Analysis
- max time kernel
148s - max time network
135s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system - submitted
04/05/2024, 01:44
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
shipping doc.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
General
- Target shipping doc.exe
- Size 1.1MB
- Sample240504-b5xjqsdb33
- SHA256 9aeee1a70ae929e15e376532efa734d1a7dd5c0b0c814c3e620dcfe68e7baa96
- MD5 7ad4c6133f4f75ae91bf07f65dc5f21a
- SHA1 abab0fed5f43a2ee988fb45b8880d50292dc9d5f
- SHA512 c84ce782a3d8c637f68811365a5f1c6df008ff3996fc81b75b14a582dc8cbf636d3aa5db330763cd6ad1ca5cbeca8eb7c5035ba027dcc7329b643d89b423264a
- SSDEEP 24576:XqDEvCTbMWu7rQYlBQcBiT6rprG8aLJI1r+vgWrKA:XTvC/MTQYxsWR7aLJIl+VrK
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
formbook
Version
-
4.1
Campaign
-
ba94
Decoy
-
dxtra.shop
-
upfromhere-eventsdecor.com
-
blacksevenkoeln.shop
-
pcboards2024.xyz
-
posteo.lol
-
naservus.com
-
pivotance.com
-
90ans.com
-
ebenezer-remodeling.com
-
reddragondao.com
-
gspotshop.com
-
thesiamesebetta.biz
-
rrdhq.com
-
greenislandservices.info
-
prismotrov.com
-
elaqbh.shop
-
sosenfantscovidlong.com
-
elmsolarsavings.com
-
sol-casino-2023.club
-
sharecroipper.top
-
yqwija.info
-
eat-smile.com
-
idj257.com
-
popenza.com
-
bingpueng.website
-
odty744.net
-
ooqowerh.com
-
primetechinnovationllc.com
-
themvpcatalyst.us
-
spesandosupermercato.com
-
arwile.com
-
pachecoarquitectos.com
-
csrhzs.com
-
citylinechimneythorntonpa.us
-
apocalypticsigil.us
-
shareebrooksphotography.com
-
hjgd.xyz
-
vertexoffice.com
-
xn--vf4b25j89a162a.com
-
fijula.com
-
odvip666.bet
-
sekutvk5ks.top
-
creditscorewizards.com
-
happyjon.com
-
18plusmovies.com
-
xn--vr-jc9iv7k9yrlb465i.net
-
saga-launchs.app
-
liyinghao.cc
-
binpc6.club
-
schatzaviation.com
-
employeefeedback.link
-
whatpixels.com
-
humidityflash.site
-
seraph.live
-
6lsamr.vip
-
hmi29.top
-
galaxyprofituk.com
-
educationman.me
-
heelfixkit.com
-
jacobmcfarland.dev
-
kso032.com
-
fdue.store
-
yourreicapital.com
-
ac6a2qa.cc
-
steam.help
Signatures
- Formbook payload 3 IoCs
resource yara_rule behavioral2/memory/4352-11-0x0000000000390000-0x00000000003BF000-memory.dmp formbook behavioral2/memory/4352-15-0x0000000000390000-0x00000000003BF000-memory.dmp formbook behavioral2/memory/2800-21-0x0000000000C20000-0x0000000000C4F000-memory.dmp formbook - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 784 set thread context of 4352 784 shipping doc.exe 86 PID 4352 set thread context of 3520 4352 svchost.exe 56 PID 2800 set thread context of 3520 2800 svchost.exe 56 - Program crash 1 IoCs
pid pid_target Process procid_target 1536 784 WerFault.exe 82 - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Explorer.EXE - Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 4352 svchost.exe 4352 svchost.exe 4352 svchost.exe 4352 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe 2800 svchost.exe - Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 784 shipping doc.exe 784 shipping doc.exe 4352 svchost.exe 4352 svchost.exe 4352 svchost.exe 2800 svchost.exe 2800 svchost.exe - Suspicious use of AdjustPrivilegeToken 14 IoCs
description pid Process Token: SeDebugPrivilege 4352 svchost.exe Token: SeShutdownPrivilege 3520 Explorer.EXE Token: SeCreatePagefilePrivilege 3520 Explorer.EXE Token: SeShutdownPrivilege 3520 Explorer.EXE Token: SeCreatePagefilePrivilege 3520 Explorer.EXE Token: SeShutdownPrivilege 3520 Explorer.EXE Token: SeCreatePagefilePrivilege 3520 Explorer.EXE Token: SeShutdownPrivilege 3520 Explorer.EXE Token: SeCreatePagefilePrivilege 3520 Explorer.EXE Token: SeShutdownPrivilege 3520 Explorer.EXE Token: SeCreatePagefilePrivilege 3520 Explorer.EXE Token: SeShutdownPrivilege 3520 Explorer.EXE Token: SeCreatePagefilePrivilege 3520 Explorer.EXE Token: SeDebugPrivilege 2800 svchost.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3520 Explorer.EXE 3520 Explorer.EXE - Suspicious use of UnmapMainImage 1 IoCs
pid Process 3520 Explorer.EXE - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 784 wrote to memory of 4352 784 shipping doc.exe 86 PID 784 wrote to memory of 4352 784 shipping doc.exe 86 PID 784 wrote to memory of 4352 784 shipping doc.exe 86 PID 784 wrote to memory of 4352 784 shipping doc.exe 86 PID 3520 wrote to memory of 2800 3520 Explorer.EXE 90 PID 3520 wrote to memory of 2800 3520 Explorer.EXE 90 PID 3520 wrote to memory of 2800 3520 Explorer.EXE 90 PID 2800 wrote to memory of 2332 2800 svchost.exe 96 PID 2800 wrote to memory of 2332 2800 svchost.exe 96 PID 2800 wrote to memory of 2332 2800 svchost.exe 96
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\shipping doc.exe"C:\Users\Admin\AppData\Local\Temp\shipping doc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:784 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\shipping doc.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4352
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 784 -s 6363⤵
- Program crash
PID:1536
-
-
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵PID:2332
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 784 -ip 7841⤵PID:2032