Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
06/06/2024, 01:27
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
6305683c82227f88452f652423871426259657f45fc89ad8802b3e92b49e0380.exe
Resource
win7-20240220-en
windows7-x64
9 signatures
150 seconds
General
- Target 6305683c82227f88452f652423871426259657f45fc89ad8802b3e92b49e0380.exe
- Size 1.0MB
- Sample240606-bve7psef69
- SHA256 6305683c82227f88452f652423871426259657f45fc89ad8802b3e92b49e0380
- MD5 8170ed5deb6ad823fc7ae0b4d3c0cb4d
- SHA1 b851fda5941039c70879c1c5aaafe7ee98f1d4f6
- SHA512 e42b0be31d5bec09621dfe297c93416122dceaa7feccd270b89a0e6f595c0aad869a296732d2f549976df45528781430586e1b564f165b97ae129ec0a4e88feb
- SSDEEP 24576:2AHnh+eWsN3skA4RV1Hom2KXMmHaeVM8iSU2HMMOuvzON5:Rh+ZkldoPK8YaeVs2s0U
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
formbook
Version
-
4.1
Campaign
-
da29
Decoy
-
kas-travel.com
-
hy1618.net
-
biosrch.com
-
sharvellestudio.com
-
56416.ooo
-
953700958.com
-
500051.com
-
clic.coach
-
veriosg.xyz
-
aptsafety.com
-
cucinaconestilo.com
-
sercettopper.com
-
diycoldplungetub.com
-
hostingopinion.com
-
mediatechnologysolutions.com
-
nodogwifnohat.com
-
ethpiee.com
-
tragaperrasbares.com
-
bbbcf.top
-
jtxu6.top
-
sorgulama95.shop
-
myconc.pro
-
okb-ar.net
-
thanhdoanacademy.com
-
rlyadventures.com
-
maestrolipari.com
-
digitaluxsolution.com
-
zituahmed.com
-
h5yfdgtg.top
-
whalesnorkelingmirissa.online
-
indxriim-firsaxtllari.com
-
fopoliswhlvtjv.top
-
iransarafan.com
-
usedata.monster
-
mnasjdqw66775jqwe09qwjsqwx.vip
-
aphropay.com
-
myfreedomlyfe.com
-
vytennow.com
-
micheleditrana.com
-
babycarrot.fun
-
maltepede.site
-
618dfyy21.com
-
flickzbiz.fun
-
sshihi.top
-
xsports108.com
-
ideiastransformadoras.com
-
aerotyneholdings.com
-
expandyourbusinessdigital.com
-
crown777login.com
-
wheepexpress.com
-
openshiftstore.com
-
xzdkzsaczp.xyz
-
cycmedb.com
-
9sh3j02g8j.com
-
cemeku.sydney
-
functionalfossils.com
-
kenguru.ink
-
classicsty.com
-
directadz.com
-
scuffedwrapz.com
-
oxmoz.art
-
rusticstores.com
-
vietcadao.com
-
ai-infinite.net
-
1wxir.com
Signatures
- Formbook payload 3 IoCs
resource yara_rule behavioral2/memory/616-11-0x00000000006E0000-0x000000000070F000-memory.dmp formbook behavioral2/memory/616-15-0x00000000006E0000-0x000000000070F000-memory.dmp formbook behavioral2/memory/3232-21-0x0000000000310000-0x000000000033F000-memory.dmp formbook - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 5112 set thread context of 616 5112 6305683c82227f88452f652423871426259657f45fc89ad8802b3e92b49e0380.exe 86 PID 616 set thread context of 3480 616 svchost.exe 56 PID 3232 set thread context of 3480 3232 mstsc.exe 56 - Program crash 1 IoCs
pid pid_target Process procid_target 3628 5112 WerFault.exe 82 - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Explorer.EXE - Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 616 svchost.exe 616 svchost.exe 616 svchost.exe 616 svchost.exe 3232 mstsc.exe 3232 mstsc.exe 3232 mstsc.exe 3232 mstsc.exe 3232 mstsc.exe 3232 mstsc.exe 3232 mstsc.exe 3232 mstsc.exe 3232 mstsc.exe 3232 mstsc.exe 3232 mstsc.exe 3232 mstsc.exe 3232 mstsc.exe 3232 mstsc.exe 3232 mstsc.exe 3232 mstsc.exe 3232 mstsc.exe 3232 mstsc.exe 3232 mstsc.exe 3232 mstsc.exe 3232 mstsc.exe 3232 mstsc.exe 3232 mstsc.exe 3232 mstsc.exe 3232 mstsc.exe 3232 mstsc.exe 3232 mstsc.exe 3232 mstsc.exe 3232 mstsc.exe 3232 mstsc.exe 3232 mstsc.exe 3232 mstsc.exe 3232 mstsc.exe 3232 mstsc.exe 3232 mstsc.exe 3232 mstsc.exe 3232 mstsc.exe 3232 mstsc.exe 3232 mstsc.exe 3232 mstsc.exe 3232 mstsc.exe 3232 mstsc.exe 3232 mstsc.exe 3232 mstsc.exe 3232 mstsc.exe 3232 mstsc.exe 3232 mstsc.exe 3232 mstsc.exe 3232 mstsc.exe 3232 mstsc.exe 3232 mstsc.exe 3232 mstsc.exe 3232 mstsc.exe 3232 mstsc.exe 3232 mstsc.exe 3232 mstsc.exe 3232 mstsc.exe 3232 mstsc.exe - Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 5112 6305683c82227f88452f652423871426259657f45fc89ad8802b3e92b49e0380.exe 5112 6305683c82227f88452f652423871426259657f45fc89ad8802b3e92b49e0380.exe 616 svchost.exe 616 svchost.exe 616 svchost.exe 3232 mstsc.exe 3232 mstsc.exe - Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 616 svchost.exe Token: SeShutdownPrivilege 3480 Explorer.EXE Token: SeCreatePagefilePrivilege 3480 Explorer.EXE Token: SeShutdownPrivilege 3480 Explorer.EXE Token: SeCreatePagefilePrivilege 3480 Explorer.EXE Token: SeShutdownPrivilege 3480 Explorer.EXE Token: SeCreatePagefilePrivilege 3480 Explorer.EXE Token: SeShutdownPrivilege 3480 Explorer.EXE Token: SeCreatePagefilePrivilege 3480 Explorer.EXE Token: SeDebugPrivilege 3232 mstsc.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 5112 6305683c82227f88452f652423871426259657f45fc89ad8802b3e92b49e0380.exe 5112 6305683c82227f88452f652423871426259657f45fc89ad8802b3e92b49e0380.exe 3480 Explorer.EXE 3480 Explorer.EXE - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 5112 6305683c82227f88452f652423871426259657f45fc89ad8802b3e92b49e0380.exe 5112 6305683c82227f88452f652423871426259657f45fc89ad8802b3e92b49e0380.exe - Suspicious use of UnmapMainImage 1 IoCs
pid Process 3480 Explorer.EXE - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 5112 wrote to memory of 616 5112 6305683c82227f88452f652423871426259657f45fc89ad8802b3e92b49e0380.exe 86 PID 5112 wrote to memory of 616 5112 6305683c82227f88452f652423871426259657f45fc89ad8802b3e92b49e0380.exe 86 PID 5112 wrote to memory of 616 5112 6305683c82227f88452f652423871426259657f45fc89ad8802b3e92b49e0380.exe 86 PID 5112 wrote to memory of 616 5112 6305683c82227f88452f652423871426259657f45fc89ad8802b3e92b49e0380.exe 86 PID 3480 wrote to memory of 3232 3480 Explorer.EXE 90 PID 3480 wrote to memory of 3232 3480 Explorer.EXE 90 PID 3480 wrote to memory of 3232 3480 Explorer.EXE 90 PID 3232 wrote to memory of 2392 3232 mstsc.exe 92 PID 3232 wrote to memory of 2392 3232 mstsc.exe 92 PID 3232 wrote to memory of 2392 3232 mstsc.exe 92
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\6305683c82227f88452f652423871426259657f45fc89ad8802b3e92b49e0380.exe"C:\Users\Admin\AppData\Local\Temp\6305683c82227f88452f652423871426259657f45fc89ad8802b3e92b49e0380.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\6305683c82227f88452f652423871426259657f45fc89ad8802b3e92b49e0380.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:616
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5112 -s 7003⤵
- Program crash
PID:3628
-
-
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵PID:2392
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5112 -ip 51121⤵PID:3388