Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
27-03-2023 15:15
Static task
static1
Behavioral task
behavioral1
Sample
Orden de compra del proveedor OC_No 1435 27-03-2023.exe
Resource
win7-20230220-en
General
-
Target
Orden de compra del proveedor OC_No 1435 27-03-2023.exe
-
Size
822KB
-
MD5
91da3743bb05e6744e50fe749f5a9cc6
-
SHA1
fbb00ec09354ded8bf1b7f18f2e9cb2ef0e3d3b3
-
SHA256
b3811fa28d3e22cf5029476f6870c54e7fcd4d68da1342bb199ca6d41ed9ff56
-
SHA512
08bb7e82f83aa4d5146838b8cdc2c40382656c8db8775792d850b3bf5426f53a4e5b9e3420c16e4b4140767a030e0eab9d3339f5182f6390def143d470f3f277
-
SSDEEP
12288:LUJB0Oq8p2ZEtCgO27/mW9XqUjX5OFUuOWGt0p4VedclBeHlOrh1CuQvpAoJhZ:AZpTtV7fjc36veA1Gx9D
Malware Config
Extracted
formbook
4.1
jr22
941zhe.com
lunarportal.space
xn--osmaniyeiek-t9ab.online
trejoscar.com
nrnursery.com
quizcannot.cfd
seedstockersthailand.com
watsonwindow.com
wjfholdings.com
weziclondon.com
naruot.xyz
yeji.plus
classicmenstore.com
oharatravel.com
therapyplankits.com
keviegreshonpt.com
qdlyner.com
seithupaarungal.com
casinorates.online
8ug4as.icu
foamyfallscarwash.com
padelfaculty.com
theenergysavingcentre.com
dorpp.com
scoresendirect.online
yuqintw.com
erenortopedi.com
skymagickey.com
infinitepuremind.com
watchtamilmovie.com
southplainsinsurance.net
intentionaldating.app
certaproarkansas.com
blidai.com
thehoneybeeworks.com
followplace.com
sipsterbyananeke.com
37300.uk
bluebirdbuyers.com
composewithme.com
moneymundo.com
daftarakun.xyz
samsonm.com
nurse-jobs-in-us-35896.com
cancerbloodspecialistsga.net
feelfeminineagain.com
residentialcaretraining.com
allprocleanouts.com
englishsongs.online
bookkeepingdeerfield.com
bendcollegeadvisor.com
boaiqixian.com
vixensgolfcarts.com
igarrido.net
rsconstructiontrading.com
lakewayturf.com
carelesstees.com
silviaheni.xyz
iaqieqq.com
campingspiel.com
diacute.com
thaigeneratortg.com
autoreenter.com
meclishaber.xyz
airbnbtransfers.com
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/1772-150-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1772-176-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2864-221-0x00000000003D0000-0x00000000003FF000-memory.dmp formbook behavioral2/memory/2864-223-0x00000000003D0000-0x00000000003FF000-memory.dmp formbook -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Orden de compra del proveedor OC_No 1435 27-03-2023.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation Orden de compra del proveedor OC_No 1435 27-03-2023.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Orden de compra del proveedor OC_No 1435 27-03-2023.exeOrden de compra del proveedor OC_No 1435 27-03-2023.exemsiexec.exedescription pid process target process PID 4976 set thread context of 1772 4976 Orden de compra del proveedor OC_No 1435 27-03-2023.exe Orden de compra del proveedor OC_No 1435 27-03-2023.exe PID 1772 set thread context of 3196 1772 Orden de compra del proveedor OC_No 1435 27-03-2023.exe Explorer.EXE PID 2864 set thread context of 3196 2864 msiexec.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 44 IoCs
Processes:
powershell.exepowershell.exeOrden de compra del proveedor OC_No 1435 27-03-2023.exemsiexec.exepid process 2228 powershell.exe 4236 powershell.exe 4236 powershell.exe 2228 powershell.exe 1772 Orden de compra del proveedor OC_No 1435 27-03-2023.exe 1772 Orden de compra del proveedor OC_No 1435 27-03-2023.exe 1772 Orden de compra del proveedor OC_No 1435 27-03-2023.exe 1772 Orden de compra del proveedor OC_No 1435 27-03-2023.exe 2864 msiexec.exe 2864 msiexec.exe 2864 msiexec.exe 2864 msiexec.exe 2864 msiexec.exe 2864 msiexec.exe 2864 msiexec.exe 2864 msiexec.exe 2864 msiexec.exe 2864 msiexec.exe 2864 msiexec.exe 2864 msiexec.exe 2864 msiexec.exe 2864 msiexec.exe 2864 msiexec.exe 2864 msiexec.exe 2864 msiexec.exe 2864 msiexec.exe 2864 msiexec.exe 2864 msiexec.exe 2864 msiexec.exe 2864 msiexec.exe 2864 msiexec.exe 2864 msiexec.exe 2864 msiexec.exe 2864 msiexec.exe 2864 msiexec.exe 2864 msiexec.exe 2864 msiexec.exe 2864 msiexec.exe 2864 msiexec.exe 2864 msiexec.exe 2864 msiexec.exe 2864 msiexec.exe 2864 msiexec.exe 2864 msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3196 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Orden de compra del proveedor OC_No 1435 27-03-2023.exemsiexec.exepid process 1772 Orden de compra del proveedor OC_No 1435 27-03-2023.exe 1772 Orden de compra del proveedor OC_No 1435 27-03-2023.exe 1772 Orden de compra del proveedor OC_No 1435 27-03-2023.exe 2864 msiexec.exe 2864 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
powershell.exepowershell.exeOrden de compra del proveedor OC_No 1435 27-03-2023.exeExplorer.EXEmsiexec.exedescription pid process Token: SeDebugPrivilege 2228 powershell.exe Token: SeDebugPrivilege 4236 powershell.exe Token: SeDebugPrivilege 1772 Orden de compra del proveedor OC_No 1435 27-03-2023.exe Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeShutdownPrivilege 3196 Explorer.EXE Token: SeCreatePagefilePrivilege 3196 Explorer.EXE Token: SeDebugPrivilege 2864 msiexec.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
Orden de compra del proveedor OC_No 1435 27-03-2023.exeExplorer.EXEmsiexec.exedescription pid process target process PID 4976 wrote to memory of 4236 4976 Orden de compra del proveedor OC_No 1435 27-03-2023.exe powershell.exe PID 4976 wrote to memory of 4236 4976 Orden de compra del proveedor OC_No 1435 27-03-2023.exe powershell.exe PID 4976 wrote to memory of 4236 4976 Orden de compra del proveedor OC_No 1435 27-03-2023.exe powershell.exe PID 4976 wrote to memory of 2228 4976 Orden de compra del proveedor OC_No 1435 27-03-2023.exe powershell.exe PID 4976 wrote to memory of 2228 4976 Orden de compra del proveedor OC_No 1435 27-03-2023.exe powershell.exe PID 4976 wrote to memory of 2228 4976 Orden de compra del proveedor OC_No 1435 27-03-2023.exe powershell.exe PID 4976 wrote to memory of 3052 4976 Orden de compra del proveedor OC_No 1435 27-03-2023.exe schtasks.exe PID 4976 wrote to memory of 3052 4976 Orden de compra del proveedor OC_No 1435 27-03-2023.exe schtasks.exe PID 4976 wrote to memory of 3052 4976 Orden de compra del proveedor OC_No 1435 27-03-2023.exe schtasks.exe PID 4976 wrote to memory of 1772 4976 Orden de compra del proveedor OC_No 1435 27-03-2023.exe Orden de compra del proveedor OC_No 1435 27-03-2023.exe PID 4976 wrote to memory of 1772 4976 Orden de compra del proveedor OC_No 1435 27-03-2023.exe Orden de compra del proveedor OC_No 1435 27-03-2023.exe PID 4976 wrote to memory of 1772 4976 Orden de compra del proveedor OC_No 1435 27-03-2023.exe Orden de compra del proveedor OC_No 1435 27-03-2023.exe PID 4976 wrote to memory of 1772 4976 Orden de compra del proveedor OC_No 1435 27-03-2023.exe Orden de compra del proveedor OC_No 1435 27-03-2023.exe PID 4976 wrote to memory of 1772 4976 Orden de compra del proveedor OC_No 1435 27-03-2023.exe Orden de compra del proveedor OC_No 1435 27-03-2023.exe PID 4976 wrote to memory of 1772 4976 Orden de compra del proveedor OC_No 1435 27-03-2023.exe Orden de compra del proveedor OC_No 1435 27-03-2023.exe PID 3196 wrote to memory of 2864 3196 Explorer.EXE msiexec.exe PID 3196 wrote to memory of 2864 3196 Explorer.EXE msiexec.exe PID 3196 wrote to memory of 2864 3196 Explorer.EXE msiexec.exe PID 2864 wrote to memory of 1428 2864 msiexec.exe cmd.exe PID 2864 wrote to memory of 1428 2864 msiexec.exe cmd.exe PID 2864 wrote to memory of 1428 2864 msiexec.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Orden de compra del proveedor OC_No 1435 27-03-2023.exe"C:\Users\Admin\AppData\Local\Temp\Orden de compra del proveedor OC_No 1435 27-03-2023.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Orden de compra del proveedor OC_No 1435 27-03-2023.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\YCNgsiXL.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YCNgsiXL" /XML "C:\Users\Admin\AppData\Local\Temp\tmp47D6.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Orden de compra del proveedor OC_No 1435 27-03-2023.exe"C:\Users\Admin\AppData\Local\Temp\Orden de compra del proveedor OC_No 1435 27-03-2023.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Orden de compra del proveedor OC_No 1435 27-03-2023.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD51201b583900d29a9f031c81534946276
SHA1cd5d240e614d2bcd07e2f8021f2a4203defb59e5
SHA256391399f853509e083ef3ef305282a7c0c7d08fee41313ec4a469a9b886f11d6b
SHA512266a222b78dd9a97ac3f34d6537514de9c2c94ebe31f8978af3addd332e5dd27a3efcb68abfa6c4c3018d90835bc7c6b7aad1e4c0e51b3076008a715bbeee8e8
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cqzq4yj4.aq1.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmp47D6.tmpFilesize
1KB
MD5c5dcfa26d18bdeb5b6a6263253165732
SHA1ac9fb7e1ee616100087ce97f41a6ef6727a01cec
SHA25654fb9535820865a8f30dc4cca0610d3855a8f3288e5d15e5cbf704b7587e631c
SHA512a82151c70521d680e5be2e0b955b484a5bcf632a210b1bf794e1582ce13bacb0724bede8e418751bfc3f8634b3492ee7e81a4e817857362ef6dc3c5decf3d562
-
memory/1772-177-0x0000000001300000-0x0000000001314000-memory.dmpFilesize
80KB
-
memory/1772-150-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1772-176-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1772-175-0x00000000014F0000-0x000000000183A000-memory.dmpFilesize
3.3MB
-
memory/2228-207-0x0000000007360000-0x00000000073F6000-memory.dmpFilesize
600KB
-
memory/2228-204-0x0000000007720000-0x0000000007D9A000-memory.dmpFilesize
6.5MB
-
memory/2228-203-0x000000007F700000-0x000000007F710000-memory.dmpFilesize
64KB
-
memory/2228-149-0x0000000004A50000-0x0000000004A60000-memory.dmpFilesize
64KB
-
memory/2228-205-0x00000000070E0000-0x00000000070FA000-memory.dmpFilesize
104KB
-
memory/2228-146-0x0000000005090000-0x00000000056B8000-memory.dmpFilesize
6.2MB
-
memory/2228-201-0x0000000004A50000-0x0000000004A60000-memory.dmpFilesize
64KB
-
memory/2228-200-0x0000000006380000-0x000000000639E000-memory.dmpFilesize
120KB
-
memory/2228-181-0x00000000758A0000-0x00000000758EC000-memory.dmpFilesize
304KB
-
memory/2228-206-0x0000000007150000-0x000000000715A000-memory.dmpFilesize
40KB
-
memory/2228-210-0x0000000007400000-0x0000000007408000-memory.dmpFilesize
32KB
-
memory/2864-221-0x00000000003D0000-0x00000000003FF000-memory.dmpFilesize
188KB
-
memory/2864-222-0x0000000002560000-0x00000000028AA000-memory.dmpFilesize
3.3MB
-
memory/2864-225-0x0000000002480000-0x0000000002513000-memory.dmpFilesize
588KB
-
memory/2864-223-0x00000000003D0000-0x00000000003FF000-memory.dmpFilesize
188KB
-
memory/2864-216-0x0000000000690000-0x00000000006A2000-memory.dmpFilesize
72KB
-
memory/2864-218-0x0000000000690000-0x00000000006A2000-memory.dmpFilesize
72KB
-
memory/2864-220-0x0000000000690000-0x00000000006A2000-memory.dmpFilesize
72KB
-
memory/3196-178-0x0000000007E00000-0x0000000007F7B000-memory.dmpFilesize
1.5MB
-
memory/3196-229-0x0000000008430000-0x0000000008555000-memory.dmpFilesize
1.1MB
-
memory/3196-227-0x0000000008430000-0x0000000008555000-memory.dmpFilesize
1.1MB
-
memory/3196-226-0x0000000008430000-0x0000000008555000-memory.dmpFilesize
1.1MB
-
memory/4236-148-0x0000000004B50000-0x0000000004B60000-memory.dmpFilesize
64KB
-
memory/4236-157-0x0000000005090000-0x00000000050B2000-memory.dmpFilesize
136KB
-
memory/4236-180-0x00000000758A0000-0x00000000758EC000-memory.dmpFilesize
304KB
-
memory/4236-179-0x0000000007010000-0x0000000007042000-memory.dmpFilesize
200KB
-
memory/4236-208-0x0000000007390000-0x000000000739E000-memory.dmpFilesize
56KB
-
memory/4236-209-0x00000000074A0000-0x00000000074BA000-memory.dmpFilesize
104KB
-
memory/4236-173-0x0000000005E70000-0x0000000005E8E000-memory.dmpFilesize
120KB
-
memory/4236-169-0x0000000005930000-0x0000000005996000-memory.dmpFilesize
408KB
-
memory/4236-164-0x00000000057C0000-0x0000000005826000-memory.dmpFilesize
408KB
-
memory/4236-202-0x0000000004B50000-0x0000000004B60000-memory.dmpFilesize
64KB
-
memory/4236-144-0x0000000002520000-0x0000000002556000-memory.dmpFilesize
216KB
-
memory/4236-147-0x0000000004B50000-0x0000000004B60000-memory.dmpFilesize
64KB
-
memory/4976-133-0x00000000001C0000-0x0000000000294000-memory.dmpFilesize
848KB
-
memory/4976-139-0x0000000007E20000-0x0000000007EBC000-memory.dmpFilesize
624KB
-
memory/4976-138-0x0000000004DD0000-0x0000000004DE0000-memory.dmpFilesize
64KB
-
memory/4976-137-0x0000000004DD0000-0x0000000004DE0000-memory.dmpFilesize
64KB
-
memory/4976-136-0x0000000004B20000-0x0000000004B2A000-memory.dmpFilesize
40KB
-
memory/4976-135-0x0000000004B40000-0x0000000004BD2000-memory.dmpFilesize
584KB
-
memory/4976-134-0x0000000005050000-0x00000000055F4000-memory.dmpFilesize
5.6MB