Analysis
-
max time kernel
156s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
28-11-2022 12:27
Static task
static1
Behavioral task
behavioral1
Sample
Urgent quote request -pdf-.exe
Resource
win7-20221111-en
General
-
Target
Urgent quote request -pdf-.exe
-
Size
812KB
-
MD5
ce411b2f7dfd407c1a546e160193b55d
-
SHA1
c061262cf1a7999d7ee59694dd0c8bb570987e02
-
SHA256
8cfdcbcbb0b67c66ebb1c3a4cfb995424a9dc791c13d8df53cea06bcd8c2afef
-
SHA512
af96c79b2af92840691a777a72e650c0763f0bc20ecd8d1970ac97cdd5048768fbe413dbd7d673f03f53bcace92d517eeb17b9a791c4c29fa4463b6a8c9c51ba
-
SSDEEP
12288:h2D2DHPXsU51ZM0W52nCrgxRzrzbH3sgGJy3i9zxihIg95lvTHRyoY:Q2DPugfrzbHcFJwIohIgvpjRpY
Malware Config
Extracted
formbook
4.1
a24e
flormarine.co.uk
theglazingsquad.uk
konarkpharma.com
maxpropertyfinanceuk.co.uk
jackson-ifc.com
yvonneazevedoimoveis.net
baystella.com
arexbaba.online
trihgd.xyz
filth520571.com
cikpkg.cfd
jakesupport.com
8863365.com
duniaslot777.online
lop3a.com
berkut-clan.ru
lernnavigator.com
elenaisaprincess.co.uk
daimadaquan.xyz
mychirocart.net
auroraalerts.uk
dunaphotography.com
netspirit.africa
alborhaneye.com
dwentalplans.com
95878.se
family-doctor-49371.com
grafonord.se
avimpactfit.com
growthlabus.com
kidney-life.com
delightfulappearance.com
valleymistst.co.uk
getasalaryraise.com
hongqiqu.vip
arkadiumstore.com
gaskansaja.click
getv3apparel.com
3888my.com
flaginyard.com
applehci.com
politouniversity.com
health-23.com
asciana.com
estheticdoctorturkey.com
bkes-2023.info
6bitly.com
abopappas.online
faridfabrics.com
td0.online
seosquid.co.uk
0731ye.net
alliotcloud.top
gxin-cn.com
96yz857.xyz
tekniik.co.uk
histarfamily.com
industrailglasstech.com
ioqpht6c.store
dacodig.com
emaliaolkusz1907.com
hjd533.com
dentalblueprints.com
amberdrichardson.com
balloonbanarasdecorator.com
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/1392-142-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1392-145-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2500-155-0x00000000007D0000-0x00000000007FF000-memory.dmp formbook behavioral2/memory/2500-158-0x00000000007D0000-0x00000000007FF000-memory.dmp formbook -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Urgent quote request -pdf-.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation Urgent quote request -pdf-.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Urgent quote request -pdf-.exeUrgent quote request -pdf-.execscript.exedescription pid process target process PID 4804 set thread context of 1392 4804 Urgent quote request -pdf-.exe Urgent quote request -pdf-.exe PID 1392 set thread context of 2520 1392 Urgent quote request -pdf-.exe Explorer.EXE PID 2500 set thread context of 2520 2500 cscript.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
Urgent quote request -pdf-.exepowershell.execscript.exepid process 1392 Urgent quote request -pdf-.exe 1392 Urgent quote request -pdf-.exe 1392 Urgent quote request -pdf-.exe 1392 Urgent quote request -pdf-.exe 4340 powershell.exe 2500 cscript.exe 2500 cscript.exe 2500 cscript.exe 2500 cscript.exe 4340 powershell.exe 2500 cscript.exe 2500 cscript.exe 2500 cscript.exe 2500 cscript.exe 2500 cscript.exe 2500 cscript.exe 2500 cscript.exe 2500 cscript.exe 2500 cscript.exe 2500 cscript.exe 2500 cscript.exe 2500 cscript.exe 2500 cscript.exe 2500 cscript.exe 2500 cscript.exe 2500 cscript.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Urgent quote request -pdf-.execscript.exepid process 1392 Urgent quote request -pdf-.exe 1392 Urgent quote request -pdf-.exe 1392 Urgent quote request -pdf-.exe 2500 cscript.exe 2500 cscript.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
Urgent quote request -pdf-.exeExplorer.EXEpowershell.execscript.exedescription pid process Token: SeDebugPrivilege 1392 Urgent quote request -pdf-.exe Token: SeShutdownPrivilege 2520 Explorer.EXE Token: SeCreatePagefilePrivilege 2520 Explorer.EXE Token: SeDebugPrivilege 4340 powershell.exe Token: SeDebugPrivilege 2500 cscript.exe Token: SeShutdownPrivilege 2520 Explorer.EXE Token: SeCreatePagefilePrivilege 2520 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
Urgent quote request -pdf-.exeExplorer.EXEcscript.exedescription pid process target process PID 4804 wrote to memory of 4340 4804 Urgent quote request -pdf-.exe powershell.exe PID 4804 wrote to memory of 4340 4804 Urgent quote request -pdf-.exe powershell.exe PID 4804 wrote to memory of 4340 4804 Urgent quote request -pdf-.exe powershell.exe PID 4804 wrote to memory of 3132 4804 Urgent quote request -pdf-.exe schtasks.exe PID 4804 wrote to memory of 3132 4804 Urgent quote request -pdf-.exe schtasks.exe PID 4804 wrote to memory of 3132 4804 Urgent quote request -pdf-.exe schtasks.exe PID 4804 wrote to memory of 1392 4804 Urgent quote request -pdf-.exe Urgent quote request -pdf-.exe PID 4804 wrote to memory of 1392 4804 Urgent quote request -pdf-.exe Urgent quote request -pdf-.exe PID 4804 wrote to memory of 1392 4804 Urgent quote request -pdf-.exe Urgent quote request -pdf-.exe PID 4804 wrote to memory of 1392 4804 Urgent quote request -pdf-.exe Urgent quote request -pdf-.exe PID 4804 wrote to memory of 1392 4804 Urgent quote request -pdf-.exe Urgent quote request -pdf-.exe PID 4804 wrote to memory of 1392 4804 Urgent quote request -pdf-.exe Urgent quote request -pdf-.exe PID 2520 wrote to memory of 2500 2520 Explorer.EXE cscript.exe PID 2520 wrote to memory of 2500 2520 Explorer.EXE cscript.exe PID 2520 wrote to memory of 2500 2520 Explorer.EXE cscript.exe PID 2500 wrote to memory of 1848 2500 cscript.exe cmd.exe PID 2500 wrote to memory of 1848 2500 cscript.exe cmd.exe PID 2500 wrote to memory of 1848 2500 cscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\Urgent quote request -pdf-.exe"C:\Users\Admin\AppData\Local\Temp\Urgent quote request -pdf-.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\KLDxttbPfKRi.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4340 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\KLDxttbPfKRi" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8690.tmp"3⤵
- Creates scheduled task(s)
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\Urgent quote request -pdf-.exe"C:\Users\Admin\AppData\Local\Temp\Urgent quote request -pdf-.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1392 -
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Urgent quote request -pdf-.exe"3⤵PID:1848
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp8690.tmpFilesize
1KB
MD5ad9e3fa058211ab8895a9408acc0a4a6
SHA15028eff8da0b73db68862e83701a8410752fd9fa
SHA256e1f0f464dbb604d04369e241c5bb9828f42d5dcc3a7f6ef737e6484ae42fd630
SHA512f2c1848f7411876bc042ecc5c38d93f1a965eccc844d7d95e2c98ff863b02da7fa9c9de7ccf3a356e3bfb995eb3678c9462fc158794c75e13f2d7a4b2608fc2a
-
memory/1392-146-0x0000000001900000-0x0000000001C4A000-memory.dmpFilesize
3.3MB
-
memory/1392-145-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1392-147-0x00000000018A0000-0x00000000018B4000-memory.dmpFilesize
80KB
-
memory/1392-142-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1392-141-0x0000000000000000-mapping.dmp
-
memory/1848-153-0x0000000000000000-mapping.dmp
-
memory/2500-152-0x0000000000000000-mapping.dmp
-
memory/2500-154-0x0000000000540000-0x0000000000567000-memory.dmpFilesize
156KB
-
memory/2500-155-0x00000000007D0000-0x00000000007FF000-memory.dmpFilesize
188KB
-
memory/2500-156-0x0000000002A50000-0x0000000002D9A000-memory.dmpFilesize
3.3MB
-
memory/2500-158-0x00000000007D0000-0x00000000007FF000-memory.dmpFilesize
188KB
-
memory/2500-159-0x0000000002970000-0x0000000002A03000-memory.dmpFilesize
588KB
-
memory/2520-160-0x00000000082D0000-0x00000000083E0000-memory.dmpFilesize
1.1MB
-
memory/2520-148-0x0000000003260000-0x0000000003353000-memory.dmpFilesize
972KB
-
memory/2520-168-0x00000000082D0000-0x00000000083E0000-memory.dmpFilesize
1.1MB
-
memory/3132-138-0x0000000000000000-mapping.dmp
-
memory/4340-165-0x0000000006F70000-0x0000000006F8A000-memory.dmpFilesize
104KB
-
memory/4340-166-0x0000000006FD0000-0x0000000006FDA000-memory.dmpFilesize
40KB
-
memory/4340-139-0x00000000022D0000-0x0000000002306000-memory.dmpFilesize
216KB
-
memory/4340-150-0x0000000005530000-0x0000000005596000-memory.dmpFilesize
408KB
-
memory/4340-137-0x0000000000000000-mapping.dmp
-
memory/4340-171-0x0000000007280000-0x0000000007288000-memory.dmpFilesize
32KB
-
memory/4340-170-0x00000000072A0000-0x00000000072BA000-memory.dmpFilesize
104KB
-
memory/4340-157-0x0000000005C50000-0x0000000005C6E000-memory.dmpFilesize
120KB
-
memory/4340-169-0x0000000006FB0000-0x0000000006FBE000-memory.dmpFilesize
56KB
-
memory/4340-149-0x0000000004B00000-0x0000000004B22000-memory.dmpFilesize
136KB
-
memory/4340-167-0x00000000071C0000-0x0000000007256000-memory.dmpFilesize
600KB
-
memory/4340-161-0x0000000006230000-0x0000000006262000-memory.dmpFilesize
200KB
-
memory/4340-162-0x0000000071010000-0x000000007105C000-memory.dmpFilesize
304KB
-
memory/4340-163-0x0000000006210000-0x000000000622E000-memory.dmpFilesize
120KB
-
memory/4340-164-0x00000000075F0000-0x0000000007C6A000-memory.dmpFilesize
6.5MB
-
memory/4340-143-0x0000000004E00000-0x0000000005428000-memory.dmpFilesize
6.2MB
-
memory/4340-151-0x0000000005650000-0x00000000056B6000-memory.dmpFilesize
408KB
-
memory/4804-132-0x0000000000170000-0x0000000000242000-memory.dmpFilesize
840KB
-
memory/4804-133-0x00000000050F0000-0x0000000005694000-memory.dmpFilesize
5.6MB
-
memory/4804-134-0x0000000004C20000-0x0000000004CB2000-memory.dmpFilesize
584KB
-
memory/4804-135-0x0000000004C00000-0x0000000004C0A000-memory.dmpFilesize
40KB
-
memory/4804-136-0x0000000008800000-0x000000000889C000-memory.dmpFilesize
624KB