Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
06-07-2022 14:46
Static task
static1
Behavioral task
behavioral1
Sample
80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe
Resource
win7-20220414-en
General
-
Target
80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe
-
Size
548KB
-
MD5
52b4ab184953eb0206a26c7b6da611f9
-
SHA1
3efe986b907a864ea964fcf82a428dd36ef01b40
-
SHA256
80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386
-
SHA512
edc5200e160898142f436ba8403247501e9c7e0e98a7876797c0e0d3dfc1bcd9cfb5656fd44007c7d5b5ab9aa1ef2550df1d8e677c2d53082dd4b92b404e6a60
Malware Config
Extracted
formbook
4.1
de08
retirecloudyyard.com
fabiyan.xyz
chrisarlyde.com
selapex.com
vivalosgales.com
specialty-medicine.com
contasesolucoes.com
satunusanews.net
allyibc.com
alameda1876.com
artofdala.com
yukoidusp.xyz
steeldrumbandnearme.com
stonewedgetechnology.com
kentonai.com
macquarie-private.com
ddgwy.com
megagreenhousekits.com
descomplicaomarketing.com
inclusiverealtor.com
themummyfront.club
computerfashiondesigns.com
ericparlatore.com
whathappened2me.com
baksomail.xyz
mugupplatform.com
shopsolutely.com
gymcservices.com
qianshunchina.com
zoomsbshab.icu
esrmtech.com
966211.com
stockinsidepr.com
df-wh.com
smartshopapps.com
kayseriadsl.com
acedesserts.com
205qs.com
ei8i.com
aibtly.com
kpviewllc.net
nnehandebol.com
torontonianapparel.ca
therealgoldenganjagang.com
mingxiang99.com
rewkagcompany.xyz
ahmee4.com
valen.info
vacuumfun.parts
fabiyan.xyz
psncareersolutions.com
escobargroups.com
michigandice.com
ey3solutions.com
li-n.info
puingkehancuran.xyz
bilt-green.com
dfysuitetech.xyz
abdoomar.com
actsaka.xyz
justsweatitout.com
axabank.life
billyyaka.com
mypatchtools.com
epulsive.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/880-68-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/880-69-0x000000000041F120-mapping.dmp formbook behavioral1/memory/880-71-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1920-80-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exeRegSvcs.execolorcpl.exedescription pid process target process PID 1452 set thread context of 880 1452 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe RegSvcs.exe PID 880 set thread context of 1188 880 RegSvcs.exe Explorer.EXE PID 1920 set thread context of 1188 1920 colorcpl.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
RegSvcs.exepowershell.execolorcpl.exepid process 880 RegSvcs.exe 880 RegSvcs.exe 1004 powershell.exe 1920 colorcpl.exe 1920 colorcpl.exe 1920 colorcpl.exe 1920 colorcpl.exe 1920 colorcpl.exe 1920 colorcpl.exe 1920 colorcpl.exe 1920 colorcpl.exe 1920 colorcpl.exe 1920 colorcpl.exe 1920 colorcpl.exe 1920 colorcpl.exe 1920 colorcpl.exe 1920 colorcpl.exe 1920 colorcpl.exe 1920 colorcpl.exe 1920 colorcpl.exe 1920 colorcpl.exe 1920 colorcpl.exe 1920 colorcpl.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.execolorcpl.exepid process 880 RegSvcs.exe 880 RegSvcs.exe 880 RegSvcs.exe 1920 colorcpl.exe 1920 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
RegSvcs.exepowershell.execolorcpl.exedescription pid process Token: SeDebugPrivilege 880 RegSvcs.exe Token: SeDebugPrivilege 1004 powershell.exe Token: SeDebugPrivilege 1920 colorcpl.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1188 Explorer.EXE 1188 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1188 Explorer.EXE 1188 Explorer.EXE -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exeExplorer.EXEcolorcpl.exedescription pid process target process PID 1452 wrote to memory of 1004 1452 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe powershell.exe PID 1452 wrote to memory of 1004 1452 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe powershell.exe PID 1452 wrote to memory of 1004 1452 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe powershell.exe PID 1452 wrote to memory of 1004 1452 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe powershell.exe PID 1452 wrote to memory of 112 1452 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe schtasks.exe PID 1452 wrote to memory of 112 1452 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe schtasks.exe PID 1452 wrote to memory of 112 1452 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe schtasks.exe PID 1452 wrote to memory of 112 1452 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe schtasks.exe PID 1452 wrote to memory of 880 1452 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe RegSvcs.exe PID 1452 wrote to memory of 880 1452 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe RegSvcs.exe PID 1452 wrote to memory of 880 1452 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe RegSvcs.exe PID 1452 wrote to memory of 880 1452 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe RegSvcs.exe PID 1452 wrote to memory of 880 1452 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe RegSvcs.exe PID 1452 wrote to memory of 880 1452 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe RegSvcs.exe PID 1452 wrote to memory of 880 1452 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe RegSvcs.exe PID 1452 wrote to memory of 880 1452 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe RegSvcs.exe PID 1452 wrote to memory of 880 1452 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe RegSvcs.exe PID 1452 wrote to memory of 880 1452 80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe RegSvcs.exe PID 1188 wrote to memory of 1920 1188 Explorer.EXE colorcpl.exe PID 1188 wrote to memory of 1920 1188 Explorer.EXE colorcpl.exe PID 1188 wrote to memory of 1920 1188 Explorer.EXE colorcpl.exe PID 1188 wrote to memory of 1920 1188 Explorer.EXE colorcpl.exe PID 1920 wrote to memory of 1556 1920 colorcpl.exe cmd.exe PID 1920 wrote to memory of 1556 1920 colorcpl.exe cmd.exe PID 1920 wrote to memory of 1556 1920 colorcpl.exe cmd.exe PID 1920 wrote to memory of 1556 1920 colorcpl.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe"C:\Users\Admin\AppData\Local\Temp\80d967b707bb161f63ea1f4dd4b18ca3bea87e5ccc1ecfbbafe1ce251eaf2386.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\msUCFUQkYKOqDO.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\msUCFUQkYKOqDO" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5CFF.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp5CFF.tmpFilesize
1KB
MD5033438482d0ad57ef16f89d73591bb94
SHA192e493027172cf75f50153f63bcb369445751e64
SHA2568cbfa5ce61c8833d532a51f97c5bfef4e0f4cc0f04781af4528f325a1ff364c6
SHA5125e1af22aca9844f4fe035c0bd275b814257088f6bf127e52af451a096bfee52ee6fa151e1012ecb3d31514540d8547a34d8d18987d5ded6232959a10383d161a
-
memory/112-61-0x0000000000000000-mapping.dmp
-
memory/880-65-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/880-74-0x0000000000220000-0x0000000000234000-memory.dmpFilesize
80KB
-
memory/880-73-0x0000000000830000-0x0000000000B33000-memory.dmpFilesize
3.0MB
-
memory/880-71-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/880-69-0x000000000041F120-mapping.dmp
-
memory/880-68-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/880-66-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1004-60-0x0000000000000000-mapping.dmp
-
memory/1004-72-0x000000006F460000-0x000000006FA0B000-memory.dmpFilesize
5.7MB
-
memory/1188-84-0x0000000004C80000-0x0000000004DE7000-memory.dmpFilesize
1.4MB
-
memory/1188-83-0x0000000004C80000-0x0000000004DE7000-memory.dmpFilesize
1.4MB
-
memory/1188-75-0x0000000007640000-0x00000000077EE000-memory.dmpFilesize
1.7MB
-
memory/1452-57-0x0000000000B10000-0x0000000000B2C000-memory.dmpFilesize
112KB
-
memory/1452-64-0x00000000052D0000-0x0000000005304000-memory.dmpFilesize
208KB
-
memory/1452-56-0x0000000004EE0000-0x0000000004F5A000-memory.dmpFilesize
488KB
-
memory/1452-55-0x0000000075EF1000-0x0000000075EF3000-memory.dmpFilesize
8KB
-
memory/1452-58-0x0000000000AC0000-0x0000000000ACA000-memory.dmpFilesize
40KB
-
memory/1452-59-0x0000000005050000-0x00000000050BE000-memory.dmpFilesize
440KB
-
memory/1452-54-0x0000000000C80000-0x0000000000D0E000-memory.dmpFilesize
568KB
-
memory/1556-78-0x0000000000000000-mapping.dmp
-
memory/1920-76-0x0000000000000000-mapping.dmp
-
memory/1920-79-0x0000000000900000-0x0000000000918000-memory.dmpFilesize
96KB
-
memory/1920-80-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/1920-81-0x00000000021C0000-0x00000000024C3000-memory.dmpFilesize
3.0MB
-
memory/1920-82-0x00000000007D0000-0x0000000000863000-memory.dmpFilesize
588KB