Analysis
-
max time kernel
148s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 02:12
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20231129-en
General
-
Target
tmp.exe
-
Size
604KB
-
MD5
97c714162ef1642b13216a22f6d76b7c
-
SHA1
c5b4bf4078229531546d1a447711ef1d1ead83f3
-
SHA256
1a4cd34adc6abfab45060e502911d580b52e689375a81835b2753fb038a21fe1
-
SHA512
9ec065ee13f57045b8011663fbeaa59af8e9f348efdefc1856c2c5d94bb63e3cfb55f30459a9d5a0872af376b4e7615dff3280b9a57f55b98019e6b41d226943
-
SSDEEP
12288:1lYifT9r8TyKftQb8SrAYL7jWNdxDgEzb8lwAhaopQhn7bKTOuzwJ86p:QiGfCfA0aDg/ljL07m5zc86p
Malware Config
Extracted
formbook
4.1
pz12
paucanyes.com
autonwheels.com
cowboysandcaviarbar.com
fitnessengineeredworkouts.com
nuevobajonfavorito.com
dflx8.com
rothability.com
sxybet88.com
onesource.live
brenjitu1904.com
airdrop-zero1labs.com
guangdongqiangzhetc.com
apartments-for-rent-72254.bond
ombak99.lol
qqfoodsolutions.com
kyyzz.com
thepicklematch.com
ainth.com
missorris.com
gabbygomez.com
aromacuppa.com
kaskusbagus.com
zoox1.asia
hemophilia-treatment-41433.bond
meidupro.com
shrisona.com
sekanse.com
marcocostasax.com
loyalbahis356.com
mzmz97.com
ma-google.com
xiangadvanced.site
tuotalogis.com
xcxocef.shop
fidgetbottles.com
shuaninvolved.site
ambientelatino.com
98980901.com
singhbrothersframes.com
pureamyl.com
hgs0713.net
surejobzapp.com
slotgame99.bet
datalakeflow.com
ebehemin.com
vanessasmobilespa.com
317wb.com
motchillssss.top
huesch.net
salesgymshark.shop
mejorcompra99.com
tacubashop.com
jessicaxsimmons.com
roar-stores.com
chalkandthimble.com
84556.vip
luyutuwen.com
siliconcollege.icu
marvowhite.com
gjxuh82y0u3h6.top
e2taop5.top
businessbroadway.com
cripmz.xyz
4hu259.com
jnhdh8827.com
Signatures
-
Formbook payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/5072-10-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/5072-20-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1480-67-0x0000000000E70000-0x0000000000E9F000-memory.dmp formbook -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
tmp.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation tmp.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
tmp.exetmp.exewscript.exedescription pid process target process PID 228 set thread context of 5072 228 tmp.exe tmp.exe PID 5072 set thread context of 3540 5072 tmp.exe Explorer.EXE PID 1480 set thread context of 3540 1480 wscript.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 58 IoCs
Processes:
tmp.exepowershell.exewscript.exepid process 5072 tmp.exe 5072 tmp.exe 5072 tmp.exe 5072 tmp.exe 2788 powershell.exe 2788 powershell.exe 1480 wscript.exe 1480 wscript.exe 1480 wscript.exe 1480 wscript.exe 1480 wscript.exe 1480 wscript.exe 1480 wscript.exe 1480 wscript.exe 1480 wscript.exe 1480 wscript.exe 1480 wscript.exe 1480 wscript.exe 1480 wscript.exe 1480 wscript.exe 1480 wscript.exe 1480 wscript.exe 1480 wscript.exe 1480 wscript.exe 1480 wscript.exe 1480 wscript.exe 1480 wscript.exe 1480 wscript.exe 1480 wscript.exe 1480 wscript.exe 1480 wscript.exe 1480 wscript.exe 1480 wscript.exe 1480 wscript.exe 1480 wscript.exe 1480 wscript.exe 1480 wscript.exe 1480 wscript.exe 1480 wscript.exe 1480 wscript.exe 1480 wscript.exe 1480 wscript.exe 1480 wscript.exe 1480 wscript.exe 1480 wscript.exe 1480 wscript.exe 1480 wscript.exe 1480 wscript.exe 1480 wscript.exe 1480 wscript.exe 1480 wscript.exe 1480 wscript.exe 1480 wscript.exe 1480 wscript.exe 1480 wscript.exe 1480 wscript.exe 1480 wscript.exe 1480 wscript.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
tmp.exewscript.exepid process 5072 tmp.exe 5072 tmp.exe 5072 tmp.exe 1480 wscript.exe 1480 wscript.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
tmp.exepowershell.exewscript.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 5072 tmp.exe Token: SeDebugPrivilege 2788 powershell.exe Token: SeDebugPrivilege 1480 wscript.exe Token: SeShutdownPrivilege 3540 Explorer.EXE Token: SeCreatePagefilePrivilege 3540 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3540 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
tmp.exeExplorer.EXEwscript.exedescription pid process target process PID 228 wrote to memory of 2788 228 tmp.exe powershell.exe PID 228 wrote to memory of 2788 228 tmp.exe powershell.exe PID 228 wrote to memory of 2788 228 tmp.exe powershell.exe PID 228 wrote to memory of 5072 228 tmp.exe tmp.exe PID 228 wrote to memory of 5072 228 tmp.exe tmp.exe PID 228 wrote to memory of 5072 228 tmp.exe tmp.exe PID 228 wrote to memory of 5072 228 tmp.exe tmp.exe PID 228 wrote to memory of 5072 228 tmp.exe tmp.exe PID 228 wrote to memory of 5072 228 tmp.exe tmp.exe PID 3540 wrote to memory of 1480 3540 Explorer.EXE wscript.exe PID 3540 wrote to memory of 1480 3540 Explorer.EXE wscript.exe PID 3540 wrote to memory of 1480 3540 Explorer.EXE wscript.exe PID 1480 wrote to memory of 3492 1480 wscript.exe cmd.exe PID 1480 wrote to memory of 3492 1480 wscript.exe cmd.exe PID 1480 wrote to memory of 3492 1480 wscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\tmp.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\tmp.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_juugqst1.dut.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/228-6-0x00000000059C0000-0x0000000005A5C000-memory.dmpFilesize
624KB
-
memory/228-8-0x00000000059A0000-0x00000000059B0000-memory.dmpFilesize
64KB
-
memory/228-3-0x0000000005730000-0x00000000057C2000-memory.dmpFilesize
584KB
-
memory/228-4-0x00000000056D0000-0x00000000056DA000-memory.dmpFilesize
40KB
-
memory/228-5-0x00000000747A0000-0x0000000074F50000-memory.dmpFilesize
7.7MB
-
memory/228-1-0x0000000000C40000-0x0000000000CDC000-memory.dmpFilesize
624KB
-
memory/228-7-0x0000000005980000-0x000000000599A000-memory.dmpFilesize
104KB
-
memory/228-2-0x0000000005CE0000-0x0000000006284000-memory.dmpFilesize
5.6MB
-
memory/228-9-0x0000000006C50000-0x0000000006CC6000-memory.dmpFilesize
472KB
-
memory/228-0-0x00000000747AE000-0x00000000747AF000-memory.dmpFilesize
4KB
-
memory/228-12-0x00000000747A0000-0x0000000074F50000-memory.dmpFilesize
7.7MB
-
memory/1480-57-0x0000000000EB0000-0x0000000000ED7000-memory.dmpFilesize
156KB
-
memory/1480-56-0x0000000000EB0000-0x0000000000ED7000-memory.dmpFilesize
156KB
-
memory/1480-67-0x0000000000E70000-0x0000000000E9F000-memory.dmpFilesize
188KB
-
memory/2788-55-0x00000000077F0000-0x00000000077FA000-memory.dmpFilesize
40KB
-
memory/2788-59-0x0000000007980000-0x0000000007991000-memory.dmpFilesize
68KB
-
memory/2788-66-0x0000000074820000-0x0000000074FD0000-memory.dmpFilesize
7.7MB
-
memory/2788-17-0x0000000074820000-0x0000000074FD0000-memory.dmpFilesize
7.7MB
-
memory/2788-16-0x0000000004EB0000-0x0000000004EE6000-memory.dmpFilesize
216KB
-
memory/2788-22-0x0000000005520000-0x0000000005B48000-memory.dmpFilesize
6.2MB
-
memory/2788-23-0x0000000005490000-0x00000000054B2000-memory.dmpFilesize
136KB
-
memory/2788-25-0x0000000005E30000-0x0000000005E96000-memory.dmpFilesize
408KB
-
memory/2788-24-0x0000000005DC0000-0x0000000005E26000-memory.dmpFilesize
408KB
-
memory/2788-63-0x0000000007AA0000-0x0000000007AA8000-memory.dmpFilesize
32KB
-
memory/2788-33-0x0000000005EA0000-0x00000000061F4000-memory.dmpFilesize
3.3MB
-
memory/2788-36-0x0000000006460000-0x000000000647E000-memory.dmpFilesize
120KB
-
memory/2788-37-0x00000000064F0000-0x000000000653C000-memory.dmpFilesize
304KB
-
memory/2788-38-0x000000007FAD0000-0x000000007FAE0000-memory.dmpFilesize
64KB
-
memory/2788-39-0x0000000006A20000-0x0000000006A52000-memory.dmpFilesize
200KB
-
memory/2788-40-0x0000000070640000-0x000000007068C000-memory.dmpFilesize
304KB
-
memory/2788-50-0x0000000006A00000-0x0000000006A1E000-memory.dmpFilesize
120KB
-
memory/2788-51-0x0000000002B10000-0x0000000002B20000-memory.dmpFilesize
64KB
-
memory/2788-52-0x0000000007640000-0x00000000076E3000-memory.dmpFilesize
652KB
-
memory/2788-53-0x0000000007DD0000-0x000000000844A000-memory.dmpFilesize
6.5MB
-
memory/2788-54-0x0000000007780000-0x000000000779A000-memory.dmpFilesize
104KB
-
memory/2788-62-0x0000000007AC0000-0x0000000007ADA000-memory.dmpFilesize
104KB
-
memory/2788-15-0x000000007482E000-0x000000007482F000-memory.dmpFilesize
4KB
-
memory/2788-58-0x0000000007A00000-0x0000000007A96000-memory.dmpFilesize
600KB
-
memory/2788-61-0x00000000079C0000-0x00000000079D4000-memory.dmpFilesize
80KB
-
memory/2788-21-0x0000000002B10000-0x0000000002B20000-memory.dmpFilesize
64KB
-
memory/2788-60-0x00000000079B0000-0x00000000079BE000-memory.dmpFilesize
56KB
-
memory/3540-19-0x0000000006F90000-0x00000000070C4000-memory.dmpFilesize
1.2MB
-
memory/3540-69-0x0000000006F90000-0x00000000070C4000-memory.dmpFilesize
1.2MB
-
memory/3540-72-0x00000000085F0000-0x0000000008713000-memory.dmpFilesize
1.1MB
-
memory/5072-13-0x00000000012D0000-0x000000000161A000-memory.dmpFilesize
3.3MB
-
memory/5072-20-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/5072-18-0x0000000001200000-0x0000000001214000-memory.dmpFilesize
80KB
-
memory/5072-10-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB