Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
26-03-2024 12:48
Static task
static1
Behavioral task
behavioral1
Sample
LF20240228.exe
Resource
win7-20240319-en
General
-
Target
LF20240228.exe
-
Size
652KB
-
MD5
26a38af05a6bdd23f047eb65fee67251
-
SHA1
61633e621f7d7cdcca5936b27a18cfe7e5169aae
-
SHA256
3bd968f2cff76757eb1bf75e19e8302ef97417c65ce9c0accf578eafae435c6a
-
SHA512
7d852f05e4377b77691c3c7517609b6bd12c96d0c5dfe0bb330974ff891731529c12da9a7d52ea0f4e526fd35ce35237bfe40d2099afc12f59e58f95157e16b9
-
SSDEEP
12288:JCTYHa5WHBh2Izs6vHhIlvyuq7it546mz2p9:QTYNHU6vHKlvU7ij46mKp
Malware Config
Extracted
formbook
4.1
hy07
katemclaughl.in
worthyofficial.com
digitopia.click
ledmee.com
siwaasnz.life
ba-y.com
specifiedbuild.com
abandoned-houses-pt-0.bond
yesxoit.xyz
onlinemehrgeld.com
gosysamergoods.com
speakdontell.com
brokenequipmentsolutions.online
gruppofebi.cloud
adilosk.shop
supplierpartnerportal.com
wizov.dev
fast-homeinsurance.com
j88.vote
onamaevn.com
smartbatteryshunt.com
alivo-solutions-inc.net
qdcn16qy.shop
enmawholesale.com
experiencemedia.xyz
shoeloyalty.com
wylderosehealingarts.com
m-1263bets10.com
blanks.page
postcase.site
guangxiav.com
vitlrecruiting.info
go-re.one
rutie.net
donielss.com
hitwin.world
poshplaybliss.com
used-cars-25479.bond
riadanil.com
evrenfayans.xyz
cleopatraselixirs.com
beyondcarbon.xyz
pornimmersion.site
f8serial.site
theoriginals.farm
pvindustriesbv.com
santofantasy.shop
gosignkochava.com
akabox.net
valentinesteddyshop.com
closedealsin90days.com
goodsharbor.com
cbdmarkettrends.com
theartsincarter.com
massivedgeagency.website
totthoit.com
o0qqj7jm.shop
morningcallcoffeestandnola.com
51236.loan
omniahorizon.shop
hellasicks.com
soundbiscuitmusic.net
racerace2024.com
9yywk4.site
de-cosmeticenhancement.today
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/1156-20-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1156-38-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4432-60-0x00000000003D0000-0x00000000003FF000-memory.dmp formbook behavioral2/memory/4432-75-0x00000000003D0000-0x00000000003FF000-memory.dmp formbook -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
LF20240228.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation LF20240228.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
LF20240228.exeLF20240228.exenetsh.exedescription pid process target process PID 4896 set thread context of 1156 4896 LF20240228.exe LF20240228.exe PID 1156 set thread context of 3392 1156 LF20240228.exe Explorer.EXE PID 4432 set thread context of 3392 4432 netsh.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exeLF20240228.exenetsh.exepid process 4756 powershell.exe 4756 powershell.exe 1156 LF20240228.exe 1156 LF20240228.exe 1156 LF20240228.exe 1156 LF20240228.exe 1156 LF20240228.exe 1156 LF20240228.exe 4756 powershell.exe 4432 netsh.exe 4432 netsh.exe 4432 netsh.exe 4432 netsh.exe 4432 netsh.exe 4432 netsh.exe 4432 netsh.exe 4432 netsh.exe 4432 netsh.exe 4432 netsh.exe 4432 netsh.exe 4432 netsh.exe 4432 netsh.exe 4432 netsh.exe 4432 netsh.exe 4432 netsh.exe 4432 netsh.exe 4432 netsh.exe 4432 netsh.exe 4432 netsh.exe 4432 netsh.exe 4432 netsh.exe 4432 netsh.exe 4432 netsh.exe 4432 netsh.exe 4432 netsh.exe 4432 netsh.exe 4432 netsh.exe 4432 netsh.exe 4432 netsh.exe 4432 netsh.exe 4432 netsh.exe 4432 netsh.exe 4432 netsh.exe 4432 netsh.exe 4432 netsh.exe 4432 netsh.exe 4432 netsh.exe 4432 netsh.exe 4432 netsh.exe 4432 netsh.exe 4432 netsh.exe 4432 netsh.exe 4432 netsh.exe 4432 netsh.exe 4432 netsh.exe 4432 netsh.exe 4432 netsh.exe 4432 netsh.exe 4432 netsh.exe 4432 netsh.exe 4432 netsh.exe 4432 netsh.exe 4432 netsh.exe 4432 netsh.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
LF20240228.exenetsh.exepid process 1156 LF20240228.exe 1156 LF20240228.exe 1156 LF20240228.exe 4432 netsh.exe 4432 netsh.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
powershell.exeLF20240228.exenetsh.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 4756 powershell.exe Token: SeDebugPrivilege 1156 LF20240228.exe Token: SeDebugPrivilege 4432 netsh.exe Token: SeShutdownPrivilege 3392 Explorer.EXE Token: SeCreatePagefilePrivilege 3392 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3392 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
LF20240228.exeExplorer.EXEnetsh.exedescription pid process target process PID 4896 wrote to memory of 4756 4896 LF20240228.exe powershell.exe PID 4896 wrote to memory of 4756 4896 LF20240228.exe powershell.exe PID 4896 wrote to memory of 4756 4896 LF20240228.exe powershell.exe PID 4896 wrote to memory of 4356 4896 LF20240228.exe schtasks.exe PID 4896 wrote to memory of 4356 4896 LF20240228.exe schtasks.exe PID 4896 wrote to memory of 4356 4896 LF20240228.exe schtasks.exe PID 4896 wrote to memory of 1156 4896 LF20240228.exe LF20240228.exe PID 4896 wrote to memory of 1156 4896 LF20240228.exe LF20240228.exe PID 4896 wrote to memory of 1156 4896 LF20240228.exe LF20240228.exe PID 4896 wrote to memory of 1156 4896 LF20240228.exe LF20240228.exe PID 4896 wrote to memory of 1156 4896 LF20240228.exe LF20240228.exe PID 4896 wrote to memory of 1156 4896 LF20240228.exe LF20240228.exe PID 3392 wrote to memory of 4432 3392 Explorer.EXE netsh.exe PID 3392 wrote to memory of 4432 3392 Explorer.EXE netsh.exe PID 3392 wrote to memory of 4432 3392 Explorer.EXE netsh.exe PID 4432 wrote to memory of 1872 4432 netsh.exe cmd.exe PID 4432 wrote to memory of 1872 4432 netsh.exe cmd.exe PID 4432 wrote to memory of 1872 4432 netsh.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\LF20240228.exe"C:\Users\Admin\AppData\Local\Temp\LF20240228.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wIJCOfiF.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wIJCOfiF" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9990.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\LF20240228.exe"C:\Users\Admin\AppData\Local\Temp\LF20240228.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\LF20240228.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_q2j3k4ib.yj0.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmp9990.tmpFilesize
1KB
MD58941e989eb49d78bd3dc12c83c053f4f
SHA15bfffc4ebc3fcf99d6b7169fb72c9ae0a052f13a
SHA2569bf63c882c9d066e32607ba423707b002758e35756329bd91975ad9594abbefa
SHA512c4231409ed3955418be1ed3c74c2ffbb092eb1d24a54aa2253832dacd59a3e0cb04dd60752f40e72bb2cdc24cf1b708359675a09704e29d6e7f1547f63ff8644
-
memory/1156-20-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1156-35-0x0000000001960000-0x0000000001CAA000-memory.dmpFilesize
3.3MB
-
memory/1156-38-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1156-39-0x0000000001860000-0x0000000001874000-memory.dmpFilesize
80KB
-
memory/3392-78-0x0000000006D40000-0x0000000006DFC000-memory.dmpFilesize
752KB
-
memory/3392-40-0x0000000006D40000-0x0000000006DFC000-memory.dmpFilesize
752KB
-
memory/3392-82-0x0000000007C60000-0x0000000007D25000-memory.dmpFilesize
788KB
-
memory/3392-83-0x0000000007C60000-0x0000000007D25000-memory.dmpFilesize
788KB
-
memory/3392-86-0x0000000007C60000-0x0000000007D25000-memory.dmpFilesize
788KB
-
memory/4432-65-0x0000000000F40000-0x000000000128A000-memory.dmpFilesize
3.3MB
-
memory/4432-60-0x00000000003D0000-0x00000000003FF000-memory.dmpFilesize
188KB
-
memory/4432-59-0x00000000008B0000-0x00000000008CE000-memory.dmpFilesize
120KB
-
memory/4432-57-0x00000000008B0000-0x00000000008CE000-memory.dmpFilesize
120KB
-
memory/4432-75-0x00000000003D0000-0x00000000003FF000-memory.dmpFilesize
188KB
-
memory/4432-77-0x0000000000D90000-0x0000000000E23000-memory.dmpFilesize
588KB
-
memory/4756-17-0x0000000004E70000-0x0000000004E80000-memory.dmpFilesize
64KB
-
memory/4756-69-0x0000000007950000-0x0000000007964000-memory.dmpFilesize
80KB
-
memory/4756-24-0x0000000005D20000-0x0000000005D86000-memory.dmpFilesize
408KB
-
memory/4756-74-0x0000000075000000-0x00000000757B0000-memory.dmpFilesize
7.7MB
-
memory/4756-18-0x0000000004E70000-0x0000000004E80000-memory.dmpFilesize
64KB
-
memory/4756-34-0x0000000005F00000-0x0000000005F66000-memory.dmpFilesize
408KB
-
memory/4756-36-0x0000000005F70000-0x00000000062C4000-memory.dmpFilesize
3.3MB
-
memory/4756-19-0x00000000054B0000-0x0000000005AD8000-memory.dmpFilesize
6.2MB
-
memory/4756-71-0x0000000007A30000-0x0000000007A38000-memory.dmpFilesize
32KB
-
memory/4756-15-0x0000000075000000-0x00000000757B0000-memory.dmpFilesize
7.7MB
-
memory/4756-41-0x0000000006400000-0x000000000641E000-memory.dmpFilesize
120KB
-
memory/4756-42-0x00000000064A0000-0x00000000064EC000-memory.dmpFilesize
304KB
-
memory/4756-43-0x0000000004E70000-0x0000000004E80000-memory.dmpFilesize
64KB
-
memory/4756-44-0x00000000073A0000-0x00000000073D2000-memory.dmpFilesize
200KB
-
memory/4756-45-0x00000000718C0000-0x000000007190C000-memory.dmpFilesize
304KB
-
memory/4756-55-0x0000000007360000-0x000000000737E000-memory.dmpFilesize
120KB
-
memory/4756-56-0x00000000075E0000-0x0000000007683000-memory.dmpFilesize
652KB
-
memory/4756-14-0x0000000004E10000-0x0000000004E46000-memory.dmpFilesize
216KB
-
memory/4756-70-0x0000000007A50000-0x0000000007A6A000-memory.dmpFilesize
104KB
-
memory/4756-23-0x0000000005C50000-0x0000000005C72000-memory.dmpFilesize
136KB
-
memory/4756-61-0x0000000007D50000-0x00000000083CA000-memory.dmpFilesize
6.5MB
-
memory/4756-62-0x0000000007710000-0x000000000772A000-memory.dmpFilesize
104KB
-
memory/4756-63-0x0000000075000000-0x00000000757B0000-memory.dmpFilesize
7.7MB
-
memory/4756-68-0x0000000007940000-0x000000000794E000-memory.dmpFilesize
56KB
-
memory/4756-64-0x0000000007780000-0x000000000778A000-memory.dmpFilesize
40KB
-
memory/4756-66-0x0000000007990000-0x0000000007A26000-memory.dmpFilesize
600KB
-
memory/4756-67-0x0000000007910000-0x0000000007921000-memory.dmpFilesize
68KB
-
memory/4896-7-0x0000000006BB0000-0x0000000006BBC000-memory.dmpFilesize
48KB
-
memory/4896-8-0x0000000006EA0000-0x0000000006F16000-memory.dmpFilesize
472KB
-
memory/4896-9-0x0000000009900000-0x000000000999C000-memory.dmpFilesize
624KB
-
memory/4896-1-0x0000000075000000-0x00000000757B0000-memory.dmpFilesize
7.7MB
-
memory/4896-22-0x0000000075000000-0x00000000757B0000-memory.dmpFilesize
7.7MB
-
memory/4896-6-0x0000000005D60000-0x0000000005D72000-memory.dmpFilesize
72KB
-
memory/4896-5-0x00000000059C0000-0x00000000059CA000-memory.dmpFilesize
40KB
-
memory/4896-4-0x0000000005C50000-0x0000000005C60000-memory.dmpFilesize
64KB
-
memory/4896-3-0x0000000005A50000-0x0000000005AE2000-memory.dmpFilesize
584KB
-
memory/4896-2-0x0000000006000000-0x00000000065A4000-memory.dmpFilesize
5.6MB
-
memory/4896-0-0x0000000000F30000-0x0000000000FD8000-memory.dmpFilesize
672KB