Analysis
-
max time kernel
148s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30-08-2022 07:52
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order 30 August 2022-02414291423394140374553.exe
Resource
win7-20220812-en
General
-
Target
Purchase Order 30 August 2022-02414291423394140374553.exe
-
Size
89KB
-
MD5
0c3e17513995f23e55698258b1182ff8
-
SHA1
102f3d910b9b5718d32cb53c742321fdbe1f3cf8
-
SHA256
54fae569dce7e163b82278e3353f28978511f3af6ef2f444ee5b2034a88af61e
-
SHA512
e17a9fbb516248fc44ba6dd3175130151764f6c41b9333037485ed1ddc6941d0a7d86d67efe5a2f7d4c399833ba985e8af49f0a5a8c9cc9fb4446cd9ae47562e
-
SSDEEP
768:M5Q7BWvdus8AS2ymNBqPrDhKD+sHmIBPu/5FXa7IkZsdmR/9UfaJAMnHSiU/2C7B:cxBMPtr/d0zRpSZ5adaht
Malware Config
Extracted
formbook
4.1
ba17
zoltaron.tech
exopets.online
trippingtravel.com
banded.top
shinebrightdesigns.co.uk
djlbb.com
abcsofmindfulness.com
linkaktifasialive88.club
185068.sbs
tjhongguo.com
portaldigi.store
theshoe.club
r-ceive.app
kmwww.top
search-publishing.com
banksmanlights.net
flyonthewallmovie.com
congrulations.website
trnt.store
udajabojka.xyz
bet365p6.com
purecleannyc.com
tripod.app
chesmol.xyz
gestuethollerbusch.com
longhuipet.com
noktasutesisati.com
voucherkita.xyz
paca-uk.co.uk
denizonlinekontrol.com
suresthuerta.xyz
trendingproduct.co.uk
mvkstore.com
taoseav33.top
estudiooteroyasociados.store
gandlautosalesinc.com
32ee62dd0110.info
hmrazk.website
qzbpckdo.com
solman.store
slavlavka.site
elemansepetim.xyz
btr.ltd
bjyfzssj.com
yildizanpresskomuru.com
careebroutique.com
artsirchen.com
286412.com
tradingpostatprieslake.com
aisccenter.net
tensenfarms.site
troublecolor.online
paring-deification.net
rhy6.com
zgjys888web.xyz
allhallowsluxe.com
stefanierinza.com
needy-me.online
0755aite.net
cbfashion.uk
sunrisequilts.com
rswll.com
khanaphongmamam123.xyz
nsdclub.com
pricehistory.website
Signatures
-
Formbook payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1452-63-0x000000000041F100-mapping.dmp formbook behavioral1/memory/1452-62-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1452-65-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1780-72-0x00000000000C0000-0x00000000000EF000-memory.dmp formbook behavioral1/memory/1780-76-0x00000000000C0000-0x00000000000EF000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1760 cmd.exe -
Drops startup file 2 IoCs
Processes:
Purchase Order 30 August 2022-02414291423394140374553.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Purchase Order 30 August 2022-02414291423394140374553.exe Purchase Order 30 August 2022-02414291423394140374553.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Purchase Order 30 August 2022-02414291423394140374553.exe Purchase Order 30 August 2022-02414291423394140374553.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Purchase Order 30 August 2022-02414291423394140374553.exePurchase Order 30 August 2022-02414291423394140374553.exesystray.exedescription pid process target process PID 1092 set thread context of 1452 1092 Purchase Order 30 August 2022-02414291423394140374553.exe Purchase Order 30 August 2022-02414291423394140374553.exe PID 1452 set thread context of 1276 1452 Purchase Order 30 August 2022-02414291423394140374553.exe Explorer.EXE PID 1780 set thread context of 1276 1780 systray.exe Explorer.EXE -
Processes:
Purchase Order 30 August 2022-02414291423394140374553.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 040000000100000010000000acb694a59c17e0d791529bb19706a6e40f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47419000000010000001000000068cb42b035ea773e52ef50ecf50ec52920000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 Purchase Order 30 August 2022-02414291423394140374553.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 Purchase Order 30 August 2022-02414291423394140374553.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Purchase Order 30 August 2022-02414291423394140374553.exePurchase Order 30 August 2022-02414291423394140374553.exesystray.exepid process 1092 Purchase Order 30 August 2022-02414291423394140374553.exe 1092 Purchase Order 30 August 2022-02414291423394140374553.exe 1092 Purchase Order 30 August 2022-02414291423394140374553.exe 1092 Purchase Order 30 August 2022-02414291423394140374553.exe 1092 Purchase Order 30 August 2022-02414291423394140374553.exe 1092 Purchase Order 30 August 2022-02414291423394140374553.exe 1092 Purchase Order 30 August 2022-02414291423394140374553.exe 1092 Purchase Order 30 August 2022-02414291423394140374553.exe 1092 Purchase Order 30 August 2022-02414291423394140374553.exe 1092 Purchase Order 30 August 2022-02414291423394140374553.exe 1092 Purchase Order 30 August 2022-02414291423394140374553.exe 1092 Purchase Order 30 August 2022-02414291423394140374553.exe 1092 Purchase Order 30 August 2022-02414291423394140374553.exe 1092 Purchase Order 30 August 2022-02414291423394140374553.exe 1092 Purchase Order 30 August 2022-02414291423394140374553.exe 1092 Purchase Order 30 August 2022-02414291423394140374553.exe 1092 Purchase Order 30 August 2022-02414291423394140374553.exe 1092 Purchase Order 30 August 2022-02414291423394140374553.exe 1092 Purchase Order 30 August 2022-02414291423394140374553.exe 1092 Purchase Order 30 August 2022-02414291423394140374553.exe 1092 Purchase Order 30 August 2022-02414291423394140374553.exe 1092 Purchase Order 30 August 2022-02414291423394140374553.exe 1092 Purchase Order 30 August 2022-02414291423394140374553.exe 1092 Purchase Order 30 August 2022-02414291423394140374553.exe 1092 Purchase Order 30 August 2022-02414291423394140374553.exe 1092 Purchase Order 30 August 2022-02414291423394140374553.exe 1092 Purchase Order 30 August 2022-02414291423394140374553.exe 1092 Purchase Order 30 August 2022-02414291423394140374553.exe 1092 Purchase Order 30 August 2022-02414291423394140374553.exe 1092 Purchase Order 30 August 2022-02414291423394140374553.exe 1092 Purchase Order 30 August 2022-02414291423394140374553.exe 1092 Purchase Order 30 August 2022-02414291423394140374553.exe 1092 Purchase Order 30 August 2022-02414291423394140374553.exe 1092 Purchase Order 30 August 2022-02414291423394140374553.exe 1092 Purchase Order 30 August 2022-02414291423394140374553.exe 1092 Purchase Order 30 August 2022-02414291423394140374553.exe 1092 Purchase Order 30 August 2022-02414291423394140374553.exe 1092 Purchase Order 30 August 2022-02414291423394140374553.exe 1092 Purchase Order 30 August 2022-02414291423394140374553.exe 1092 Purchase Order 30 August 2022-02414291423394140374553.exe 1092 Purchase Order 30 August 2022-02414291423394140374553.exe 1092 Purchase Order 30 August 2022-02414291423394140374553.exe 1092 Purchase Order 30 August 2022-02414291423394140374553.exe 1092 Purchase Order 30 August 2022-02414291423394140374553.exe 1092 Purchase Order 30 August 2022-02414291423394140374553.exe 1092 Purchase Order 30 August 2022-02414291423394140374553.exe 1452 Purchase Order 30 August 2022-02414291423394140374553.exe 1452 Purchase Order 30 August 2022-02414291423394140374553.exe 1780 systray.exe 1780 systray.exe 1780 systray.exe 1780 systray.exe 1780 systray.exe 1780 systray.exe 1780 systray.exe 1780 systray.exe 1780 systray.exe 1780 systray.exe 1780 systray.exe 1780 systray.exe 1780 systray.exe 1780 systray.exe 1780 systray.exe 1780 systray.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Purchase Order 30 August 2022-02414291423394140374553.exesystray.exepid process 1452 Purchase Order 30 August 2022-02414291423394140374553.exe 1452 Purchase Order 30 August 2022-02414291423394140374553.exe 1452 Purchase Order 30 August 2022-02414291423394140374553.exe 1780 systray.exe 1780 systray.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Purchase Order 30 August 2022-02414291423394140374553.exePurchase Order 30 August 2022-02414291423394140374553.exesystray.exedescription pid process Token: SeDebugPrivilege 1092 Purchase Order 30 August 2022-02414291423394140374553.exe Token: SeDebugPrivilege 1452 Purchase Order 30 August 2022-02414291423394140374553.exe Token: SeDebugPrivilege 1780 systray.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
Purchase Order 30 August 2022-02414291423394140374553.exeExplorer.EXEsystray.exedescription pid process target process PID 1092 wrote to memory of 820 1092 Purchase Order 30 August 2022-02414291423394140374553.exe Purchase Order 30 August 2022-02414291423394140374553.exe PID 1092 wrote to memory of 820 1092 Purchase Order 30 August 2022-02414291423394140374553.exe Purchase Order 30 August 2022-02414291423394140374553.exe PID 1092 wrote to memory of 820 1092 Purchase Order 30 August 2022-02414291423394140374553.exe Purchase Order 30 August 2022-02414291423394140374553.exe PID 1092 wrote to memory of 820 1092 Purchase Order 30 August 2022-02414291423394140374553.exe Purchase Order 30 August 2022-02414291423394140374553.exe PID 1092 wrote to memory of 1452 1092 Purchase Order 30 August 2022-02414291423394140374553.exe Purchase Order 30 August 2022-02414291423394140374553.exe PID 1092 wrote to memory of 1452 1092 Purchase Order 30 August 2022-02414291423394140374553.exe Purchase Order 30 August 2022-02414291423394140374553.exe PID 1092 wrote to memory of 1452 1092 Purchase Order 30 August 2022-02414291423394140374553.exe Purchase Order 30 August 2022-02414291423394140374553.exe PID 1092 wrote to memory of 1452 1092 Purchase Order 30 August 2022-02414291423394140374553.exe Purchase Order 30 August 2022-02414291423394140374553.exe PID 1092 wrote to memory of 1452 1092 Purchase Order 30 August 2022-02414291423394140374553.exe Purchase Order 30 August 2022-02414291423394140374553.exe PID 1092 wrote to memory of 1452 1092 Purchase Order 30 August 2022-02414291423394140374553.exe Purchase Order 30 August 2022-02414291423394140374553.exe PID 1092 wrote to memory of 1452 1092 Purchase Order 30 August 2022-02414291423394140374553.exe Purchase Order 30 August 2022-02414291423394140374553.exe PID 1276 wrote to memory of 1780 1276 Explorer.EXE systray.exe PID 1276 wrote to memory of 1780 1276 Explorer.EXE systray.exe PID 1276 wrote to memory of 1780 1276 Explorer.EXE systray.exe PID 1276 wrote to memory of 1780 1276 Explorer.EXE systray.exe PID 1780 wrote to memory of 1760 1780 systray.exe cmd.exe PID 1780 wrote to memory of 1760 1780 systray.exe cmd.exe PID 1780 wrote to memory of 1760 1780 systray.exe cmd.exe PID 1780 wrote to memory of 1760 1780 systray.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order 30 August 2022-02414291423394140374553.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order 30 August 2022-02414291423394140374553.exe"2⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order 30 August 2022-02414291423394140374553.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order 30 August 2022-02414291423394140374553.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order 30 August 2022-02414291423394140374553.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order 30 August 2022-02414291423394140374553.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Purchase Order 30 August 2022-02414291423394140374553.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1092-54-0x0000000000E10000-0x0000000000E2C000-memory.dmpFilesize
112KB
-
memory/1092-55-0x0000000074C91000-0x0000000074C93000-memory.dmpFilesize
8KB
-
memory/1092-56-0x0000000000A60000-0x0000000000A98000-memory.dmpFilesize
224KB
-
memory/1092-57-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/1092-58-0x0000000000680000-0x0000000000688000-memory.dmpFilesize
32KB
-
memory/1276-77-0x0000000006560000-0x00000000066ED000-memory.dmpFilesize
1.6MB
-
memory/1276-75-0x0000000006560000-0x00000000066ED000-memory.dmpFilesize
1.6MB
-
memory/1276-68-0x0000000005FB0000-0x00000000060EA000-memory.dmpFilesize
1.2MB
-
memory/1452-66-0x0000000000A60000-0x0000000000D63000-memory.dmpFilesize
3.0MB
-
memory/1452-62-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1452-67-0x0000000000190000-0x00000000001A4000-memory.dmpFilesize
80KB
-
memory/1452-63-0x000000000041F100-mapping.dmp
-
memory/1452-59-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1452-60-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1452-65-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1760-73-0x0000000000000000-mapping.dmp
-
memory/1780-71-0x0000000000F70000-0x0000000000F75000-memory.dmpFilesize
20KB
-
memory/1780-72-0x00000000000C0000-0x00000000000EF000-memory.dmpFilesize
188KB
-
memory/1780-74-0x00000000008E0000-0x0000000000973000-memory.dmpFilesize
588KB
-
memory/1780-70-0x00000000009E0000-0x0000000000CE3000-memory.dmpFilesize
3.0MB
-
memory/1780-76-0x00000000000C0000-0x00000000000EF000-memory.dmpFilesize
188KB
-
memory/1780-69-0x0000000000000000-mapping.dmp