Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
18-05-2023 02:02
Static task
static1
Behavioral task
behavioral1
Sample
MTEC PURCHASE ORDER.exe
Resource
win7-20230220-en
General
-
Target
MTEC PURCHASE ORDER.exe
-
Size
632KB
-
MD5
c05652e4a0a26f32bebadf09b4a5ef1b
-
SHA1
afd662c0b711f3fae0357c14117ab4f335ecc164
-
SHA256
1ab21622dec3ed837ed83abf3b79689037682a6d24da2c48ffbe12ba022c19ef
-
SHA512
547a40f72197183384f3a76012aba46af81edd4ee273bcda39b3a757c3b88cf2a52e9cc5a55b41f852c5b4df07ad9ad45f451b2318dfe0467853f9a67cbc4a7f
-
SSDEEP
12288:/Nj5AyKDm0wPguKYJAdYN5HVEc9dS8aemdDceRTCO/MoGn9dpmd3hBhm:/34DhwPhaQsDtoeJtMoOqxPhm
Malware Config
Extracted
formbook
4.1
gtt8
thesuccessbot.com
rittercivil.com
jt1.fun
d365extension.com
quqoxeq.top
visittworiverswi.com
bfprotienda.com
greenhabitsph.com
ladmere.com
clockboutiques.com
minwart.xyz
xinyuejiancai.online
eggsl.com
fetchingcandles.com
skywatiniya.com
hinkley.news
realityonlineenterprises.com
teamcroissant.com
esfera-pv.ch
herdadedosmontesbastos.com
buddhistprayers.app
talytic-one.com
capital-top.com
pawmultiverse.com
gdrop.biz
africanswers.online
amgconstruct1on.com
review.builders
findinstinct.online
leseditionsdupangolin.site
vector-sale.com
hutesmarke.shop
spacevisualmedia.com
jeweledcrown.shop
divinedivas.store
redirr.online
callifam.com
nickelinfo.com
ginghamstudio.com
launchthepodcast.com
arlisia.com
kerryshields.com
xn--o39aj5xqvflut.com
ramsgatecarwash.com
semrushfreetrails.com
rmpaclub.ru
wtpoexpo.one
amlar.xyz
downlis.top
phrasecheck.com
uk885.top
gdtrn.com
99522v.com
liftdetox2023.online
evo-omega.cloud
iccu3v.link
amd-soft1.site
containermurah.xyz
vineagency.uk
leeprintanddesign.com
bnjyjy.com
bookra-ck.com
ilyinsurance.com
texasmicroneedling.com
osmosstore.com
Signatures
-
Formbook payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1636-64-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1636-68-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1636-76-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/692-78-0x0000000000090000-0x00000000000BF000-memory.dmp formbook behavioral1/memory/692-80-0x0000000000090000-0x00000000000BF000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 536 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
MTEC PURCHASE ORDER.exeMTEC PURCHASE ORDER.exewuapp.exedescription pid process target process PID 1988 set thread context of 1636 1988 MTEC PURCHASE ORDER.exe MTEC PURCHASE ORDER.exe PID 1636 set thread context of 1268 1636 MTEC PURCHASE ORDER.exe Explorer.EXE PID 1636 set thread context of 1268 1636 MTEC PURCHASE ORDER.exe Explorer.EXE PID 692 set thread context of 1268 692 wuapp.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 19 IoCs
Processes:
MTEC PURCHASE ORDER.exewuapp.exepid process 1636 MTEC PURCHASE ORDER.exe 1636 MTEC PURCHASE ORDER.exe 1636 MTEC PURCHASE ORDER.exe 692 wuapp.exe 692 wuapp.exe 692 wuapp.exe 692 wuapp.exe 692 wuapp.exe 692 wuapp.exe 692 wuapp.exe 692 wuapp.exe 692 wuapp.exe 692 wuapp.exe 692 wuapp.exe 692 wuapp.exe 692 wuapp.exe 692 wuapp.exe 692 wuapp.exe 692 wuapp.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1268 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
MTEC PURCHASE ORDER.exewuapp.exepid process 1636 MTEC PURCHASE ORDER.exe 1636 MTEC PURCHASE ORDER.exe 1636 MTEC PURCHASE ORDER.exe 1636 MTEC PURCHASE ORDER.exe 692 wuapp.exe 692 wuapp.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
MTEC PURCHASE ORDER.exewuapp.exedescription pid process Token: SeDebugPrivilege 1636 MTEC PURCHASE ORDER.exe Token: SeDebugPrivilege 692 wuapp.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
MTEC PURCHASE ORDER.exeMTEC PURCHASE ORDER.exewuapp.exedescription pid process target process PID 1988 wrote to memory of 1636 1988 MTEC PURCHASE ORDER.exe MTEC PURCHASE ORDER.exe PID 1988 wrote to memory of 1636 1988 MTEC PURCHASE ORDER.exe MTEC PURCHASE ORDER.exe PID 1988 wrote to memory of 1636 1988 MTEC PURCHASE ORDER.exe MTEC PURCHASE ORDER.exe PID 1988 wrote to memory of 1636 1988 MTEC PURCHASE ORDER.exe MTEC PURCHASE ORDER.exe PID 1988 wrote to memory of 1636 1988 MTEC PURCHASE ORDER.exe MTEC PURCHASE ORDER.exe PID 1988 wrote to memory of 1636 1988 MTEC PURCHASE ORDER.exe MTEC PURCHASE ORDER.exe PID 1988 wrote to memory of 1636 1988 MTEC PURCHASE ORDER.exe MTEC PURCHASE ORDER.exe PID 1636 wrote to memory of 692 1636 MTEC PURCHASE ORDER.exe wuapp.exe PID 1636 wrote to memory of 692 1636 MTEC PURCHASE ORDER.exe wuapp.exe PID 1636 wrote to memory of 692 1636 MTEC PURCHASE ORDER.exe wuapp.exe PID 1636 wrote to memory of 692 1636 MTEC PURCHASE ORDER.exe wuapp.exe PID 1636 wrote to memory of 692 1636 MTEC PURCHASE ORDER.exe wuapp.exe PID 1636 wrote to memory of 692 1636 MTEC PURCHASE ORDER.exe wuapp.exe PID 1636 wrote to memory of 692 1636 MTEC PURCHASE ORDER.exe wuapp.exe PID 692 wrote to memory of 536 692 wuapp.exe cmd.exe PID 692 wrote to memory of 536 692 wuapp.exe cmd.exe PID 692 wrote to memory of 536 692 wuapp.exe cmd.exe PID 692 wrote to memory of 536 692 wuapp.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\MTEC PURCHASE ORDER.exe"C:\Users\Admin\AppData\Local\Temp\MTEC PURCHASE ORDER.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MTEC PURCHASE ORDER.exe"C:\Users\Admin\AppData\Local\Temp\MTEC PURCHASE ORDER.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wuapp.exe"C:\Windows\SysWOW64\wuapp.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\MTEC PURCHASE ORDER.exe"5⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/692-77-0x0000000000340000-0x000000000034B000-memory.dmpFilesize
44KB
-
memory/692-83-0x0000000001DA0000-0x0000000001E34000-memory.dmpFilesize
592KB
-
memory/692-80-0x0000000000090000-0x00000000000BF000-memory.dmpFilesize
188KB
-
memory/692-79-0x0000000001ED0000-0x00000000021D3000-memory.dmpFilesize
3.0MB
-
memory/692-78-0x0000000000090000-0x00000000000BF000-memory.dmpFilesize
188KB
-
memory/692-75-0x0000000000340000-0x000000000034B000-memory.dmpFilesize
44KB
-
memory/1268-87-0x0000000007F50000-0x0000000008065000-memory.dmpFilesize
1.1MB
-
memory/1268-85-0x0000000007F50000-0x0000000008065000-memory.dmpFilesize
1.1MB
-
memory/1268-84-0x0000000007F50000-0x0000000008065000-memory.dmpFilesize
1.1MB
-
memory/1268-70-0x0000000007220000-0x00000000073C3000-memory.dmpFilesize
1.6MB
-
memory/1268-74-0x00000000073D0000-0x000000000757E000-memory.dmpFilesize
1.7MB
-
memory/1268-66-0x0000000000010000-0x0000000000020000-memory.dmpFilesize
64KB
-
memory/1268-72-0x0000000003670000-0x0000000003770000-memory.dmpFilesize
1024KB
-
memory/1636-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1636-63-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1636-69-0x0000000000180000-0x0000000000195000-memory.dmpFilesize
84KB
-
memory/1636-67-0x0000000000B80000-0x0000000000E83000-memory.dmpFilesize
3.0MB
-
memory/1636-73-0x00000000001E0000-0x00000000001F5000-memory.dmpFilesize
84KB
-
memory/1636-64-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1636-76-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1636-68-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1636-62-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1988-54-0x0000000000AD0000-0x0000000000B74000-memory.dmpFilesize
656KB
-
memory/1988-60-0x00000000007D0000-0x0000000000814000-memory.dmpFilesize
272KB
-
memory/1988-59-0x0000000008230000-0x00000000082AC000-memory.dmpFilesize
496KB
-
memory/1988-58-0x0000000000440000-0x000000000044A000-memory.dmpFilesize
40KB
-
memory/1988-57-0x0000000004A70000-0x0000000004AB0000-memory.dmpFilesize
256KB
-
memory/1988-56-0x00000000003E0000-0x00000000003F2000-memory.dmpFilesize
72KB
-
memory/1988-55-0x0000000004A70000-0x0000000004AB0000-memory.dmpFilesize
256KB