Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
25-07-2022 04:18
Static task
static1
Behavioral task
behavioral1
Sample
Purchase order.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
Purchase order.exe
Resource
win10v2004-20220721-en
General
-
Target
Purchase order.exe
-
Size
884KB
-
MD5
c0ca159ecfd86c426acfa99e7255f874
-
SHA1
1e8b2344a0252db75e9a106111e89d844639cb62
-
SHA256
aae89af9bf54cc3d9659631b9438942f192239e50eba6da7918ebced50c700c5
-
SHA512
353a5d40ff2df98fb9d0442bb18f04e8c0a61c58f21bbb8192605d82089810607483faa8a8fc863bfa5602bd7a547142112105de21ae48854de4699696ad06ab
Malware Config
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Purchase order.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Control Panel\International\Geo\Nation Purchase order.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Purchase order.exePurchase order.execolorcpl.exedescription pid process target process PID 1092 set thread context of 1296 1092 Purchase order.exe Purchase order.exe PID 1296 set thread context of 1376 1296 Purchase order.exe Explorer.EXE PID 1296 set thread context of 1376 1296 Purchase order.exe Explorer.EXE PID 524 set thread context of 1376 524 colorcpl.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
Purchase order.exePurchase order.execolorcpl.exepid process 1092 Purchase order.exe 1296 Purchase order.exe 1296 Purchase order.exe 1296 Purchase order.exe 1296 Purchase order.exe 1296 Purchase order.exe 524 colorcpl.exe 524 colorcpl.exe 524 colorcpl.exe 524 colorcpl.exe 524 colorcpl.exe 524 colorcpl.exe 524 colorcpl.exe 524 colorcpl.exe 524 colorcpl.exe 524 colorcpl.exe 524 colorcpl.exe 524 colorcpl.exe 524 colorcpl.exe 524 colorcpl.exe 524 colorcpl.exe 524 colorcpl.exe 524 colorcpl.exe 524 colorcpl.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
Purchase order.execolorcpl.exepid process 1296 Purchase order.exe 1296 Purchase order.exe 1296 Purchase order.exe 1296 Purchase order.exe 524 colorcpl.exe 524 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Purchase order.exePurchase order.execolorcpl.exedescription pid process Token: SeDebugPrivilege 1092 Purchase order.exe Token: SeDebugPrivilege 1296 Purchase order.exe Token: SeDebugPrivilege 524 colorcpl.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1376 Explorer.EXE 1376 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1376 Explorer.EXE 1376 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Purchase order.exePurchase order.exedescription pid process target process PID 1092 wrote to memory of 1136 1092 Purchase order.exe Purchase order.exe PID 1092 wrote to memory of 1136 1092 Purchase order.exe Purchase order.exe PID 1092 wrote to memory of 1136 1092 Purchase order.exe Purchase order.exe PID 1092 wrote to memory of 1136 1092 Purchase order.exe Purchase order.exe PID 1092 wrote to memory of 1296 1092 Purchase order.exe Purchase order.exe PID 1092 wrote to memory of 1296 1092 Purchase order.exe Purchase order.exe PID 1092 wrote to memory of 1296 1092 Purchase order.exe Purchase order.exe PID 1092 wrote to memory of 1296 1092 Purchase order.exe Purchase order.exe PID 1092 wrote to memory of 1296 1092 Purchase order.exe Purchase order.exe PID 1092 wrote to memory of 1296 1092 Purchase order.exe Purchase order.exe PID 1092 wrote to memory of 1296 1092 Purchase order.exe Purchase order.exe PID 1296 wrote to memory of 524 1296 Purchase order.exe colorcpl.exe PID 1296 wrote to memory of 524 1296 Purchase order.exe colorcpl.exe PID 1296 wrote to memory of 524 1296 Purchase order.exe colorcpl.exe PID 1296 wrote to memory of 524 1296 Purchase order.exe colorcpl.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\Purchase order.exe"C:\Users\Admin\AppData\Local\Temp\Purchase order.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchase order.exe"{path}"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Purchase order.exe"{path}"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/524-72-0x0000000000000000-mapping.dmp
-
memory/524-80-0x00000000000C0000-0x00000000000ED000-memory.dmpFilesize
180KB
-
memory/524-78-0x0000000001DE0000-0x0000000001E70000-memory.dmpFilesize
576KB
-
memory/524-77-0x0000000001F70000-0x0000000002273000-memory.dmpFilesize
3.0MB
-
memory/524-76-0x00000000000C0000-0x00000000000ED000-memory.dmpFilesize
180KB
-
memory/524-75-0x00000000006A0000-0x00000000006B8000-memory.dmpFilesize
96KB
-
memory/1092-55-0x0000000075481000-0x0000000075483000-memory.dmpFilesize
8KB
-
memory/1092-56-0x0000000000450000-0x000000000045A000-memory.dmpFilesize
40KB
-
memory/1092-57-0x0000000004E50000-0x0000000004ED6000-memory.dmpFilesize
536KB
-
memory/1092-58-0x0000000000940000-0x0000000000972000-memory.dmpFilesize
200KB
-
memory/1092-54-0x0000000000A30000-0x0000000000B14000-memory.dmpFilesize
912KB
-
memory/1296-60-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/1296-70-0x0000000000210000-0x0000000000221000-memory.dmpFilesize
68KB
-
memory/1296-67-0x00000000001D0000-0x00000000001E1000-memory.dmpFilesize
68KB
-
memory/1296-73-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/1296-66-0x0000000000CB0000-0x0000000000FB3000-memory.dmpFilesize
3.0MB
-
memory/1296-65-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/1296-63-0x00000000004207F0-mapping.dmp
-
memory/1296-62-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/1296-59-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/1376-68-0x0000000006AA0000-0x0000000006C3E000-memory.dmpFilesize
1.6MB
-
memory/1376-71-0x0000000006780000-0x000000000688F000-memory.dmpFilesize
1.1MB
-
memory/1376-79-0x0000000006C40000-0x0000000006D7D000-memory.dmpFilesize
1.2MB
-
memory/1376-81-0x0000000006C40000-0x0000000006D7D000-memory.dmpFilesize
1.2MB