Analysis
-
max time kernel
152s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08-05-2024 13:25
Static task
static1
Behavioral task
behavioral1
Sample
eec2040b640e5b1806119e1a428d54c4dab8fe87e2afe89570d158968122e4bb.exe
Resource
win7-20240221-en
General
-
Target
eec2040b640e5b1806119e1a428d54c4dab8fe87e2afe89570d158968122e4bb.exe
-
Size
573KB
-
MD5
90d93d073d92e1cd47f4d792f430bbbc
-
SHA1
3e4fe2f29722803551c31fe38aa04d97ec9150e7
-
SHA256
eec2040b640e5b1806119e1a428d54c4dab8fe87e2afe89570d158968122e4bb
-
SHA512
bd1daa7f963319f40e59c27870737f43e61e087c20cc0c3605a23910eb3a3a1aa27384f2c041d2a12bb1aed35adaabad6f7b797fbdd61acd5dde181046441481
-
SSDEEP
12288:rccadOGEW1ivxTRRSXyXQjDYq7C+5bLTTrBGZKGYC1DrJh6xjfHBB778Q6:IWGEW16TRRSKcAGbzrB4SC1DrJ0ZJB
Malware Config
Extracted
formbook
4.1
fs83
blastol.space
tomwalkerisfalco.com
us-sumatrraslimbellytonic.com
drywallandpaintingservice.com
vntapp.net
passportpages.site
at-mim.com
yeondagoods.com
teomanyildirim.com
paygame.site
senze.art
alhandco.com
9831bsej.xyz
traumatic.xyz
sos-soutien.com
thetechnolgy.live
washing-machine-46612.bond
marvsneakers.com
shequbaike.net
xc4f35fg4h35fg4h53.top
587659.com
mydiamondsea.com
purifyelements.com
key-royalty.com
aimuzil.fun
ykautomotives.com
naelm.xyz
memejseventhall.com
opensource.beer
whiskersfood.com
piedrajuansebastian.net
q3cts.baby
wdfa.xyz
marketfield.shop
id91920.com
22yorkwood.com
sogracefully.net
nodoubt2025tour.com
042024b.vip
fmegsw.com
zsqd4i.com
clashfitness.com
matrixtech.biz
ketoxiamejaworks.buzz
ariostech.com
cardingforum.co
comicdesk.xyz
johnsonforchair.com
mpower-recruitment.com
essenceemporium.us
die-mosaik.schule
saturnp.com
tophotoffers.com
rosamorflorerialima.com
askhelpsecur.us
lifestyledbymodigital.com
clintforcouncil2021.com
king1122.com
veterinariaconvet.com.co
jackandthebox.net
donderbosgames.com
wszy.site
off7979.com
justklip.com
buywestlakevillagehomes.com
Signatures
-
Formbook payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2212-11-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2212-21-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1168-54-0x0000000001000000-0x000000000102F000-memory.dmp formbook -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
eec2040b640e5b1806119e1a428d54c4dab8fe87e2afe89570d158968122e4bb.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation eec2040b640e5b1806119e1a428d54c4dab8fe87e2afe89570d158968122e4bb.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
eec2040b640e5b1806119e1a428d54c4dab8fe87e2afe89570d158968122e4bb.exeRegSvcs.exewlanext.exedescription pid process target process PID 3844 set thread context of 2212 3844 eec2040b640e5b1806119e1a428d54c4dab8fe87e2afe89570d158968122e4bb.exe RegSvcs.exe PID 2212 set thread context of 3372 2212 RegSvcs.exe Explorer.EXE PID 1168 set thread context of 3372 1168 wlanext.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
eec2040b640e5b1806119e1a428d54c4dab8fe87e2afe89570d158968122e4bb.exeRegSvcs.exepowershell.exewlanext.exepid process 3844 eec2040b640e5b1806119e1a428d54c4dab8fe87e2afe89570d158968122e4bb.exe 3844 eec2040b640e5b1806119e1a428d54c4dab8fe87e2afe89570d158968122e4bb.exe 3844 eec2040b640e5b1806119e1a428d54c4dab8fe87e2afe89570d158968122e4bb.exe 3844 eec2040b640e5b1806119e1a428d54c4dab8fe87e2afe89570d158968122e4bb.exe 2212 RegSvcs.exe 2212 RegSvcs.exe 2212 RegSvcs.exe 2212 RegSvcs.exe 2212 RegSvcs.exe 2212 RegSvcs.exe 3080 powershell.exe 3080 powershell.exe 3080 powershell.exe 1168 wlanext.exe 1168 wlanext.exe 1168 wlanext.exe 1168 wlanext.exe 1168 wlanext.exe 1168 wlanext.exe 1168 wlanext.exe 1168 wlanext.exe 1168 wlanext.exe 1168 wlanext.exe 1168 wlanext.exe 1168 wlanext.exe 1168 wlanext.exe 1168 wlanext.exe 1168 wlanext.exe 1168 wlanext.exe 1168 wlanext.exe 1168 wlanext.exe 1168 wlanext.exe 1168 wlanext.exe 1168 wlanext.exe 1168 wlanext.exe 1168 wlanext.exe 1168 wlanext.exe 1168 wlanext.exe 1168 wlanext.exe 1168 wlanext.exe 1168 wlanext.exe 1168 wlanext.exe 1168 wlanext.exe 1168 wlanext.exe 1168 wlanext.exe 1168 wlanext.exe 1168 wlanext.exe 1168 wlanext.exe 1168 wlanext.exe 1168 wlanext.exe 1168 wlanext.exe 1168 wlanext.exe 1168 wlanext.exe 1168 wlanext.exe 1168 wlanext.exe 1168 wlanext.exe 1168 wlanext.exe 1168 wlanext.exe 1168 wlanext.exe 1168 wlanext.exe 1168 wlanext.exe 1168 wlanext.exe 1168 wlanext.exe 1168 wlanext.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.exewlanext.exepid process 2212 RegSvcs.exe 2212 RegSvcs.exe 2212 RegSvcs.exe 1168 wlanext.exe 1168 wlanext.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
eec2040b640e5b1806119e1a428d54c4dab8fe87e2afe89570d158968122e4bb.exeRegSvcs.exepowershell.exewlanext.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 3844 eec2040b640e5b1806119e1a428d54c4dab8fe87e2afe89570d158968122e4bb.exe Token: SeDebugPrivilege 2212 RegSvcs.exe Token: SeDebugPrivilege 3080 powershell.exe Token: SeDebugPrivilege 1168 wlanext.exe Token: SeShutdownPrivilege 3372 Explorer.EXE Token: SeCreatePagefilePrivilege 3372 Explorer.EXE -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
eec2040b640e5b1806119e1a428d54c4dab8fe87e2afe89570d158968122e4bb.exeExplorer.EXEwlanext.exedescription pid process target process PID 3844 wrote to memory of 3080 3844 eec2040b640e5b1806119e1a428d54c4dab8fe87e2afe89570d158968122e4bb.exe powershell.exe PID 3844 wrote to memory of 3080 3844 eec2040b640e5b1806119e1a428d54c4dab8fe87e2afe89570d158968122e4bb.exe powershell.exe PID 3844 wrote to memory of 3080 3844 eec2040b640e5b1806119e1a428d54c4dab8fe87e2afe89570d158968122e4bb.exe powershell.exe PID 3844 wrote to memory of 4732 3844 eec2040b640e5b1806119e1a428d54c4dab8fe87e2afe89570d158968122e4bb.exe RegSvcs.exe PID 3844 wrote to memory of 4732 3844 eec2040b640e5b1806119e1a428d54c4dab8fe87e2afe89570d158968122e4bb.exe RegSvcs.exe PID 3844 wrote to memory of 4732 3844 eec2040b640e5b1806119e1a428d54c4dab8fe87e2afe89570d158968122e4bb.exe RegSvcs.exe PID 3844 wrote to memory of 2040 3844 eec2040b640e5b1806119e1a428d54c4dab8fe87e2afe89570d158968122e4bb.exe RegSvcs.exe PID 3844 wrote to memory of 2040 3844 eec2040b640e5b1806119e1a428d54c4dab8fe87e2afe89570d158968122e4bb.exe RegSvcs.exe PID 3844 wrote to memory of 2040 3844 eec2040b640e5b1806119e1a428d54c4dab8fe87e2afe89570d158968122e4bb.exe RegSvcs.exe PID 3844 wrote to memory of 2212 3844 eec2040b640e5b1806119e1a428d54c4dab8fe87e2afe89570d158968122e4bb.exe RegSvcs.exe PID 3844 wrote to memory of 2212 3844 eec2040b640e5b1806119e1a428d54c4dab8fe87e2afe89570d158968122e4bb.exe RegSvcs.exe PID 3844 wrote to memory of 2212 3844 eec2040b640e5b1806119e1a428d54c4dab8fe87e2afe89570d158968122e4bb.exe RegSvcs.exe PID 3844 wrote to memory of 2212 3844 eec2040b640e5b1806119e1a428d54c4dab8fe87e2afe89570d158968122e4bb.exe RegSvcs.exe PID 3844 wrote to memory of 2212 3844 eec2040b640e5b1806119e1a428d54c4dab8fe87e2afe89570d158968122e4bb.exe RegSvcs.exe PID 3844 wrote to memory of 2212 3844 eec2040b640e5b1806119e1a428d54c4dab8fe87e2afe89570d158968122e4bb.exe RegSvcs.exe PID 3372 wrote to memory of 1168 3372 Explorer.EXE wlanext.exe PID 3372 wrote to memory of 1168 3372 Explorer.EXE wlanext.exe PID 3372 wrote to memory of 1168 3372 Explorer.EXE wlanext.exe PID 1168 wrote to memory of 3748 1168 wlanext.exe cmd.exe PID 1168 wrote to memory of 3748 1168 wlanext.exe cmd.exe PID 1168 wrote to memory of 3748 1168 wlanext.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\eec2040b640e5b1806119e1a428d54c4dab8fe87e2afe89570d158968122e4bb.exe"C:\Users\Admin\AppData\Local\Temp\eec2040b640e5b1806119e1a428d54c4dab8fe87e2afe89570d158968122e4bb.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\eec2040b640e5b1806119e1a428d54c4dab8fe87e2afe89570d158968122e4bb.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3080 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵PID:4732
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵PID:2040
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2212 -
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:5112
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵PID:3748
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3536 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:81⤵PID:1660
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82