Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
08-02-2023 11:41
Static task
static1
Behavioral task
behavioral1
Sample
REVISED PURCHASE ORDER.exe
Resource
win7-20220901-en
General
-
Target
REVISED PURCHASE ORDER.exe
-
Size
913KB
-
MD5
41ab5bbead147ca7db73d398076e3fd9
-
SHA1
a0ebaff7957bf8799a03cca6ac70e8231d75eeec
-
SHA256
686802626b55d584dba9bb97f1a9c6b61cdb1f56ab9362cb57b333109ed3a486
-
SHA512
9b451126a7d5e90c51b560f6e0f6699741d7d7f32756eb9e05a2d38f6a3bd14ae540781b4d874a0e3db5e4650a588296892a12e09e78fff62cfb414f2ee01b3e
-
SSDEEP
24576:l1BFwfrxN5IC54TWM/G9PXswdhfi+KOE9udmifzoaAneetX:lSjtgi55cw6+zOQmifze
Malware Config
Extracted
formbook
4.1
gg62
growfast.africa
lerema.com
38945.se
wheelfermotors.africa
giftshareforyou.online
burrismktg.com
keepgrowing.uk
efefhomeless.buzz
bryanokoh.com
fashion-clothing-40094.com
andreasunshine.com
naijahood.africa
aditrirealty.com
kinnoitodatsumou.com
cryptoqzclimax.com
hairly.biz
comeuphither4.com
integrity360.ltd
flushywhole.com
8869365.com
fabvance-demos.online
motherpearl.africa
dnsmctmu.com
25779.football
crimson-sunset.ru
haamyounghoon.com
0563news.com
battleb0t.site
transnetfreight.africa
djdaxroadshow.co.uk
bwrps.live
abuin.vip
impressionsbyb.store
findguyscolorado.com
jordanflowerauction.net
fdm50off.com
31seaaa.com
centuryofviolence.co.uk
againstszhanweek.com
injurylawyersconsultants.com
kuotabike.com
cruisejoy.uk
clotaire.ru
hurloic.xyz
anvair.com
ivapeonthis.com
hotsesso.xyz
khramvyazovki.store
mentalistas.dev
cahayasunnah.com
bypro1.online
flavoredkreations.info
inuwallet.com
livingemployebenefits.com
enlighthings.com
focobreathwork.com
emaskhalipahbertam.com
jswl.store
chamaera.com
abbeyspear.com
downwind.one
lovelive.buzz
essentialhealth101.com
irakit.com
cbsht.com
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3612-138-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3612-144-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4536-147-0x00000000010D0000-0x00000000010FF000-memory.dmp formbook behavioral2/memory/4536-152-0x00000000010D0000-0x00000000010FF000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
REVISED PURCHASE ORDER.exeREVISED PURCHASE ORDER.exeNETSTAT.EXEdescription pid process target process PID 3812 set thread context of 3612 3812 REVISED PURCHASE ORDER.exe REVISED PURCHASE ORDER.exe PID 3612 set thread context of 3080 3612 REVISED PURCHASE ORDER.exe Explorer.EXE PID 4536 set thread context of 3080 4536 NETSTAT.EXE Explorer.EXE -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
NETSTAT.EXEpid process 4536 NETSTAT.EXE -
Modifies registry class 3 IoCs
Processes:
Explorer.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 45 IoCs
Processes:
REVISED PURCHASE ORDER.exeREVISED PURCHASE ORDER.exeNETSTAT.EXEpid process 3812 REVISED PURCHASE ORDER.exe 3812 REVISED PURCHASE ORDER.exe 3812 REVISED PURCHASE ORDER.exe 3612 REVISED PURCHASE ORDER.exe 3612 REVISED PURCHASE ORDER.exe 3612 REVISED PURCHASE ORDER.exe 3612 REVISED PURCHASE ORDER.exe 4536 NETSTAT.EXE 4536 NETSTAT.EXE 4536 NETSTAT.EXE 4536 NETSTAT.EXE 4536 NETSTAT.EXE 4536 NETSTAT.EXE 4536 NETSTAT.EXE 4536 NETSTAT.EXE 4536 NETSTAT.EXE 4536 NETSTAT.EXE 4536 NETSTAT.EXE 4536 NETSTAT.EXE 4536 NETSTAT.EXE 4536 NETSTAT.EXE 4536 NETSTAT.EXE 4536 NETSTAT.EXE 4536 NETSTAT.EXE 4536 NETSTAT.EXE 4536 NETSTAT.EXE 4536 NETSTAT.EXE 4536 NETSTAT.EXE 4536 NETSTAT.EXE 4536 NETSTAT.EXE 4536 NETSTAT.EXE 4536 NETSTAT.EXE 4536 NETSTAT.EXE 4536 NETSTAT.EXE 4536 NETSTAT.EXE 4536 NETSTAT.EXE 4536 NETSTAT.EXE 4536 NETSTAT.EXE 4536 NETSTAT.EXE 4536 NETSTAT.EXE 4536 NETSTAT.EXE 4536 NETSTAT.EXE 4536 NETSTAT.EXE 4536 NETSTAT.EXE 4536 NETSTAT.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3080 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
REVISED PURCHASE ORDER.exeNETSTAT.EXEpid process 3612 REVISED PURCHASE ORDER.exe 3612 REVISED PURCHASE ORDER.exe 3612 REVISED PURCHASE ORDER.exe 4536 NETSTAT.EXE 4536 NETSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 17 IoCs
Processes:
REVISED PURCHASE ORDER.exeREVISED PURCHASE ORDER.exeNETSTAT.EXEExplorer.EXEdescription pid process Token: SeDebugPrivilege 3812 REVISED PURCHASE ORDER.exe Token: SeDebugPrivilege 3612 REVISED PURCHASE ORDER.exe Token: SeDebugPrivilege 4536 NETSTAT.EXE Token: SeShutdownPrivilege 3080 Explorer.EXE Token: SeCreatePagefilePrivilege 3080 Explorer.EXE Token: SeShutdownPrivilege 3080 Explorer.EXE Token: SeCreatePagefilePrivilege 3080 Explorer.EXE Token: SeShutdownPrivilege 3080 Explorer.EXE Token: SeCreatePagefilePrivilege 3080 Explorer.EXE Token: SeShutdownPrivilege 3080 Explorer.EXE Token: SeCreatePagefilePrivilege 3080 Explorer.EXE Token: SeShutdownPrivilege 3080 Explorer.EXE Token: SeCreatePagefilePrivilege 3080 Explorer.EXE Token: SeShutdownPrivilege 3080 Explorer.EXE Token: SeCreatePagefilePrivilege 3080 Explorer.EXE Token: SeShutdownPrivilege 3080 Explorer.EXE Token: SeCreatePagefilePrivilege 3080 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 3080 Explorer.EXE 3080 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
REVISED PURCHASE ORDER.exeExplorer.EXENETSTAT.EXEdescription pid process target process PID 3812 wrote to memory of 3612 3812 REVISED PURCHASE ORDER.exe REVISED PURCHASE ORDER.exe PID 3812 wrote to memory of 3612 3812 REVISED PURCHASE ORDER.exe REVISED PURCHASE ORDER.exe PID 3812 wrote to memory of 3612 3812 REVISED PURCHASE ORDER.exe REVISED PURCHASE ORDER.exe PID 3812 wrote to memory of 3612 3812 REVISED PURCHASE ORDER.exe REVISED PURCHASE ORDER.exe PID 3812 wrote to memory of 3612 3812 REVISED PURCHASE ORDER.exe REVISED PURCHASE ORDER.exe PID 3812 wrote to memory of 3612 3812 REVISED PURCHASE ORDER.exe REVISED PURCHASE ORDER.exe PID 3080 wrote to memory of 4536 3080 Explorer.EXE NETSTAT.EXE PID 3080 wrote to memory of 4536 3080 Explorer.EXE NETSTAT.EXE PID 3080 wrote to memory of 4536 3080 Explorer.EXE NETSTAT.EXE PID 4536 wrote to memory of 1840 4536 NETSTAT.EXE cmd.exe PID 4536 wrote to memory of 1840 4536 NETSTAT.EXE cmd.exe PID 4536 wrote to memory of 1840 4536 NETSTAT.EXE cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\REVISED PURCHASE ORDER.exe"C:\Users\Admin\AppData\Local\Temp\REVISED PURCHASE ORDER.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\REVISED PURCHASE ORDER.exe"C:\Users\Admin\AppData\Local\Temp\REVISED PURCHASE ORDER.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\REVISED PURCHASE ORDER.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1840-145-0x0000000000000000-mapping.dmp
-
memory/3080-149-0x0000000002900000-0x0000000002A7B000-memory.dmpFilesize
1.5MB
-
memory/3080-151-0x0000000007C10000-0x0000000007D16000-memory.dmpFilesize
1.0MB
-
memory/3080-153-0x0000000007C10000-0x0000000007D16000-memory.dmpFilesize
1.0MB
-
memory/3080-142-0x0000000002900000-0x0000000002A7B000-memory.dmpFilesize
1.5MB
-
memory/3612-138-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3612-137-0x0000000000000000-mapping.dmp
-
memory/3612-140-0x0000000001360000-0x00000000016AA000-memory.dmpFilesize
3.3MB
-
memory/3612-141-0x0000000001300000-0x0000000001314000-memory.dmpFilesize
80KB
-
memory/3612-144-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3812-136-0x0000000008D50000-0x0000000008DEC000-memory.dmpFilesize
624KB
-
memory/3812-132-0x0000000000170000-0x000000000025A000-memory.dmpFilesize
936KB
-
memory/3812-135-0x0000000004F90000-0x0000000004F9A000-memory.dmpFilesize
40KB
-
memory/3812-134-0x0000000004FF0000-0x0000000005082000-memory.dmpFilesize
584KB
-
memory/3812-133-0x0000000005380000-0x0000000005924000-memory.dmpFilesize
5.6MB
-
memory/4536-143-0x0000000000000000-mapping.dmp
-
memory/4536-148-0x0000000001960000-0x0000000001CAA000-memory.dmpFilesize
3.3MB
-
memory/4536-146-0x0000000000110000-0x000000000011B000-memory.dmpFilesize
44KB
-
memory/4536-150-0x00000000017A0000-0x0000000001833000-memory.dmpFilesize
588KB
-
memory/4536-152-0x00000000010D0000-0x00000000010FF000-memory.dmpFilesize
188KB
-
memory/4536-147-0x00000000010D0000-0x00000000010FF000-memory.dmpFilesize
188KB