 600 chkdsk.exe cmd.exe PID 600 wrote to memory of 1488 600 chkdsk.exe cmd.exe PID 600 wrote to memory of 1488 600 chkdsk.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ordem de compra para julho.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Ordem de compra para julho.pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\JXVNljtiVHwGbZ.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JXVNljtiVHwGbZ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp711B.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp711B.tmpFilesize
1KB
MD5aa274cc321ca553f6958976385e9f0a7
SHA1e9d9401324053a2ba97806e5db5c23b52661653d
SHA256d01f18622754c7145d0db31695a018217187c59b463da80b5c36bdb687ad1b33
SHA5126af92d7b06f9a3637b736b33357d02b25a12c16b3533c8ec95fb8edd386fc1e74086eea5a4f6ae050a11eb49cf8430431be686e89168f9962da0c60fedb6f1cc
-
memory/588-64-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/588-73-0x0000000000160000-0x0000000000174000-memory.dmpFilesize
80KB
-
memory/588-70-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/588-72-0x0000000000A20000-0x0000000000D23000-memory.dmpFilesize
3.0MB
-
memory/588-68-0x000000000041F120-mapping.dmp
-
memory/588-67-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/588-65-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/600-80-0x0000000002080000-0x0000000002383000-memory.dmpFilesize
3.0MB
-
memory/600-76-0x0000000000000000-mapping.dmp
-
memory/600-78-0x00000000006D0000-0x00000000006D7000-memory.dmpFilesize
28KB
-
memory/600-79-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/600-81-0x0000000001DB0000-0x0000000001E43000-memory.dmpFilesize
588KB
-
memory/600-82-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/1220-74-0x0000000004B20000-0x0000000004CBB000-memory.dmpFilesize
1.6MB
-
memory/1236-60-0x0000000000000000-mapping.dmp
-
memory/1416-63-0x0000000004C50000-0x0000000004C84000-memory.dmpFilesize
208KB
-
memory/1416-54-0x0000000001030000-0x00000000010E2000-memory.dmpFilesize
712KB
-
memory/1416-58-0x0000000005070000-0x00000000050DC000-memory.dmpFilesize
432KB
-
memory/1416-57-0x0000000000420000-0x000000000042A000-memory.dmpFilesize
40KB
-
memory/1416-56-0x0000000000410000-0x0000000000426000-memory.dmpFilesize
88KB
-
memory/1416-55-0x00000000764C1000-0x00000000764C3000-memory.dmpFilesize
8KB
-
memory/1488-77-0x0000000000000000-mapping.dmp
-
memory/1732-71-0x000000006EB10000-0x000000006F0BB000-memory.dmpFilesize
5.7MB
-
memory/1732-75-0x000000006EB10000-0x000000006F0BB000-memory.dmpFilesize
5.7MB
-
memory/1732-59-0x0000000000000000-mapping.dmp