Analysis
-
max time kernel
148s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
23-04-2024 02:01
Static task
static1
Behavioral task
behavioral1
Sample
e1fd783c3c5c3a686b2ae04b64ecce2b3c5e00d2bed04cdbf8f420a57d82208e.exe
Resource
win7-20231129-en
General
-
Target
e1fd783c3c5c3a686b2ae04b64ecce2b3c5e00d2bed04cdbf8f420a57d82208e.exe
-
Size
649KB
-
MD5
70f1ab254a32c6050743605d6f3384d5
-
SHA1
526c5e0280cb55ef308312db603e94af4fee0b42
-
SHA256
e1fd783c3c5c3a686b2ae04b64ecce2b3c5e00d2bed04cdbf8f420a57d82208e
-
SHA512
120d687da81b7fede4954e181bba535b279e81542ed779af0f41f6fda58596b25d1162a950e2633b45d6c9f0034ba91606873a87dc9530aa5fad1d5c2a5bbe8c
-
SSDEEP
12288:3f7mvgKnFHMF9XuroT07oUdMIEoKrom2Az3HCqC48wypy/LfcfhtYiQGMXJEGYc:zmvL9MDXurIMMIEHvzrC489ybcfvxQGs
Malware Config
Extracted
formbook
4.1
fs83
blastol.space
tomwalkerisfalco.com
us-sumatrraslimbellytonic.com
drywallandpaintingservice.com
vntapp.net
passportpages.site
at-mim.com
yeondagoods.com
teomanyildirim.com
paygame.site
senze.art
alhandco.com
9831bsej.xyz
traumatic.xyz
sos-soutien.com
thetechnolgy.live
washing-machine-46612.bond
marvsneakers.com
shequbaike.net
xc4f35fg4h35fg4h53.top
587659.com
mydiamondsea.com
purifyelements.com
key-royalty.com
aimuzil.fun
ykautomotives.com
naelm.xyz
memejseventhall.com
opensource.beer
whiskersfood.com
piedrajuansebastian.net
q3cts.baby
wdfa.xyz
marketfield.shop
id91920.com
22yorkwood.com
sogracefully.net
nodoubt2025tour.com
042024b.vip
fmegsw.com
zsqd4i.com
clashfitness.com
matrixtech.biz
ketoxiamejaworks.buzz
ariostech.com
cardingforum.co
comicdesk.xyz
johnsonforchair.com
mpower-recruitment.com
essenceemporium.us
die-mosaik.schule
saturnp.com
tophotoffers.com
rosamorflorerialima.com
askhelpsecur.us
lifestyledbymodigital.com
clintforcouncil2021.com
king1122.com
veterinariaconvet.com.co
jackandthebox.net
donderbosgames.com
wszy.site
off7979.com
justklip.com
buywestlakevillagehomes.com
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/3052-14-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/3052-21-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2760-32-0x0000000000080000-0x00000000000AF000-memory.dmp formbook behavioral1/memory/2760-34-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
e1fd783c3c5c3a686b2ae04b64ecce2b3c5e00d2bed04cdbf8f420a57d82208e.exeRegSvcs.exechkdsk.exedescription pid process target process PID 2948 set thread context of 3052 2948 e1fd783c3c5c3a686b2ae04b64ecce2b3c5e00d2bed04cdbf8f420a57d82208e.exe RegSvcs.exe PID 3052 set thread context of 1204 3052 RegSvcs.exe Explorer.EXE PID 2760 set thread context of 1204 2760 chkdsk.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
RegSvcs.exepowershell.exechkdsk.exepid process 3052 RegSvcs.exe 3052 RegSvcs.exe 2832 powershell.exe 2760 chkdsk.exe 2760 chkdsk.exe 2760 chkdsk.exe 2760 chkdsk.exe 2760 chkdsk.exe 2760 chkdsk.exe 2760 chkdsk.exe 2760 chkdsk.exe 2760 chkdsk.exe 2760 chkdsk.exe 2760 chkdsk.exe 2760 chkdsk.exe 2760 chkdsk.exe 2760 chkdsk.exe 2760 chkdsk.exe 2760 chkdsk.exe 2760 chkdsk.exe 2760 chkdsk.exe 2760 chkdsk.exe 2760 chkdsk.exe 2760 chkdsk.exe 2760 chkdsk.exe 2760 chkdsk.exe 2760 chkdsk.exe 2760 chkdsk.exe 2760 chkdsk.exe 2760 chkdsk.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.exechkdsk.exepid process 3052 RegSvcs.exe 3052 RegSvcs.exe 3052 RegSvcs.exe 2760 chkdsk.exe 2760 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
RegSvcs.exepowershell.exechkdsk.exedescription pid process Token: SeDebugPrivilege 3052 RegSvcs.exe Token: SeDebugPrivilege 2832 powershell.exe Token: SeDebugPrivilege 2760 chkdsk.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
e1fd783c3c5c3a686b2ae04b64ecce2b3c5e00d2bed04cdbf8f420a57d82208e.exeExplorer.EXEchkdsk.exedescription pid process target process PID 2948 wrote to memory of 2832 2948 e1fd783c3c5c3a686b2ae04b64ecce2b3c5e00d2bed04cdbf8f420a57d82208e.exe powershell.exe PID 2948 wrote to memory of 2832 2948 e1fd783c3c5c3a686b2ae04b64ecce2b3c5e00d2bed04cdbf8f420a57d82208e.exe powershell.exe PID 2948 wrote to memory of 2832 2948 e1fd783c3c5c3a686b2ae04b64ecce2b3c5e00d2bed04cdbf8f420a57d82208e.exe powershell.exe PID 2948 wrote to memory of 2832 2948 e1fd783c3c5c3a686b2ae04b64ecce2b3c5e00d2bed04cdbf8f420a57d82208e.exe powershell.exe PID 2948 wrote to memory of 3052 2948 e1fd783c3c5c3a686b2ae04b64ecce2b3c5e00d2bed04cdbf8f420a57d82208e.exe RegSvcs.exe PID 2948 wrote to memory of 3052 2948 e1fd783c3c5c3a686b2ae04b64ecce2b3c5e00d2bed04cdbf8f420a57d82208e.exe RegSvcs.exe PID 2948 wrote to memory of 3052 2948 e1fd783c3c5c3a686b2ae04b64ecce2b3c5e00d2bed04cdbf8f420a57d82208e.exe RegSvcs.exe PID 2948 wrote to memory of 3052 2948 e1fd783c3c5c3a686b2ae04b64ecce2b3c5e00d2bed04cdbf8f420a57d82208e.exe RegSvcs.exe PID 2948 wrote to memory of 3052 2948 e1fd783c3c5c3a686b2ae04b64ecce2b3c5e00d2bed04cdbf8f420a57d82208e.exe RegSvcs.exe PID 2948 wrote to memory of 3052 2948 e1fd783c3c5c3a686b2ae04b64ecce2b3c5e00d2bed04cdbf8f420a57d82208e.exe RegSvcs.exe PID 2948 wrote to memory of 3052 2948 e1fd783c3c5c3a686b2ae04b64ecce2b3c5e00d2bed04cdbf8f420a57d82208e.exe RegSvcs.exe PID 2948 wrote to memory of 3052 2948 e1fd783c3c5c3a686b2ae04b64ecce2b3c5e00d2bed04cdbf8f420a57d82208e.exe RegSvcs.exe PID 2948 wrote to memory of 3052 2948 e1fd783c3c5c3a686b2ae04b64ecce2b3c5e00d2bed04cdbf8f420a57d82208e.exe RegSvcs.exe PID 2948 wrote to memory of 3052 2948 e1fd783c3c5c3a686b2ae04b64ecce2b3c5e00d2bed04cdbf8f420a57d82208e.exe RegSvcs.exe PID 1204 wrote to memory of 2760 1204 Explorer.EXE chkdsk.exe PID 1204 wrote to memory of 2760 1204 Explorer.EXE chkdsk.exe PID 1204 wrote to memory of 2760 1204 Explorer.EXE chkdsk.exe PID 1204 wrote to memory of 2760 1204 Explorer.EXE chkdsk.exe PID 2760 wrote to memory of 2500 2760 chkdsk.exe cmd.exe PID 2760 wrote to memory of 2500 2760 chkdsk.exe cmd.exe PID 2760 wrote to memory of 2500 2760 chkdsk.exe cmd.exe PID 2760 wrote to memory of 2500 2760 chkdsk.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e1fd783c3c5c3a686b2ae04b64ecce2b3c5e00d2bed04cdbf8f420a57d82208e.exe"C:\Users\Admin\AppData\Local\Temp\e1fd783c3c5c3a686b2ae04b64ecce2b3c5e00d2bed04cdbf8f420a57d82208e.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\e1fd783c3c5c3a686b2ae04b64ecce2b3c5e00d2bed04cdbf8f420a57d82208e.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1204-20-0x0000000003C10000-0x0000000003D10000-memory.dmpFilesize
1024KB
-
memory/1204-26-0x0000000004FC0000-0x00000000050AC000-memory.dmpFilesize
944KB
-
memory/2760-36-0x00000000005A0000-0x0000000000633000-memory.dmpFilesize
588KB
-
memory/2760-34-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/2760-33-0x00000000024D0000-0x00000000027D3000-memory.dmpFilesize
3.0MB
-
memory/2760-32-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/2760-31-0x00000000003C0000-0x00000000003C7000-memory.dmpFilesize
28KB
-
memory/2760-30-0x00000000003C0000-0x00000000003C7000-memory.dmpFilesize
28KB
-
memory/2832-27-0x0000000002AC0000-0x0000000002B00000-memory.dmpFilesize
256KB
-
memory/2832-23-0x000000006EE80000-0x000000006F42B000-memory.dmpFilesize
5.7MB
-
memory/2832-29-0x000000006EE80000-0x000000006F42B000-memory.dmpFilesize
5.7MB
-
memory/2832-28-0x0000000002AC0000-0x0000000002B00000-memory.dmpFilesize
256KB
-
memory/2832-25-0x000000006EE80000-0x000000006F42B000-memory.dmpFilesize
5.7MB
-
memory/2832-24-0x0000000002AC0000-0x0000000002B00000-memory.dmpFilesize
256KB
-
memory/2948-6-0x00000000005C0000-0x00000000005D4000-memory.dmpFilesize
80KB
-
memory/2948-5-0x0000000000560000-0x000000000056E000-memory.dmpFilesize
56KB
-
memory/2948-1-0x0000000073F30000-0x000000007461E000-memory.dmpFilesize
6.9MB
-
memory/2948-2-0x0000000004AD0000-0x0000000004B10000-memory.dmpFilesize
256KB
-
memory/2948-3-0x0000000004A20000-0x0000000004AB0000-memory.dmpFilesize
576KB
-
memory/2948-15-0x0000000073F30000-0x000000007461E000-memory.dmpFilesize
6.9MB
-
memory/2948-7-0x000000000A250000-0x000000000A2C6000-memory.dmpFilesize
472KB
-
memory/2948-0-0x0000000000EC0000-0x0000000000F68000-memory.dmpFilesize
672KB
-
memory/2948-4-0x0000000000540000-0x0000000000558000-memory.dmpFilesize
96KB
-
memory/3052-16-0x0000000000920000-0x0000000000C23000-memory.dmpFilesize
3.0MB
-
memory/3052-10-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3052-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/3052-14-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3052-21-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3052-8-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3052-22-0x0000000000190000-0x00000000001A4000-memory.dmpFilesize
80KB