Analysis
-
max time kernel
207s -
max time network
35s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
28-11-2022 17:10
Static task
static1
Behavioral task
behavioral1
Sample
Ordem de Compra pdf xxQ4h.exe
Resource
win7-20221111-en
General
-
Target
Ordem de Compra pdf xxQ4h.exe
-
Size
894KB
-
MD5
973a94d5f2fb8e7d4da718d074dfd9eb
-
SHA1
707f58e7972ed3493b0bd62480e4ed9538eba93f
-
SHA256
608aed0c05c0bd3ff091e559c92093440f659cc8b6f98865ce907cd9d6885ba3
-
SHA512
9b5dac4e93ff472550e557b9ea6e3bc4ccdcefd861886403a4c3729b9070de30d507ce3d4dc341d671416b1f4bd6e1a7a3624e5f9cd0f9935b3c375b89595250
-
SSDEEP
24576:EHryn040Nznszfdf0DYkmybe7hxtcPuDdEPf:6mp0SZfsgyOT6vP
Malware Config
Extracted
formbook
4.1
cy28
100049723423.review
lovehealthcare.online
immuniversity.info
ihproductions.net
originatorsu.mobi
shxwjn.top
fivemeters.com
planettiki.site
berantaspinjol.online
oregonusedtrucks.com
darkstarkoi.com
izmirhaberci.world
41014.top
georgiaspanishgoats.com
dealstopstartups.click
ravmodeling.center
unsundayjesus.world
initialslash.site
shubaola.top
caserevision.com
tstak.us
jmessickconstructionllc.com
bluemagicmusique.com
laspirale.site
tugarujisyo.com
privatizestagnant.top
udqwxzfy.site
forami.xyz
lkougd.com
october-zodiac-sign.info
peppervalue.com
miladarentacar.com
englishcontinue.com
lainhavenohair.icu
587250.biz
acaskill.com
signworldtv.com
cuflyfishing.com
joelthomson.shop
1wwsf.top
232521.info
swiftenginereconditioning.store
kfcva4.tech
alejand-gomez.com
adimarketplace.online
thenewusalon.com
17877.top
toukoukai.site
pvalbedo.com
entrylogs.com
instantarms.com
ellicottcitymd.info
pontificals-stumblingstone.biz
vickers.store
financier.pro
tecfloors.online
onearani.store
eleganciacliniclucknow.com
fishphon.com
toxidosie3d.store
allcitytowingnow.com
linkc88.com
ky4150.com
themetaversewire.com
toxicboneyard.net
Signatures
-
Formbook payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1604-67-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1604-68-0x000000000041F140-mapping.dmp formbook behavioral1/memory/1604-74-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1604-80-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1988-83-0x0000000000070000-0x000000000009F000-memory.dmp formbook behavioral1/memory/1988-86-0x0000000000070000-0x000000000009F000-memory.dmp formbook -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Ordem de Compra pdf xxQ4h.exeRegSvcs.exewscript.exedescription pid process target process PID 888 set thread context of 1604 888 Ordem de Compra pdf xxQ4h.exe RegSvcs.exe PID 1604 set thread context of 1268 1604 RegSvcs.exe Explorer.EXE PID 1604 set thread context of 1268 1604 RegSvcs.exe Explorer.EXE PID 1988 set thread context of 1268 1988 wscript.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
RegSvcs.exepowershell.exewscript.exepid process 1604 RegSvcs.exe 1604 RegSvcs.exe 1676 powershell.exe 1604 RegSvcs.exe 1988 wscript.exe 1988 wscript.exe 1988 wscript.exe 1988 wscript.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
RegSvcs.exewscript.exepid process 1604 RegSvcs.exe 1604 RegSvcs.exe 1604 RegSvcs.exe 1604 RegSvcs.exe 1988 wscript.exe 1988 wscript.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
RegSvcs.exepowershell.exewscript.exedescription pid process Token: SeDebugPrivilege 1604 RegSvcs.exe Token: SeDebugPrivilege 1676 powershell.exe Token: SeDebugPrivilege 1988 wscript.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
Ordem de Compra pdf xxQ4h.exeRegSvcs.exewscript.exedescription pid process target process PID 888 wrote to memory of 1676 888 Ordem de Compra pdf xxQ4h.exe powershell.exe PID 888 wrote to memory of 1676 888 Ordem de Compra pdf xxQ4h.exe powershell.exe PID 888 wrote to memory of 1676 888 Ordem de Compra pdf xxQ4h.exe powershell.exe PID 888 wrote to memory of 1676 888 Ordem de Compra pdf xxQ4h.exe powershell.exe PID 888 wrote to memory of 732 888 Ordem de Compra pdf xxQ4h.exe schtasks.exe PID 888 wrote to memory of 732 888 Ordem de Compra pdf xxQ4h.exe schtasks.exe PID 888 wrote to memory of 732 888 Ordem de Compra pdf xxQ4h.exe schtasks.exe PID 888 wrote to memory of 732 888 Ordem de Compra pdf xxQ4h.exe schtasks.exe PID 888 wrote to memory of 1604 888 Ordem de Compra pdf xxQ4h.exe RegSvcs.exe PID 888 wrote to memory of 1604 888 Ordem de Compra pdf xxQ4h.exe RegSvcs.exe PID 888 wrote to memory of 1604 888 Ordem de Compra pdf xxQ4h.exe RegSvcs.exe PID 888 wrote to memory of 1604 888 Ordem de Compra pdf xxQ4h.exe RegSvcs.exe PID 888 wrote to memory of 1604 888 Ordem de Compra pdf xxQ4h.exe RegSvcs.exe PID 888 wrote to memory of 1604 888 Ordem de Compra pdf xxQ4h.exe RegSvcs.exe PID 888 wrote to memory of 1604 888 Ordem de Compra pdf xxQ4h.exe RegSvcs.exe PID 888 wrote to memory of 1604 888 Ordem de Compra pdf xxQ4h.exe RegSvcs.exe PID 888 wrote to memory of 1604 888 Ordem de Compra pdf xxQ4h.exe RegSvcs.exe PID 888 wrote to memory of 1604 888 Ordem de Compra pdf xxQ4h.exe RegSvcs.exe PID 1604 wrote to memory of 1988 1604 RegSvcs.exe wscript.exe PID 1604 wrote to memory of 1988 1604 RegSvcs.exe wscript.exe PID 1604 wrote to memory of 1988 1604 RegSvcs.exe wscript.exe PID 1604 wrote to memory of 1988 1604 RegSvcs.exe wscript.exe PID 1988 wrote to memory of 880 1988 wscript.exe cmd.exe PID 1988 wrote to memory of 880 1988 wscript.exe cmd.exe PID 1988 wrote to memory of 880 1988 wscript.exe cmd.exe PID 1988 wrote to memory of 880 1988 wscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\Ordem de Compra pdf xxQ4h.exe"C:\Users\Admin\AppData\Local\Temp\Ordem de Compra pdf xxQ4h.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\IAFLNzOdgRR.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1676 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IAFLNzOdgRR" /XML "C:\Users\Admin\AppData\Local\Temp\tmp41E1.tmp"3⤵
- Creates scheduled task(s)
PID:732 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"5⤵PID:880
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp41E1.tmpFilesize
1KB
MD5c0a44275ca41acddb603d0517c77f04c
SHA1e31ef94ac7f7b0f3744d2a9b740fd91418311f14
SHA256f9ee1503e8a89b277eccbf9acbf2fef83348c7e7e4b3740ef87c625ac9237743
SHA5125d14814f8674a084d72a19bdbbe154562bf6cf087c27772b428c9979f5ea29728d18a630391884f244d034f79cd8f21b30540fe8450d3b6988fb5f5d0aacc69d
-
memory/732-60-0x0000000000000000-mapping.dmp
-
memory/880-84-0x0000000000000000-mapping.dmp
-
memory/888-54-0x00000000008B0000-0x0000000000996000-memory.dmpFilesize
920KB
-
memory/888-55-0x0000000075B61000-0x0000000075B63000-memory.dmpFilesize
8KB
-
memory/888-56-0x00000000005A0000-0x00000000005B6000-memory.dmpFilesize
88KB
-
memory/888-57-0x00000000005B0000-0x00000000005BE000-memory.dmpFilesize
56KB
-
memory/888-58-0x0000000005480000-0x0000000005526000-memory.dmpFilesize
664KB
-
memory/888-63-0x0000000004FD0000-0x000000000503C000-memory.dmpFilesize
432KB
-
memory/1268-88-0x0000000004CA0000-0x0000000004D71000-memory.dmpFilesize
836KB
-
memory/1268-77-0x0000000004960000-0x0000000004A43000-memory.dmpFilesize
908KB
-
memory/1268-73-0x0000000003CE0000-0x0000000003DC4000-memory.dmpFilesize
912KB
-
memory/1604-71-0x0000000000AA0000-0x0000000000DA3000-memory.dmpFilesize
3.0MB
-
memory/1604-64-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1604-68-0x000000000041F140-mapping.dmp
-
memory/1604-72-0x0000000000190000-0x00000000001A4000-memory.dmpFilesize
80KB
-
memory/1604-67-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1604-74-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1604-76-0x0000000000320000-0x0000000000334000-memory.dmpFilesize
80KB
-
memory/1604-65-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1604-80-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1676-78-0x000000006E760000-0x000000006ED0B000-memory.dmpFilesize
5.7MB
-
memory/1676-70-0x000000006E760000-0x000000006ED0B000-memory.dmpFilesize
5.7MB
-
memory/1676-59-0x0000000000000000-mapping.dmp
-
memory/1676-85-0x000000006E760000-0x000000006ED0B000-memory.dmpFilesize
5.7MB
-
memory/1988-79-0x0000000000000000-mapping.dmp
-
memory/1988-83-0x0000000000070000-0x000000000009F000-memory.dmpFilesize
188KB
-
memory/1988-82-0x0000000001FB0000-0x00000000022B3000-memory.dmpFilesize
3.0MB
-
memory/1988-86-0x0000000000070000-0x000000000009F000-memory.dmpFilesize
188KB
-
memory/1988-81-0x0000000000460000-0x0000000000486000-memory.dmpFilesize
152KB
-
memory/1988-87-0x0000000001D80000-0x0000000001E13000-memory.dmpFilesize
588KB