Analysis
-
max time kernel
147s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240319-en -
resource tags
arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system -
submitted
26-03-2024 12:48
Static task
static1
Behavioral task
behavioral1
Sample
LF20240228.exe
Resource
win7-20240319-en
General
-
Target
LF20240228.exe
-
Size
652KB
-
MD5
26a38af05a6bdd23f047eb65fee67251
-
SHA1
61633e621f7d7cdcca5936b27a18cfe7e5169aae
-
SHA256
3bd968f2cff76757eb1bf75e19e8302ef97417c65ce9c0accf578eafae435c6a
-
SHA512
7d852f05e4377b77691c3c7517609b6bd12c96d0c5dfe0bb330974ff891731529c12da9a7d52ea0f4e526fd35ce35237bfe40d2099afc12f59e58f95157e16b9
-
SSDEEP
12288:JCTYHa5WHBh2Izs6vHhIlvyuq7it546mz2p9:QTYNHU6vHKlvU7ij46mKp
Malware Config
Extracted
formbook
4.1
hy07
katemclaughl.in
worthyofficial.com
digitopia.click
ledmee.com
siwaasnz.life
ba-y.com
specifiedbuild.com
abandoned-houses-pt-0.bond
yesxoit.xyz
onlinemehrgeld.com
gosysamergoods.com
speakdontell.com
brokenequipmentsolutions.online
gruppofebi.cloud
adilosk.shop
supplierpartnerportal.com
wizov.dev
fast-homeinsurance.com
j88.vote
onamaevn.com
smartbatteryshunt.com
alivo-solutions-inc.net
qdcn16qy.shop
enmawholesale.com
experiencemedia.xyz
shoeloyalty.com
wylderosehealingarts.com
m-1263bets10.com
blanks.page
postcase.site
guangxiav.com
vitlrecruiting.info
go-re.one
rutie.net
donielss.com
hitwin.world
poshplaybliss.com
used-cars-25479.bond
riadanil.com
evrenfayans.xyz
cleopatraselixirs.com
beyondcarbon.xyz
pornimmersion.site
f8serial.site
theoriginals.farm
pvindustriesbv.com
santofantasy.shop
gosignkochava.com
akabox.net
valentinesteddyshop.com
closedealsin90days.com
goodsharbor.com
cbdmarkettrends.com
theartsincarter.com
massivedgeagency.website
totthoit.com
o0qqj7jm.shop
morningcallcoffeestandnola.com
51236.loan
omniahorizon.shop
hellasicks.com
soundbiscuitmusic.net
racerace2024.com
9yywk4.site
de-cosmeticenhancement.today
Signatures
-
Formbook payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2712-17-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2712-23-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2712-32-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2948-37-0x0000000000080000-0x00000000000AF000-memory.dmp formbook behavioral1/memory/2948-39-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 748 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
LF20240228.exeLF20240228.exehelp.exedescription pid process target process PID 2052 set thread context of 2712 2052 LF20240228.exe LF20240228.exe PID 2712 set thread context of 1264 2712 LF20240228.exe Explorer.EXE PID 2712 set thread context of 1264 2712 LF20240228.exe Explorer.EXE PID 2948 set thread context of 1264 2948 help.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 31 IoCs
Processes:
LF20240228.exeLF20240228.exepowershell.exehelp.exepid process 2052 LF20240228.exe 2052 LF20240228.exe 2712 LF20240228.exe 2712 LF20240228.exe 2520 powershell.exe 2712 LF20240228.exe 2948 help.exe 2948 help.exe 2948 help.exe 2948 help.exe 2948 help.exe 2948 help.exe 2948 help.exe 2948 help.exe 2948 help.exe 2948 help.exe 2948 help.exe 2948 help.exe 2948 help.exe 2948 help.exe 2948 help.exe 2948 help.exe 2948 help.exe 2948 help.exe 2948 help.exe 2948 help.exe 2948 help.exe 2948 help.exe 2948 help.exe 2948 help.exe 2948 help.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
LF20240228.exehelp.exepid process 2712 LF20240228.exe 2712 LF20240228.exe 2712 LF20240228.exe 2712 LF20240228.exe 2948 help.exe 2948 help.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
LF20240228.exeLF20240228.exepowershell.exehelp.exedescription pid process Token: SeDebugPrivilege 2052 LF20240228.exe Token: SeDebugPrivilege 2712 LF20240228.exe Token: SeDebugPrivilege 2520 powershell.exe Token: SeDebugPrivilege 2948 help.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
LF20240228.exeExplorer.EXEhelp.exedescription pid process target process PID 2052 wrote to memory of 2520 2052 LF20240228.exe powershell.exe PID 2052 wrote to memory of 2520 2052 LF20240228.exe powershell.exe PID 2052 wrote to memory of 2520 2052 LF20240228.exe powershell.exe PID 2052 wrote to memory of 2520 2052 LF20240228.exe powershell.exe PID 2052 wrote to memory of 3068 2052 LF20240228.exe schtasks.exe PID 2052 wrote to memory of 3068 2052 LF20240228.exe schtasks.exe PID 2052 wrote to memory of 3068 2052 LF20240228.exe schtasks.exe PID 2052 wrote to memory of 3068 2052 LF20240228.exe schtasks.exe PID 2052 wrote to memory of 2588 2052 LF20240228.exe LF20240228.exe PID 2052 wrote to memory of 2588 2052 LF20240228.exe LF20240228.exe PID 2052 wrote to memory of 2588 2052 LF20240228.exe LF20240228.exe PID 2052 wrote to memory of 2588 2052 LF20240228.exe LF20240228.exe PID 2052 wrote to memory of 2712 2052 LF20240228.exe LF20240228.exe PID 2052 wrote to memory of 2712 2052 LF20240228.exe LF20240228.exe PID 2052 wrote to memory of 2712 2052 LF20240228.exe LF20240228.exe PID 2052 wrote to memory of 2712 2052 LF20240228.exe LF20240228.exe PID 2052 wrote to memory of 2712 2052 LF20240228.exe LF20240228.exe PID 2052 wrote to memory of 2712 2052 LF20240228.exe LF20240228.exe PID 2052 wrote to memory of 2712 2052 LF20240228.exe LF20240228.exe PID 1264 wrote to memory of 2948 1264 Explorer.EXE help.exe PID 1264 wrote to memory of 2948 1264 Explorer.EXE help.exe PID 1264 wrote to memory of 2948 1264 Explorer.EXE help.exe PID 1264 wrote to memory of 2948 1264 Explorer.EXE help.exe PID 2948 wrote to memory of 748 2948 help.exe cmd.exe PID 2948 wrote to memory of 748 2948 help.exe cmd.exe PID 2948 wrote to memory of 748 2948 help.exe cmd.exe PID 2948 wrote to memory of 748 2948 help.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\LF20240228.exe"C:\Users\Admin\AppData\Local\Temp\LF20240228.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wIJCOfiF.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wIJCOfiF" /XML "C:\Users\Admin\AppData\Local\Temp\tmp71C6.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\LF20240228.exe"C:\Users\Admin\AppData\Local\Temp\LF20240228.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\LF20240228.exe"C:\Users\Admin\AppData\Local\Temp\LF20240228.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\LF20240228.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp71C6.tmpFilesize
1KB
MD57e91a442917902677b9094935d5669da
SHA12ded15538feba0ef8fa66dc962ab6ca884e8b072
SHA2564e878a2b98c84c709a4f4ee929b969b297a93241012d251c2cb4a85f7d6b0357
SHA51250a516102fd8d2cddee7e6477e2c7494bcd27dcab1d8ca126c0a7085c0b3554a1a13253b341bb434d7c3f597424abfcb2e96417f50e667115bb5f215ab269ee1
-
memory/1264-20-0x00000000037A0000-0x00000000038A0000-memory.dmpFilesize
1024KB
-
memory/1264-34-0x00000000049A0000-0x0000000004A5F000-memory.dmpFilesize
764KB
-
memory/1264-43-0x00000000049A0000-0x0000000004A5F000-memory.dmpFilesize
764KB
-
memory/1264-26-0x0000000006B70000-0x0000000006CE6000-memory.dmpFilesize
1.5MB
-
memory/2052-4-0x00000000002E0000-0x00000000002EC000-memory.dmpFilesize
48KB
-
memory/2052-5-0x0000000004E30000-0x0000000004EA6000-memory.dmpFilesize
472KB
-
memory/2052-3-0x0000000000280000-0x0000000000292000-memory.dmpFilesize
72KB
-
memory/2052-0-0x0000000000AF0000-0x0000000000B98000-memory.dmpFilesize
672KB
-
memory/2052-2-0x0000000004B50000-0x0000000004B90000-memory.dmpFilesize
256KB
-
memory/2052-18-0x0000000074160000-0x000000007484E000-memory.dmpFilesize
6.9MB
-
memory/2052-1-0x0000000074160000-0x000000007484E000-memory.dmpFilesize
6.9MB
-
memory/2520-30-0x000000006DFD0000-0x000000006E57B000-memory.dmpFilesize
5.7MB
-
memory/2520-21-0x000000006DFD0000-0x000000006E57B000-memory.dmpFilesize
5.7MB
-
memory/2520-22-0x000000006DFD0000-0x000000006E57B000-memory.dmpFilesize
5.7MB
-
memory/2520-29-0x0000000002720000-0x0000000002760000-memory.dmpFilesize
256KB
-
memory/2520-25-0x0000000002720000-0x0000000002760000-memory.dmpFilesize
256KB
-
memory/2520-28-0x0000000002720000-0x0000000002760000-memory.dmpFilesize
256KB
-
memory/2712-14-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2712-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2712-24-0x00000000001E0000-0x00000000001F4000-memory.dmpFilesize
80KB
-
memory/2712-23-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2712-17-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2712-32-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2712-33-0x00000000003E0000-0x00000000003F4000-memory.dmpFilesize
80KB
-
memory/2712-27-0x0000000000BA0000-0x0000000000EA3000-memory.dmpFilesize
3.0MB
-
memory/2712-13-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2948-36-0x0000000000C70000-0x0000000000C76000-memory.dmpFilesize
24KB
-
memory/2948-37-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/2948-38-0x0000000000770000-0x0000000000A73000-memory.dmpFilesize
3.0MB
-
memory/2948-39-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/2948-41-0x0000000000540000-0x00000000005D3000-memory.dmpFilesize
588KB
-
memory/2948-35-0x0000000000C70000-0x0000000000C76000-memory.dmpFilesize
24KB