Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
25-07-2022 09:11
Static task
static1
Behavioral task
behavioral1
Sample
RFQ5462-PO22000850.pdf.exe
Resource
win7-20220718-en
General
-
Target
RFQ5462-PO22000850.pdf.exe
-
Size
613KB
-
MD5
3ba5f2da42cf3865b04008a26744d346
-
SHA1
2b897b32de43663cce219db2e7c64aa7315ad6f5
-
SHA256
a06756251dbd94ca9bbecb73e4b5e9c768d3fada398cccae4a59323aebb31eab
-
SHA512
5cda5d155abbb748a9845ba2e7b6a10dbc299101b4ad3c641da558b0420a418738c5b8397f6fe5b76c1afb8b54c83137c9803afe32de7fb9a57e42166bc81811
Malware Config
Extracted
formbook
4.1
t19g
playstationspiele.com
cakesbyannal.com
racepin.space
anti-offender.com
magnetque.com
farragorealtybrokerage.com
khuludmohammed.com
v33696.com
84ggg.com
d440.com
soccersmarthome.com
ofthis.world
fivestaryardcards.com
lusyard.com
gghft.com
viajesfortur.com
rationalirrationality.com
hanaramenrestaurant.com
exactlycleanse.com
martensenargentina.com
michellesellsvt.com
pupsloveandlondon.com
kfhym.world
makeuphoje.com
ebookrise.com
flesherbrothers.com
doonaudio.com
doanet.xyz
wrghintlian.com
davidchristl.com
domaintch.com
quotereflection.com
eroptikblog.xyz
iranianinvestmentclub.com
cp200motorola.com
vsenq.com
theamazonmovement.com
aspiteksoln.com
perkebunannews.com
myreverie.life
hrddf.com
gblaincreative.com
lipsstreet.com
xxf76.top
dureluxx.com
heldelicioso.com
taskconsulting.com
dongcunzhengfu.com
itohpe.com
abundantskill.com
fernhutco.com
hairgrowthxpert.com
intelligentreportscloud.com
maybesupply.com
7156.world
cr-marcelo.com
shequipamentos.com
villeenvie.net
robbyscreations.com
mpaohead.com
nailsa.biz
accoladesandmore.com
preppers.pro
pinpinduo2.xyz
allsofttech.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/456-68-0x000000000041F1B0-mapping.dmp formbook behavioral1/memory/456-67-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/456-71-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1776-79-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
RFQ5462-PO22000850.pdf.exeRFQ5462-PO22000850.pdf.exenetsh.exedescription pid process target process PID 1592 set thread context of 456 1592 RFQ5462-PO22000850.pdf.exe RFQ5462-PO22000850.pdf.exe PID 456 set thread context of 1372 456 RFQ5462-PO22000850.pdf.exe Explorer.EXE PID 1776 set thread context of 1372 1776 netsh.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Processes:
netsh.exedescription ioc process Key created \Registry\User\S-1-5-21-3762437355-3468409815-1164039494-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 netsh.exe -
Suspicious behavior: EnumeratesProcesses 17 IoCs
Processes:
RFQ5462-PO22000850.pdf.exepowershell.exenetsh.exepid process 456 RFQ5462-PO22000850.pdf.exe 952 powershell.exe 456 RFQ5462-PO22000850.pdf.exe 1776 netsh.exe 1776 netsh.exe 1776 netsh.exe 1776 netsh.exe 1776 netsh.exe 1776 netsh.exe 1776 netsh.exe 1776 netsh.exe 1776 netsh.exe 1776 netsh.exe 1776 netsh.exe 1776 netsh.exe 1776 netsh.exe 1776 netsh.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
RFQ5462-PO22000850.pdf.exenetsh.exepid process 456 RFQ5462-PO22000850.pdf.exe 456 RFQ5462-PO22000850.pdf.exe 456 RFQ5462-PO22000850.pdf.exe 1776 netsh.exe 1776 netsh.exe 1776 netsh.exe 1776 netsh.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exeRFQ5462-PO22000850.pdf.exenetsh.exedescription pid process Token: SeDebugPrivilege 952 powershell.exe Token: SeDebugPrivilege 456 RFQ5462-PO22000850.pdf.exe Token: SeDebugPrivilege 1776 netsh.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1372 Explorer.EXE 1372 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1372 Explorer.EXE 1372 Explorer.EXE -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
RFQ5462-PO22000850.pdf.exeExplorer.EXEnetsh.exedescription pid process target process PID 1592 wrote to memory of 952 1592 RFQ5462-PO22000850.pdf.exe powershell.exe PID 1592 wrote to memory of 952 1592 RFQ5462-PO22000850.pdf.exe powershell.exe PID 1592 wrote to memory of 952 1592 RFQ5462-PO22000850.pdf.exe powershell.exe PID 1592 wrote to memory of 952 1592 RFQ5462-PO22000850.pdf.exe powershell.exe PID 1592 wrote to memory of 1120 1592 RFQ5462-PO22000850.pdf.exe schtasks.exe PID 1592 wrote to memory of 1120 1592 RFQ5462-PO22000850.pdf.exe schtasks.exe PID 1592 wrote to memory of 1120 1592 RFQ5462-PO22000850.pdf.exe schtasks.exe PID 1592 wrote to memory of 1120 1592 RFQ5462-PO22000850.pdf.exe schtasks.exe PID 1592 wrote to memory of 456 1592 RFQ5462-PO22000850.pdf.exe RFQ5462-PO22000850.pdf.exe PID 1592 wrote to memory of 456 1592 RFQ5462-PO22000850.pdf.exe RFQ5462-PO22000850.pdf.exe PID 1592 wrote to memory of 456 1592 RFQ5462-PO22000850.pdf.exe RFQ5462-PO22000850.pdf.exe PID 1592 wrote to memory of 456 1592 RFQ5462-PO22000850.pdf.exe RFQ5462-PO22000850.pdf.exe PID 1592 wrote to memory of 456 1592 RFQ5462-PO22000850.pdf.exe RFQ5462-PO22000850.pdf.exe PID 1592 wrote to memory of 456 1592 RFQ5462-PO22000850.pdf.exe RFQ5462-PO22000850.pdf.exe PID 1592 wrote to memory of 456 1592 RFQ5462-PO22000850.pdf.exe RFQ5462-PO22000850.pdf.exe PID 1372 wrote to memory of 1776 1372 Explorer.EXE netsh.exe PID 1372 wrote to memory of 1776 1372 Explorer.EXE netsh.exe PID 1372 wrote to memory of 1776 1372 Explorer.EXE netsh.exe PID 1372 wrote to memory of 1776 1372 Explorer.EXE netsh.exe PID 1776 wrote to memory of 1972 1776 netsh.exe Firefox.exe PID 1776 wrote to memory of 1972 1776 netsh.exe Firefox.exe PID 1776 wrote to memory of 1972 1776 netsh.exe Firefox.exe PID 1776 wrote to memory of 1972 1776 netsh.exe Firefox.exe PID 1776 wrote to memory of 1972 1776 netsh.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RFQ5462-PO22000850.pdf.exe"C:\Users\Admin\AppData\Local\Temp\RFQ5462-PO22000850.pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\TUciHnCOcgcjY.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TUciHnCOcgcjY" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE966.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\RFQ5462-PO22000850.pdf.exe"C:\Users\Admin\AppData\Local\Temp\RFQ5462-PO22000850.pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpE966.tmpFilesize
1KB
MD5ce3f11f43c65a62d350ad6d1e2ade00f
SHA1998c05978d018f3fc9b5a9cb93945eebd7386402
SHA2565004870752ae2aee5a43cf19ca97cf3adde234c907568460a03d5ab56c3fbdd7
SHA51234b34ee1654dac4cf537002ef7de4d0a81d3da068336281706975a463a0a418445ff5a79d8a852e1ba77996ea69dbb0b9c00f73909a1199a1b9756a296e17397
-
C:\Users\Admin\AppData\Roaming\269N2RT7\269logim.jpegFilesize
65KB
MD5b74b61d98f83182c043d32241cb8ca5b
SHA1873b1570b6a935ba8499a2add61dcdfba4c105c0
SHA2565c89850f4a25d3ef8080d7e9d86ebf4b055148bff76d73cd65042ff4af59b516
SHA51272fc5774a38254fac8bb1c0a2a200ceb021bfa053356d3ddb5aa2e124c9aafb398bc72fcea5468b4723a9ddce6dbf07769aa7822dd943e45bcf79dd42cf04b50
-
C:\Users\Admin\AppData\Roaming\269N2RT7\269logrf.iniFilesize
40B
MD52f245469795b865bdd1b956c23d7893d
SHA16ad80b974d3808f5a20ea1e766c7d2f88b9e5895
SHA2561662d01a2d47b875a34fc7a8cd92e78cb2ba7f34023c7fd2639cbb10b8d94361
SHA512909f189846a5d2db208a5eb2e7cb3042c0f164caf437e2b1b6de608c0a70e4f3510b81b85753dbeec1e211e6a83e6ea8c96aff896e9b6e8ed42014473a54dc4f
-
C:\Users\Admin\AppData\Roaming\269N2RT7\269logri.iniFilesize
40B
MD5d63a82e5d81e02e399090af26db0b9cb
SHA191d0014c8f54743bba141fd60c9d963f869d76c9
SHA256eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae
SHA51238afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad
-
C:\Users\Admin\AppData\Roaming\269N2RT7\269logrv.iniFilesize
40B
MD5ba3b6bc807d4f76794c4b81b09bb9ba5
SHA124cb89501f0212ff3095ecc0aba97dd563718fb1
SHA2566eebf968962745b2e9de2ca969af7c424916d4e3fe3cc0bb9b3d414abfce9507
SHA512ecd07e601fc9e3cfc39addd7bd6f3d7f7ff3253afb40bf536e9eaac5a4c243e5ec40fbfd7b216cb0ea29f2517419601e335e33ba19dea4a46f65e38694d465bf
-
memory/456-71-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/456-67-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/456-73-0x0000000000140000-0x0000000000155000-memory.dmpFilesize
84KB
-
memory/456-72-0x0000000000A50000-0x0000000000D53000-memory.dmpFilesize
3.0MB
-
memory/456-64-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/456-65-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/456-68-0x000000000041F1B0-mapping.dmp
-
memory/952-75-0x000000006EB10000-0x000000006F0BB000-memory.dmpFilesize
5.7MB
-
memory/952-59-0x0000000000000000-mapping.dmp
-
memory/952-70-0x000000006EB10000-0x000000006F0BB000-memory.dmpFilesize
5.7MB
-
memory/1120-60-0x0000000000000000-mapping.dmp
-
memory/1372-84-0x0000000006BF0000-0x0000000006D7B000-memory.dmpFilesize
1.5MB
-
memory/1372-74-0x0000000006420000-0x000000000651C000-memory.dmpFilesize
1008KB
-
memory/1372-82-0x0000000006BF0000-0x0000000006D7B000-memory.dmpFilesize
1.5MB
-
memory/1592-54-0x00000000009B0000-0x0000000000A50000-memory.dmpFilesize
640KB
-
memory/1592-63-0x0000000004ED0000-0x0000000004F04000-memory.dmpFilesize
208KB
-
memory/1592-55-0x0000000076201000-0x0000000076203000-memory.dmpFilesize
8KB
-
memory/1592-56-0x0000000000470000-0x000000000048E000-memory.dmpFilesize
120KB
-
memory/1592-57-0x00000000009A0000-0x00000000009AA000-memory.dmpFilesize
40KB
-
memory/1592-58-0x0000000005020000-0x000000000508C000-memory.dmpFilesize
432KB
-
memory/1776-78-0x00000000016A0000-0x00000000016BB000-memory.dmpFilesize
108KB
-
memory/1776-83-0x0000000000AA0000-0x0000000000B34000-memory.dmpFilesize
592KB
-
memory/1776-81-0x0000000000AA0000-0x0000000000B34000-memory.dmpFilesize
592KB
-
memory/1776-80-0x0000000000D70000-0x0000000001073000-memory.dmpFilesize
3.0MB
-
memory/1776-79-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/1776-76-0x0000000000000000-mapping.dmp