Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2023 07:12
Static task
static1
Behavioral task
behavioral1
Sample
Inv_7623980.exe
Resource
win7-20230220-en
General
-
Target
Inv_7623980.exe
-
Size
711KB
-
MD5
9fefd93d8530102d9b1689d0aa233e51
-
SHA1
6c3f12a9fa864ac8c783da3f2a5b75254a692f85
-
SHA256
3017b026d0925919ad8085d523f83235fa84ead58d1399576e60e6183003820e
-
SHA512
45754db3bd5cc9d11d42f5b226efceac2b9694188e5843ccc28b103b005776e92b859f0fcdb7a192b7ed22fd00001ee21c15def22446c8deb07e2375a9ccb3e5
-
SSDEEP
12288:4MqBGppnzSOTzo6rv625OPX4EaxKqHcTZK9Mlr:9q0pBSOTc6Dn5MX4uq8Zz
Malware Config
Extracted
formbook
4.1
m82
jamesdevereux.com
artificialturfminneapolis.com
hongmeiyan.com
lojaderoupasbr.com
yit.africa
austinrelocationexpert.com
saiva.page
exitsategy.com
chochonux.com
klosterbraeu-unterliezheim.com
byseymanur.com
sblwarwickshire.co.uk
brazimaid.com
ciogame.com
bronzesailing.com
dwkapl.xyz
022dyd.com
compassandpathwriting.com
alphabet1x.com
selfcleaninghairbrush.co.uk
power-bank.co.uk
kickskaart.com
baumanbilliardsnv.com
bestcp.net
doghospitalnearme.com
mixano.africa
helarybaber.online
illubio.com
ciutas.com
ldpr33.ru
killtheblacks.com
cassino-portugal.com
danhaii.com
gvtowingservice.com
let-travel.africa
dental-implants-67128.com
facetaxi.xyz
ctjh9u8e.vip
kyosaiohruri.com
executivepresencetrainer.com
greatharmony.africa
feelingsarereal.com
devopsuday.club
happiestminds-udemy.com
fittingstands.com
happyhousegarment.com
24daysofheaven.com
herhustlenation.com
xn--oy2b27nt6b.net
hothotcogixem.online
hausmeisterservice-berlin.net
hjddbb.com
stoutfamilychiro.com
bookishthoughtsbychristy.com
gibellinaheartquake.com
8cf1utrb6.xyz
patrick-daggitt.com
ebcbank.net
angel909reviews.com
arcteryxsouthafricaonline.com
cutematvhy.com
art2z.com
bulkforeverstamps.com
heatbling.com
despachocontablequinsa.com
Signatures
-
Formbook payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/1684-140-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1684-144-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1684-151-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2584-153-0x0000000000E60000-0x0000000000E8F000-memory.dmp formbook behavioral2/memory/2584-155-0x0000000000E60000-0x0000000000E8F000-memory.dmp formbook -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Inv_7623980.exeInv_7623980.exechkdsk.exedescription pid process target process PID 2244 set thread context of 1684 2244 Inv_7623980.exe Inv_7623980.exe PID 1684 set thread context of 2784 1684 Inv_7623980.exe Explorer.EXE PID 1684 set thread context of 2784 1684 Inv_7623980.exe Explorer.EXE PID 2584 set thread context of 2784 2584 chkdsk.exe Explorer.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 44 IoCs
Processes:
Inv_7623980.exeInv_7623980.exechkdsk.exepid process 2244 Inv_7623980.exe 2244 Inv_7623980.exe 1684 Inv_7623980.exe 1684 Inv_7623980.exe 1684 Inv_7623980.exe 1684 Inv_7623980.exe 1684 Inv_7623980.exe 1684 Inv_7623980.exe 2584 chkdsk.exe 2584 chkdsk.exe 2584 chkdsk.exe 2584 chkdsk.exe 2584 chkdsk.exe 2584 chkdsk.exe 2584 chkdsk.exe 2584 chkdsk.exe 2584 chkdsk.exe 2584 chkdsk.exe 2584 chkdsk.exe 2584 chkdsk.exe 2584 chkdsk.exe 2584 chkdsk.exe 2584 chkdsk.exe 2584 chkdsk.exe 2584 chkdsk.exe 2584 chkdsk.exe 2584 chkdsk.exe 2584 chkdsk.exe 2584 chkdsk.exe 2584 chkdsk.exe 2584 chkdsk.exe 2584 chkdsk.exe 2584 chkdsk.exe 2584 chkdsk.exe 2584 chkdsk.exe 2584 chkdsk.exe 2584 chkdsk.exe 2584 chkdsk.exe 2584 chkdsk.exe 2584 chkdsk.exe 2584 chkdsk.exe 2584 chkdsk.exe 2584 chkdsk.exe 2584 chkdsk.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2784 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
Inv_7623980.exechkdsk.exepid process 1684 Inv_7623980.exe 1684 Inv_7623980.exe 1684 Inv_7623980.exe 1684 Inv_7623980.exe 2584 chkdsk.exe 2584 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Inv_7623980.exeInv_7623980.exechkdsk.exedescription pid process Token: SeDebugPrivilege 2244 Inv_7623980.exe Token: SeDebugPrivilege 1684 Inv_7623980.exe Token: SeDebugPrivilege 2584 chkdsk.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Inv_7623980.exeExplorer.EXEchkdsk.exedescription pid process target process PID 2244 wrote to memory of 3324 2244 Inv_7623980.exe Inv_7623980.exe PID 2244 wrote to memory of 3324 2244 Inv_7623980.exe Inv_7623980.exe PID 2244 wrote to memory of 3324 2244 Inv_7623980.exe Inv_7623980.exe PID 2244 wrote to memory of 1684 2244 Inv_7623980.exe Inv_7623980.exe PID 2244 wrote to memory of 1684 2244 Inv_7623980.exe Inv_7623980.exe PID 2244 wrote to memory of 1684 2244 Inv_7623980.exe Inv_7623980.exe PID 2244 wrote to memory of 1684 2244 Inv_7623980.exe Inv_7623980.exe PID 2244 wrote to memory of 1684 2244 Inv_7623980.exe Inv_7623980.exe PID 2244 wrote to memory of 1684 2244 Inv_7623980.exe Inv_7623980.exe PID 2784 wrote to memory of 2584 2784 Explorer.EXE chkdsk.exe PID 2784 wrote to memory of 2584 2784 Explorer.EXE chkdsk.exe PID 2784 wrote to memory of 2584 2784 Explorer.EXE chkdsk.exe PID 2584 wrote to memory of 1844 2584 chkdsk.exe cmd.exe PID 2584 wrote to memory of 1844 2584 chkdsk.exe cmd.exe PID 2584 wrote to memory of 1844 2584 chkdsk.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Inv_7623980.exe"C:\Users\Admin\AppData\Local\Temp\Inv_7623980.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Inv_7623980.exe"C:\Users\Admin\AppData\Local\Temp\Inv_7623980.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Inv_7623980.exe"C:\Users\Admin\AppData\Local\Temp\Inv_7623980.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Inv_7623980.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1684-140-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1684-151-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1684-148-0x0000000003460000-0x0000000003475000-memory.dmpFilesize
84KB
-
memory/1684-145-0x00000000016F0000-0x0000000001705000-memory.dmpFilesize
84KB
-
memory/1684-144-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1684-143-0x0000000001710000-0x0000000001A5A000-memory.dmpFilesize
3.3MB
-
memory/2244-139-0x0000000008490000-0x000000000852C000-memory.dmpFilesize
624KB
-
memory/2244-134-0x0000000005BA0000-0x0000000006144000-memory.dmpFilesize
5.6MB
-
memory/2244-138-0x00000000057A0000-0x00000000057B0000-memory.dmpFilesize
64KB
-
memory/2244-137-0x00000000057A0000-0x00000000057B0000-memory.dmpFilesize
64KB
-
memory/2244-136-0x0000000005580000-0x000000000558A000-memory.dmpFilesize
40KB
-
memory/2244-133-0x0000000000C60000-0x0000000000D18000-memory.dmpFilesize
736KB
-
memory/2244-135-0x00000000055F0000-0x0000000005682000-memory.dmpFilesize
584KB
-
memory/2584-155-0x0000000000E60000-0x0000000000E8F000-memory.dmpFilesize
188KB
-
memory/2584-150-0x0000000000F00000-0x0000000000F0A000-memory.dmpFilesize
40KB
-
memory/2584-152-0x0000000000F00000-0x0000000000F0A000-memory.dmpFilesize
40KB
-
memory/2584-153-0x0000000000E60000-0x0000000000E8F000-memory.dmpFilesize
188KB
-
memory/2584-154-0x0000000001740000-0x0000000001A8A000-memory.dmpFilesize
3.3MB
-
memory/2584-157-0x0000000001530000-0x00000000015C4000-memory.dmpFilesize
592KB
-
memory/2784-149-0x0000000008E70000-0x0000000008F8B000-memory.dmpFilesize
1.1MB
-
memory/2784-146-0x00000000089B0000-0x0000000008AA8000-memory.dmpFilesize
992KB
-
memory/2784-158-0x00000000091E0000-0x00000000092E0000-memory.dmpFilesize
1024KB
-
memory/2784-159-0x00000000091E0000-0x00000000092E0000-memory.dmpFilesize
1024KB
-
memory/2784-161-0x00000000091E0000-0x00000000092E0000-memory.dmpFilesize
1024KB