Analysis
-
max time kernel
146s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
24-04-2024 01:14
Static task
static1
Behavioral task
behavioral1
Sample
331ca91b3a643aab796547bdd69ecd624ab13ac224ea80f88ca4a8987c0625e3.exe
Resource
win7-20231129-en
General
-
Target
331ca91b3a643aab796547bdd69ecd624ab13ac224ea80f88ca4a8987c0625e3.exe
-
Size
599KB
-
MD5
2417cdb09f72141abfa45cb64e699d91
-
SHA1
1ddc6b218dd520915ba8933e8214f307387b0e13
-
SHA256
331ca91b3a643aab796547bdd69ecd624ab13ac224ea80f88ca4a8987c0625e3
-
SHA512
39e83bd1bb9c0a2d529216ba75bd5ad15ebffb836c188e2723633e58203d2008ff6efb3995b51209992eee3120a36852939925d0282b4b218ceafd0c98f622c6
-
SSDEEP
12288:Hiu6oMr21DjiSdBaLMl7kKxYBQWHm6ayJNMH00qLsPBUr4wtJ:Hi/KDjJdPbyvm6DrMHPsLr/L
Malware Config
Extracted
formbook
4.1
fs83
blastol.space
tomwalkerisfalco.com
us-sumatrraslimbellytonic.com
drywallandpaintingservice.com
vntapp.net
passportpages.site
at-mim.com
yeondagoods.com
teomanyildirim.com
paygame.site
senze.art
alhandco.com
9831bsej.xyz
traumatic.xyz
sos-soutien.com
thetechnolgy.live
washing-machine-46612.bond
marvsneakers.com
shequbaike.net
xc4f35fg4h35fg4h53.top
587659.com
mydiamondsea.com
purifyelements.com
key-royalty.com
aimuzil.fun
ykautomotives.com
naelm.xyz
memejseventhall.com
opensource.beer
whiskersfood.com
piedrajuansebastian.net
q3cts.baby
wdfa.xyz
marketfield.shop
id91920.com
22yorkwood.com
sogracefully.net
nodoubt2025tour.com
042024b.vip
fmegsw.com
zsqd4i.com
clashfitness.com
matrixtech.biz
ketoxiamejaworks.buzz
ariostech.com
cardingforum.co
comicdesk.xyz
johnsonforchair.com
mpower-recruitment.com
essenceemporium.us
die-mosaik.schule
saturnp.com
tophotoffers.com
rosamorflorerialima.com
askhelpsecur.us
lifestyledbymodigital.com
clintforcouncil2021.com
king1122.com
veterinariaconvet.com.co
jackandthebox.net
donderbosgames.com
wszy.site
off7979.com
justklip.com
buywestlakevillagehomes.com
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2268-12-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2268-16-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2124-29-0x0000000000070000-0x000000000009F000-memory.dmp formbook behavioral1/memory/2124-31-0x0000000000070000-0x000000000009F000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
331ca91b3a643aab796547bdd69ecd624ab13ac224ea80f88ca4a8987c0625e3.exeRegSvcs.execscript.exedescription pid process target process PID 1872 set thread context of 2268 1872 331ca91b3a643aab796547bdd69ecd624ab13ac224ea80f88ca4a8987c0625e3.exe RegSvcs.exe PID 2268 set thread context of 1376 2268 RegSvcs.exe Explorer.EXE PID 2124 set thread context of 1376 2124 cscript.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
RegSvcs.exepowershell.execscript.exepid process 2268 RegSvcs.exe 2268 RegSvcs.exe 2024 powershell.exe 2124 cscript.exe 2124 cscript.exe 2124 cscript.exe 2124 cscript.exe 2124 cscript.exe 2124 cscript.exe 2124 cscript.exe 2124 cscript.exe 2124 cscript.exe 2124 cscript.exe 2124 cscript.exe 2124 cscript.exe 2124 cscript.exe 2124 cscript.exe 2124 cscript.exe 2124 cscript.exe 2124 cscript.exe 2124 cscript.exe 2124 cscript.exe 2124 cscript.exe 2124 cscript.exe 2124 cscript.exe 2124 cscript.exe 2124 cscript.exe 2124 cscript.exe 2124 cscript.exe 2124 cscript.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.execscript.exepid process 2268 RegSvcs.exe 2268 RegSvcs.exe 2268 RegSvcs.exe 2124 cscript.exe 2124 cscript.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
RegSvcs.exepowershell.execscript.exedescription pid process Token: SeDebugPrivilege 2268 RegSvcs.exe Token: SeDebugPrivilege 2024 powershell.exe Token: SeDebugPrivilege 2124 cscript.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
331ca91b3a643aab796547bdd69ecd624ab13ac224ea80f88ca4a8987c0625e3.exeExplorer.EXEcscript.exedescription pid process target process PID 1872 wrote to memory of 2024 1872 331ca91b3a643aab796547bdd69ecd624ab13ac224ea80f88ca4a8987c0625e3.exe powershell.exe PID 1872 wrote to memory of 2024 1872 331ca91b3a643aab796547bdd69ecd624ab13ac224ea80f88ca4a8987c0625e3.exe powershell.exe PID 1872 wrote to memory of 2024 1872 331ca91b3a643aab796547bdd69ecd624ab13ac224ea80f88ca4a8987c0625e3.exe powershell.exe PID 1872 wrote to memory of 2024 1872 331ca91b3a643aab796547bdd69ecd624ab13ac224ea80f88ca4a8987c0625e3.exe powershell.exe PID 1872 wrote to memory of 2268 1872 331ca91b3a643aab796547bdd69ecd624ab13ac224ea80f88ca4a8987c0625e3.exe RegSvcs.exe PID 1872 wrote to memory of 2268 1872 331ca91b3a643aab796547bdd69ecd624ab13ac224ea80f88ca4a8987c0625e3.exe RegSvcs.exe PID 1872 wrote to memory of 2268 1872 331ca91b3a643aab796547bdd69ecd624ab13ac224ea80f88ca4a8987c0625e3.exe RegSvcs.exe PID 1872 wrote to memory of 2268 1872 331ca91b3a643aab796547bdd69ecd624ab13ac224ea80f88ca4a8987c0625e3.exe RegSvcs.exe PID 1872 wrote to memory of 2268 1872 331ca91b3a643aab796547bdd69ecd624ab13ac224ea80f88ca4a8987c0625e3.exe RegSvcs.exe PID 1872 wrote to memory of 2268 1872 331ca91b3a643aab796547bdd69ecd624ab13ac224ea80f88ca4a8987c0625e3.exe RegSvcs.exe PID 1872 wrote to memory of 2268 1872 331ca91b3a643aab796547bdd69ecd624ab13ac224ea80f88ca4a8987c0625e3.exe RegSvcs.exe PID 1872 wrote to memory of 2268 1872 331ca91b3a643aab796547bdd69ecd624ab13ac224ea80f88ca4a8987c0625e3.exe RegSvcs.exe PID 1872 wrote to memory of 2268 1872 331ca91b3a643aab796547bdd69ecd624ab13ac224ea80f88ca4a8987c0625e3.exe RegSvcs.exe PID 1872 wrote to memory of 2268 1872 331ca91b3a643aab796547bdd69ecd624ab13ac224ea80f88ca4a8987c0625e3.exe RegSvcs.exe PID 1376 wrote to memory of 2124 1376 Explorer.EXE cscript.exe PID 1376 wrote to memory of 2124 1376 Explorer.EXE cscript.exe PID 1376 wrote to memory of 2124 1376 Explorer.EXE cscript.exe PID 1376 wrote to memory of 2124 1376 Explorer.EXE cscript.exe PID 2124 wrote to memory of 2508 2124 cscript.exe cmd.exe PID 2124 wrote to memory of 2508 2124 cscript.exe cmd.exe PID 2124 wrote to memory of 2508 2124 cscript.exe cmd.exe PID 2124 wrote to memory of 2508 2124 cscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\331ca91b3a643aab796547bdd69ecd624ab13ac224ea80f88ca4a8987c0625e3.exe"C:\Users\Admin\AppData\Local\Temp\331ca91b3a643aab796547bdd69ecd624ab13ac224ea80f88ca4a8987c0625e3.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\331ca91b3a643aab796547bdd69ecd624ab13ac224ea80f88ca4a8987c0625e3.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1376-15-0x0000000003090000-0x0000000003190000-memory.dmpFilesize
1024KB
-
memory/1376-34-0x0000000004C40000-0x0000000004D26000-memory.dmpFilesize
920KB
-
memory/1376-20-0x0000000004C40000-0x0000000004D26000-memory.dmpFilesize
920KB
-
memory/1872-7-0x00000000005E0000-0x0000000000656000-memory.dmpFilesize
472KB
-
memory/1872-3-0x0000000004E50000-0x0000000004EE2000-memory.dmpFilesize
584KB
-
memory/1872-5-0x00000000004C0000-0x00000000004CE000-memory.dmpFilesize
56KB
-
memory/1872-6-0x00000000004D0000-0x00000000004E4000-memory.dmpFilesize
80KB
-
memory/1872-1-0x0000000074B70000-0x000000007525E000-memory.dmpFilesize
6.9MB
-
memory/1872-0-0x0000000000260000-0x00000000002FA000-memory.dmpFilesize
616KB
-
memory/1872-4-0x0000000000450000-0x0000000000468000-memory.dmpFilesize
96KB
-
memory/1872-21-0x0000000074B70000-0x000000007525E000-memory.dmpFilesize
6.9MB
-
memory/1872-2-0x00000000049C0000-0x0000000004A00000-memory.dmpFilesize
256KB
-
memory/2024-26-0x000000006FAC0000-0x000000007006B000-memory.dmpFilesize
5.7MB
-
memory/2024-22-0x000000006FAC0000-0x000000007006B000-memory.dmpFilesize
5.7MB
-
memory/2024-25-0x000000006FAC0000-0x000000007006B000-memory.dmpFilesize
5.7MB
-
memory/2024-23-0x0000000002950000-0x0000000002990000-memory.dmpFilesize
256KB
-
memory/2024-24-0x0000000002950000-0x0000000002990000-memory.dmpFilesize
256KB
-
memory/2124-29-0x0000000000070000-0x000000000009F000-memory.dmpFilesize
188KB
-
memory/2124-27-0x0000000000230000-0x0000000000252000-memory.dmpFilesize
136KB
-
memory/2124-28-0x0000000000230000-0x0000000000252000-memory.dmpFilesize
136KB
-
memory/2124-30-0x00000000020D0000-0x00000000023D3000-memory.dmpFilesize
3.0MB
-
memory/2124-31-0x0000000000070000-0x000000000009F000-memory.dmpFilesize
188KB
-
memory/2124-32-0x0000000001E00000-0x0000000001E93000-memory.dmpFilesize
588KB
-
memory/2268-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2268-12-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2268-19-0x0000000000320000-0x0000000000334000-memory.dmpFilesize
80KB
-
memory/2268-13-0x0000000000800000-0x0000000000B03000-memory.dmpFilesize
3.0MB
-
memory/2268-9-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2268-16-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2268-8-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB