Analysis
- max time kernel
146s - max time network
129s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 08:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Receipt.exe
Resource
win7-20240419-en
windows7-x64
9 signatures
150 seconds
General
- Target Receipt.exe
- Size 566KB
- Sample240603-jzncwaaa34
- SHA256 b79cfaa7a2e97cbaab90bca401cd0099210c653bc1fbb38dccab617e4c5299ca
- MD5 b087df97441c10a635821f5125039903
- SHA1 188bdd07174280b2abaec985c2e2013bd05ed719
- SHA512 81ef38afbc8352a530ffb31a365491271aa1c31e64533d4e1069bbbd493853617f9d84fd1b62424cbef77f0e2376bd44f72990a43d9de7d6d0f45d57583e2980
- SSDEEP 12288:TjVnUiQvH1etl72rtwlXbI7XHgZQKhJgeCmR:XUsD72rtwlXsLHgZpJEW
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
formbook
Version
-
2.9
Campaign
-
ch
Decoy
-
online-resources.website
Signatures
- Formbook payload 1 IoCs
resource yara_rule behavioral2/memory/1468-3-0x0000000000400000-0x000000000048F000-memory.dmp formbook - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1468 set thread context of 3500 1468 Receipt.exe 56 PID 1052 set thread context of 3500 1052 wlanext.exe 56 - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Explorer.EXE - Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 1468 Receipt.exe 1468 Receipt.exe 1468 Receipt.exe 1468 Receipt.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe 1052 wlanext.exe - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 1468 Receipt.exe 1468 Receipt.exe 1468 Receipt.exe 1052 wlanext.exe 1052 wlanext.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 1468 Receipt.exe Token: SeShutdownPrivilege 3500 Explorer.EXE Token: SeCreatePagefilePrivilege 3500 Explorer.EXE Token: SeShutdownPrivilege 3500 Explorer.EXE Token: SeCreatePagefilePrivilege 3500 Explorer.EXE Token: SeDebugPrivilege 1052 wlanext.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3500 Explorer.EXE 3500 Explorer.EXE - Suspicious use of UnmapMainImage 1 IoCs
pid Process 3500 Explorer.EXE - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3500 wrote to memory of 1052 3500 Explorer.EXE 84 PID 3500 wrote to memory of 1052 3500 Explorer.EXE 84 PID 3500 wrote to memory of 1052 3500 Explorer.EXE 84 PID 1052 wrote to memory of 1284 1052 wlanext.exe 89 PID 1052 wrote to memory of 1284 1052 wlanext.exe 89 PID 1052 wrote to memory of 1284 1052 wlanext.exe 89
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\Receipt.exe"C:\Users\Admin\AppData\Local\Temp\Receipt.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1468
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:3576
-
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Receipt.exe"3⤵PID:1284
-
-