Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
24-10-2023 05:34
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order_A7.pdf.exe
Resource
win7-20231020-en
General
-
Target
Purchase Order_A7.pdf.exe
-
Size
613KB
-
MD5
5b1b412ccc9ccca7f9156c3a4e3badee
-
SHA1
8222046cd5c8c57d2b4e51f4b987ac339afb2461
-
SHA256
fa8b2e6ab78a1b6cb804a7125624b693a9271e19a6091737534d1f471c7762c6
-
SHA512
f6c99f41c7f58b4e9a4906911771669215f9ce7525d27c0f9f19e3263a712e5e4bbdd41b5560cc73f795176e79aaaf0ce6d3bc9068796dd3b7010a010a39a4a8
-
SSDEEP
12288:XhNh6sxTA6qNh3NDsJkr7ZAYkUPBzknjq2/68Q3ZfKNtX7+A7yNse8yFx5t1h:XDDxs6gzsJ+PBzknjx6vQV7wNsIFN1
Malware Config
Extracted
formbook
4.1
fw02
photonplayground.shop
bestonlinecasinos1.com
ks3633.com
vozandvalor.com
crowdfundmylife.com
rfidci.top
onhdl.cloud
asianwithshorthair.com
m4i6g.com
sb1388.com
ekantipurdainik.com
jonesbridgeltd.com
emilylau.xyz
alveomx.com
stekloff.online
gzzzcszx.com
hi-fishop.com
eureka-fashion.shop
mprojektai.com
scaletiktokyws.com
pornmovs.cam
ggyxw.com
h-deez.com
luxdope.com
surptb.xyz
konzertbern25.com
theworldwidepost.com
sugarmedica.com
alivebodyreset.com
ne-ops.com
rsteamproject.com
telesur889.com
ruianxinlei.com
accountingist.com
ashewabranding.com
systemasmdp.com
memphiswaterandmold.com
iptv-germany.com
thedollsstudiosuite.com
goldenbahis511.com
triveniholidays.com
vinjd.com
yushan2021.com
p326.vip
tcg01.top
wpseoaimarketing.com
tintedpanda.com
etinteracdeposit.com
coachingprozesse.online
deardeafdogs.com
xtratorrent.com
losbelones.com
mritalentpodcast.com
monarchstitle.com
pentecostalsermons.com
animeshia.com
justem-aws.com
vifit.store
oceanfreightcarriers.com
zakbyajklqrra.top
kbq9r.top
converonlinefree.com
deinservice.com
taofinland.com
dr-seek.life
Signatures
-
Formbook payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2740-15-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2740-19-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2740-23-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2684-29-0x0000000000080000-0x00000000000AF000-memory.dmp formbook behavioral1/memory/2684-31-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1704 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Purchase Order_A7.pdf.exePurchase Order_A7.pdf.execmd.exedescription pid process target process PID 2664 set thread context of 2740 2664 Purchase Order_A7.pdf.exe Purchase Order_A7.pdf.exe PID 2740 set thread context of 1236 2740 Purchase Order_A7.pdf.exe Explorer.EXE PID 2740 set thread context of 1236 2740 Purchase Order_A7.pdf.exe Explorer.EXE PID 2684 set thread context of 1236 2684 cmd.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
Purchase Order_A7.pdf.execmd.exepid process 2740 Purchase Order_A7.pdf.exe 2740 Purchase Order_A7.pdf.exe 2740 Purchase Order_A7.pdf.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1236 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
Purchase Order_A7.pdf.execmd.exepid process 2740 Purchase Order_A7.pdf.exe 2740 Purchase Order_A7.pdf.exe 2740 Purchase Order_A7.pdf.exe 2740 Purchase Order_A7.pdf.exe 2684 cmd.exe 2684 cmd.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Purchase Order_A7.pdf.execmd.exedescription pid process Token: SeDebugPrivilege 2740 Purchase Order_A7.pdf.exe Token: SeDebugPrivilege 2684 cmd.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1236 Explorer.EXE 1236 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1236 Explorer.EXE 1236 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Purchase Order_A7.pdf.exeExplorer.EXEcmd.exedescription pid process target process PID 2664 wrote to memory of 2740 2664 Purchase Order_A7.pdf.exe Purchase Order_A7.pdf.exe PID 2664 wrote to memory of 2740 2664 Purchase Order_A7.pdf.exe Purchase Order_A7.pdf.exe PID 2664 wrote to memory of 2740 2664 Purchase Order_A7.pdf.exe Purchase Order_A7.pdf.exe PID 2664 wrote to memory of 2740 2664 Purchase Order_A7.pdf.exe Purchase Order_A7.pdf.exe PID 2664 wrote to memory of 2740 2664 Purchase Order_A7.pdf.exe Purchase Order_A7.pdf.exe PID 2664 wrote to memory of 2740 2664 Purchase Order_A7.pdf.exe Purchase Order_A7.pdf.exe PID 2664 wrote to memory of 2740 2664 Purchase Order_A7.pdf.exe Purchase Order_A7.pdf.exe PID 1236 wrote to memory of 2684 1236 Explorer.EXE cmd.exe PID 1236 wrote to memory of 2684 1236 Explorer.EXE cmd.exe PID 1236 wrote to memory of 2684 1236 Explorer.EXE cmd.exe PID 1236 wrote to memory of 2684 1236 Explorer.EXE cmd.exe PID 2684 wrote to memory of 1704 2684 cmd.exe cmd.exe PID 2684 wrote to memory of 1704 2684 cmd.exe cmd.exe PID 2684 wrote to memory of 1704 2684 cmd.exe cmd.exe PID 2684 wrote to memory of 1704 2684 cmd.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order_A7.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order_A7.pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order_A7.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order_A7.pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Purchase Order_A7.pdf.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1236-39-0x0000000009910000-0x0000000009A7E000-memory.dmpFilesize
1.4MB
-
memory/1236-26-0x0000000008DC0000-0x0000000008F34000-memory.dmpFilesize
1.5MB
-
memory/1236-32-0x0000000008DC0000-0x0000000008F34000-memory.dmpFilesize
1.5MB
-
memory/1236-35-0x00000000038E0000-0x00000000039E0000-memory.dmpFilesize
1024KB
-
memory/1236-21-0x0000000005EB0000-0x0000000005FA6000-memory.dmpFilesize
984KB
-
memory/1236-36-0x0000000009910000-0x0000000009A7E000-memory.dmpFilesize
1.4MB
-
memory/1236-37-0x0000000009910000-0x0000000009A7E000-memory.dmpFilesize
1.4MB
-
memory/2664-4-0x00000000003C0000-0x00000000003CC000-memory.dmpFilesize
48KB
-
memory/2664-8-0x0000000004940000-0x00000000049AE000-memory.dmpFilesize
440KB
-
memory/2664-7-0x00000000005C0000-0x00000000005D0000-memory.dmpFilesize
64KB
-
memory/2664-6-0x0000000004A00000-0x0000000004A40000-memory.dmpFilesize
256KB
-
memory/2664-5-0x0000000074E70000-0x000000007555E000-memory.dmpFilesize
6.9MB
-
memory/2664-3-0x0000000000610000-0x000000000062C000-memory.dmpFilesize
112KB
-
memory/2664-16-0x0000000074E70000-0x000000007555E000-memory.dmpFilesize
6.9MB
-
memory/2664-2-0x0000000004A00000-0x0000000004A40000-memory.dmpFilesize
256KB
-
memory/2664-0-0x0000000000220000-0x00000000002C0000-memory.dmpFilesize
640KB
-
memory/2664-1-0x0000000074E70000-0x000000007555E000-memory.dmpFilesize
6.9MB
-
memory/2684-30-0x00000000020B0000-0x00000000023B3000-memory.dmpFilesize
3.0MB
-
memory/2684-34-0x0000000001FD0000-0x0000000002064000-memory.dmpFilesize
592KB
-
memory/2684-31-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/2684-29-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/2684-27-0x000000004A9C0000-0x000000004AA0C000-memory.dmpFilesize
304KB
-
memory/2684-28-0x000000004A9C0000-0x000000004AA0C000-memory.dmpFilesize
304KB
-
memory/2740-20-0x0000000000200000-0x0000000000215000-memory.dmpFilesize
84KB
-
memory/2740-19-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2740-23-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2740-17-0x0000000000800000-0x0000000000B03000-memory.dmpFilesize
3.0MB
-
memory/2740-24-0x0000000000770000-0x0000000000785000-memory.dmpFilesize
84KB
-
memory/2740-15-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2740-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2740-11-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2740-9-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB