Analysis
-
max time kernel
148s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
13-02-2024 05:48
Static task
static1
Behavioral task
behavioral1
Sample
e64a5a0e34ecb51c2c40cb84016354e096b7c5bc34f5a841d685e94844644ad6.exe
Resource
win7-20231215-en
General
-
Target
e64a5a0e34ecb51c2c40cb84016354e096b7c5bc34f5a841d685e94844644ad6.exe
-
Size
814KB
-
MD5
8fc83cdc44075773ee401f010d2443b0
-
SHA1
96cd91bb463dcb0f7b56e94bf2cb15d7dc8f63b6
-
SHA256
220977b28fc847b8a2d7c65d3d19a3859e3e62dc5e19edaf4909965516a91694
-
SHA512
12a5cf0ee3c995faf09f821e4f4db1bf4f50c5ead57e72bf6e518b38c4d14a020724698e0930ea515ddeb810464ab9c9a616e3c8cd0a7e82ce64ab58a614f597
-
SSDEEP
12288:mj6mRlmDKClMfkrPEBuGKw3f+s2geR3VJ6wGllh5VelrQTydKp:m2a4KCycrPQIo+aePgDalrQTl
Malware Config
Extracted
formbook
4.1
kmge
jia0752d.com
cq0jt.sbs
whimsicalweddingrentals.com
meetsex-here.life
hhe-crv220.com
bedbillionaire.com
soycmo.com
mrawkward.xyz
11ramshornroad.com
motoyonaturals.com
thischicloves.com
gacorbet.pro
ihsanid.com
pancaketurner.com
santanarstore.com
cr3dtv.com
negotools.com
landfillequip.com
sejasuapropriachefe.com
diamant-verkopen.store
builtonmybrother.art
teoti.beauty
kickssoccercamp.com
chickfrau.com
compare-energy.com
icvp5o.xyz
susan-writes.com
dropletcoin.com
sivertool.com
sup-25987659.com
weedz-seeds.today
agritamaperkasaindonesia.com
safwankhalil.com
jm2s8a3mz.com
wfjwjm.com
be-heatpumps.life
hcwoodpanel.com
n5l780.com
mandalah.art
szexvideokingyen.sbs
justinroemmick.com
thecoolkidsdontfitin.com
gsolartech.com
swisswearables.com
chicagocarpetcleaneril.com
terrazahills-cbre.com
santatainha.com
sacksmantenimiento.store
wzhem.rest
shearwaterpembrokeshire.com
baansantiburi.com
mid-size-suv-87652.com
solunchina.com
nandos.moe
blucretebistro.com
identificatiekvk.digital
8772876.com
longfangyun.com
litblacklit.com
mobilferrari.com
zeeedajewelermusic.com
allenbach.swiss
industrialrevolution.ink
cmgamingtrack.com
a2zglobalimports.com
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1200-30-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1200-34-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1516-40-0x00000000000C0000-0x00000000000EF000-memory.dmp formbook behavioral1/memory/1516-42-0x00000000000C0000-0x00000000000EF000-memory.dmp formbook -
Drops startup file 3 IoCs
Processes:
e64a5a0e34ecb51c2c40cb84016354e096b7c5bc34f5a841d685e94844644ad6.execmd.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype.lnk e64a5a0e34ecb51c2c40cb84016354e096b7c5bc34f5a841d685e94844644ad6.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\skype.exe cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\skype.exe cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
skype.exepid process 2908 skype.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 2708 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
skype.exeAddInProcess32.exechkdsk.exedescription pid process target process PID 2908 set thread context of 1200 2908 skype.exe AddInProcess32.exe PID 1200 set thread context of 1380 1200 AddInProcess32.exe Explorer.EXE PID 1516 set thread context of 1380 1516 chkdsk.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Processes:
chkdsk.exedescription ioc process Key created \Registry\User\S-1-5-21-3427588347-1492276948-3422228430-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 chkdsk.exe -
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
e64a5a0e34ecb51c2c40cb84016354e096b7c5bc34f5a841d685e94844644ad6.exeskype.exeskype.exeAddInProcess32.exechkdsk.exepid process 2336 e64a5a0e34ecb51c2c40cb84016354e096b7c5bc34f5a841d685e94844644ad6.exe 3016 skype.exe 3016 skype.exe 3016 skype.exe 3016 skype.exe 2908 skype.exe 2908 skype.exe 1200 AddInProcess32.exe 1200 AddInProcess32.exe 1516 chkdsk.exe 1516 chkdsk.exe 1516 chkdsk.exe 1516 chkdsk.exe 1516 chkdsk.exe 1516 chkdsk.exe 1516 chkdsk.exe 1516 chkdsk.exe 1516 chkdsk.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
AddInProcess32.exechkdsk.exepid process 1200 AddInProcess32.exe 1200 AddInProcess32.exe 1200 AddInProcess32.exe 1516 chkdsk.exe 1516 chkdsk.exe 1516 chkdsk.exe 1516 chkdsk.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
e64a5a0e34ecb51c2c40cb84016354e096b7c5bc34f5a841d685e94844644ad6.exepid process 2336 e64a5a0e34ecb51c2c40cb84016354e096b7c5bc34f5a841d685e94844644ad6.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
e64a5a0e34ecb51c2c40cb84016354e096b7c5bc34f5a841d685e94844644ad6.exeskype.exeskype.exeAddInProcess32.exechkdsk.exedescription pid process Token: SeDebugPrivilege 2336 e64a5a0e34ecb51c2c40cb84016354e096b7c5bc34f5a841d685e94844644ad6.exe Token: SeDebugPrivilege 3016 skype.exe Token: SeDebugPrivilege 2908 skype.exe Token: SeDebugPrivilege 1200 AddInProcess32.exe Token: SeDebugPrivilege 1516 chkdsk.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
e64a5a0e34ecb51c2c40cb84016354e096b7c5bc34f5a841d685e94844644ad6.exeskype.execmd.exeskype.exeExplorer.EXEchkdsk.exedescription pid process target process PID 2336 wrote to memory of 3016 2336 e64a5a0e34ecb51c2c40cb84016354e096b7c5bc34f5a841d685e94844644ad6.exe skype.exe PID 2336 wrote to memory of 3016 2336 e64a5a0e34ecb51c2c40cb84016354e096b7c5bc34f5a841d685e94844644ad6.exe skype.exe PID 2336 wrote to memory of 3016 2336 e64a5a0e34ecb51c2c40cb84016354e096b7c5bc34f5a841d685e94844644ad6.exe skype.exe PID 2336 wrote to memory of 3016 2336 e64a5a0e34ecb51c2c40cb84016354e096b7c5bc34f5a841d685e94844644ad6.exe skype.exe PID 3016 wrote to memory of 2708 3016 skype.exe cmd.exe PID 3016 wrote to memory of 2708 3016 skype.exe cmd.exe PID 3016 wrote to memory of 2708 3016 skype.exe cmd.exe PID 3016 wrote to memory of 2708 3016 skype.exe cmd.exe PID 2708 wrote to memory of 2540 2708 cmd.exe PING.EXE PID 2708 wrote to memory of 2540 2708 cmd.exe PING.EXE PID 2708 wrote to memory of 2540 2708 cmd.exe PING.EXE PID 2708 wrote to memory of 2540 2708 cmd.exe PING.EXE PID 2708 wrote to memory of 596 2708 cmd.exe PING.EXE PID 2708 wrote to memory of 596 2708 cmd.exe PING.EXE PID 2708 wrote to memory of 596 2708 cmd.exe PING.EXE PID 2708 wrote to memory of 596 2708 cmd.exe PING.EXE PID 2708 wrote to memory of 2908 2708 cmd.exe skype.exe PID 2708 wrote to memory of 2908 2708 cmd.exe skype.exe PID 2708 wrote to memory of 2908 2708 cmd.exe skype.exe PID 2708 wrote to memory of 2908 2708 cmd.exe skype.exe PID 2908 wrote to memory of 1200 2908 skype.exe AddInProcess32.exe PID 2908 wrote to memory of 1200 2908 skype.exe AddInProcess32.exe PID 2908 wrote to memory of 1200 2908 skype.exe AddInProcess32.exe PID 2908 wrote to memory of 1200 2908 skype.exe AddInProcess32.exe PID 2908 wrote to memory of 1200 2908 skype.exe AddInProcess32.exe PID 2908 wrote to memory of 1200 2908 skype.exe AddInProcess32.exe PID 2908 wrote to memory of 1200 2908 skype.exe AddInProcess32.exe PID 1380 wrote to memory of 1516 1380 Explorer.EXE chkdsk.exe PID 1380 wrote to memory of 1516 1380 Explorer.EXE chkdsk.exe PID 1380 wrote to memory of 1516 1380 Explorer.EXE chkdsk.exe PID 1380 wrote to memory of 1516 1380 Explorer.EXE chkdsk.exe PID 1516 wrote to memory of 1096 1516 chkdsk.exe Firefox.exe PID 1516 wrote to memory of 1096 1516 chkdsk.exe Firefox.exe PID 1516 wrote to memory of 1096 1516 chkdsk.exe Firefox.exe PID 1516 wrote to memory of 1096 1516 chkdsk.exe Firefox.exe PID 1516 wrote to memory of 1096 1516 chkdsk.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e64a5a0e34ecb51c2c40cb84016354e096b7c5bc34f5a841d685e94844644ad6.exe"C:\Users\Admin\AppData\Local\Temp\e64a5a0e34ecb51c2c40cb84016354e096b7c5bc34f5a841d685e94844644ad6.exe"2⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\skype.exe"C:\Users\Admin\AppData\Local\Temp\skype.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 19 > nul && copy "C:\Users\Admin\AppData\Local\Temp\skype.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\skype.exe" && ping 127.0.0.1 -n 19 > nul && "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\skype.exe"4⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 195⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 195⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\skype.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\skype.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"6⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\skype.exeFilesize
814KB
MD58fc83cdc44075773ee401f010d2443b0
SHA196cd91bb463dcb0f7b56e94bf2cb15d7dc8f63b6
SHA256220977b28fc847b8a2d7c65d3d19a3859e3e62dc5e19edaf4909965516a91694
SHA51212a5cf0ee3c995faf09f821e4f4db1bf4f50c5ead57e72bf6e518b38c4d14a020724698e0930ea515ddeb810464ab9c9a616e3c8cd0a7e82ce64ab58a614f597
-
memory/1200-34-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1200-30-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1200-36-0x0000000000390000-0x00000000003A4000-memory.dmpFilesize
80KB
-
memory/1200-26-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1200-32-0x0000000000B40000-0x0000000000E43000-memory.dmpFilesize
3.0MB
-
memory/1200-24-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1200-22-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1380-49-0x0000000004F90000-0x000000000508D000-memory.dmpFilesize
1012KB
-
memory/1380-37-0x0000000004F90000-0x000000000508D000-memory.dmpFilesize
1012KB
-
memory/1380-35-0x00000000038B0000-0x00000000039B0000-memory.dmpFilesize
1024KB
-
memory/1516-40-0x00000000000C0000-0x00000000000EF000-memory.dmpFilesize
188KB
-
memory/1516-39-0x0000000000E80000-0x0000000000E87000-memory.dmpFilesize
28KB
-
memory/1516-38-0x0000000000E80000-0x0000000000E87000-memory.dmpFilesize
28KB
-
memory/1516-46-0x0000000000990000-0x0000000000A23000-memory.dmpFilesize
588KB
-
memory/1516-53-0x0000000000990000-0x0000000000A23000-memory.dmpFilesize
588KB
-
memory/1516-41-0x0000000000B00000-0x0000000000E03000-memory.dmpFilesize
3.0MB
-
memory/1516-42-0x00000000000C0000-0x00000000000EF000-memory.dmpFilesize
188KB
-
memory/2336-0-0x0000000000320000-0x00000000003F2000-memory.dmpFilesize
840KB
-
memory/2336-8-0x0000000074550000-0x0000000074C3E000-memory.dmpFilesize
6.9MB
-
memory/2336-3-0x00000000042C0000-0x0000000004304000-memory.dmpFilesize
272KB
-
memory/2336-2-0x0000000000720000-0x0000000000760000-memory.dmpFilesize
256KB
-
memory/2336-1-0x0000000074550000-0x0000000074C3E000-memory.dmpFilesize
6.9MB
-
memory/2908-16-0x00000000010E0000-0x00000000011B2000-memory.dmpFilesize
840KB
-
memory/2908-31-0x0000000073E60000-0x000000007454E000-memory.dmpFilesize
6.9MB
-
memory/2908-29-0x0000000004D70000-0x0000000004DB0000-memory.dmpFilesize
256KB
-
memory/2908-28-0x0000000004D70000-0x0000000004DB0000-memory.dmpFilesize
256KB
-
memory/2908-27-0x0000000073E60000-0x000000007454E000-memory.dmpFilesize
6.9MB
-
memory/2908-21-0x0000000004D70000-0x0000000004DB0000-memory.dmpFilesize
256KB
-
memory/2908-20-0x0000000000500000-0x0000000000506000-memory.dmpFilesize
24KB
-
memory/2908-19-0x0000000000640000-0x000000000065A000-memory.dmpFilesize
104KB
-
memory/2908-18-0x0000000004D70000-0x0000000004DB0000-memory.dmpFilesize
256KB
-
memory/2908-17-0x0000000073E60000-0x000000007454E000-memory.dmpFilesize
6.9MB
-
memory/3016-7-0x0000000074550000-0x0000000074C3E000-memory.dmpFilesize
6.9MB
-
memory/3016-6-0x0000000004C40000-0x0000000004C80000-memory.dmpFilesize
256KB
-
memory/3016-5-0x0000000074550000-0x0000000074C3E000-memory.dmpFilesize
6.9MB