Analysis
-
max time kernel
184s -
max time network
186s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
12-10-2023 13:03
Static task
static1
Behavioral task
behavioral1
Sample
Urgent-N65.pdf.exe
Resource
win7-20230831-en
General
-
Target
Urgent-N65.pdf.exe
-
Size
559KB
-
MD5
641b93249d87d4a7c59d4896a61a29cd
-
SHA1
c1259ec9f29890ea520faa81c2b10ffe61add985
-
SHA256
89bcf1ff783e9986332cd6debe5fe5f424439518b7638f56b8322541a460f596
-
SHA512
c6014c21a90711a8ca83ba9a2b843e9fa855a5808caecab4841c08609bb5c2dc919c58ffd2777dc0b3e887e85b2b1555bdc20e2c1df6b3910b59e6a3b63973e5
-
SSDEEP
12288:VXICvof8kZTYRFm6YCrkEitIq+fX7qk8AVyiI:VXICvof8SMR8ZUeIq+v7sqw
Malware Config
Extracted
formbook
4.1
fw02
photonplayground.shop
bestonlinecasinos1.com
ks3633.com
vozandvalor.com
crowdfundmylife.com
rfidci.top
onhdl.cloud
asianwithshorthair.com
m4i6g.com
sb1388.com
ekantipurdainik.com
jonesbridgeltd.com
emilylau.xyz
alveomx.com
stekloff.online
gzzzcszx.com
hi-fishop.com
eureka-fashion.shop
mprojektai.com
scaletiktokyws.com
pornmovs.cam
ggyxw.com
h-deez.com
luxdope.com
surptb.xyz
konzertbern25.com
theworldwidepost.com
sugarmedica.com
alivebodyreset.com
ne-ops.com
rsteamproject.com
telesur889.com
ruianxinlei.com
accountingist.com
ashewabranding.com
systemasmdp.com
memphiswaterandmold.com
iptv-germany.com
thedollsstudiosuite.com
goldenbahis511.com
triveniholidays.com
vinjd.com
yushan2021.com
p326.vip
tcg01.top
wpseoaimarketing.com
tintedpanda.com
etinteracdeposit.com
coachingprozesse.online
deardeafdogs.com
xtratorrent.com
losbelones.com
mritalentpodcast.com
monarchstitle.com
pentecostalsermons.com
animeshia.com
justem-aws.com
vifit.store
oceanfreightcarriers.com
zakbyajklqrra.top
kbq9r.top
converonlinefree.com
deinservice.com
taofinland.com
dr-seek.life
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/2788-12-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2788-16-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/5020-22-0x0000000000420000-0x000000000044F000-memory.dmp formbook behavioral2/memory/5020-24-0x0000000000420000-0x000000000044F000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Urgent-N65.pdf.exeUrgent-N65.pdf.execscript.exedescription pid process target process PID 3460 set thread context of 2788 3460 Urgent-N65.pdf.exe Urgent-N65.pdf.exe PID 2788 set thread context of 3216 2788 Urgent-N65.pdf.exe Explorer.EXE PID 5020 set thread context of 3216 5020 cscript.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 36 IoCs
Processes:
Urgent-N65.pdf.execscript.exepid process 2788 Urgent-N65.pdf.exe 2788 Urgent-N65.pdf.exe 2788 Urgent-N65.pdf.exe 2788 Urgent-N65.pdf.exe 5020 cscript.exe 5020 cscript.exe 5020 cscript.exe 5020 cscript.exe 5020 cscript.exe 5020 cscript.exe 5020 cscript.exe 5020 cscript.exe 5020 cscript.exe 5020 cscript.exe 5020 cscript.exe 5020 cscript.exe 5020 cscript.exe 5020 cscript.exe 5020 cscript.exe 5020 cscript.exe 5020 cscript.exe 5020 cscript.exe 5020 cscript.exe 5020 cscript.exe 5020 cscript.exe 5020 cscript.exe 5020 cscript.exe 5020 cscript.exe 5020 cscript.exe 5020 cscript.exe 5020 cscript.exe 5020 cscript.exe 5020 cscript.exe 5020 cscript.exe 5020 cscript.exe 5020 cscript.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3216 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Urgent-N65.pdf.execscript.exepid process 2788 Urgent-N65.pdf.exe 2788 Urgent-N65.pdf.exe 2788 Urgent-N65.pdf.exe 5020 cscript.exe 5020 cscript.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
Urgent-N65.pdf.exeExplorer.EXEcscript.exedescription pid process Token: SeDebugPrivilege 2788 Urgent-N65.pdf.exe Token: SeShutdownPrivilege 3216 Explorer.EXE Token: SeCreatePagefilePrivilege 3216 Explorer.EXE Token: SeDebugPrivilege 5020 cscript.exe Token: SeShutdownPrivilege 3216 Explorer.EXE Token: SeCreatePagefilePrivilege 3216 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3216 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Urgent-N65.pdf.exeExplorer.EXEcscript.exedescription pid process target process PID 3460 wrote to memory of 2788 3460 Urgent-N65.pdf.exe Urgent-N65.pdf.exe PID 3460 wrote to memory of 2788 3460 Urgent-N65.pdf.exe Urgent-N65.pdf.exe PID 3460 wrote to memory of 2788 3460 Urgent-N65.pdf.exe Urgent-N65.pdf.exe PID 3460 wrote to memory of 2788 3460 Urgent-N65.pdf.exe Urgent-N65.pdf.exe PID 3460 wrote to memory of 2788 3460 Urgent-N65.pdf.exe Urgent-N65.pdf.exe PID 3460 wrote to memory of 2788 3460 Urgent-N65.pdf.exe Urgent-N65.pdf.exe PID 3216 wrote to memory of 5020 3216 Explorer.EXE cscript.exe PID 3216 wrote to memory of 5020 3216 Explorer.EXE cscript.exe PID 3216 wrote to memory of 5020 3216 Explorer.EXE cscript.exe PID 5020 wrote to memory of 4312 5020 cscript.exe cmd.exe PID 5020 wrote to memory of 4312 5020 cscript.exe cmd.exe PID 5020 wrote to memory of 4312 5020 cscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Urgent-N65.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Urgent-N65.pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Urgent-N65.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Urgent-N65.pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Urgent-N65.pdf.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2788-12-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2788-17-0x0000000001360000-0x0000000001375000-memory.dmpFilesize
84KB
-
memory/2788-16-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2788-14-0x0000000001010000-0x000000000135A000-memory.dmpFilesize
3.3MB
-
memory/3216-31-0x0000000008390000-0x00000000084D6000-memory.dmpFilesize
1.3MB
-
memory/3216-29-0x0000000008390000-0x00000000084D6000-memory.dmpFilesize
1.3MB
-
memory/3216-28-0x0000000008390000-0x00000000084D6000-memory.dmpFilesize
1.3MB
-
memory/3216-25-0x00000000078A0000-0x00000000079B3000-memory.dmpFilesize
1.1MB
-
memory/3216-18-0x00000000078A0000-0x00000000079B3000-memory.dmpFilesize
1.1MB
-
memory/3460-7-0x0000000074820000-0x0000000074FD0000-memory.dmpFilesize
7.7MB
-
memory/3460-4-0x0000000004DF0000-0x0000000004E00000-memory.dmpFilesize
64KB
-
memory/3460-11-0x0000000008D60000-0x0000000008DFC000-memory.dmpFilesize
624KB
-
memory/3460-9-0x00000000060D0000-0x00000000060E0000-memory.dmpFilesize
64KB
-
memory/3460-8-0x0000000004DF0000-0x0000000004E00000-memory.dmpFilesize
64KB
-
memory/3460-0-0x0000000074820000-0x0000000074FD0000-memory.dmpFilesize
7.7MB
-
memory/3460-6-0x0000000005260000-0x0000000005276000-memory.dmpFilesize
88KB
-
memory/3460-5-0x0000000004C40000-0x0000000004C4A000-memory.dmpFilesize
40KB
-
memory/3460-19-0x0000000074820000-0x0000000074FD0000-memory.dmpFilesize
7.7MB
-
memory/3460-10-0x0000000006700000-0x000000000676E000-memory.dmpFilesize
440KB
-
memory/3460-1-0x0000000000130000-0x00000000001C0000-memory.dmpFilesize
576KB
-
memory/3460-2-0x0000000005270000-0x0000000005814000-memory.dmpFilesize
5.6MB
-
memory/3460-3-0x0000000004B80000-0x0000000004C12000-memory.dmpFilesize
584KB
-
memory/5020-20-0x00000000005A0000-0x00000000005C7000-memory.dmpFilesize
156KB
-
memory/5020-24-0x0000000000420000-0x000000000044F000-memory.dmpFilesize
188KB
-
memory/5020-27-0x0000000002380000-0x0000000002414000-memory.dmpFilesize
592KB
-
memory/5020-23-0x0000000002450000-0x000000000279A000-memory.dmpFilesize
3.3MB
-
memory/5020-22-0x0000000000420000-0x000000000044F000-memory.dmpFilesize
188KB
-
memory/5020-21-0x00000000005A0000-0x00000000005C7000-memory.dmpFilesize
156KB