Analysis
-
max time kernel
148s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
24-04-2024 01:14
Static task
static1
Behavioral task
behavioral1
Sample
331ca91b3a643aab796547bdd69ecd624ab13ac224ea80f88ca4a8987c0625e3.exe
Resource
win7-20231129-en
General
-
Target
331ca91b3a643aab796547bdd69ecd624ab13ac224ea80f88ca4a8987c0625e3.exe
-
Size
599KB
-
MD5
2417cdb09f72141abfa45cb64e699d91
-
SHA1
1ddc6b218dd520915ba8933e8214f307387b0e13
-
SHA256
331ca91b3a643aab796547bdd69ecd624ab13ac224ea80f88ca4a8987c0625e3
-
SHA512
39e83bd1bb9c0a2d529216ba75bd5ad15ebffb836c188e2723633e58203d2008ff6efb3995b51209992eee3120a36852939925d0282b4b218ceafd0c98f622c6
-
SSDEEP
12288:Hiu6oMr21DjiSdBaLMl7kKxYBQWHm6ayJNMH00qLsPBUr4wtJ:Hi/KDjJdPbyvm6DrMHPsLr/L
Malware Config
Extracted
formbook
4.1
fs83
blastol.space
tomwalkerisfalco.com
us-sumatrraslimbellytonic.com
drywallandpaintingservice.com
vntapp.net
passportpages.site
at-mim.com
yeondagoods.com
teomanyildirim.com
paygame.site
senze.art
alhandco.com
9831bsej.xyz
traumatic.xyz
sos-soutien.com
thetechnolgy.live
washing-machine-46612.bond
marvsneakers.com
shequbaike.net
xc4f35fg4h35fg4h53.top
587659.com
mydiamondsea.com
purifyelements.com
key-royalty.com
aimuzil.fun
ykautomotives.com
naelm.xyz
memejseventhall.com
opensource.beer
whiskersfood.com
piedrajuansebastian.net
q3cts.baby
wdfa.xyz
marketfield.shop
id91920.com
22yorkwood.com
sogracefully.net
nodoubt2025tour.com
042024b.vip
fmegsw.com
zsqd4i.com
clashfitness.com
matrixtech.biz
ketoxiamejaworks.buzz
ariostech.com
cardingforum.co
comicdesk.xyz
johnsonforchair.com
mpower-recruitment.com
essenceemporium.us
die-mosaik.schule
saturnp.com
tophotoffers.com
rosamorflorerialima.com
askhelpsecur.us
lifestyledbymodigital.com
clintforcouncil2021.com
king1122.com
veterinariaconvet.com.co
jackandthebox.net
donderbosgames.com
wszy.site
off7979.com
justklip.com
buywestlakevillagehomes.com
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3140-12-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3140-21-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1456-57-0x0000000000B90000-0x0000000000BBF000-memory.dmp formbook behavioral2/memory/1456-68-0x0000000000B90000-0x0000000000BBF000-memory.dmp formbook -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
331ca91b3a643aab796547bdd69ecd624ab13ac224ea80f88ca4a8987c0625e3.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Control Panel\International\Geo\Nation 331ca91b3a643aab796547bdd69ecd624ab13ac224ea80f88ca4a8987c0625e3.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
331ca91b3a643aab796547bdd69ecd624ab13ac224ea80f88ca4a8987c0625e3.exeRegSvcs.exechkdsk.exedescription pid process target process PID 1788 set thread context of 3140 1788 331ca91b3a643aab796547bdd69ecd624ab13ac224ea80f88ca4a8987c0625e3.exe RegSvcs.exe PID 3140 set thread context of 3384 3140 RegSvcs.exe Explorer.EXE PID 1456 set thread context of 3384 1456 chkdsk.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
RegSvcs.exepowershell.exechkdsk.exepid process 3140 RegSvcs.exe 3140 RegSvcs.exe 3140 RegSvcs.exe 3140 RegSvcs.exe 3140 RegSvcs.exe 3140 RegSvcs.exe 4920 powershell.exe 4920 powershell.exe 4920 powershell.exe 1456 chkdsk.exe 1456 chkdsk.exe 1456 chkdsk.exe 1456 chkdsk.exe 1456 chkdsk.exe 1456 chkdsk.exe 1456 chkdsk.exe 1456 chkdsk.exe 1456 chkdsk.exe 1456 chkdsk.exe 1456 chkdsk.exe 1456 chkdsk.exe 1456 chkdsk.exe 1456 chkdsk.exe 1456 chkdsk.exe 1456 chkdsk.exe 1456 chkdsk.exe 1456 chkdsk.exe 1456 chkdsk.exe 1456 chkdsk.exe 1456 chkdsk.exe 1456 chkdsk.exe 1456 chkdsk.exe 1456 chkdsk.exe 1456 chkdsk.exe 1456 chkdsk.exe 1456 chkdsk.exe 1456 chkdsk.exe 1456 chkdsk.exe 1456 chkdsk.exe 1456 chkdsk.exe 1456 chkdsk.exe 1456 chkdsk.exe 1456 chkdsk.exe 1456 chkdsk.exe 1456 chkdsk.exe 1456 chkdsk.exe 1456 chkdsk.exe 1456 chkdsk.exe 1456 chkdsk.exe 1456 chkdsk.exe 1456 chkdsk.exe 1456 chkdsk.exe 1456 chkdsk.exe 1456 chkdsk.exe 1456 chkdsk.exe 1456 chkdsk.exe 1456 chkdsk.exe 1456 chkdsk.exe 1456 chkdsk.exe 1456 chkdsk.exe 1456 chkdsk.exe 1456 chkdsk.exe 1456 chkdsk.exe 1456 chkdsk.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.exechkdsk.exepid process 3140 RegSvcs.exe 3140 RegSvcs.exe 3140 RegSvcs.exe 1456 chkdsk.exe 1456 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
RegSvcs.exepowershell.exechkdsk.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 3140 RegSvcs.exe Token: SeDebugPrivilege 4920 powershell.exe Token: SeDebugPrivilege 1456 chkdsk.exe Token: SeShutdownPrivilege 3384 Explorer.EXE Token: SeCreatePagefilePrivilege 3384 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3384 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
331ca91b3a643aab796547bdd69ecd624ab13ac224ea80f88ca4a8987c0625e3.exeExplorer.EXEchkdsk.exedescription pid process target process PID 1788 wrote to memory of 4920 1788 331ca91b3a643aab796547bdd69ecd624ab13ac224ea80f88ca4a8987c0625e3.exe powershell.exe PID 1788 wrote to memory of 4920 1788 331ca91b3a643aab796547bdd69ecd624ab13ac224ea80f88ca4a8987c0625e3.exe powershell.exe PID 1788 wrote to memory of 4920 1788 331ca91b3a643aab796547bdd69ecd624ab13ac224ea80f88ca4a8987c0625e3.exe powershell.exe PID 1788 wrote to memory of 3140 1788 331ca91b3a643aab796547bdd69ecd624ab13ac224ea80f88ca4a8987c0625e3.exe RegSvcs.exe PID 1788 wrote to memory of 3140 1788 331ca91b3a643aab796547bdd69ecd624ab13ac224ea80f88ca4a8987c0625e3.exe RegSvcs.exe PID 1788 wrote to memory of 3140 1788 331ca91b3a643aab796547bdd69ecd624ab13ac224ea80f88ca4a8987c0625e3.exe RegSvcs.exe PID 1788 wrote to memory of 3140 1788 331ca91b3a643aab796547bdd69ecd624ab13ac224ea80f88ca4a8987c0625e3.exe RegSvcs.exe PID 1788 wrote to memory of 3140 1788 331ca91b3a643aab796547bdd69ecd624ab13ac224ea80f88ca4a8987c0625e3.exe RegSvcs.exe PID 1788 wrote to memory of 3140 1788 331ca91b3a643aab796547bdd69ecd624ab13ac224ea80f88ca4a8987c0625e3.exe RegSvcs.exe PID 3384 wrote to memory of 1456 3384 Explorer.EXE chkdsk.exe PID 3384 wrote to memory of 1456 3384 Explorer.EXE chkdsk.exe PID 3384 wrote to memory of 1456 3384 Explorer.EXE chkdsk.exe PID 1456 wrote to memory of 3008 1456 chkdsk.exe cmd.exe PID 1456 wrote to memory of 3008 1456 chkdsk.exe cmd.exe PID 1456 wrote to memory of 3008 1456 chkdsk.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\331ca91b3a643aab796547bdd69ecd624ab13ac224ea80f88ca4a8987c0625e3.exe"C:\Users\Admin\AppData\Local\Temp\331ca91b3a643aab796547bdd69ecd624ab13ac224ea80f88ca4a8987c0625e3.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\331ca91b3a643aab796547bdd69ecd624ab13ac224ea80f88ca4a8987c0625e3.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_upo1r1uf.zwb.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/1456-72-0x0000000001310000-0x00000000013A3000-memory.dmpFilesize
588KB
-
memory/1456-55-0x0000000000110000-0x000000000011A000-memory.dmpFilesize
40KB
-
memory/1456-56-0x0000000000110000-0x000000000011A000-memory.dmpFilesize
40KB
-
memory/1456-57-0x0000000000B90000-0x0000000000BBF000-memory.dmpFilesize
188KB
-
memory/1456-60-0x0000000001560000-0x00000000018AA000-memory.dmpFilesize
3.3MB
-
memory/1456-68-0x0000000000B90000-0x0000000000BBF000-memory.dmpFilesize
188KB
-
memory/1788-5-0x0000000005340000-0x000000000534A000-memory.dmpFilesize
40KB
-
memory/1788-8-0x0000000005930000-0x0000000005948000-memory.dmpFilesize
96KB
-
memory/1788-9-0x0000000006710000-0x000000000671E000-memory.dmpFilesize
56KB
-
memory/1788-10-0x0000000006720000-0x0000000006734000-memory.dmpFilesize
80KB
-
memory/1788-11-0x000000000A510000-0x000000000A586000-memory.dmpFilesize
472KB
-
memory/1788-1-0x0000000074550000-0x0000000074D00000-memory.dmpFilesize
7.7MB
-
memory/1788-16-0x0000000074550000-0x0000000074D00000-memory.dmpFilesize
7.7MB
-
memory/1788-7-0x0000000007DA0000-0x0000000007E32000-memory.dmpFilesize
584KB
-
memory/1788-6-0x0000000005610000-0x00000000056AC000-memory.dmpFilesize
624KB
-
memory/1788-4-0x00000000052A0000-0x00000000052B0000-memory.dmpFilesize
64KB
-
memory/1788-3-0x00000000053A0000-0x0000000005432000-memory.dmpFilesize
584KB
-
memory/1788-2-0x0000000005950000-0x0000000005EF4000-memory.dmpFilesize
5.6MB
-
memory/1788-0-0x00000000008B0000-0x000000000094A000-memory.dmpFilesize
616KB
-
memory/3140-12-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3140-20-0x0000000001090000-0x00000000010A4000-memory.dmpFilesize
80KB
-
memory/3140-19-0x0000000001230000-0x000000000157A000-memory.dmpFilesize
3.3MB
-
memory/3140-21-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3384-79-0x0000000008310000-0x0000000008438000-memory.dmpFilesize
1.2MB
-
memory/3384-76-0x0000000008310000-0x0000000008438000-memory.dmpFilesize
1.2MB
-
memory/3384-75-0x0000000008310000-0x0000000008438000-memory.dmpFilesize
1.2MB
-
memory/3384-23-0x0000000008240000-0x0000000008303000-memory.dmpFilesize
780KB
-
memory/4920-39-0x0000000005D90000-0x0000000005DDC000-memory.dmpFilesize
304KB
-
memory/4920-59-0x0000000007020000-0x000000000703A000-memory.dmpFilesize
104KB
-
memory/4920-40-0x000000007FC20000-0x000000007FC30000-memory.dmpFilesize
64KB
-
memory/4920-41-0x00000000062C0000-0x00000000062F2000-memory.dmpFilesize
200KB
-
memory/4920-42-0x0000000070410000-0x000000007045C000-memory.dmpFilesize
304KB
-
memory/4920-53-0x0000000002570000-0x0000000002580000-memory.dmpFilesize
64KB
-
memory/4920-52-0x00000000062A0000-0x00000000062BE000-memory.dmpFilesize
120KB
-
memory/4920-54-0x0000000006EE0000-0x0000000006F83000-memory.dmpFilesize
652KB
-
memory/4920-22-0x0000000004F10000-0x0000000005538000-memory.dmpFilesize
6.2MB
-
memory/4920-38-0x0000000005D00000-0x0000000005D1E000-memory.dmpFilesize
120KB
-
memory/4920-58-0x0000000007670000-0x0000000007CEA000-memory.dmpFilesize
6.5MB
-
memory/4920-29-0x0000000005720000-0x0000000005A74000-memory.dmpFilesize
3.3MB
-
memory/4920-18-0x0000000002570000-0x0000000002580000-memory.dmpFilesize
64KB
-
memory/4920-24-0x0000000004C20000-0x0000000004C42000-memory.dmpFilesize
136KB
-
memory/4920-61-0x0000000007090000-0x000000000709A000-memory.dmpFilesize
40KB
-
memory/4920-62-0x00000000072A0000-0x0000000007336000-memory.dmpFilesize
600KB
-
memory/4920-63-0x0000000007220000-0x0000000007231000-memory.dmpFilesize
68KB
-
memory/4920-64-0x0000000007250000-0x000000000725E000-memory.dmpFilesize
56KB
-
memory/4920-65-0x0000000007260000-0x0000000007274000-memory.dmpFilesize
80KB
-
memory/4920-66-0x0000000007360000-0x000000000737A000-memory.dmpFilesize
104KB
-
memory/4920-67-0x0000000007340000-0x0000000007348000-memory.dmpFilesize
32KB
-
memory/4920-17-0x0000000074550000-0x0000000074D00000-memory.dmpFilesize
7.7MB
-
memory/4920-71-0x0000000074550000-0x0000000074D00000-memory.dmpFilesize
7.7MB
-
memory/4920-14-0x0000000000D20000-0x0000000000D56000-memory.dmpFilesize
216KB
-
memory/4920-25-0x0000000005640000-0x00000000056A6000-memory.dmpFilesize
408KB
-
memory/4920-27-0x00000000056B0000-0x0000000005716000-memory.dmpFilesize
408KB
-
memory/4920-26-0x0000000002570000-0x0000000002580000-memory.dmpFilesize
64KB