Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
26-07-2022 17:43
Static task
static1
Behavioral task
behavioral1
Sample
Orden de Compra Urgente.exe
Resource
win7-20220715-en
General
-
Target
Orden de Compra Urgente.exe
-
Size
757KB
-
MD5
96d65af8738de30dfa2283585f11e1e1
-
SHA1
fce536c32341baad02ba836a06688ab9f60193b9
-
SHA256
a69ee77f4eb102a3528594435748d3a1e2925022a6d986eac8d32feb068c1f36
-
SHA512
99364f2a86bb7a10e57642ad176195df04a746cb2e25d3b2562228f61192634ccec3668b008b141a3fb6864fb6f6608dff3721e96613eb31aaf65e5cb5b204ca
Malware Config
Extracted
formbook
4.1
de08
retirecloudyyard.com
fabiyan.xyz
chrisarlyde.com
selapex.com
vivalosgales.com
specialty-medicine.com
contasesolucoes.com
satunusanews.net
allyibc.com
alameda1876.com
artofdala.com
yukoidusp.xyz
steeldrumbandnearme.com
stonewedgetechnology.com
kentonai.com
macquarie-private.com
ddgwy.com
megagreenhousekits.com
descomplicaomarketing.com
inclusiverealtor.com
themummyfront.club
computerfashiondesigns.com
ericparlatore.com
whathappened2me.com
baksomail.xyz
mugupplatform.com
shopsolutely.com
gymcservices.com
qianshunchina.com
zoomsbshab.icu
esrmtech.com
966211.com
stockinsidepr.com
df-wh.com
smartshopapps.com
kayseriadsl.com
acedesserts.com
205qs.com
ei8i.com
aibtly.com
kpviewllc.net
nnehandebol.com
torontonianapparel.ca
therealgoldenganjagang.com
mingxiang99.com
rewkagcompany.xyz
ahmee4.com
valen.info
vacuumfun.parts
fabiyan.xyz
psncareersolutions.com
escobargroups.com
michigandice.com
ey3solutions.com
li-n.info
puingkehancuran.xyz
bilt-green.com
dfysuitetech.xyz
abdoomar.com
actsaka.xyz
justsweatitout.com
axabank.life
billyyaka.com
mypatchtools.com
epulsive.com
Signatures
-
Formbook payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/2044-67-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2044-68-0x000000000041F120-mapping.dmp formbook behavioral1/memory/2044-75-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2044-79-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1392-83-0x0000000000080000-0x00000000000AF000-memory.dmp formbook behavioral1/memory/1392-85-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Orden de Compra Urgente.exeRegSvcs.exewininit.exedescription pid process target process PID 1612 set thread context of 2044 1612 Orden de Compra Urgente.exe RegSvcs.exe PID 2044 set thread context of 1244 2044 RegSvcs.exe Explorer.EXE PID 2044 set thread context of 1244 2044 RegSvcs.exe Explorer.EXE PID 1392 set thread context of 1244 1392 wininit.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
RegSvcs.exepowershell.exewininit.exepid process 2044 RegSvcs.exe 2044 RegSvcs.exe 824 powershell.exe 2044 RegSvcs.exe 1392 wininit.exe 1392 wininit.exe 1392 wininit.exe 1392 wininit.exe 1392 wininit.exe 1392 wininit.exe 1392 wininit.exe 1392 wininit.exe 1392 wininit.exe 1392 wininit.exe 1392 wininit.exe 1392 wininit.exe 1392 wininit.exe 1392 wininit.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
RegSvcs.exewininit.exepid process 2044 RegSvcs.exe 2044 RegSvcs.exe 2044 RegSvcs.exe 2044 RegSvcs.exe 1392 wininit.exe 1392 wininit.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
RegSvcs.exepowershell.exewininit.exedescription pid process Token: SeDebugPrivilege 2044 RegSvcs.exe Token: SeDebugPrivilege 824 powershell.exe Token: SeDebugPrivilege 1392 wininit.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1244 Explorer.EXE 1244 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1244 Explorer.EXE 1244 Explorer.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
Orden de Compra Urgente.exepid process 1612 Orden de Compra Urgente.exe 1612 Orden de Compra Urgente.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
Orden de Compra Urgente.exeExplorer.EXEwininit.exedescription pid process target process PID 1612 wrote to memory of 824 1612 Orden de Compra Urgente.exe powershell.exe PID 1612 wrote to memory of 824 1612 Orden de Compra Urgente.exe powershell.exe PID 1612 wrote to memory of 824 1612 Orden de Compra Urgente.exe powershell.exe PID 1612 wrote to memory of 824 1612 Orden de Compra Urgente.exe powershell.exe PID 1612 wrote to memory of 1372 1612 Orden de Compra Urgente.exe schtasks.exe PID 1612 wrote to memory of 1372 1612 Orden de Compra Urgente.exe schtasks.exe PID 1612 wrote to memory of 1372 1612 Orden de Compra Urgente.exe schtasks.exe PID 1612 wrote to memory of 1372 1612 Orden de Compra Urgente.exe schtasks.exe PID 1612 wrote to memory of 2044 1612 Orden de Compra Urgente.exe RegSvcs.exe PID 1612 wrote to memory of 2044 1612 Orden de Compra Urgente.exe RegSvcs.exe PID 1612 wrote to memory of 2044 1612 Orden de Compra Urgente.exe RegSvcs.exe PID 1612 wrote to memory of 2044 1612 Orden de Compra Urgente.exe RegSvcs.exe PID 1612 wrote to memory of 2044 1612 Orden de Compra Urgente.exe RegSvcs.exe PID 1612 wrote to memory of 2044 1612 Orden de Compra Urgente.exe RegSvcs.exe PID 1612 wrote to memory of 2044 1612 Orden de Compra Urgente.exe RegSvcs.exe PID 1612 wrote to memory of 2044 1612 Orden de Compra Urgente.exe RegSvcs.exe PID 1612 wrote to memory of 2044 1612 Orden de Compra Urgente.exe RegSvcs.exe PID 1612 wrote to memory of 2044 1612 Orden de Compra Urgente.exe RegSvcs.exe PID 1244 wrote to memory of 1392 1244 Explorer.EXE wininit.exe PID 1244 wrote to memory of 1392 1244 Explorer.EXE wininit.exe PID 1244 wrote to memory of 1392 1244 Explorer.EXE wininit.exe PID 1244 wrote to memory of 1392 1244 Explorer.EXE wininit.exe PID 1392 wrote to memory of 1120 1392 wininit.exe cmd.exe PID 1392 wrote to memory of 1120 1392 wininit.exe cmd.exe PID 1392 wrote to memory of 1120 1392 wininit.exe cmd.exe PID 1392 wrote to memory of 1120 1392 wininit.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Orden de Compra Urgente.exe"C:\Users\Admin\AppData\Local\Temp\Orden de Compra Urgente.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qBdLBxat.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qBdLBxat" /XML "C:\Users\Admin\AppData\Local\Temp\tmp31BB.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wininit.exe"C:\Windows\SysWOW64\wininit.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp31BB.tmpFilesize
1KB
MD510e814ed1ee88d7d5de211f410605e02
SHA126d585e1604e0b99e745825e23602ef0ab75e1ae
SHA256357b3389410fdcab10ad9475a1d89030adb9ec0caba367f4ef0df08e1f1b7536
SHA51296f15d737e8e6787143bd6ffa1d14e62030d2753e168fe96a6f87a700539fafdf7a48470175fa0d1e7cb6c49886768aa92f389be42b2e6956d1ce78d2a3f4f31
-
memory/824-59-0x0000000000000000-mapping.dmp
-
memory/824-74-0x000000006F0B0000-0x000000006F65B000-memory.dmpFilesize
5.7MB
-
memory/824-70-0x000000006F0B0000-0x000000006F65B000-memory.dmpFilesize
5.7MB
-
memory/1120-80-0x0000000000000000-mapping.dmp
-
memory/1244-86-0x0000000004F00000-0x0000000004F99000-memory.dmpFilesize
612KB
-
memory/1244-73-0x0000000006B90000-0x0000000006CAC000-memory.dmpFilesize
1.1MB
-
memory/1244-77-0x0000000006CB0000-0x0000000006DE5000-memory.dmpFilesize
1.2MB
-
memory/1244-87-0x0000000004F00000-0x0000000004F99000-memory.dmpFilesize
612KB
-
memory/1372-61-0x0000000000000000-mapping.dmp
-
memory/1392-82-0x0000000001EB0000-0x00000000021B3000-memory.dmpFilesize
3.0MB
-
memory/1392-85-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/1392-84-0x0000000001D10000-0x0000000001DA3000-memory.dmpFilesize
588KB
-
memory/1392-83-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/1392-78-0x0000000000000000-mapping.dmp
-
memory/1392-81-0x00000000000C0000-0x00000000000DA000-memory.dmpFilesize
104KB
-
memory/1612-57-0x0000000004350000-0x000000000435A000-memory.dmpFilesize
40KB
-
memory/1612-54-0x0000000000040000-0x0000000000102000-memory.dmpFilesize
776KB
-
memory/1612-56-0x0000000001FC0000-0x0000000001FD6000-memory.dmpFilesize
88KB
-
memory/1612-63-0x0000000008240000-0x0000000008278000-memory.dmpFilesize
224KB
-
memory/1612-58-0x000000000A950000-0x000000000A9D6000-memory.dmpFilesize
536KB
-
memory/1612-55-0x0000000075F81000-0x0000000075F83000-memory.dmpFilesize
8KB
-
memory/2044-71-0x0000000000820000-0x0000000000B23000-memory.dmpFilesize
3.0MB
-
memory/2044-79-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2044-76-0x0000000000360000-0x0000000000374000-memory.dmpFilesize
80KB
-
memory/2044-75-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2044-72-0x0000000000290000-0x00000000002A4000-memory.dmpFilesize
80KB
-
memory/2044-68-0x000000000041F120-mapping.dmp
-
memory/2044-67-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2044-65-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2044-64-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB