Analysis
-
max time kernel
118s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
17-04-2024 12:44
Static task
static1
Behavioral task
behavioral1
Sample
8ab205dc4d6f7c232cf9e2047a6abf4b2bb6425258cefeaf9b05e922c8229c6a.exe
Resource
win7-20240221-en
General
-
Target
8ab205dc4d6f7c232cf9e2047a6abf4b2bb6425258cefeaf9b05e922c8229c6a.exe
-
Size
672KB
-
MD5
efc1aecb2febb98362434f147e63d852
-
SHA1
924abf59555a3b57e0a48f5ffb63732ac6969045
-
SHA256
8ab205dc4d6f7c232cf9e2047a6abf4b2bb6425258cefeaf9b05e922c8229c6a
-
SHA512
edb6f959093546fcf4b4379d3110c829dc620914cd0680d6166b053520e012fe54833218afd76c3f28eb119c551c650f3251b03af48b244c5116069d73338c37
-
SSDEEP
12288:gtNR4EoOBKMNHlg5yjFqYG6W0KDyMBu34T9NwdooIqVN5hxhwaJX6gtnSHjP:CoOBrBltZSqtAu34THgamuwX3ajP
Malware Config
Extracted
formbook
4.1
fs83
blastol.space
tomwalkerisfalco.com
us-sumatrraslimbellytonic.com
drywallandpaintingservice.com
vntapp.net
passportpages.site
at-mim.com
yeondagoods.com
teomanyildirim.com
paygame.site
senze.art
alhandco.com
9831bsej.xyz
traumatic.xyz
sos-soutien.com
thetechnolgy.live
washing-machine-46612.bond
marvsneakers.com
shequbaike.net
xc4f35fg4h35fg4h53.top
587659.com
mydiamondsea.com
purifyelements.com
key-royalty.com
aimuzil.fun
ykautomotives.com
naelm.xyz
memejseventhall.com
opensource.beer
whiskersfood.com
piedrajuansebastian.net
q3cts.baby
wdfa.xyz
marketfield.shop
id91920.com
22yorkwood.com
sogracefully.net
nodoubt2025tour.com
042024b.vip
fmegsw.com
zsqd4i.com
clashfitness.com
matrixtech.biz
ketoxiamejaworks.buzz
ariostech.com
cardingforum.co
comicdesk.xyz
johnsonforchair.com
mpower-recruitment.com
essenceemporium.us
die-mosaik.schule
saturnp.com
tophotoffers.com
rosamorflorerialima.com
askhelpsecur.us
lifestyledbymodigital.com
clintforcouncil2021.com
king1122.com
veterinariaconvet.com.co
jackandthebox.net
donderbosgames.com
wszy.site
off7979.com
justklip.com
buywestlakevillagehomes.com
Signatures
-
Formbook payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2604-12-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
Processes:
8ab205dc4d6f7c232cf9e2047a6abf4b2bb6425258cefeaf9b05e922c8229c6a.exedescription pid process target process PID 1708 set thread context of 2604 1708 8ab205dc4d6f7c232cf9e2047a6abf4b2bb6425258cefeaf9b05e922c8229c6a.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2596 2604 WerFault.exe RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 2484 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2484 powershell.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
8ab205dc4d6f7c232cf9e2047a6abf4b2bb6425258cefeaf9b05e922c8229c6a.exeRegSvcs.exedescription pid process target process PID 1708 wrote to memory of 2484 1708 8ab205dc4d6f7c232cf9e2047a6abf4b2bb6425258cefeaf9b05e922c8229c6a.exe powershell.exe PID 1708 wrote to memory of 2484 1708 8ab205dc4d6f7c232cf9e2047a6abf4b2bb6425258cefeaf9b05e922c8229c6a.exe powershell.exe PID 1708 wrote to memory of 2484 1708 8ab205dc4d6f7c232cf9e2047a6abf4b2bb6425258cefeaf9b05e922c8229c6a.exe powershell.exe PID 1708 wrote to memory of 2484 1708 8ab205dc4d6f7c232cf9e2047a6abf4b2bb6425258cefeaf9b05e922c8229c6a.exe powershell.exe PID 1708 wrote to memory of 2604 1708 8ab205dc4d6f7c232cf9e2047a6abf4b2bb6425258cefeaf9b05e922c8229c6a.exe RegSvcs.exe PID 1708 wrote to memory of 2604 1708 8ab205dc4d6f7c232cf9e2047a6abf4b2bb6425258cefeaf9b05e922c8229c6a.exe RegSvcs.exe PID 1708 wrote to memory of 2604 1708 8ab205dc4d6f7c232cf9e2047a6abf4b2bb6425258cefeaf9b05e922c8229c6a.exe RegSvcs.exe PID 1708 wrote to memory of 2604 1708 8ab205dc4d6f7c232cf9e2047a6abf4b2bb6425258cefeaf9b05e922c8229c6a.exe RegSvcs.exe PID 1708 wrote to memory of 2604 1708 8ab205dc4d6f7c232cf9e2047a6abf4b2bb6425258cefeaf9b05e922c8229c6a.exe RegSvcs.exe PID 1708 wrote to memory of 2604 1708 8ab205dc4d6f7c232cf9e2047a6abf4b2bb6425258cefeaf9b05e922c8229c6a.exe RegSvcs.exe PID 1708 wrote to memory of 2604 1708 8ab205dc4d6f7c232cf9e2047a6abf4b2bb6425258cefeaf9b05e922c8229c6a.exe RegSvcs.exe PID 1708 wrote to memory of 2604 1708 8ab205dc4d6f7c232cf9e2047a6abf4b2bb6425258cefeaf9b05e922c8229c6a.exe RegSvcs.exe PID 1708 wrote to memory of 2604 1708 8ab205dc4d6f7c232cf9e2047a6abf4b2bb6425258cefeaf9b05e922c8229c6a.exe RegSvcs.exe PID 1708 wrote to memory of 2604 1708 8ab205dc4d6f7c232cf9e2047a6abf4b2bb6425258cefeaf9b05e922c8229c6a.exe RegSvcs.exe PID 2604 wrote to memory of 2596 2604 RegSvcs.exe WerFault.exe PID 2604 wrote to memory of 2596 2604 RegSvcs.exe WerFault.exe PID 2604 wrote to memory of 2596 2604 RegSvcs.exe WerFault.exe PID 2604 wrote to memory of 2596 2604 RegSvcs.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ab205dc4d6f7c232cf9e2047a6abf4b2bb6425258cefeaf9b05e922c8229c6a.exe"C:\Users\Admin\AppData\Local\Temp\8ab205dc4d6f7c232cf9e2047a6abf4b2bb6425258cefeaf9b05e922c8229c6a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\8ab205dc4d6f7c232cf9e2047a6abf4b2bb6425258cefeaf9b05e922c8229c6a.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 363⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1708-13-0x0000000074330000-0x0000000074A1E000-memory.dmpFilesize
6.9MB
-
memory/1708-1-0x0000000074330000-0x0000000074A1E000-memory.dmpFilesize
6.9MB
-
memory/1708-2-0x0000000004F80000-0x0000000004FC0000-memory.dmpFilesize
256KB
-
memory/1708-3-0x00000000003D0000-0x00000000003EC000-memory.dmpFilesize
112KB
-
memory/1708-4-0x0000000000310000-0x0000000000318000-memory.dmpFilesize
32KB
-
memory/1708-5-0x0000000000340000-0x000000000034C000-memory.dmpFilesize
48KB
-
memory/1708-6-0x0000000004FC0000-0x0000000005036000-memory.dmpFilesize
472KB
-
memory/1708-0-0x0000000000A30000-0x0000000000ADA000-memory.dmpFilesize
680KB
-
memory/2484-16-0x0000000074280000-0x000000007482B000-memory.dmpFilesize
5.7MB
-
memory/2484-17-0x0000000074280000-0x000000007482B000-memory.dmpFilesize
5.7MB
-
memory/2484-18-0x0000000002570000-0x00000000025B0000-memory.dmpFilesize
256KB
-
memory/2484-19-0x0000000002570000-0x00000000025B0000-memory.dmpFilesize
256KB
-
memory/2484-20-0x0000000074280000-0x000000007482B000-memory.dmpFilesize
5.7MB
-
memory/2604-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2604-12-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2604-9-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2604-7-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB