Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01-12-2022 14:22
Static task
static1
Behavioral task
behavioral1
Sample
Confirmation transfer Ref No_0033463247892.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Confirmation transfer Ref No_0033463247892.exe
Resource
win10v2004-20221111-en
General
-
Target
Confirmation transfer Ref No_0033463247892.exe
-
Size
890KB
-
MD5
03c738a9106a7ba9bad7f4995d52f028
-
SHA1
204762dbb01579ea39295660d86085591578e0a1
-
SHA256
aa6874a63646474141e2928b094c5dc15a1fc2ea610ece7ca7f95b80ec856be5
-
SHA512
d87e427aa177cd28b989e00a4bb382679054009a55021834319ee78bcc181b91d72b639c78fceb7e89584aef552af2fbb7cd90ec76719fb8cc81b18acf4e8c8d
-
SSDEEP
24576:jmRx3Gdhk0yClxNwArBMQm8i9eXiDdEPf:jmr32hkGFxBlmFezP
Malware Config
Extracted
formbook
q4k5
ZXN4RZ1db9JIzC7mhQ==
5+KpXZWys/DewpGQbChh6uPT5SNzFQ==
A8YuEKESXrzBhw==
uYH/9+Amwe1ZMkaR
KAusoWlA4I1Rt0P0jA==
AgIBy9IHiq8cdo4h47hB
PsX/0DrQRr+0hQ==
3z4v9UwXBjNTf48h47hB
bySPUkT+SFuT
VsQK5NkDks06l5z+TUG3eetd/twx2Mcjlg==
3+DcnQWuXG84sOphj5LEHIv/hA==
TOZXSDkjSHDoLk/pl2HYpOXJ
q7GGZ9KJrss/oTNwyxI=
2+O/k7y22Qo=
Joatk/qnSoO3q48h47hB
KT1UQcQ9yxWFQzCI
onRBEIHmYIl9XzhAIMtPLFAh5SNzFQ==
a8IY/+/oCDOj2TuM4Ohc
UlIOzyniF1sRnTNwyxI=
8UJiR6gijbvt+exXo7oCvdNV4BE=
Urjip46/QFqY3IbL49JI
JfhnyyWmRr+0hQ==
NQ/x1kqxFzdlZxj77D50BA==
s8KGT8F9hORX0PpkwQ0=
YSzTpB3S8xCI8ULHIqGXNgY=
sh5wMyQZI1vLJmwH6iCYYhs=
btoWw6OWyfyFQzCI
K5bFl4HSibSwnJIh47hB
5sRZGfCxukuFQzCI
4jiHORQB/0EDbaGQl2ilFw==
Ts7ysROSFE3HrOnU8EqBDg==
2z9tHQD6Gjl3YUCJh1vLdcrTwRt+Hw==
w91HMRoJOmeYopkN49VL
a1ga8Wf5Bx9fUzPDjUWJEw==
rBpOLYYTzP++KoBH2XWmbB8=
JZPo4OETkqGrdBDliw+PrW4Zmg==
PYzy1tDDx/96nYLpl2HYpOXJ
p/M0Ef80rdYbFfcO4p7irW4Zmg==
6YhhQS0qE0+O
rT4fBVXCf+hb2xM=
pwQDw8H/dewWOzpxb1HPt0gcMA9t
P6X8tCGrSmWZLbWjgQ==
wrCGfm2dv+KgNsISa42zHM+BOgxl
GXjQw6Xfj8VBF9/mng==
x6WEd+1T0d6iSdb9jA+DOQQ=
v5Y09doqE0+O
e7Kvto6ClseFgnKzlA==
PAAwEG/mkb2xgvobt0+ADA==
ddEnEwXzDyZodU9dK7/prW4Zmg==
hmTOmXa3PWqtq9PR1dRY
d3ZqOq8XkK635xo=
sf1cMQ5W4RhWZE52h5nbZNOAgFKsUS7B
b4hMHaBbU3d5twfgmg==
wNLg11vUbqOUPNLH3mmtLxE=
9D5oSLllFkJugkZbVThn404IIRl0
LaEqCfmuAyFwVPLwnQ==
ryEt5D/BRWVRKvgL53n30PG/Rb8M9pMXlQ==
alIsGunV8xlUdI4h47hB
yCI/OqUUpcHxdgrymg==
6FJ1QUNw7x5hf44h47hB
/f4T9lO+KIVF2Rk=
etr639YLfJni1+vy8sFD
DWvuYbw2NEmZ
1ndLKAERBY9kUkKt3fRdXdGFAAlv
qkbe4.xyz
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Confirmation transfer Ref No_0033463247892.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\Geo\Nation Confirmation transfer Ref No_0033463247892.exe -
Loads dropped DLL 1 IoCs
Processes:
colorcpl.exepid process 684 colorcpl.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Confirmation transfer Ref No_0033463247892.exeConfirmation transfer Ref No_0033463247892.execolorcpl.exedescription pid process target process PID 1784 set thread context of 692 1784 Confirmation transfer Ref No_0033463247892.exe Confirmation transfer Ref No_0033463247892.exe PID 692 set thread context of 1220 692 Confirmation transfer Ref No_0033463247892.exe Explorer.EXE PID 692 set thread context of 1220 692 Confirmation transfer Ref No_0033463247892.exe Explorer.EXE PID 684 set thread context of 1220 684 colorcpl.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Processes:
colorcpl.exedescription ioc process Key created \Registry\User\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 colorcpl.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
Confirmation transfer Ref No_0033463247892.exeConfirmation transfer Ref No_0033463247892.exepowershell.execolorcpl.exepid process 1784 Confirmation transfer Ref No_0033463247892.exe 1784 Confirmation transfer Ref No_0033463247892.exe 1784 Confirmation transfer Ref No_0033463247892.exe 1784 Confirmation transfer Ref No_0033463247892.exe 1784 Confirmation transfer Ref No_0033463247892.exe 1784 Confirmation transfer Ref No_0033463247892.exe 1784 Confirmation transfer Ref No_0033463247892.exe 1784 Confirmation transfer Ref No_0033463247892.exe 692 Confirmation transfer Ref No_0033463247892.exe 692 Confirmation transfer Ref No_0033463247892.exe 692 Confirmation transfer Ref No_0033463247892.exe 692 Confirmation transfer Ref No_0033463247892.exe 1784 Confirmation transfer Ref No_0033463247892.exe 2028 powershell.exe 692 Confirmation transfer Ref No_0033463247892.exe 684 colorcpl.exe 684 colorcpl.exe 684 colorcpl.exe 684 colorcpl.exe 684 colorcpl.exe 684 colorcpl.exe 684 colorcpl.exe 684 colorcpl.exe -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
Confirmation transfer Ref No_0033463247892.execolorcpl.exepid process 692 Confirmation transfer Ref No_0033463247892.exe 692 Confirmation transfer Ref No_0033463247892.exe 692 Confirmation transfer Ref No_0033463247892.exe 692 Confirmation transfer Ref No_0033463247892.exe 684 colorcpl.exe 684 colorcpl.exe 684 colorcpl.exe 684 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
Confirmation transfer Ref No_0033463247892.exeConfirmation transfer Ref No_0033463247892.exepowershell.execolorcpl.exedescription pid process Token: SeDebugPrivilege 1784 Confirmation transfer Ref No_0033463247892.exe Token: SeDebugPrivilege 692 Confirmation transfer Ref No_0033463247892.exe Token: SeDebugPrivilege 2028 powershell.exe Token: SeDebugPrivilege 684 colorcpl.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1220 Explorer.EXE 1220 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1220 Explorer.EXE 1220 Explorer.EXE -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
Confirmation transfer Ref No_0033463247892.exeExplorer.EXEcolorcpl.exedescription pid process target process PID 1784 wrote to memory of 2028 1784 Confirmation transfer Ref No_0033463247892.exe powershell.exe PID 1784 wrote to memory of 2028 1784 Confirmation transfer Ref No_0033463247892.exe powershell.exe PID 1784 wrote to memory of 2028 1784 Confirmation transfer Ref No_0033463247892.exe powershell.exe PID 1784 wrote to memory of 2028 1784 Confirmation transfer Ref No_0033463247892.exe powershell.exe PID 1784 wrote to memory of 1980 1784 Confirmation transfer Ref No_0033463247892.exe schtasks.exe PID 1784 wrote to memory of 1980 1784 Confirmation transfer Ref No_0033463247892.exe schtasks.exe PID 1784 wrote to memory of 1980 1784 Confirmation transfer Ref No_0033463247892.exe schtasks.exe PID 1784 wrote to memory of 1980 1784 Confirmation transfer Ref No_0033463247892.exe schtasks.exe PID 1784 wrote to memory of 692 1784 Confirmation transfer Ref No_0033463247892.exe Confirmation transfer Ref No_0033463247892.exe PID 1784 wrote to memory of 692 1784 Confirmation transfer Ref No_0033463247892.exe Confirmation transfer Ref No_0033463247892.exe PID 1784 wrote to memory of 692 1784 Confirmation transfer Ref No_0033463247892.exe Confirmation transfer Ref No_0033463247892.exe PID 1784 wrote to memory of 692 1784 Confirmation transfer Ref No_0033463247892.exe Confirmation transfer Ref No_0033463247892.exe PID 1784 wrote to memory of 692 1784 Confirmation transfer Ref No_0033463247892.exe Confirmation transfer Ref No_0033463247892.exe PID 1784 wrote to memory of 692 1784 Confirmation transfer Ref No_0033463247892.exe Confirmation transfer Ref No_0033463247892.exe PID 1784 wrote to memory of 692 1784 Confirmation transfer Ref No_0033463247892.exe Confirmation transfer Ref No_0033463247892.exe PID 1220 wrote to memory of 684 1220 Explorer.EXE colorcpl.exe PID 1220 wrote to memory of 684 1220 Explorer.EXE colorcpl.exe PID 1220 wrote to memory of 684 1220 Explorer.EXE colorcpl.exe PID 1220 wrote to memory of 684 1220 Explorer.EXE colorcpl.exe PID 684 wrote to memory of 552 684 colorcpl.exe Firefox.exe PID 684 wrote to memory of 552 684 colorcpl.exe Firefox.exe PID 684 wrote to memory of 552 684 colorcpl.exe Firefox.exe PID 684 wrote to memory of 552 684 colorcpl.exe Firefox.exe PID 684 wrote to memory of 552 684 colorcpl.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\Confirmation transfer Ref No_0033463247892.exe"C:\Users\Admin\AppData\Local\Temp\Confirmation transfer Ref No_0033463247892.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\eSdygJSxTrIOo.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2028 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eSdygJSxTrIOo" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAF15.tmp"3⤵
- Creates scheduled task(s)
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\Confirmation transfer Ref No_0033463247892.exe"C:\Users\Admin\AppData\Local\Temp\Confirmation transfer Ref No_0033463247892.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:692 -
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:684 -
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:552
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpAF15.tmpFilesize
1KB
MD54c30c266649a2af5aa1f24badb3eb045
SHA171b19e539bc9e0f04db9a8c17bf6cd7ae19707fb
SHA2561f987f3d6b496b11147951281dab866e73444221adb0194c8920b00d09e03aef
SHA512e4ece3294001ddf8607ebea5856c2db23c537161e328a458fefd6758aad344612a129e34c748886a3f3c7f6f2ed4b2a33cd7fa720a3d963cb89ecaf0b2b0c596
-
\Users\Admin\AppData\Local\Temp\sqlite3.dllFilesize
910KB
MD5d79258c5189103d69502eac786addb04
SHA1f34b33681cfe8ce649218173a7f58b237821c1ef
SHA25657d89a52061d70d87e40281f1196d53273f87860c4d707d667a8c7d9573da675
SHA512da797f4dd1ad628aa4e8004b2e00b7c278facbc57a313f56b70dc8fcfbdb0050ea8b025b3475098223cce96ea53537d678273656d46c2d33d81b496d90da34b2
-
memory/684-83-0x0000000000000000-mapping.dmp
-
memory/684-92-0x0000000000080000-0x00000000000AD000-memory.dmpFilesize
180KB
-
memory/684-90-0x0000000000970000-0x00000000009FF000-memory.dmpFilesize
572KB
-
memory/684-89-0x0000000002200000-0x0000000002503000-memory.dmpFilesize
3.0MB
-
memory/684-88-0x0000000000080000-0x00000000000AD000-memory.dmpFilesize
180KB
-
memory/684-87-0x0000000000DE0000-0x0000000000DF8000-memory.dmpFilesize
96KB
-
memory/692-64-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/692-74-0x0000000000422000-0x0000000000424000-memory.dmpFilesize
8KB
-
memory/692-65-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/692-68-0x00000000004012B0-mapping.dmp
-
memory/692-67-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/692-70-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/692-71-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/692-72-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/692-73-0x0000000000880000-0x0000000000B83000-memory.dmpFilesize
3.0MB
-
memory/692-85-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/692-84-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/692-75-0x00000000000A0000-0x00000000000B0000-memory.dmpFilesize
64KB
-
memory/692-80-0x0000000000422000-0x0000000000424000-memory.dmpFilesize
8KB
-
memory/692-81-0x0000000000210000-0x0000000000220000-memory.dmpFilesize
64KB
-
memory/1220-91-0x0000000006200000-0x00000000062B4000-memory.dmpFilesize
720KB
-
memory/1220-93-0x0000000006200000-0x00000000062B4000-memory.dmpFilesize
720KB
-
memory/1220-82-0x00000000073C0000-0x0000000007545000-memory.dmpFilesize
1.5MB
-
memory/1220-76-0x0000000007060000-0x0000000007161000-memory.dmpFilesize
1.0MB
-
memory/1784-63-0x0000000005110000-0x0000000005166000-memory.dmpFilesize
344KB
-
memory/1784-54-0x0000000000D20000-0x0000000000E04000-memory.dmpFilesize
912KB
-
memory/1784-58-0x0000000005760000-0x00000000057F0000-memory.dmpFilesize
576KB
-
memory/1784-57-0x0000000000410000-0x000000000041E000-memory.dmpFilesize
56KB
-
memory/1784-56-0x0000000000210000-0x0000000000226000-memory.dmpFilesize
88KB
-
memory/1784-55-0x00000000753C1000-0x00000000753C3000-memory.dmpFilesize
8KB
-
memory/1980-61-0x0000000000000000-mapping.dmp
-
memory/2028-59-0x0000000000000000-mapping.dmp
-
memory/2028-78-0x000000006E780000-0x000000006ED2B000-memory.dmpFilesize
5.7MB
-
memory/2028-77-0x000000006E780000-0x000000006ED2B000-memory.dmpFilesize
5.7MB