Analysis
-
max time kernel
147s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
26-03-2024 12:48
Static task
static1
Behavioral task
behavioral1
Sample
LF20240228.exe
Resource
win7-20231129-en
General
-
Target
LF20240228.exe
-
Size
652KB
-
MD5
26a38af05a6bdd23f047eb65fee67251
-
SHA1
61633e621f7d7cdcca5936b27a18cfe7e5169aae
-
SHA256
3bd968f2cff76757eb1bf75e19e8302ef97417c65ce9c0accf578eafae435c6a
-
SHA512
7d852f05e4377b77691c3c7517609b6bd12c96d0c5dfe0bb330974ff891731529c12da9a7d52ea0f4e526fd35ce35237bfe40d2099afc12f59e58f95157e16b9
-
SSDEEP
12288:JCTYHa5WHBh2Izs6vHhIlvyuq7it546mz2p9:QTYNHU6vHKlvU7ij46mKp
Malware Config
Extracted
formbook
4.1
hy07
katemclaughl.in
worthyofficial.com
digitopia.click
ledmee.com
siwaasnz.life
ba-y.com
specifiedbuild.com
abandoned-houses-pt-0.bond
yesxoit.xyz
onlinemehrgeld.com
gosysamergoods.com
speakdontell.com
brokenequipmentsolutions.online
gruppofebi.cloud
adilosk.shop
supplierpartnerportal.com
wizov.dev
fast-homeinsurance.com
j88.vote
onamaevn.com
smartbatteryshunt.com
alivo-solutions-inc.net
qdcn16qy.shop
enmawholesale.com
experiencemedia.xyz
shoeloyalty.com
wylderosehealingarts.com
m-1263bets10.com
blanks.page
postcase.site
guangxiav.com
vitlrecruiting.info
go-re.one
rutie.net
donielss.com
hitwin.world
poshplaybliss.com
used-cars-25479.bond
riadanil.com
evrenfayans.xyz
cleopatraselixirs.com
beyondcarbon.xyz
pornimmersion.site
f8serial.site
theoriginals.farm
pvindustriesbv.com
santofantasy.shop
gosignkochava.com
akabox.net
valentinesteddyshop.com
closedealsin90days.com
goodsharbor.com
cbdmarkettrends.com
theartsincarter.com
massivedgeagency.website
totthoit.com
o0qqj7jm.shop
morningcallcoffeestandnola.com
51236.loan
omniahorizon.shop
hellasicks.com
soundbiscuitmusic.net
racerace2024.com
9yywk4.site
de-cosmeticenhancement.today
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2828-17-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2828-21-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2736-33-0x00000000000C0000-0x00000000000EF000-memory.dmp formbook behavioral1/memory/2736-35-0x00000000000C0000-0x00000000000EF000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2540 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
LF20240228.exeLF20240228.exesvchost.exedescription pid process target process PID 2392 set thread context of 2828 2392 LF20240228.exe LF20240228.exe PID 2828 set thread context of 1340 2828 LF20240228.exe Explorer.EXE PID 2736 set thread context of 1340 2736 svchost.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
LF20240228.exepowershell.exesvchost.exepid process 2828 LF20240228.exe 2828 LF20240228.exe 1360 powershell.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
LF20240228.exesvchost.exepid process 2828 LF20240228.exe 2828 LF20240228.exe 2828 LF20240228.exe 2736 svchost.exe 2736 svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
LF20240228.exepowershell.exesvchost.exedescription pid process Token: SeDebugPrivilege 2828 LF20240228.exe Token: SeDebugPrivilege 1360 powershell.exe Token: SeDebugPrivilege 2736 svchost.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
LF20240228.exeExplorer.EXEsvchost.exedescription pid process target process PID 2392 wrote to memory of 1360 2392 LF20240228.exe powershell.exe PID 2392 wrote to memory of 1360 2392 LF20240228.exe powershell.exe PID 2392 wrote to memory of 1360 2392 LF20240228.exe powershell.exe PID 2392 wrote to memory of 1360 2392 LF20240228.exe powershell.exe PID 2392 wrote to memory of 2748 2392 LF20240228.exe schtasks.exe PID 2392 wrote to memory of 2748 2392 LF20240228.exe schtasks.exe PID 2392 wrote to memory of 2748 2392 LF20240228.exe schtasks.exe PID 2392 wrote to memory of 2748 2392 LF20240228.exe schtasks.exe PID 2392 wrote to memory of 2828 2392 LF20240228.exe LF20240228.exe PID 2392 wrote to memory of 2828 2392 LF20240228.exe LF20240228.exe PID 2392 wrote to memory of 2828 2392 LF20240228.exe LF20240228.exe PID 2392 wrote to memory of 2828 2392 LF20240228.exe LF20240228.exe PID 2392 wrote to memory of 2828 2392 LF20240228.exe LF20240228.exe PID 2392 wrote to memory of 2828 2392 LF20240228.exe LF20240228.exe PID 2392 wrote to memory of 2828 2392 LF20240228.exe LF20240228.exe PID 1340 wrote to memory of 2736 1340 Explorer.EXE svchost.exe PID 1340 wrote to memory of 2736 1340 Explorer.EXE svchost.exe PID 1340 wrote to memory of 2736 1340 Explorer.EXE svchost.exe PID 1340 wrote to memory of 2736 1340 Explorer.EXE svchost.exe PID 2736 wrote to memory of 2540 2736 svchost.exe cmd.exe PID 2736 wrote to memory of 2540 2736 svchost.exe cmd.exe PID 2736 wrote to memory of 2540 2736 svchost.exe cmd.exe PID 2736 wrote to memory of 2540 2736 svchost.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\LF20240228.exe"C:\Users\Admin\AppData\Local\Temp\LF20240228.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wIJCOfiF.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wIJCOfiF" /XML "C:\Users\Admin\AppData\Local\Temp\tmp388E.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\LF20240228.exe"C:\Users\Admin\AppData\Local\Temp\LF20240228.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\LF20240228.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp388E.tmpFilesize
1KB
MD59c9b41c8c6367711205b78d0655eb858
SHA1cd1133db4ec8a096ac8af0ec30b7e8eddcf21ee7
SHA2567f5fbeb96c3dcee08eef4201dce323a76fcc92a6939be767a4d202a0f1c5a821
SHA512c20a66aa226e63961e91ee80f69e6a83589ce1e933714411ae2115fd16860756d9c6e7af0c820f43bdd0acbe6dacc6da2a590e2487f2cc978e8627f4167cca14
-
memory/1340-22-0x0000000003040000-0x0000000003140000-memory.dmpFilesize
1024KB
-
memory/1340-29-0x00000000052E0000-0x0000000005425000-memory.dmpFilesize
1.3MB
-
memory/1360-25-0x0000000002AB0000-0x0000000002AF0000-memory.dmpFilesize
256KB
-
memory/1360-26-0x0000000002AB0000-0x0000000002AF0000-memory.dmpFilesize
256KB
-
memory/1360-28-0x000000006E520000-0x000000006EACB000-memory.dmpFilesize
5.7MB
-
memory/1360-30-0x000000006E520000-0x000000006EACB000-memory.dmpFilesize
5.7MB
-
memory/1360-23-0x000000006E520000-0x000000006EACB000-memory.dmpFilesize
5.7MB
-
memory/1360-24-0x0000000002AB0000-0x0000000002AF0000-memory.dmpFilesize
256KB
-
memory/2392-5-0x0000000002350000-0x00000000023C6000-memory.dmpFilesize
472KB
-
memory/2392-18-0x0000000074150000-0x000000007483E000-memory.dmpFilesize
6.9MB
-
memory/2392-0-0x0000000000D90000-0x0000000000E38000-memory.dmpFilesize
672KB
-
memory/2392-4-0x00000000003E0000-0x00000000003EC000-memory.dmpFilesize
48KB
-
memory/2392-3-0x0000000000300000-0x0000000000312000-memory.dmpFilesize
72KB
-
memory/2392-2-0x00000000006E0000-0x0000000000720000-memory.dmpFilesize
256KB
-
memory/2392-1-0x0000000074150000-0x000000007483E000-memory.dmpFilesize
6.9MB
-
memory/2736-34-0x0000000000870000-0x0000000000B73000-memory.dmpFilesize
3.0MB
-
memory/2736-31-0x0000000000860000-0x0000000000868000-memory.dmpFilesize
32KB
-
memory/2736-35-0x00000000000C0000-0x00000000000EF000-memory.dmpFilesize
188KB
-
memory/2736-32-0x0000000000860000-0x0000000000868000-memory.dmpFilesize
32KB
-
memory/2736-37-0x0000000000650000-0x00000000006E3000-memory.dmpFilesize
588KB
-
memory/2736-33-0x00000000000C0000-0x00000000000EF000-memory.dmpFilesize
188KB
-
memory/2828-13-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2828-27-0x0000000000270000-0x0000000000284000-memory.dmpFilesize
80KB
-
memory/2828-21-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2828-20-0x00000000008E0000-0x0000000000BE3000-memory.dmpFilesize
3.0MB
-
memory/2828-17-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2828-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2828-14-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB