Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
23/04/2024, 13:03
Static task
static1
Behavioral task
behavioral1
Sample
SOA.pdf.exe
Resource
win7-20240221-en
General
-
Target
SOA.pdf.exe
-
Size
599KB
-
MD5
2417cdb09f72141abfa45cb64e699d91
-
SHA1
1ddc6b218dd520915ba8933e8214f307387b0e13
-
SHA256
331ca91b3a643aab796547bdd69ecd624ab13ac224ea80f88ca4a8987c0625e3
-
SHA512
39e83bd1bb9c0a2d529216ba75bd5ad15ebffb836c188e2723633e58203d2008ff6efb3995b51209992eee3120a36852939925d0282b4b218ceafd0c98f622c6
-
SSDEEP
12288:Hiu6oMr21DjiSdBaLMl7kKxYBQWHm6ayJNMH00qLsPBUr4wtJ:Hi/KDjJdPbyvm6DrMHPsLr/L
Malware Config
Extracted
formbook
4.1
fs83
blastol.space
tomwalkerisfalco.com
us-sumatrraslimbellytonic.com
drywallandpaintingservice.com
vntapp.net
passportpages.site
at-mim.com
yeondagoods.com
teomanyildirim.com
paygame.site
senze.art
alhandco.com
9831bsej.xyz
traumatic.xyz
sos-soutien.com
thetechnolgy.live
washing-machine-46612.bond
marvsneakers.com
shequbaike.net
xc4f35fg4h35fg4h53.top
587659.com
mydiamondsea.com
purifyelements.com
key-royalty.com
aimuzil.fun
ykautomotives.com
naelm.xyz
memejseventhall.com
opensource.beer
whiskersfood.com
piedrajuansebastian.net
q3cts.baby
wdfa.xyz
marketfield.shop
id91920.com
22yorkwood.com
sogracefully.net
nodoubt2025tour.com
042024b.vip
fmegsw.com
zsqd4i.com
clashfitness.com
matrixtech.biz
ketoxiamejaworks.buzz
ariostech.com
cardingforum.co
comicdesk.xyz
johnsonforchair.com
mpower-recruitment.com
essenceemporium.us
die-mosaik.schule
saturnp.com
tophotoffers.com
rosamorflorerialima.com
askhelpsecur.us
lifestyledbymodigital.com
clintforcouncil2021.com
king1122.com
veterinariaconvet.com.co
jackandthebox.net
donderbosgames.com
wszy.site
off7979.com
justklip.com
buywestlakevillagehomes.com
Signatures
-
Formbook payload 5 IoCs
resource yara_rule behavioral2/memory/3440-12-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3440-21-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3440-69-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3348-74-0x0000000000490000-0x00000000004BF000-memory.dmp formbook behavioral2/memory/3348-77-0x0000000000490000-0x00000000004BF000-memory.dmp formbook -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation SOA.pdf.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 3860 set thread context of 3440 3860 SOA.pdf.exe 100 PID 3440 set thread context of 3528 3440 RegSvcs.exe 56 PID 3440 set thread context of 3528 3440 RegSvcs.exe 56 PID 3348 set thread context of 3528 3348 cmstp.exe 56 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 63 IoCs
pid Process 3860 SOA.pdf.exe 3860 SOA.pdf.exe 3440 RegSvcs.exe 3440 RegSvcs.exe 3440 RegSvcs.exe 3440 RegSvcs.exe 3440 RegSvcs.exe 3440 RegSvcs.exe 4728 powershell.exe 4728 powershell.exe 4728 powershell.exe 3440 RegSvcs.exe 3440 RegSvcs.exe 3348 cmstp.exe 3348 cmstp.exe 3348 cmstp.exe 3348 cmstp.exe 3348 cmstp.exe 3348 cmstp.exe 3348 cmstp.exe 3348 cmstp.exe 3348 cmstp.exe 3348 cmstp.exe 3348 cmstp.exe 3348 cmstp.exe 3348 cmstp.exe 3348 cmstp.exe 3348 cmstp.exe 3348 cmstp.exe 3348 cmstp.exe 3348 cmstp.exe 3348 cmstp.exe 3348 cmstp.exe 3348 cmstp.exe 3348 cmstp.exe 3348 cmstp.exe 3348 cmstp.exe 3348 cmstp.exe 3348 cmstp.exe 3348 cmstp.exe 3348 cmstp.exe 3348 cmstp.exe 3348 cmstp.exe 3348 cmstp.exe 3348 cmstp.exe 3348 cmstp.exe 3348 cmstp.exe 3348 cmstp.exe 3348 cmstp.exe 3348 cmstp.exe 3348 cmstp.exe 3348 cmstp.exe 3348 cmstp.exe 3348 cmstp.exe 3348 cmstp.exe 3348 cmstp.exe 3348 cmstp.exe 3348 cmstp.exe 3348 cmstp.exe 3348 cmstp.exe 3348 cmstp.exe 3348 cmstp.exe 3348 cmstp.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 3440 RegSvcs.exe 3440 RegSvcs.exe 3440 RegSvcs.exe 3440 RegSvcs.exe 3348 cmstp.exe 3348 cmstp.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 3860 SOA.pdf.exe Token: SeDebugPrivilege 3440 RegSvcs.exe Token: SeDebugPrivilege 4728 powershell.exe Token: SeShutdownPrivilege 3528 Explorer.EXE Token: SeCreatePagefilePrivilege 3528 Explorer.EXE Token: SeDebugPrivilege 3348 cmstp.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3528 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 3860 wrote to memory of 4728 3860 SOA.pdf.exe 97 PID 3860 wrote to memory of 4728 3860 SOA.pdf.exe 97 PID 3860 wrote to memory of 4728 3860 SOA.pdf.exe 97 PID 3860 wrote to memory of 3516 3860 SOA.pdf.exe 99 PID 3860 wrote to memory of 3516 3860 SOA.pdf.exe 99 PID 3860 wrote to memory of 3516 3860 SOA.pdf.exe 99 PID 3860 wrote to memory of 3440 3860 SOA.pdf.exe 100 PID 3860 wrote to memory of 3440 3860 SOA.pdf.exe 100 PID 3860 wrote to memory of 3440 3860 SOA.pdf.exe 100 PID 3860 wrote to memory of 3440 3860 SOA.pdf.exe 100 PID 3860 wrote to memory of 3440 3860 SOA.pdf.exe 100 PID 3860 wrote to memory of 3440 3860 SOA.pdf.exe 100 PID 3528 wrote to memory of 3348 3528 Explorer.EXE 102 PID 3528 wrote to memory of 3348 3528 Explorer.EXE 102 PID 3528 wrote to memory of 3348 3528 Explorer.EXE 102 PID 3348 wrote to memory of 4612 3348 cmstp.exe 103 PID 3348 wrote to memory of 4612 3348 cmstp.exe 103 PID 3348 wrote to memory of 4612 3348 cmstp.exe 103
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\SOA.pdf.exe"C:\Users\Admin\AppData\Local\Temp\SOA.pdf.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SOA.pdf.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4728
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵PID:3516
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3440
-
-
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵PID:4612
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82