Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
10-05-2023 18:17
Static task
static1
Behavioral task
behavioral1
Sample
PI.exe
Resource
win7-20230220-en
General
-
Target
PI.exe
-
Size
773KB
-
MD5
fe3365e83f4a43d63e0394450e1e284d
-
SHA1
f36a3148c6220bb10b0c828cf9818e75676d920f
-
SHA256
114f4e62ec2b81ab45799a56b183ef282b2bc5c172fd9831af33c154b23034ea
-
SHA512
de3a276bfd45430cc926a3362246baf78d5de04fecf234549c6ecc219249556aad7fc9e65cadfc83a14edec9940ea1860fbb758376681bbc0bd33b19ce21b724
-
SSDEEP
12288:xdZfTbsC8pAhY42pX13LLA2qpDJzn70NsF/qBth53rSdxj:xfLb78qhIF3LLRkzF/qh536xj
Malware Config
Extracted
formbook
4.1
m82
jamesdevereux.com
artificialturfminneapolis.com
hongmeiyan.com
lojaderoupasbr.com
yit.africa
austinrelocationexpert.com
saiva.page
exitsategy.com
chochonux.com
klosterbraeu-unterliezheim.com
byseymanur.com
sblwarwickshire.co.uk
brazimaid.com
ciogame.com
bronzesailing.com
dwkapl.xyz
022dyd.com
compassandpathwriting.com
alphabet1x.com
selfcleaninghairbrush.co.uk
power-bank.co.uk
kickskaart.com
baumanbilliardsnv.com
bestcp.net
doghospitalnearme.com
mixano.africa
helarybaber.online
illubio.com
ciutas.com
ldpr33.ru
killtheblacks.com
cassino-portugal.com
danhaii.com
gvtowingservice.com
let-travel.africa
dental-implants-67128.com
facetaxi.xyz
ctjh9u8e.vip
kyosaiohruri.com
executivepresencetrainer.com
greatharmony.africa
feelingsarereal.com
devopsuday.club
happiestminds-udemy.com
fittingstands.com
happyhousegarment.com
24daysofheaven.com
herhustlenation.com
xn--oy2b27nt6b.net
hothotcogixem.online
hausmeisterservice-berlin.net
hjddbb.com
stoutfamilychiro.com
bookishthoughtsbychristy.com
gibellinaheartquake.com
8cf1utrb6.xyz
patrick-daggitt.com
ebcbank.net
angel909reviews.com
arcteryxsouthafricaonline.com
cutematvhy.com
art2z.com
bulkforeverstamps.com
heatbling.com
despachocontablequinsa.com
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3284-147-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3284-182-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2220-187-0x0000000000B30000-0x0000000000B5F000-memory.dmp formbook behavioral2/memory/2220-192-0x0000000000B30000-0x0000000000B5F000-memory.dmp formbook -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
PI.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation PI.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
PI.exeRegSvcs.exewlanext.exedescription pid process target process PID 1196 set thread context of 3284 1196 PI.exe RegSvcs.exe PID 3284 set thread context of 3112 3284 RegSvcs.exe Explorer.EXE PID 2220 set thread context of 3112 2220 wlanext.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 46 IoCs
Processes:
PI.exepowershell.exeRegSvcs.exewlanext.exepid process 1196 PI.exe 1196 PI.exe 832 powershell.exe 3284 RegSvcs.exe 3284 RegSvcs.exe 3284 RegSvcs.exe 3284 RegSvcs.exe 832 powershell.exe 2220 wlanext.exe 2220 wlanext.exe 2220 wlanext.exe 2220 wlanext.exe 2220 wlanext.exe 2220 wlanext.exe 2220 wlanext.exe 2220 wlanext.exe 2220 wlanext.exe 2220 wlanext.exe 2220 wlanext.exe 2220 wlanext.exe 2220 wlanext.exe 2220 wlanext.exe 2220 wlanext.exe 2220 wlanext.exe 2220 wlanext.exe 2220 wlanext.exe 2220 wlanext.exe 2220 wlanext.exe 2220 wlanext.exe 2220 wlanext.exe 2220 wlanext.exe 2220 wlanext.exe 2220 wlanext.exe 2220 wlanext.exe 2220 wlanext.exe 2220 wlanext.exe 2220 wlanext.exe 2220 wlanext.exe 2220 wlanext.exe 2220 wlanext.exe 2220 wlanext.exe 2220 wlanext.exe 2220 wlanext.exe 2220 wlanext.exe 2220 wlanext.exe 2220 wlanext.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3112 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.exewlanext.exepid process 3284 RegSvcs.exe 3284 RegSvcs.exe 3284 RegSvcs.exe 2220 wlanext.exe 2220 wlanext.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
PI.exepowershell.exeRegSvcs.exewlanext.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1196 PI.exe Token: SeDebugPrivilege 832 powershell.exe Token: SeDebugPrivilege 3284 RegSvcs.exe Token: SeDebugPrivilege 2220 wlanext.exe Token: SeShutdownPrivilege 3112 Explorer.EXE Token: SeCreatePagefilePrivilege 3112 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
PI.exeExplorer.EXEwlanext.exedescription pid process target process PID 1196 wrote to memory of 832 1196 PI.exe powershell.exe PID 1196 wrote to memory of 832 1196 PI.exe powershell.exe PID 1196 wrote to memory of 832 1196 PI.exe powershell.exe PID 1196 wrote to memory of 4556 1196 PI.exe schtasks.exe PID 1196 wrote to memory of 4556 1196 PI.exe schtasks.exe PID 1196 wrote to memory of 4556 1196 PI.exe schtasks.exe PID 1196 wrote to memory of 3284 1196 PI.exe RegSvcs.exe PID 1196 wrote to memory of 3284 1196 PI.exe RegSvcs.exe PID 1196 wrote to memory of 3284 1196 PI.exe RegSvcs.exe PID 1196 wrote to memory of 3284 1196 PI.exe RegSvcs.exe PID 1196 wrote to memory of 3284 1196 PI.exe RegSvcs.exe PID 1196 wrote to memory of 3284 1196 PI.exe RegSvcs.exe PID 3112 wrote to memory of 2220 3112 Explorer.EXE wlanext.exe PID 3112 wrote to memory of 2220 3112 Explorer.EXE wlanext.exe PID 3112 wrote to memory of 2220 3112 Explorer.EXE wlanext.exe PID 2220 wrote to memory of 2356 2220 wlanext.exe cmd.exe PID 2220 wrote to memory of 2356 2220 wlanext.exe cmd.exe PID 2220 wrote to memory of 2356 2220 wlanext.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\xJeUBgKHLFV.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xJeUBgKHLFV" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9BD2.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vgdxtaif.ci2.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmp9BD2.tmpFilesize
1KB
MD57d462ecc6fab6c03515031573a085932
SHA10b386c5efd2f4481c65a95451b3c3c2441f3f58c
SHA25676681dd5ab64cba5afb486a2e7268532f51942a6a48d6ccddd9a489982030477
SHA51216b17833032231e648d1c94e38a59de847c2746004507cdabd845e81a3be69ed7d5481aa0cb42a91e37cc17a551a33b86b5ab520b46589f17eeff66d2fabc916
-
memory/832-152-0x0000000005B10000-0x0000000005B76000-memory.dmpFilesize
408KB
-
memory/832-185-0x0000000007B50000-0x00000000081CA000-memory.dmpFilesize
6.5MB
-
memory/832-186-0x0000000007500000-0x000000000751A000-memory.dmpFilesize
104KB
-
memory/832-164-0x0000000006200000-0x000000000621E000-memory.dmpFilesize
120KB
-
memory/832-158-0x0000000005B80000-0x0000000005BE6000-memory.dmpFilesize
408KB
-
memory/832-144-0x0000000002930000-0x0000000002966000-memory.dmpFilesize
216KB
-
memory/832-195-0x0000000007830000-0x0000000007838000-memory.dmpFilesize
32KB
-
memory/832-146-0x0000000005370000-0x0000000005998000-memory.dmpFilesize
6.2MB
-
memory/832-194-0x0000000007850000-0x000000000786A000-memory.dmpFilesize
104KB
-
memory/832-150-0x00000000028E0000-0x00000000028F0000-memory.dmpFilesize
64KB
-
memory/832-149-0x0000000005340000-0x0000000005362000-memory.dmpFilesize
136KB
-
memory/832-151-0x00000000028E0000-0x00000000028F0000-memory.dmpFilesize
64KB
-
memory/832-189-0x000000007F890000-0x000000007F8A0000-memory.dmpFilesize
64KB
-
memory/832-190-0x0000000007580000-0x000000000758A000-memory.dmpFilesize
40KB
-
memory/832-170-0x00000000711C0000-0x000000007120C000-memory.dmpFilesize
304KB
-
memory/832-193-0x0000000007740000-0x000000000774E000-memory.dmpFilesize
56KB
-
memory/832-180-0x00000000067A0000-0x00000000067BE000-memory.dmpFilesize
120KB
-
memory/832-191-0x0000000007790000-0x0000000007826000-memory.dmpFilesize
600KB
-
memory/832-169-0x00000000067E0000-0x0000000006812000-memory.dmpFilesize
200KB
-
memory/832-168-0x00000000028E0000-0x00000000028F0000-memory.dmpFilesize
64KB
-
memory/1196-133-0x0000000000BE0000-0x0000000000CA8000-memory.dmpFilesize
800KB
-
memory/1196-134-0x0000000005CB0000-0x0000000006254000-memory.dmpFilesize
5.6MB
-
memory/1196-135-0x0000000005650000-0x00000000056E2000-memory.dmpFilesize
584KB
-
memory/1196-138-0x0000000005840000-0x0000000005850000-memory.dmpFilesize
64KB
-
memory/1196-136-0x0000000005800000-0x000000000580A000-memory.dmpFilesize
40KB
-
memory/1196-137-0x0000000005840000-0x0000000005850000-memory.dmpFilesize
64KB
-
memory/1196-139-0x0000000007D40000-0x0000000007DDC000-memory.dmpFilesize
624KB
-
memory/2220-192-0x0000000000B30000-0x0000000000B5F000-memory.dmpFilesize
188KB
-
memory/2220-187-0x0000000000B30000-0x0000000000B5F000-memory.dmpFilesize
188KB
-
memory/2220-184-0x0000000000BB0000-0x0000000000BC7000-memory.dmpFilesize
92KB
-
memory/2220-188-0x00000000013D0000-0x000000000171A000-memory.dmpFilesize
3.3MB
-
memory/2220-181-0x0000000000BB0000-0x0000000000BC7000-memory.dmpFilesize
92KB
-
memory/2220-199-0x00000000012C0000-0x0000000001354000-memory.dmpFilesize
592KB
-
memory/3112-167-0x0000000008410000-0x000000000854D000-memory.dmpFilesize
1.2MB
-
memory/3112-200-0x0000000002F70000-0x000000000301E000-memory.dmpFilesize
696KB
-
memory/3112-201-0x0000000002F70000-0x000000000301E000-memory.dmpFilesize
696KB
-
memory/3112-203-0x0000000002F70000-0x000000000301E000-memory.dmpFilesize
696KB
-
memory/3284-182-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3284-166-0x0000000001380000-0x0000000001395000-memory.dmpFilesize
84KB
-
memory/3284-165-0x00000000013C0000-0x000000000170A000-memory.dmpFilesize
3.3MB
-
memory/3284-147-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB