Analysis
-
max time kernel
146s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
17-04-2024 14:48
Static task
static1
Behavioral task
behavioral1
Sample
36ca307d291dd056c62947b445d527b4a84c42d2d669382abb78413185d3a6a1.exe
Resource
win7-20240220-en
General
-
Target
36ca307d291dd056c62947b445d527b4a84c42d2d669382abb78413185d3a6a1.exe
-
Size
638KB
-
MD5
6975f1f27e4016368f71dabba716ca6e
-
SHA1
3225deb13c647b26a52c59a328b3432cff5e8871
-
SHA256
36ca307d291dd056c62947b445d527b4a84c42d2d669382abb78413185d3a6a1
-
SHA512
362c0901c959f12357263254bbbc0105824bdee7da87ca4c1e9ea0f0c7717761a97a0b954ec3150c4e4e74aea0e33a77c1b8a360e344c9395d75e0f108284702
-
SSDEEP
12288:n9d2iNjJz/IIHF3fKqHqWLr66AEWzP0S0iHjl8KqUitqfZqb2V2M31VgCnoe:nn1NJz/IIHFv9HtLW6AEWz/0SitAgmLP
Malware Config
Extracted
formbook
4.1
gy14
mavbam.com
theanhedonia.com
budgetnurseries.com
buflitr.com
alqamarhotel.com
2660348.top
123bu6.shop
v72999.com
yzyz841.xyz
247fracing.com
naples.beauty
twinklethrive.com
loscaseros.com
creditspisatylegko.site
sgyy3ej2dgwesb5.com
ufocafe.net
techn9nehollywoodundead.com
truedatalab.com
alterdpxlmarketing.com
harborspringsfire.com
soulheroes.online
tryscriptify.com
collline.com
tulisanemas.com
thelectricandsolar.com
jokergiftcard.buzz
sciencemediainstitute.com
loading-231412.info
ampsportss.com
dianetion.com
169cc.xyz
zezfhys.com
smnyg.com
elenorbet327.com
whatsapp1.autos
0854n5.shop
jxscols.top
camelpmkrf.com
myxtremecleanshq.services
beautyloungebydede.online
artbydianayorktownva.com
functional-yarns.com
accepted6.com
ug19bklo.com
roelofsen.online
batuoe.com
amiciperlacoda.com
883831.com
qieqyt.xyz
vendorato.online
6733633.com
stadtliche-arbeit.info
survivordental.com
mrbmed.com
elbt-ag.com
mtdiyx.xyz
mediayoki.site
zom11.com
biosif.com
aicashu.com
inovarevending.com
8x101n.xyz
ioherstrulybeauty.com
mosaica.online
venitro.com
Signatures
-
Formbook payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2532-20-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2532-27-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2532-34-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
36ca307d291dd056c62947b445d527b4a84c42d2d669382abb78413185d3a6a1.exeRegSvcs.exedescription pid process target process PID 1640 set thread context of 2532 1640 36ca307d291dd056c62947b445d527b4a84c42d2d669382abb78413185d3a6a1.exe RegSvcs.exe PID 2532 set thread context of 1124 2532 RegSvcs.exe Explorer.EXE PID 2532 set thread context of 1124 2532 RegSvcs.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2004 1888 WerFault.exe msiexec.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
36ca307d291dd056c62947b445d527b4a84c42d2d669382abb78413185d3a6a1.exeRegSvcs.exepowershell.exepid process 1640 36ca307d291dd056c62947b445d527b4a84c42d2d669382abb78413185d3a6a1.exe 1640 36ca307d291dd056c62947b445d527b4a84c42d2d669382abb78413185d3a6a1.exe 2532 RegSvcs.exe 2532 RegSvcs.exe 2700 powershell.exe 2532 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 4 IoCs
Processes:
RegSvcs.exepid process 2532 RegSvcs.exe 2532 RegSvcs.exe 2532 RegSvcs.exe 2532 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
36ca307d291dd056c62947b445d527b4a84c42d2d669382abb78413185d3a6a1.exeRegSvcs.exepowershell.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1640 36ca307d291dd056c62947b445d527b4a84c42d2d669382abb78413185d3a6a1.exe Token: SeDebugPrivilege 2532 RegSvcs.exe Token: SeDebugPrivilege 2700 powershell.exe Token: SeShutdownPrivilege 1124 Explorer.EXE -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
36ca307d291dd056c62947b445d527b4a84c42d2d669382abb78413185d3a6a1.exeExplorer.EXEmsiexec.exedescription pid process target process PID 1640 wrote to memory of 2700 1640 36ca307d291dd056c62947b445d527b4a84c42d2d669382abb78413185d3a6a1.exe powershell.exe PID 1640 wrote to memory of 2700 1640 36ca307d291dd056c62947b445d527b4a84c42d2d669382abb78413185d3a6a1.exe powershell.exe PID 1640 wrote to memory of 2700 1640 36ca307d291dd056c62947b445d527b4a84c42d2d669382abb78413185d3a6a1.exe powershell.exe PID 1640 wrote to memory of 2700 1640 36ca307d291dd056c62947b445d527b4a84c42d2d669382abb78413185d3a6a1.exe powershell.exe PID 1640 wrote to memory of 2840 1640 36ca307d291dd056c62947b445d527b4a84c42d2d669382abb78413185d3a6a1.exe schtasks.exe PID 1640 wrote to memory of 2840 1640 36ca307d291dd056c62947b445d527b4a84c42d2d669382abb78413185d3a6a1.exe schtasks.exe PID 1640 wrote to memory of 2840 1640 36ca307d291dd056c62947b445d527b4a84c42d2d669382abb78413185d3a6a1.exe schtasks.exe PID 1640 wrote to memory of 2840 1640 36ca307d291dd056c62947b445d527b4a84c42d2d669382abb78413185d3a6a1.exe schtasks.exe PID 1640 wrote to memory of 2532 1640 36ca307d291dd056c62947b445d527b4a84c42d2d669382abb78413185d3a6a1.exe RegSvcs.exe PID 1640 wrote to memory of 2532 1640 36ca307d291dd056c62947b445d527b4a84c42d2d669382abb78413185d3a6a1.exe RegSvcs.exe PID 1640 wrote to memory of 2532 1640 36ca307d291dd056c62947b445d527b4a84c42d2d669382abb78413185d3a6a1.exe RegSvcs.exe PID 1640 wrote to memory of 2532 1640 36ca307d291dd056c62947b445d527b4a84c42d2d669382abb78413185d3a6a1.exe RegSvcs.exe PID 1640 wrote to memory of 2532 1640 36ca307d291dd056c62947b445d527b4a84c42d2d669382abb78413185d3a6a1.exe RegSvcs.exe PID 1640 wrote to memory of 2532 1640 36ca307d291dd056c62947b445d527b4a84c42d2d669382abb78413185d3a6a1.exe RegSvcs.exe PID 1640 wrote to memory of 2532 1640 36ca307d291dd056c62947b445d527b4a84c42d2d669382abb78413185d3a6a1.exe RegSvcs.exe PID 1640 wrote to memory of 2532 1640 36ca307d291dd056c62947b445d527b4a84c42d2d669382abb78413185d3a6a1.exe RegSvcs.exe PID 1640 wrote to memory of 2532 1640 36ca307d291dd056c62947b445d527b4a84c42d2d669382abb78413185d3a6a1.exe RegSvcs.exe PID 1640 wrote to memory of 2532 1640 36ca307d291dd056c62947b445d527b4a84c42d2d669382abb78413185d3a6a1.exe RegSvcs.exe PID 1124 wrote to memory of 1888 1124 Explorer.EXE msiexec.exe PID 1124 wrote to memory of 1888 1124 Explorer.EXE msiexec.exe PID 1124 wrote to memory of 1888 1124 Explorer.EXE msiexec.exe PID 1124 wrote to memory of 1888 1124 Explorer.EXE msiexec.exe PID 1124 wrote to memory of 1888 1124 Explorer.EXE msiexec.exe PID 1124 wrote to memory of 1888 1124 Explorer.EXE msiexec.exe PID 1124 wrote to memory of 1888 1124 Explorer.EXE msiexec.exe PID 1888 wrote to memory of 2004 1888 msiexec.exe WerFault.exe PID 1888 wrote to memory of 2004 1888 msiexec.exe WerFault.exe PID 1888 wrote to memory of 2004 1888 msiexec.exe WerFault.exe PID 1888 wrote to memory of 2004 1888 msiexec.exe WerFault.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\36ca307d291dd056c62947b445d527b4a84c42d2d669382abb78413185d3a6a1.exe"C:\Users\Admin\AppData\Local\Temp\36ca307d291dd056c62947b445d527b4a84c42d2d669382abb78413185d3a6a1.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\sauCxoBUXLq.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2700 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sauCxoBUXLq" /XML "C:\Users\Admin\AppData\Local\Temp\tmp50CE.tmp"3⤵
- Creates scheduled task(s)
PID:2840 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2532 -
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:1356
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:352
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:2476
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:2484
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:2648
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:2664
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:2504
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:2516
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:2620
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:2636
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:2652
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:2764
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:1952
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:2772
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:628
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:2140
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:1756
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:1892
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:2008
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:1876
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:1944
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:1936
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:1988
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:2304
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 2683⤵
- Program crash
PID:2004
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp50CE.tmpFilesize
1KB
MD5da3f1f0a6377cfd96336421d96fa95ff
SHA1623a5faa4d53297d7ea94edd016b765a5d4d4a9d
SHA25681e761d04347de1072ce57d064f6c32f3a958d638ff0b8dcd4e6ae82f0a81eed
SHA51286618dce850f210959c910b38c36e5bc433be9a67b68893f4d53f9274c2f84a5877a5f8d42c3216fadb0b9b2519028c99fd9905daabf71b2d4f0620c683f2f12
-
memory/1124-24-0x0000000002EE0000-0x0000000002FE0000-memory.dmpFilesize
1024KB
-
memory/1124-29-0x00000000044A0000-0x000000000455E000-memory.dmpFilesize
760KB
-
memory/1124-36-0x0000000004EF0000-0x000000000509C000-memory.dmpFilesize
1.7MB
-
memory/1124-43-0x0000000004EF0000-0x000000000509C000-memory.dmpFilesize
1.7MB
-
memory/1640-2-0x0000000004F10000-0x0000000004F50000-memory.dmpFilesize
256KB
-
memory/1640-6-0x0000000004E10000-0x0000000004E7E000-memory.dmpFilesize
440KB
-
memory/1640-1-0x00000000742D0000-0x00000000749BE000-memory.dmpFilesize
6.9MB
-
memory/1640-5-0x0000000000470000-0x000000000047E000-memory.dmpFilesize
56KB
-
memory/1640-0-0x0000000000BD0000-0x0000000000C76000-memory.dmpFilesize
664KB
-
memory/1640-21-0x00000000742D0000-0x00000000749BE000-memory.dmpFilesize
6.9MB
-
memory/1640-4-0x0000000000220000-0x000000000022A000-memory.dmpFilesize
40KB
-
memory/1640-3-0x0000000000290000-0x00000000002B0000-memory.dmpFilesize
128KB
-
memory/1888-40-0x0000000000410000-0x0000000000424000-memory.dmpFilesize
80KB
-
memory/1888-37-0x0000000000410000-0x0000000000424000-memory.dmpFilesize
80KB
-
memory/1888-38-0x0000000000410000-0x0000000000424000-memory.dmpFilesize
80KB
-
memory/2532-14-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2532-27-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2532-34-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2532-35-0x0000000000430000-0x0000000000445000-memory.dmpFilesize
84KB
-
memory/2532-28-0x0000000000130000-0x0000000000145000-memory.dmpFilesize
84KB
-
memory/2532-22-0x0000000000B00000-0x0000000000E03000-memory.dmpFilesize
3.0MB
-
memory/2532-20-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2532-16-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2532-18-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2700-26-0x000000006E760000-0x000000006ED0B000-memory.dmpFilesize
5.7MB
-
memory/2700-25-0x000000006E760000-0x000000006ED0B000-memory.dmpFilesize
5.7MB
-
memory/2700-30-0x0000000002000000-0x0000000002040000-memory.dmpFilesize
256KB
-
memory/2700-31-0x000000006E760000-0x000000006ED0B000-memory.dmpFilesize
5.7MB