Analysis
-
max time kernel
152s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
25-03-2024 16:26
Static task
static1
Behavioral task
behavioral1
Sample
GSO3357.exe
Resource
win7-20240215-en
General
-
Target
GSO3357.exe
-
Size
654KB
-
MD5
c77b45b902fb66b1bda25f0c9f32c152
-
SHA1
e17705713ede18731797bbfd7b5eb31a7ca52477
-
SHA256
d56e9061e7f6df6e094d1582d817c381f8ce9ac6c3925cba5da96464487a18b7
-
SHA512
61af84f112b704230a8f07ead38678e2e3052f55a86e8e7c8b480be2a0da03546801d03d328e663a6ba284ded71bba22bac3caf8365848b2e3e8abf8dfb2d348
-
SSDEEP
12288:Td4CMwtBBGV/8nu3JKhuL3RlcYgbXvApn76bUtaj6b0jZEgVzvF7B5P9ylA:FBJu3FLBlcYEXvApn76bJ3tEAzvNDP4
Malware Config
Extracted
formbook
4.1
hy07
katemclaughl.in
worthyofficial.com
digitopia.click
ledmee.com
siwaasnz.life
ba-y.com
specifiedbuild.com
abandoned-houses-pt-0.bond
yesxoit.xyz
onlinemehrgeld.com
gosysamergoods.com
speakdontell.com
brokenequipmentsolutions.online
gruppofebi.cloud
adilosk.shop
supplierpartnerportal.com
wizov.dev
fast-homeinsurance.com
j88.vote
onamaevn.com
smartbatteryshunt.com
alivo-solutions-inc.net
qdcn16qy.shop
enmawholesale.com
experiencemedia.xyz
shoeloyalty.com
wylderosehealingarts.com
m-1263bets10.com
blanks.page
postcase.site
guangxiav.com
vitlrecruiting.info
go-re.one
rutie.net
donielss.com
hitwin.world
poshplaybliss.com
used-cars-25479.bond
riadanil.com
evrenfayans.xyz
cleopatraselixirs.com
beyondcarbon.xyz
pornimmersion.site
f8serial.site
theoriginals.farm
pvindustriesbv.com
santofantasy.shop
gosignkochava.com
akabox.net
valentinesteddyshop.com
closedealsin90days.com
goodsharbor.com
cbdmarkettrends.com
theartsincarter.com
massivedgeagency.website
totthoit.com
o0qqj7jm.shop
morningcallcoffeestandnola.com
51236.loan
omniahorizon.shop
hellasicks.com
soundbiscuitmusic.net
racerace2024.com
9yywk4.site
de-cosmeticenhancement.today
Signatures
-
Formbook payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/2088-20-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2088-38-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2088-63-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2408-72-0x00000000012E0000-0x000000000130F000-memory.dmp formbook behavioral2/memory/2408-78-0x00000000012E0000-0x000000000130F000-memory.dmp formbook -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
GSO3357.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation GSO3357.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
GSO3357.exeGSO3357.execolorcpl.exedescription pid process target process PID 5060 set thread context of 2088 5060 GSO3357.exe GSO3357.exe PID 2088 set thread context of 3448 2088 GSO3357.exe Explorer.EXE PID 2088 set thread context of 3448 2088 GSO3357.exe Explorer.EXE PID 2408 set thread context of 3448 2408 colorcpl.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
GSO3357.exepowershell.exeGSO3357.execolorcpl.exepid process 5060 GSO3357.exe 5060 GSO3357.exe 2812 powershell.exe 2088 GSO3357.exe 2088 GSO3357.exe 2088 GSO3357.exe 2088 GSO3357.exe 2812 powershell.exe 2088 GSO3357.exe 2088 GSO3357.exe 2088 GSO3357.exe 2408 colorcpl.exe 2408 colorcpl.exe 2408 colorcpl.exe 2408 colorcpl.exe 2408 colorcpl.exe 2408 colorcpl.exe 2408 colorcpl.exe 2408 colorcpl.exe 2408 colorcpl.exe 2408 colorcpl.exe 2408 colorcpl.exe 2408 colorcpl.exe 2408 colorcpl.exe 2408 colorcpl.exe 2408 colorcpl.exe 2408 colorcpl.exe 2408 colorcpl.exe 2408 colorcpl.exe 2408 colorcpl.exe 2408 colorcpl.exe 2408 colorcpl.exe 2408 colorcpl.exe 2408 colorcpl.exe 2408 colorcpl.exe 2408 colorcpl.exe 2408 colorcpl.exe 2408 colorcpl.exe 2408 colorcpl.exe 2408 colorcpl.exe 2408 colorcpl.exe 2408 colorcpl.exe 2408 colorcpl.exe 2408 colorcpl.exe 2408 colorcpl.exe 2408 colorcpl.exe 2408 colorcpl.exe 2408 colorcpl.exe 2408 colorcpl.exe 2408 colorcpl.exe 2408 colorcpl.exe 2408 colorcpl.exe 2408 colorcpl.exe 2408 colorcpl.exe 2408 colorcpl.exe 2408 colorcpl.exe 2408 colorcpl.exe 2408 colorcpl.exe 2408 colorcpl.exe 2408 colorcpl.exe 2408 colorcpl.exe 2408 colorcpl.exe 2408 colorcpl.exe 2408 colorcpl.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
GSO3357.execolorcpl.exepid process 2088 GSO3357.exe 2088 GSO3357.exe 2088 GSO3357.exe 2088 GSO3357.exe 2408 colorcpl.exe 2408 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
GSO3357.exepowershell.exeGSO3357.execolorcpl.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 5060 GSO3357.exe Token: SeDebugPrivilege 2812 powershell.exe Token: SeDebugPrivilege 2088 GSO3357.exe Token: SeDebugPrivilege 2408 colorcpl.exe Token: SeShutdownPrivilege 3448 Explorer.EXE Token: SeCreatePagefilePrivilege 3448 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3448 Explorer.EXE -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
GSO3357.exeExplorer.EXEcolorcpl.exedescription pid process target process PID 5060 wrote to memory of 2812 5060 GSO3357.exe powershell.exe PID 5060 wrote to memory of 2812 5060 GSO3357.exe powershell.exe PID 5060 wrote to memory of 2812 5060 GSO3357.exe powershell.exe PID 5060 wrote to memory of 3444 5060 GSO3357.exe schtasks.exe PID 5060 wrote to memory of 3444 5060 GSO3357.exe schtasks.exe PID 5060 wrote to memory of 3444 5060 GSO3357.exe schtasks.exe PID 5060 wrote to memory of 3104 5060 GSO3357.exe GSO3357.exe PID 5060 wrote to memory of 3104 5060 GSO3357.exe GSO3357.exe PID 5060 wrote to memory of 3104 5060 GSO3357.exe GSO3357.exe PID 5060 wrote to memory of 2088 5060 GSO3357.exe GSO3357.exe PID 5060 wrote to memory of 2088 5060 GSO3357.exe GSO3357.exe PID 5060 wrote to memory of 2088 5060 GSO3357.exe GSO3357.exe PID 5060 wrote to memory of 2088 5060 GSO3357.exe GSO3357.exe PID 5060 wrote to memory of 2088 5060 GSO3357.exe GSO3357.exe PID 5060 wrote to memory of 2088 5060 GSO3357.exe GSO3357.exe PID 3448 wrote to memory of 2408 3448 Explorer.EXE colorcpl.exe PID 3448 wrote to memory of 2408 3448 Explorer.EXE colorcpl.exe PID 3448 wrote to memory of 2408 3448 Explorer.EXE colorcpl.exe PID 2408 wrote to memory of 1424 2408 colorcpl.exe cmd.exe PID 2408 wrote to memory of 1424 2408 colorcpl.exe cmd.exe PID 2408 wrote to memory of 1424 2408 colorcpl.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\GSO3357.exe"C:\Users\Admin\AppData\Local\Temp\GSO3357.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ozCkrZdsJL.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ozCkrZdsJL" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBC3B.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\GSO3357.exe"C:\Users\Admin\AppData\Local\Temp\GSO3357.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\GSO3357.exe"C:\Users\Admin\AppData\Local\Temp\GSO3357.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\GSO3357.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hhf2sg5u.1xq.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmpBC3B.tmpFilesize
1KB
MD52c2b5bedd0ca61001677111c3c1af845
SHA1e375c162a37205fc3862a05dc31e73b9a894978e
SHA2568683633889228ab6442d0e23c11f4d9361cf1349b6c2268fa0fd8ceeb3aabfac
SHA512c4490d4a2a595484a1ed5dd37cb08d406471fece6e614c360121e3c4d61542132c9b7304261f6c04aa2fc00bd0db9f15399264bb998f54b3d110a056dfe862ba
-
memory/2088-63-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2088-36-0x0000000001020000-0x000000000136A000-memory.dmpFilesize
3.3MB
-
memory/2088-20-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2088-38-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2088-39-0x0000000000F00000-0x0000000000F14000-memory.dmpFilesize
80KB
-
memory/2088-64-0x0000000000F90000-0x0000000000FA4000-memory.dmpFilesize
80KB
-
memory/2408-73-0x00000000032C0000-0x000000000360A000-memory.dmpFilesize
3.3MB
-
memory/2408-70-0x0000000000310000-0x0000000000329000-memory.dmpFilesize
100KB
-
memory/2408-71-0x0000000000310000-0x0000000000329000-memory.dmpFilesize
100KB
-
memory/2408-72-0x00000000012E0000-0x000000000130F000-memory.dmpFilesize
188KB
-
memory/2408-78-0x00000000012E0000-0x000000000130F000-memory.dmpFilesize
188KB
-
memory/2408-84-0x0000000003150000-0x00000000031E3000-memory.dmpFilesize
588KB
-
memory/2812-44-0x000000007F900000-0x000000007F910000-memory.dmpFilesize
64KB
-
memory/2812-60-0x00000000071F0000-0x00000000071FA000-memory.dmpFilesize
40KB
-
memory/2812-17-0x00000000049C0000-0x00000000049D0000-memory.dmpFilesize
64KB
-
memory/2812-83-0x0000000074520000-0x0000000074CD0000-memory.dmpFilesize
7.7MB
-
memory/2812-29-0x00000000056A0000-0x0000000005706000-memory.dmpFilesize
408KB
-
memory/2812-18-0x0000000005000000-0x0000000005628000-memory.dmpFilesize
6.2MB
-
memory/2812-23-0x0000000004E70000-0x0000000004E92000-memory.dmpFilesize
136KB
-
memory/2812-34-0x0000000005900000-0x0000000005966000-memory.dmpFilesize
408KB
-
memory/2812-35-0x00000000059E0000-0x0000000005D34000-memory.dmpFilesize
3.3MB
-
memory/2812-16-0x0000000074520000-0x0000000074CD0000-memory.dmpFilesize
7.7MB
-
memory/2812-14-0x0000000002530000-0x0000000002566000-memory.dmpFilesize
216KB
-
memory/2812-80-0x00000000049C0000-0x00000000049D0000-memory.dmpFilesize
64KB
-
memory/2812-40-0x0000000005E20000-0x0000000005E3E000-memory.dmpFilesize
120KB
-
memory/2812-77-0x0000000006410000-0x0000000006418000-memory.dmpFilesize
32KB
-
memory/2812-42-0x00000000063B0000-0x00000000063FC000-memory.dmpFilesize
304KB
-
memory/2812-43-0x00000000049C0000-0x00000000049D0000-memory.dmpFilesize
64KB
-
memory/2812-76-0x00000000074C0000-0x00000000074DA000-memory.dmpFilesize
104KB
-
memory/2812-45-0x0000000006E20000-0x0000000006E52000-memory.dmpFilesize
200KB
-
memory/2812-46-0x0000000070DE0000-0x0000000070E2C000-memory.dmpFilesize
304KB
-
memory/2812-56-0x0000000006200000-0x000000000621E000-memory.dmpFilesize
120KB
-
memory/2812-57-0x0000000006E60000-0x0000000006F03000-memory.dmpFilesize
652KB
-
memory/2812-58-0x00000000077D0000-0x0000000007E4A000-memory.dmpFilesize
6.5MB
-
memory/2812-59-0x0000000007180000-0x000000000719A000-memory.dmpFilesize
104KB
-
memory/2812-75-0x00000000073C0000-0x00000000073D4000-memory.dmpFilesize
80KB
-
memory/2812-62-0x0000000074520000-0x0000000074CD0000-memory.dmpFilesize
7.7MB
-
memory/2812-74-0x00000000073B0000-0x00000000073BE000-memory.dmpFilesize
56KB
-
memory/2812-69-0x00000000049C0000-0x00000000049D0000-memory.dmpFilesize
64KB
-
memory/2812-68-0x0000000007380000-0x0000000007391000-memory.dmpFilesize
68KB
-
memory/2812-66-0x00000000049C0000-0x00000000049D0000-memory.dmpFilesize
64KB
-
memory/2812-67-0x0000000007400000-0x0000000007496000-memory.dmpFilesize
600KB
-
memory/3448-65-0x00000000025F0000-0x00000000026EF000-memory.dmpFilesize
1020KB
-
memory/3448-91-0x0000000008780000-0x00000000088EF000-memory.dmpFilesize
1.4MB
-
memory/3448-87-0x0000000008780000-0x00000000088EF000-memory.dmpFilesize
1.4MB
-
memory/3448-86-0x00000000025F0000-0x00000000026EF000-memory.dmpFilesize
1020KB
-
memory/3448-85-0x0000000008780000-0x00000000088EF000-memory.dmpFilesize
1.4MB
-
memory/3448-41-0x0000000008530000-0x0000000008659000-memory.dmpFilesize
1.2MB
-
memory/5060-0-0x0000000000A00000-0x0000000000AA8000-memory.dmpFilesize
672KB
-
memory/5060-19-0x0000000074520000-0x0000000074CD0000-memory.dmpFilesize
7.7MB
-
memory/5060-8-0x00000000056F0000-0x00000000056FC000-memory.dmpFilesize
48KB
-
memory/5060-3-0x00000000054E0000-0x0000000005572000-memory.dmpFilesize
584KB
-
memory/5060-2-0x0000000005BF0000-0x0000000006194000-memory.dmpFilesize
5.6MB
-
memory/5060-9-0x0000000006A10000-0x0000000006A86000-memory.dmpFilesize
472KB
-
memory/5060-22-0x0000000074520000-0x0000000074CD0000-memory.dmpFilesize
7.7MB
-
memory/5060-1-0x0000000074520000-0x0000000074CD0000-memory.dmpFilesize
7.7MB
-
memory/5060-4-0x0000000005620000-0x0000000005630000-memory.dmpFilesize
64KB
-
memory/5060-5-0x0000000005490000-0x000000000549A000-memory.dmpFilesize
40KB
-
memory/5060-6-0x0000000005640000-0x00000000056DC000-memory.dmpFilesize
624KB
-
memory/5060-7-0x0000000005600000-0x0000000005612000-memory.dmpFilesize
72KB