Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
25-03-2024 16:50
Static task
static1
Behavioral task
behavioral1
Sample
Confirmação do pedido.pdf.exe
Resource
win7-20240221-en
General
-
Target
Confirmação do pedido.pdf.exe
-
Size
590KB
-
MD5
2f9e1385a9c419ad70bb121e4250ae0a
-
SHA1
ee2018b7427e3eccd78683018864043a72d841a9
-
SHA256
9a565700a3d3c7a802780c0e4ba717b082175fd33b5afc7dcfeb95905b6db784
-
SHA512
9c7a9d86a29729b1189a027e11c40175928c2c76355678ebaa06a08b42a8b0d6c0e6ba6237d61aa81a8a80e8b9d52b22c877f45dd74a233c720fee10e6419917
-
SSDEEP
12288:IS4CMwNNFJyvdgH7RPTwerlTuzRjynjSGqaJt2m8:IMFggH7RbweRTuzJsjSGqaJsm8
Malware Config
Extracted
formbook
4.1
o22d
stillsfengservices.com
protectagainstcrime.com
winiboya.com
mindbeforemusic.com
giyelz1i5.sbs
coin8899.com
coolgirls.club
ssdcf1416aasx.world
heir.solutions
soulmatchup.xyz
ingenetpy.com
knkvdqt5g.sbs
vireoremedy.com
leopolis.rent
apartment-for-rent-314.space
theenlightenedmotherhood.com
zidao.cloud
oi7982jbacdbfssagroup.monster
anandasnacks.com
start.beer
rismartenterprises.com
6lc4ry0ew8.site
d17o42ajphdk8l.xyz
dib41rkzufg74c.xyz
plannuary.com
audiencehub360.com
bwbraefh.shop
rethinkottawa.com
shimo.ltd
feather.flights
ucuzposetal.com
tryliaisononline.info
warehousejobs-germany.today
mercop.xyz
rxnbgk.live
qnn8.cyou
sasubpre.com
datapheonix.com
1jcvfipyt.site
pdax600.top
namescheetah.com
babasultankebab.com
sleekwave.sbs
noderetriever.com
itsszheall.com
rookconsultingservices.com
inventorymanagmentsystems.com
belglivenews.com
gpsgousa.com
saltydogduluth.com
xdhbkj.com
quaytvc.vip
tucciwhimsicalcreations.com
fhtrend.com
projetossustentaveis.com
maxprofltlnvestment.sbs
1znhnwhz.xyz
themadefashion.com
rtpbolaslot138new.com
yuksehatyuk.com
lln6ik0k6.sbs
rato2401023.shop
ikuai.site
stephaniewmorrison.com
piecesofadream.info
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/892-10-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/892-15-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3260-21-0x0000000001450000-0x000000000147F000-memory.dmp formbook behavioral2/memory/3260-23-0x0000000001450000-0x000000000147F000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Confirmação do pedido.pdf.exeConfirmação do pedido.pdf.exeWWAHost.exedescription pid process target process PID 3896 set thread context of 892 3896 Confirmação do pedido.pdf.exe Confirmação do pedido.pdf.exe PID 892 set thread context of 3408 892 Confirmação do pedido.pdf.exe Explorer.EXE PID 3260 set thread context of 3408 3260 WWAHost.exe Explorer.EXE -
Modifies registry class 2 IoCs
Processes:
Explorer.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Confirmação do pedido.pdf.exeWWAHost.exepid process 892 Confirmação do pedido.pdf.exe 892 Confirmação do pedido.pdf.exe 892 Confirmação do pedido.pdf.exe 892 Confirmação do pedido.pdf.exe 892 Confirmação do pedido.pdf.exe 892 Confirmação do pedido.pdf.exe 3260 WWAHost.exe 3260 WWAHost.exe 3260 WWAHost.exe 3260 WWAHost.exe 3260 WWAHost.exe 3260 WWAHost.exe 3260 WWAHost.exe 3260 WWAHost.exe 3260 WWAHost.exe 3260 WWAHost.exe 3260 WWAHost.exe 3260 WWAHost.exe 3260 WWAHost.exe 3260 WWAHost.exe 3260 WWAHost.exe 3260 WWAHost.exe 3260 WWAHost.exe 3260 WWAHost.exe 3260 WWAHost.exe 3260 WWAHost.exe 3260 WWAHost.exe 3260 WWAHost.exe 3260 WWAHost.exe 3260 WWAHost.exe 3260 WWAHost.exe 3260 WWAHost.exe 3260 WWAHost.exe 3260 WWAHost.exe 3260 WWAHost.exe 3260 WWAHost.exe 3260 WWAHost.exe 3260 WWAHost.exe 3260 WWAHost.exe 3260 WWAHost.exe 3260 WWAHost.exe 3260 WWAHost.exe 3260 WWAHost.exe 3260 WWAHost.exe 3260 WWAHost.exe 3260 WWAHost.exe 3260 WWAHost.exe 3260 WWAHost.exe 3260 WWAHost.exe 3260 WWAHost.exe 3260 WWAHost.exe 3260 WWAHost.exe 3260 WWAHost.exe 3260 WWAHost.exe 3260 WWAHost.exe 3260 WWAHost.exe 3260 WWAHost.exe 3260 WWAHost.exe 3260 WWAHost.exe 3260 WWAHost.exe 3260 WWAHost.exe 3260 WWAHost.exe 3260 WWAHost.exe 3260 WWAHost.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Confirmação do pedido.pdf.exeWWAHost.exepid process 892 Confirmação do pedido.pdf.exe 892 Confirmação do pedido.pdf.exe 892 Confirmação do pedido.pdf.exe 3260 WWAHost.exe 3260 WWAHost.exe -
Suspicious use of AdjustPrivilegeToken 14 IoCs
Processes:
Confirmação do pedido.pdf.exeWWAHost.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 892 Confirmação do pedido.pdf.exe Token: SeDebugPrivilege 3260 WWAHost.exe Token: SeShutdownPrivilege 3408 Explorer.EXE Token: SeCreatePagefilePrivilege 3408 Explorer.EXE Token: SeShutdownPrivilege 3408 Explorer.EXE Token: SeCreatePagefilePrivilege 3408 Explorer.EXE Token: SeShutdownPrivilege 3408 Explorer.EXE Token: SeCreatePagefilePrivilege 3408 Explorer.EXE Token: SeShutdownPrivilege 3408 Explorer.EXE Token: SeCreatePagefilePrivilege 3408 Explorer.EXE Token: SeShutdownPrivilege 3408 Explorer.EXE Token: SeCreatePagefilePrivilege 3408 Explorer.EXE Token: SeShutdownPrivilege 3408 Explorer.EXE Token: SeCreatePagefilePrivilege 3408 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3408 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Confirmação do pedido.pdf.exeExplorer.EXEWWAHost.exedescription pid process target process PID 3896 wrote to memory of 892 3896 Confirmação do pedido.pdf.exe Confirmação do pedido.pdf.exe PID 3896 wrote to memory of 892 3896 Confirmação do pedido.pdf.exe Confirmação do pedido.pdf.exe PID 3896 wrote to memory of 892 3896 Confirmação do pedido.pdf.exe Confirmação do pedido.pdf.exe PID 3896 wrote to memory of 892 3896 Confirmação do pedido.pdf.exe Confirmação do pedido.pdf.exe PID 3896 wrote to memory of 892 3896 Confirmação do pedido.pdf.exe Confirmação do pedido.pdf.exe PID 3896 wrote to memory of 892 3896 Confirmação do pedido.pdf.exe Confirmação do pedido.pdf.exe PID 3408 wrote to memory of 3260 3408 Explorer.EXE WWAHost.exe PID 3408 wrote to memory of 3260 3408 Explorer.EXE WWAHost.exe PID 3408 wrote to memory of 3260 3408 Explorer.EXE WWAHost.exe PID 3260 wrote to memory of 2868 3260 WWAHost.exe cmd.exe PID 3260 wrote to memory of 2868 3260 WWAHost.exe cmd.exe PID 3260 wrote to memory of 2868 3260 WWAHost.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Confirmação do pedido.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Confirmação do pedido.pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Confirmação do pedido.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Confirmação do pedido.pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WWAHost.exe"C:\Windows\SysWOW64\WWAHost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Confirmação do pedido.pdf.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/892-10-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/892-16-0x00000000010D0000-0x00000000010E4000-memory.dmpFilesize
80KB
-
memory/892-15-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/892-13-0x00000000011A0000-0x00000000014EA000-memory.dmpFilesize
3.3MB
-
memory/3260-21-0x0000000001450000-0x000000000147F000-memory.dmpFilesize
188KB
-
memory/3260-18-0x0000000000D00000-0x0000000000DDC000-memory.dmpFilesize
880KB
-
memory/3260-25-0x0000000001DD0000-0x0000000001E63000-memory.dmpFilesize
588KB
-
memory/3260-23-0x0000000001450000-0x000000000147F000-memory.dmpFilesize
188KB
-
memory/3260-22-0x0000000001F30000-0x000000000227A000-memory.dmpFilesize
3.3MB
-
memory/3260-20-0x0000000000D00000-0x0000000000DDC000-memory.dmpFilesize
880KB
-
memory/3408-17-0x000000000AF60000-0x000000000B0CA000-memory.dmpFilesize
1.4MB
-
memory/3408-26-0x000000000AF60000-0x000000000B0CA000-memory.dmpFilesize
1.4MB
-
memory/3408-32-0x0000000008B60000-0x0000000008C0A000-memory.dmpFilesize
680KB
-
memory/3408-29-0x0000000008B60000-0x0000000008C0A000-memory.dmpFilesize
680KB
-
memory/3408-28-0x0000000008B60000-0x0000000008C0A000-memory.dmpFilesize
680KB
-
memory/3896-9-0x0000000008C30000-0x0000000008CCC000-memory.dmpFilesize
624KB
-
memory/3896-5-0x0000000004CE0000-0x0000000004CEA000-memory.dmpFilesize
40KB
-
memory/3896-12-0x00000000743D0000-0x0000000074B80000-memory.dmpFilesize
7.7MB
-
memory/3896-0-0x0000000000240000-0x00000000002DA000-memory.dmpFilesize
616KB
-
memory/3896-8-0x00000000061E0000-0x0000000006256000-memory.dmpFilesize
472KB
-
memory/3896-7-0x0000000005080000-0x000000000508C000-memory.dmpFilesize
48KB
-
memory/3896-6-0x0000000004D30000-0x0000000004D42000-memory.dmpFilesize
72KB
-
memory/3896-4-0x0000000004F30000-0x0000000004F40000-memory.dmpFilesize
64KB
-
memory/3896-1-0x00000000743D0000-0x0000000074B80000-memory.dmpFilesize
7.7MB
-
memory/3896-2-0x0000000005250000-0x00000000057F4000-memory.dmpFilesize
5.6MB
-
memory/3896-3-0x0000000004D40000-0x0000000004DD2000-memory.dmpFilesize
584KB