Resubmissions
17-05-2024 13:34
240517-qvapjsag93 10Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
17-05-2024 13:34
Behavioral task
behavioral1
Sample
80bc491f53143f0586753066eff8912b356258afe443f5d0f74ef9b36703225c.xlsm
Resource
win7-20240221-en
General
-
Target
80bc491f53143f0586753066eff8912b356258afe443f5d0f74ef9b36703225c.xlsm
-
Size
57KB
-
MD5
49fbdfeeae6102f667899001e34cc40a
-
SHA1
0538c187474e653f877fe6cb92cd0e4e6cf00ec6
-
SHA256
80bc491f53143f0586753066eff8912b356258afe443f5d0f74ef9b36703225c
-
SHA512
b1487ffbb8ba6c5b7eb33738ab65323d715a0d2f5238f65b4dfc1d65a72200fdc18b889ce952fc9e4e02535528d7b3d653680290890b525cde0b24a898d283c2
-
SSDEEP
1536:OwCabiKWDDSlECVV/rm8h+DVxVevyhc3W74:O8flECjzm8hBvwc3M4
Malware Config
Extracted
formbook
4.1
dn03
almouranipainting.com
cataloguia.shop
zaparielectric.com
whcqsc.com
ioco.in
aduredmond.com
vavada611a.fun
humtivers.com
jewellerytml.com
mcapitalparticipacoes.com
inhlcq.shop
solanamall.xyz
moviepropgroup.com
thegenesis.ltd
cyberxdefend.com
skinbykoco.com
entermintlead.com
honestaireviews.com
wyclhj7gqfustzp.buzz
w937xb.com
bakuusa.online
sabong-web.com
52cg2.club
jasonnutter.golf
odbet555.app
vipmotoryatkiralama.com
auravibeslighting.com
pulsesautos.com
imdcaam.com
vivaness.club
bovverbadges.com
giaydonghai.online
aditi-jobs.com
numericalsemantics.com
shoprazorlaser.com
lovedacademy.com
gets-lnds.io
teyo293.xyz
banditsolana.com
delivery-jobs-76134.bond
ppp5716.buzz
zjmeterial.com
de-ponqk.top
bntyr76rhg.top
servicepmgtl.world
nailtimelocust.top
paperappa.com
80sos.com
daysofbetting.com
slaytheday.fun
travauxdefou.com
bx2zyg.com
thecoxnews.com
qriskaq.com
top-dao.com
krstockly1.shop
roiwholesale.com
pajero777ads.click
twistedrubytx.com
thesovreignkingdomofmaui.info
cataclysmicgamingapparel.com
verxop.xyz
xn--kwra1023b.com
winterclairee.com
sukhiclothing.com
Signatures
-
Formbook payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4256-74-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2520-125-0x0000000001070000-0x000000000109F000-memory.dmp formbook -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
pp.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation pp.exe -
Executes dropped EXE 3 IoCs
Processes:
pp.exepp.exepp.exepid process 1168 pp.exe 5084 pp.exe 4256 pp.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
pp.exepp.exemsdt.exedescription pid process target process PID 1168 set thread context of 4256 1168 pp.exe pp.exe PID 4256 set thread context of 3520 4256 pp.exe Explorer.EXE PID 2520 set thread context of 3520 2520 msdt.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1948 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 60 IoCs
Processes:
pp.exepp.exepowershell.exemsdt.exepid process 1168 pp.exe 1168 pp.exe 4256 pp.exe 4256 pp.exe 4256 pp.exe 4256 pp.exe 3016 powershell.exe 3016 powershell.exe 2520 msdt.exe 2520 msdt.exe 2520 msdt.exe 2520 msdt.exe 2520 msdt.exe 2520 msdt.exe 2520 msdt.exe 2520 msdt.exe 2520 msdt.exe 2520 msdt.exe 2520 msdt.exe 2520 msdt.exe 2520 msdt.exe 2520 msdt.exe 2520 msdt.exe 2520 msdt.exe 2520 msdt.exe 2520 msdt.exe 2520 msdt.exe 2520 msdt.exe 2520 msdt.exe 2520 msdt.exe 2520 msdt.exe 2520 msdt.exe 2520 msdt.exe 2520 msdt.exe 2520 msdt.exe 2520 msdt.exe 2520 msdt.exe 2520 msdt.exe 2520 msdt.exe 2520 msdt.exe 2520 msdt.exe 2520 msdt.exe 2520 msdt.exe 2520 msdt.exe 2520 msdt.exe 2520 msdt.exe 2520 msdt.exe 2520 msdt.exe 2520 msdt.exe 2520 msdt.exe 2520 msdt.exe 2520 msdt.exe 2520 msdt.exe 2520 msdt.exe 2520 msdt.exe 2520 msdt.exe 2520 msdt.exe 2520 msdt.exe 2520 msdt.exe 2520 msdt.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
pp.exemsdt.exepid process 4256 pp.exe 4256 pp.exe 4256 pp.exe 2520 msdt.exe 2520 msdt.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
Processes:
pp.exepp.exepowershell.exemsdt.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1168 pp.exe Token: SeDebugPrivilege 4256 pp.exe Token: SeDebugPrivilege 3016 powershell.exe Token: SeDebugPrivilege 2520 msdt.exe Token: SeShutdownPrivilege 3520 Explorer.EXE Token: SeCreatePagefilePrivilege 3520 Explorer.EXE Token: SeShutdownPrivilege 3520 Explorer.EXE Token: SeCreatePagefilePrivilege 3520 Explorer.EXE Token: SeShutdownPrivilege 3520 Explorer.EXE Token: SeCreatePagefilePrivilege 3520 Explorer.EXE Token: SeShutdownPrivilege 3520 Explorer.EXE Token: SeCreatePagefilePrivilege 3520 Explorer.EXE Token: SeShutdownPrivilege 3520 Explorer.EXE Token: SeCreatePagefilePrivilege 3520 Explorer.EXE Token: SeShutdownPrivilege 3520 Explorer.EXE Token: SeCreatePagefilePrivilege 3520 Explorer.EXE Token: SeShutdownPrivilege 3520 Explorer.EXE Token: SeCreatePagefilePrivilege 3520 Explorer.EXE Token: SeShutdownPrivilege 3520 Explorer.EXE Token: SeCreatePagefilePrivilege 3520 Explorer.EXE Token: SeShutdownPrivilege 3520 Explorer.EXE Token: SeCreatePagefilePrivilege 3520 Explorer.EXE Token: SeShutdownPrivilege 3520 Explorer.EXE Token: SeCreatePagefilePrivilege 3520 Explorer.EXE Token: SeShutdownPrivilege 3520 Explorer.EXE Token: SeCreatePagefilePrivilege 3520 Explorer.EXE Token: SeShutdownPrivilege 3520 Explorer.EXE Token: SeCreatePagefilePrivilege 3520 Explorer.EXE Token: SeShutdownPrivilege 3520 Explorer.EXE Token: SeCreatePagefilePrivilege 3520 Explorer.EXE Token: SeShutdownPrivilege 3520 Explorer.EXE Token: SeCreatePagefilePrivilege 3520 Explorer.EXE Token: SeShutdownPrivilege 3520 Explorer.EXE Token: SeCreatePagefilePrivilege 3520 Explorer.EXE Token: SeShutdownPrivilege 3520 Explorer.EXE Token: SeCreatePagefilePrivilege 3520 Explorer.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
EXCEL.EXEpid process 1948 EXCEL.EXE 1948 EXCEL.EXE 1948 EXCEL.EXE 1948 EXCEL.EXE 1948 EXCEL.EXE 1948 EXCEL.EXE 1948 EXCEL.EXE 1948 EXCEL.EXE 1948 EXCEL.EXE 1948 EXCEL.EXE 1948 EXCEL.EXE 1948 EXCEL.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3520 Explorer.EXE -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
EXCEL.EXEpp.exeExplorer.EXEmsdt.exedescription pid process target process PID 1948 wrote to memory of 1168 1948 EXCEL.EXE pp.exe PID 1948 wrote to memory of 1168 1948 EXCEL.EXE pp.exe PID 1948 wrote to memory of 1168 1948 EXCEL.EXE pp.exe PID 1168 wrote to memory of 3016 1168 pp.exe powershell.exe PID 1168 wrote to memory of 3016 1168 pp.exe powershell.exe PID 1168 wrote to memory of 3016 1168 pp.exe powershell.exe PID 1168 wrote to memory of 5084 1168 pp.exe pp.exe PID 1168 wrote to memory of 5084 1168 pp.exe pp.exe PID 1168 wrote to memory of 5084 1168 pp.exe pp.exe PID 1168 wrote to memory of 4256 1168 pp.exe pp.exe PID 1168 wrote to memory of 4256 1168 pp.exe pp.exe PID 1168 wrote to memory of 4256 1168 pp.exe pp.exe PID 1168 wrote to memory of 4256 1168 pp.exe pp.exe PID 1168 wrote to memory of 4256 1168 pp.exe pp.exe PID 1168 wrote to memory of 4256 1168 pp.exe pp.exe PID 3520 wrote to memory of 2520 3520 Explorer.EXE msdt.exe PID 3520 wrote to memory of 2520 3520 Explorer.EXE msdt.exe PID 3520 wrote to memory of 2520 3520 Explorer.EXE msdt.exe PID 2520 wrote to memory of 4264 2520 msdt.exe cmd.exe PID 2520 wrote to memory of 4264 2520 msdt.exe cmd.exe PID 2520 wrote to memory of 4264 2520 msdt.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\80bc491f53143f0586753066eff8912b356258afe443f5d0f74ef9b36703225c.xlsm"2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\pp.exeC:\Users\Admin\AppData\Local\Temp\pp.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\pp.exe"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\pp.exe"C:\Users\Admin\AppData\Local\Temp\pp.exe"4⤵
- Executes dropped EXE
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\pp.exe"C:\Users\Admin\AppData\Local\Temp\pp.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4256 -
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\pp.exe"3⤵PID:4264
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ik1cfvil.0sg.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\pp.exeFilesize
650KB
MD56c3b0221a0d2bbcd925cf13b36d41533
SHA1050767238d3993ed5dbdd4ca83bbd354d7432758
SHA256e881b599bdef921677c57eeeb516ab55d6ba988637113a43949f923276a09c8f
SHA512562035c90e1948efa054e05b54ea365fbdcc20c256d71a23d33f67e06d33642603bda3bac9cfd60e960221cc62b16f7a4d38c6c79d4f3e0e526c8c6c749f40e8
-
memory/1168-65-0x0000000006360000-0x000000000636C000-memory.dmpFilesize
48KB
-
memory/1168-72-0x00000000104A0000-0x000000001053C000-memory.dmpFilesize
624KB
-
memory/1168-71-0x000000000CCF0000-0x000000000CD66000-memory.dmpFilesize
472KB
-
memory/1168-70-0x00000000048F0000-0x0000000004900000-memory.dmpFilesize
64KB
-
memory/1168-77-0x00007FFD18230000-0x00007FFD18425000-memory.dmpFilesize
2.0MB
-
memory/1168-64-0x0000000006050000-0x0000000006072000-memory.dmpFilesize
136KB
-
memory/1168-63-0x0000000004F20000-0x0000000004F2A000-memory.dmpFilesize
40KB
-
memory/1168-62-0x0000000004E70000-0x0000000004F02000-memory.dmpFilesize
584KB
-
memory/1168-61-0x0000000005380000-0x0000000005924000-memory.dmpFilesize
5.6MB
-
memory/1168-60-0x00000000003D0000-0x0000000000476000-memory.dmpFilesize
664KB
-
memory/1168-59-0x00007FFD18230000-0x00007FFD18425000-memory.dmpFilesize
2.0MB
-
memory/1948-17-0x00007FFD18230000-0x00007FFD18425000-memory.dmpFilesize
2.0MB
-
memory/1948-6-0x00007FFD18230000-0x00007FFD18425000-memory.dmpFilesize
2.0MB
-
memory/1948-20-0x00007FFD18230000-0x00007FFD18425000-memory.dmpFilesize
2.0MB
-
memory/1948-19-0x00007FFD18230000-0x00007FFD18425000-memory.dmpFilesize
2.0MB
-
memory/1948-0-0x00007FFCD82B0000-0x00007FFCD82C0000-memory.dmpFilesize
64KB
-
memory/1948-16-0x00007FFD18230000-0x00007FFD18425000-memory.dmpFilesize
2.0MB
-
memory/1948-15-0x00007FFD18230000-0x00007FFD18425000-memory.dmpFilesize
2.0MB
-
memory/1948-12-0x00007FFD18230000-0x00007FFD18425000-memory.dmpFilesize
2.0MB
-
memory/1948-45-0x00007FFD18230000-0x00007FFD18425000-memory.dmpFilesize
2.0MB
-
memory/1948-55-0x00007FFD18230000-0x00007FFD18425000-memory.dmpFilesize
2.0MB
-
memory/1948-14-0x00007FFD18230000-0x00007FFD18425000-memory.dmpFilesize
2.0MB
-
memory/1948-13-0x00007FFD18230000-0x00007FFD18425000-memory.dmpFilesize
2.0MB
-
memory/1948-11-0x00007FFCD5950000-0x00007FFCD5960000-memory.dmpFilesize
64KB
-
memory/1948-8-0x00007FFD18230000-0x00007FFD18425000-memory.dmpFilesize
2.0MB
-
memory/1948-9-0x00007FFD18230000-0x00007FFD18425000-memory.dmpFilesize
2.0MB
-
memory/1948-10-0x00007FFD18230000-0x00007FFD18425000-memory.dmpFilesize
2.0MB
-
memory/1948-7-0x00007FFCD5950000-0x00007FFCD5960000-memory.dmpFilesize
64KB
-
memory/1948-98-0x00007FFD182CD000-0x00007FFD182CE000-memory.dmpFilesize
4KB
-
memory/1948-69-0x00007FFD18230000-0x00007FFD18425000-memory.dmpFilesize
2.0MB
-
memory/1948-5-0x00007FFCD82B0000-0x00007FFCD82C0000-memory.dmpFilesize
64KB
-
memory/1948-4-0x00007FFCD82B0000-0x00007FFCD82C0000-memory.dmpFilesize
64KB
-
memory/1948-2-0x00007FFCD82B0000-0x00007FFCD82C0000-memory.dmpFilesize
64KB
-
memory/1948-155-0x00007FFD18230000-0x00007FFD18425000-memory.dmpFilesize
2.0MB
-
memory/1948-3-0x00007FFCD82B0000-0x00007FFCD82C0000-memory.dmpFilesize
64KB
-
memory/1948-151-0x00007FFCD82B0000-0x00007FFCD82C0000-memory.dmpFilesize
64KB
-
memory/1948-152-0x00007FFCD82B0000-0x00007FFCD82C0000-memory.dmpFilesize
64KB
-
memory/1948-153-0x00007FFCD82B0000-0x00007FFCD82C0000-memory.dmpFilesize
64KB
-
memory/1948-154-0x00007FFCD82B0000-0x00007FFCD82C0000-memory.dmpFilesize
64KB
-
memory/1948-18-0x00007FFD18230000-0x00007FFD18425000-memory.dmpFilesize
2.0MB
-
memory/1948-1-0x00007FFD182CD000-0x00007FFD182CE000-memory.dmpFilesize
4KB
-
memory/1948-126-0x00007FFD18230000-0x00007FFD18425000-memory.dmpFilesize
2.0MB
-
memory/1948-122-0x00007FFD18230000-0x00007FFD18425000-memory.dmpFilesize
2.0MB
-
memory/2520-125-0x0000000001070000-0x000000000109F000-memory.dmpFilesize
188KB
-
memory/2520-120-0x0000000000A70000-0x0000000000AC7000-memory.dmpFilesize
348KB
-
memory/3016-83-0x0000000005810000-0x0000000005876000-memory.dmpFilesize
408KB
-
memory/3016-119-0x0000000007D70000-0x0000000007D8A000-memory.dmpFilesize
104KB
-
memory/3016-110-0x00000000078E0000-0x00000000078FE000-memory.dmpFilesize
120KB
-
memory/3016-111-0x0000000007900000-0x00000000079A3000-memory.dmpFilesize
652KB
-
memory/3016-112-0x0000000008080000-0x00000000086FA000-memory.dmpFilesize
6.5MB
-
memory/3016-113-0x0000000007A30000-0x0000000007A4A000-memory.dmpFilesize
104KB
-
memory/3016-114-0x0000000007AA0000-0x0000000007AAA000-memory.dmpFilesize
40KB
-
memory/3016-115-0x0000000007CB0000-0x0000000007D46000-memory.dmpFilesize
600KB
-
memory/3016-116-0x0000000007C30000-0x0000000007C41000-memory.dmpFilesize
68KB
-
memory/3016-117-0x0000000007C60000-0x0000000007C6E000-memory.dmpFilesize
56KB
-
memory/3016-118-0x0000000007C70000-0x0000000007C84000-memory.dmpFilesize
80KB
-
memory/3016-100-0x0000000070520000-0x000000007056C000-memory.dmpFilesize
304KB
-
memory/3016-99-0x00000000078A0000-0x00000000078D2000-memory.dmpFilesize
200KB
-
memory/3016-121-0x0000000007D50000-0x0000000007D58000-memory.dmpFilesize
32KB
-
memory/3016-95-0x0000000006730000-0x000000000677C000-memory.dmpFilesize
304KB
-
memory/3016-94-0x00000000066E0000-0x00000000066FE000-memory.dmpFilesize
120KB
-
memory/3016-93-0x0000000006270000-0x00000000065C4000-memory.dmpFilesize
3.3MB
-
memory/3016-78-0x0000000002E10000-0x0000000002E46000-memory.dmpFilesize
216KB
-
memory/3016-81-0x0000000005650000-0x0000000005672000-memory.dmpFilesize
136KB
-
memory/3016-82-0x00000000056F0000-0x0000000005756000-memory.dmpFilesize
408KB
-
memory/3016-80-0x0000000005890000-0x0000000005EB8000-memory.dmpFilesize
6.2MB
-
memory/3520-128-0x0000000008A90000-0x0000000008BC0000-memory.dmpFilesize
1.2MB
-
memory/4256-74-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB