Analysis
-
max time kernel
236s -
max time network
312s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
05-05-2023 19:06
Static task
static1
Behavioral task
behavioral1
Sample
Havells New Order.exe
Resource
win7-20230220-en
General
-
Target
Havells New Order.exe
-
Size
699KB
-
MD5
300d31029b8682f365329877661a178f
-
SHA1
aafcc7ef5558fc23613b712eb84d527a00d0b301
-
SHA256
5165efed390a7710ab87e8256f51ec07dbc9b63e8cf55e104a9230530b813cb0
-
SHA512
33e3df0de9def64289838c135b174e6cc9bee44fd729363a2baed45301a48641d0f0d9b7d64cac4e54dece1fbfc9753a8e277d1219ae73cb318df6d1c4e1f501
-
SSDEEP
12288:qPKQH/WQn0L3PCy5lukBLuS45UF1U7+QPM2YvzM0hga6zku7f:IKQfWS07Cy5wCLUWU7+Q6vzM0Igur
Malware Config
Extracted
formbook
4.1
gtt8
thesuccessbot.com
rittercivil.com
jt1.fun
d365extension.com
quqoxeq.top
visittworiverswi.com
bfprotienda.com
greenhabitsph.com
ladmere.com
clockboutiques.com
minwart.xyz
xinyuejiancai.online
eggsl.com
fetchingcandles.com
skywatiniya.com
hinkley.news
realityonlineenterprises.com
teamcroissant.com
esfera-pv.ch
herdadedosmontesbastos.com
buddhistprayers.app
talytic-one.com
capital-top.com
pawmultiverse.com
gdrop.biz
africanswers.online
amgconstruct1on.com
review.builders
findinstinct.online
leseditionsdupangolin.site
vector-sale.com
hutesmarke.shop
spacevisualmedia.com
jeweledcrown.shop
divinedivas.store
redirr.online
callifam.com
nickelinfo.com
ginghamstudio.com
launchthepodcast.com
arlisia.com
kerryshields.com
xn--o39aj5xqvflut.com
ramsgatecarwash.com
semrushfreetrails.com
rmpaclub.ru
wtpoexpo.one
amlar.xyz
downlis.top
phrasecheck.com
uk885.top
gdtrn.com
99522v.com
liftdetox2023.online
evo-omega.cloud
iccu3v.link
amd-soft1.site
containermurah.xyz
vineagency.uk
leeprintanddesign.com
bnjyjy.com
bookra-ck.com
ilyinsurance.com
texasmicroneedling.com
osmosstore.com
Signatures
-
Formbook payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2004-64-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2004-70-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2004-74-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1000-78-0x0000000000090000-0x00000000000BF000-memory.dmp formbook behavioral1/memory/1000-80-0x0000000000090000-0x00000000000BF000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1840 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Havells New Order.exeHavells New Order.exemsiexec.exedescription pid process target process PID 268 set thread context of 2004 268 Havells New Order.exe Havells New Order.exe PID 2004 set thread context of 1256 2004 Havells New Order.exe Explorer.EXE PID 2004 set thread context of 1256 2004 Havells New Order.exe Explorer.EXE PID 1000 set thread context of 1256 1000 msiexec.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 17 IoCs
Processes:
Havells New Order.exeHavells New Order.exemsiexec.exepid process 268 Havells New Order.exe 2004 Havells New Order.exe 2004 Havells New Order.exe 2004 Havells New Order.exe 1000 msiexec.exe 1000 msiexec.exe 1000 msiexec.exe 1000 msiexec.exe 1000 msiexec.exe 1000 msiexec.exe 1000 msiexec.exe 1000 msiexec.exe 1000 msiexec.exe 1000 msiexec.exe 1000 msiexec.exe 1000 msiexec.exe 1000 msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1256 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
Havells New Order.exemsiexec.exepid process 2004 Havells New Order.exe 2004 Havells New Order.exe 2004 Havells New Order.exe 2004 Havells New Order.exe 1000 msiexec.exe 1000 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Havells New Order.exeHavells New Order.exemsiexec.exedescription pid process Token: SeDebugPrivilege 268 Havells New Order.exe Token: SeDebugPrivilege 2004 Havells New Order.exe Token: SeDebugPrivilege 1000 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1256 Explorer.EXE 1256 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1256 Explorer.EXE 1256 Explorer.EXE -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
Havells New Order.exeExplorer.EXEmsiexec.exedescription pid process target process PID 268 wrote to memory of 1360 268 Havells New Order.exe Havells New Order.exe PID 268 wrote to memory of 1360 268 Havells New Order.exe Havells New Order.exe PID 268 wrote to memory of 1360 268 Havells New Order.exe Havells New Order.exe PID 268 wrote to memory of 1360 268 Havells New Order.exe Havells New Order.exe PID 268 wrote to memory of 2004 268 Havells New Order.exe Havells New Order.exe PID 268 wrote to memory of 2004 268 Havells New Order.exe Havells New Order.exe PID 268 wrote to memory of 2004 268 Havells New Order.exe Havells New Order.exe PID 268 wrote to memory of 2004 268 Havells New Order.exe Havells New Order.exe PID 268 wrote to memory of 2004 268 Havells New Order.exe Havells New Order.exe PID 268 wrote to memory of 2004 268 Havells New Order.exe Havells New Order.exe PID 268 wrote to memory of 2004 268 Havells New Order.exe Havells New Order.exe PID 1256 wrote to memory of 1000 1256 Explorer.EXE msiexec.exe PID 1256 wrote to memory of 1000 1256 Explorer.EXE msiexec.exe PID 1256 wrote to memory of 1000 1256 Explorer.EXE msiexec.exe PID 1256 wrote to memory of 1000 1256 Explorer.EXE msiexec.exe PID 1256 wrote to memory of 1000 1256 Explorer.EXE msiexec.exe PID 1256 wrote to memory of 1000 1256 Explorer.EXE msiexec.exe PID 1256 wrote to memory of 1000 1256 Explorer.EXE msiexec.exe PID 1256 wrote to memory of 288 1256 Explorer.EXE help.exe PID 1256 wrote to memory of 288 1256 Explorer.EXE help.exe PID 1256 wrote to memory of 288 1256 Explorer.EXE help.exe PID 1256 wrote to memory of 288 1256 Explorer.EXE help.exe PID 1000 wrote to memory of 1840 1000 msiexec.exe cmd.exe PID 1000 wrote to memory of 1840 1000 msiexec.exe cmd.exe PID 1000 wrote to memory of 1840 1000 msiexec.exe cmd.exe PID 1000 wrote to memory of 1840 1000 msiexec.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Havells New Order.exe"C:\Users\Admin\AppData\Local\Temp\Havells New Order.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Havells New Order.exe"C:\Users\Admin\AppData\Local\Temp\Havells New Order.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Havells New Order.exe"C:\Users\Admin\AppData\Local\Temp\Havells New Order.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Havells New Order.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/268-54-0x0000000000EA0000-0x0000000000F56000-memory.dmpFilesize
728KB
-
memory/268-55-0x0000000004820000-0x0000000004860000-memory.dmpFilesize
256KB
-
memory/268-56-0x0000000000320000-0x0000000000330000-memory.dmpFilesize
64KB
-
memory/268-57-0x0000000004820000-0x0000000004860000-memory.dmpFilesize
256KB
-
memory/268-58-0x0000000000440000-0x000000000044C000-memory.dmpFilesize
48KB
-
memory/268-59-0x0000000005CD0000-0x0000000005D4E000-memory.dmpFilesize
504KB
-
memory/268-60-0x0000000004860000-0x00000000048A6000-memory.dmpFilesize
280KB
-
memory/1000-84-0x0000000002050000-0x00000000020E4000-memory.dmpFilesize
592KB
-
memory/1000-80-0x0000000000090000-0x00000000000BF000-memory.dmpFilesize
188KB
-
memory/1000-77-0x00000000001D0000-0x00000000001E4000-memory.dmpFilesize
80KB
-
memory/1000-78-0x0000000000090000-0x00000000000BF000-memory.dmpFilesize
188KB
-
memory/1000-75-0x00000000001D0000-0x00000000001E4000-memory.dmpFilesize
80KB
-
memory/1000-73-0x00000000001D0000-0x00000000001E4000-memory.dmpFilesize
80KB
-
memory/1000-79-0x00000000021D0000-0x00000000024D3000-memory.dmpFilesize
3.0MB
-
memory/1256-85-0x0000000006C40000-0x0000000006D41000-memory.dmpFilesize
1.0MB
-
memory/1256-81-0x0000000006B20000-0x0000000006C31000-memory.dmpFilesize
1.1MB
-
memory/1256-72-0x0000000007020000-0x00000000071B3000-memory.dmpFilesize
1.6MB
-
memory/1256-69-0x0000000006B20000-0x0000000006C31000-memory.dmpFilesize
1.1MB
-
memory/1256-82-0x0000000000010000-0x0000000000020000-memory.dmpFilesize
64KB
-
memory/1256-88-0x0000000006C40000-0x0000000006D41000-memory.dmpFilesize
1.0MB
-
memory/1256-86-0x0000000006C40000-0x0000000006D41000-memory.dmpFilesize
1.0MB
-
memory/2004-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2004-74-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2004-71-0x0000000000370000-0x0000000000385000-memory.dmpFilesize
84KB
-
memory/2004-70-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2004-68-0x0000000000330000-0x0000000000345000-memory.dmpFilesize
84KB
-
memory/2004-67-0x0000000000880000-0x0000000000B83000-memory.dmpFilesize
3.0MB
-
memory/2004-64-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2004-63-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2004-62-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB