Analysis
-
max time kernel
149s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
10-05-2023 18:17
Static task
static1
Behavioral task
behavioral1
Sample
PI.exe
Resource
win7-20230220-en
General
-
Target
PI.exe
-
Size
773KB
-
MD5
fe3365e83f4a43d63e0394450e1e284d
-
SHA1
f36a3148c6220bb10b0c828cf9818e75676d920f
-
SHA256
114f4e62ec2b81ab45799a56b183ef282b2bc5c172fd9831af33c154b23034ea
-
SHA512
de3a276bfd45430cc926a3362246baf78d5de04fecf234549c6ecc219249556aad7fc9e65cadfc83a14edec9940ea1860fbb758376681bbc0bd33b19ce21b724
-
SSDEEP
12288:xdZfTbsC8pAhY42pX13LLA2qpDJzn70NsF/qBth53rSdxj:xfLb78qhIF3LLRkzF/qh536xj
Malware Config
Extracted
formbook
4.1
m82
jamesdevereux.com
artificialturfminneapolis.com
hongmeiyan.com
lojaderoupasbr.com
yit.africa
austinrelocationexpert.com
saiva.page
exitsategy.com
chochonux.com
klosterbraeu-unterliezheim.com
byseymanur.com
sblwarwickshire.co.uk
brazimaid.com
ciogame.com
bronzesailing.com
dwkapl.xyz
022dyd.com
compassandpathwriting.com
alphabet1x.com
selfcleaninghairbrush.co.uk
power-bank.co.uk
kickskaart.com
baumanbilliardsnv.com
bestcp.net
doghospitalnearme.com
mixano.africa
helarybaber.online
illubio.com
ciutas.com
ldpr33.ru
killtheblacks.com
cassino-portugal.com
danhaii.com
gvtowingservice.com
let-travel.africa
dental-implants-67128.com
facetaxi.xyz
ctjh9u8e.vip
kyosaiohruri.com
executivepresencetrainer.com
greatharmony.africa
feelingsarereal.com
devopsuday.club
happiestminds-udemy.com
fittingstands.com
happyhousegarment.com
24daysofheaven.com
herhustlenation.com
xn--oy2b27nt6b.net
hothotcogixem.online
hausmeisterservice-berlin.net
hjddbb.com
stoutfamilychiro.com
bookishthoughtsbychristy.com
gibellinaheartquake.com
8cf1utrb6.xyz
patrick-daggitt.com
ebcbank.net
angel909reviews.com
arcteryxsouthafricaonline.com
cutematvhy.com
art2z.com
bulkforeverstamps.com
heatbling.com
despachocontablequinsa.com
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1384-71-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1384-75-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/656-81-0x0000000000080000-0x00000000000AF000-memory.dmp formbook behavioral1/memory/656-83-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
PI.exeRegSvcs.exehelp.exedescription pid process target process PID 1560 set thread context of 1384 1560 PI.exe RegSvcs.exe PID 1384 set thread context of 1208 1384 RegSvcs.exe Explorer.EXE PID 656 set thread context of 1208 656 help.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
PI.exepowershell.exeRegSvcs.exehelp.exepid process 1560 PI.exe 1560 PI.exe 572 powershell.exe 1384 RegSvcs.exe 1384 RegSvcs.exe 656 help.exe 656 help.exe 656 help.exe 656 help.exe 656 help.exe 656 help.exe 656 help.exe 656 help.exe 656 help.exe 656 help.exe 656 help.exe 656 help.exe 656 help.exe 656 help.exe 656 help.exe 656 help.exe 656 help.exe 656 help.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1208 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.exehelp.exepid process 1384 RegSvcs.exe 1384 RegSvcs.exe 1384 RegSvcs.exe 656 help.exe 656 help.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
PI.exepowershell.exeRegSvcs.exehelp.exedescription pid process Token: SeDebugPrivilege 1560 PI.exe Token: SeDebugPrivilege 572 powershell.exe Token: SeDebugPrivilege 1384 RegSvcs.exe Token: SeDebugPrivilege 656 help.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1208 Explorer.EXE 1208 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1208 Explorer.EXE 1208 Explorer.EXE -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
PI.exeExplorer.EXEhelp.exedescription pid process target process PID 1560 wrote to memory of 572 1560 PI.exe powershell.exe PID 1560 wrote to memory of 572 1560 PI.exe powershell.exe PID 1560 wrote to memory of 572 1560 PI.exe powershell.exe PID 1560 wrote to memory of 572 1560 PI.exe powershell.exe PID 1560 wrote to memory of 1312 1560 PI.exe schtasks.exe PID 1560 wrote to memory of 1312 1560 PI.exe schtasks.exe PID 1560 wrote to memory of 1312 1560 PI.exe schtasks.exe PID 1560 wrote to memory of 1312 1560 PI.exe schtasks.exe PID 1560 wrote to memory of 1384 1560 PI.exe RegSvcs.exe PID 1560 wrote to memory of 1384 1560 PI.exe RegSvcs.exe PID 1560 wrote to memory of 1384 1560 PI.exe RegSvcs.exe PID 1560 wrote to memory of 1384 1560 PI.exe RegSvcs.exe PID 1560 wrote to memory of 1384 1560 PI.exe RegSvcs.exe PID 1560 wrote to memory of 1384 1560 PI.exe RegSvcs.exe PID 1560 wrote to memory of 1384 1560 PI.exe RegSvcs.exe PID 1560 wrote to memory of 1384 1560 PI.exe RegSvcs.exe PID 1560 wrote to memory of 1384 1560 PI.exe RegSvcs.exe PID 1560 wrote to memory of 1384 1560 PI.exe RegSvcs.exe PID 1208 wrote to memory of 656 1208 Explorer.EXE help.exe PID 1208 wrote to memory of 656 1208 Explorer.EXE help.exe PID 1208 wrote to memory of 656 1208 Explorer.EXE help.exe PID 1208 wrote to memory of 656 1208 Explorer.EXE help.exe PID 656 wrote to memory of 548 656 help.exe cmd.exe PID 656 wrote to memory of 548 656 help.exe cmd.exe PID 656 wrote to memory of 548 656 help.exe cmd.exe PID 656 wrote to memory of 548 656 help.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\xJeUBgKHLFV.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xJeUBgKHLFV" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB887.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpB887.tmpFilesize
1KB
MD5e770540bbcf36db39905e23f019b6eac
SHA1e14df6697f4c053a9b6db5db6da2f6dd6aaeaf00
SHA256a7adf585a219ab0f0be427213c96f533bc9f05b7bca4c6193315a2262a8afb43
SHA512c4f40f91e9a23a09bee62dc28310ec0d8d364c3e225b40adeae73f668f0c34ea06f6bc423795ea5c00a18415da09c921b7e43bd7f6d044dc21fe97699f217e52
-
memory/572-76-0x0000000002460000-0x00000000024A0000-memory.dmpFilesize
256KB
-
memory/572-74-0x0000000002460000-0x00000000024A0000-memory.dmpFilesize
256KB
-
memory/656-82-0x00000000007B0000-0x0000000000AB3000-memory.dmpFilesize
3.0MB
-
memory/656-79-0x0000000000E40000-0x0000000000E46000-memory.dmpFilesize
24KB
-
memory/656-86-0x0000000000560000-0x00000000005F4000-memory.dmpFilesize
592KB
-
memory/656-83-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/656-81-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/656-80-0x0000000000E40000-0x0000000000E46000-memory.dmpFilesize
24KB
-
memory/1208-90-0x0000000004C60000-0x0000000004CF8000-memory.dmpFilesize
608KB
-
memory/1208-88-0x0000000004C60000-0x0000000004CF8000-memory.dmpFilesize
608KB
-
memory/1208-87-0x0000000004C60000-0x0000000004CF8000-memory.dmpFilesize
608KB
-
memory/1208-85-0x0000000000010000-0x0000000000020000-memory.dmpFilesize
64KB
-
memory/1208-73-0x0000000004AF0000-0x0000000004BCB000-memory.dmpFilesize
876KB
-
memory/1384-70-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1384-69-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1384-77-0x00000000009E0000-0x0000000000CE3000-memory.dmpFilesize
3.0MB
-
memory/1384-78-0x00000000002A0000-0x00000000002B5000-memory.dmpFilesize
84KB
-
memory/1384-75-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1384-68-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1384-71-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1560-55-0x0000000004BE0000-0x0000000004C20000-memory.dmpFilesize
256KB
-
memory/1560-58-0x00000000004E0000-0x00000000004EA000-memory.dmpFilesize
40KB
-
memory/1560-54-0x0000000000B90000-0x0000000000C58000-memory.dmpFilesize
800KB
-
memory/1560-56-0x00000000003A0000-0x00000000003B2000-memory.dmpFilesize
72KB
-
memory/1560-67-0x0000000004B20000-0x0000000004B74000-memory.dmpFilesize
336KB
-
memory/1560-57-0x0000000004BE0000-0x0000000004C20000-memory.dmpFilesize
256KB
-
memory/1560-59-0x0000000005A80000-0x0000000005B0A000-memory.dmpFilesize
552KB