Analysis
- max time kernel
149s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
04/07/2024, 02:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d577dfa0273275bc6013e1c893a3da5e8744dd7a7dd52a7b072032b86e93c1b8.exe
Resource
win7-20240611-en
windows7-x64
14 signatures
150 seconds
General
- Target d577dfa0273275bc6013e1c893a3da5e8744dd7a7dd52a7b072032b86e93c1b8.exe
- Size 1.5MB
- Sample240704-cf5dqa1ajc
- SHA256 d577dfa0273275bc6013e1c893a3da5e8744dd7a7dd52a7b072032b86e93c1b8
- MD5 caf053b7452bb345a2e751ecf92fe668
- SHA1 b50eab859ed3e6462cbca4e386353b65d19e5932
- SHA512 d9ab02ae288a5db1bc41f4ae67a0564b909b34b98b8bd492ce334c57df0e1704af35348d980629813dd17e6a10c09fefcafb29c23c07bb694d0453d4aec9035e
- SSDEEP 24576:qisp/COjcSNvhPgdqC6AdpHtcGoWNLBMK61vxuxHdH8hgC/aJ1MmVkkkkkkWxkj:qDC4Pgp6AvHtRDvV08x9HOaTVkkkkkk
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
formbook
Version
-
4.1
Campaign
-
ca63
Decoy
-
themaxrichth.online
-
lhzshb.com
-
isacarrceramics.online
-
duhochanquoc.website
-
apexmedia.pro
-
33311.pro
-
x2mjbu8gg.shop
-
dashcreative.online
-
nifle.shop
-
hora.lol
-
rclrwa.asia
-
aviation-training-sqj.top
-
a9659a62.vip
-
uspgh.work
-
hhol5.top
-
jinkaida-cn.cn
-
watchwedding.com
-
728ym.lat
-
gillieron.swiss
-
bingsne.online
-
professionaljournalism.com
-
senior-living-15150.bond
-
chatsio.com
-
dr-jordan.site
-
sador.xyz
-
nagaways.online
-
552357.pro
-
domainupdate.site
-
3v5u21668.shop
-
dh76044.vip
-
cineflickapp.online
-
ht31a.vip
-
workingcat.online
-
9h6db.shop
-
evallc.net
-
sun20win.digital
-
683ym.lat
-
retrosystem.fun
-
bgkamil.xyz
-
androidmobiledk.today
-
gsptx.online
-
onlineit.sbs
-
violetnuit.shop
-
kyusgwh2.top
-
vdqgj.asia
-
helpmepeas.net
-
4399game.asia
-
tent-homes-10133.bond
-
moki.dev
-
raildriver.net
-
lkjuy.xyz
-
presentdadsmatter.shop
-
amp-kopi77i2.xyz
-
cyber-security-onli.bond
-
rtpcmbet27.xyz
-
80lrlaenant8.life
-
urostatingr.shop
-
xn--fiq73f39fx0y2hq.work
-
zc041.xyz
-
34-health.shop
-
yunhaicm.asia
-
domain-2.buzz
-
money1lifecoachingservice.net
-
5301ulovp.website
-
siasstudios.com
Signatures
- Formbook payload 3 IoCs
resource yara_rule behavioral2/memory/3680-17-0x0000000002640000-0x0000000003640000-memory.dmp formbook behavioral2/memory/3680-20-0x0000000002640000-0x0000000003640000-memory.dmp formbook behavioral2/memory/3128-22-0x0000000000F00000-0x0000000000F2F000-memory.dmp formbook - Executes dropped EXE 1 IoCs
pid Process 4996 jdavnpzT.pif - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tzpnvadj = "C:\\Users\\Public\\Tzpnvadj.url" d577dfa0273275bc6013e1c893a3da5e8744dd7a7dd52a7b072032b86e93c1b8.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 964 set thread context of 4996 964 d577dfa0273275bc6013e1c893a3da5e8744dd7a7dd52a7b072032b86e93c1b8.exe 86 PID 3680 set thread context of 3440 3680 SndVol.exe 56 PID 3128 set thread context of 3440 3128 cscript.exe 56 - Program crash 1 IoCs
pid pid_target Process procid_target 2324 4996 WerFault.exe 86 - Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 21 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) - Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 964 d577dfa0273275bc6013e1c893a3da5e8744dd7a7dd52a7b072032b86e93c1b8.exe 964 d577dfa0273275bc6013e1c893a3da5e8744dd7a7dd52a7b072032b86e93c1b8.exe 3680 SndVol.exe 3680 SndVol.exe 3680 SndVol.exe 3680 SndVol.exe 3128 cscript.exe 3128 cscript.exe 3128 cscript.exe 3128 cscript.exe 3128 cscript.exe 3128 cscript.exe 3128 cscript.exe 3128 cscript.exe 3128 cscript.exe 3128 cscript.exe 3128 cscript.exe 3128 cscript.exe 3128 cscript.exe 3128 cscript.exe 3128 cscript.exe 3128 cscript.exe 3128 cscript.exe 3128 cscript.exe 3128 cscript.exe 3128 cscript.exe 3128 cscript.exe 3128 cscript.exe 3128 cscript.exe 3128 cscript.exe 3128 cscript.exe 3128 cscript.exe 3128 cscript.exe 3128 cscript.exe 3128 cscript.exe 3128 cscript.exe 3128 cscript.exe 3128 cscript.exe 3128 cscript.exe 3128 cscript.exe 3128 cscript.exe 3128 cscript.exe 3128 cscript.exe 3128 cscript.exe 3128 cscript.exe 3128 cscript.exe 3128 cscript.exe 3128 cscript.exe 3128 cscript.exe 3128 cscript.exe 3128 cscript.exe 3128 cscript.exe 3128 cscript.exe 3128 cscript.exe 3128 cscript.exe 3128 cscript.exe 3128 cscript.exe 3128 cscript.exe - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 3680 SndVol.exe 3680 SndVol.exe 3680 SndVol.exe 3128 cscript.exe 3128 cscript.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 3680 SndVol.exe Token: SeShutdownPrivilege 3440 Explorer.EXE Token: SeCreatePagefilePrivilege 3440 Explorer.EXE Token: SeShutdownPrivilege 3440 Explorer.EXE Token: SeCreatePagefilePrivilege 3440 Explorer.EXE Token: SeShutdownPrivilege 3440 Explorer.EXE Token: SeCreatePagefilePrivilege 3440 Explorer.EXE Token: SeShutdownPrivilege 3440 Explorer.EXE Token: SeCreatePagefilePrivilege 3440 Explorer.EXE Token: SeShutdownPrivilege 3440 Explorer.EXE Token: SeCreatePagefilePrivilege 3440 Explorer.EXE Token: SeDebugPrivilege 3128 cscript.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3680 SndVol.exe - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 3680 SndVol.exe 3680 SndVol.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 964 wrote to memory of 4996 964 d577dfa0273275bc6013e1c893a3da5e8744dd7a7dd52a7b072032b86e93c1b8.exe 86 PID 964 wrote to memory of 4996 964 d577dfa0273275bc6013e1c893a3da5e8744dd7a7dd52a7b072032b86e93c1b8.exe 86 PID 964 wrote to memory of 4996 964 d577dfa0273275bc6013e1c893a3da5e8744dd7a7dd52a7b072032b86e93c1b8.exe 86 PID 964 wrote to memory of 4996 964 d577dfa0273275bc6013e1c893a3da5e8744dd7a7dd52a7b072032b86e93c1b8.exe 86 PID 964 wrote to memory of 4996 964 d577dfa0273275bc6013e1c893a3da5e8744dd7a7dd52a7b072032b86e93c1b8.exe 86 PID 964 wrote to memory of 3904 964 d577dfa0273275bc6013e1c893a3da5e8744dd7a7dd52a7b072032b86e93c1b8.exe 92 PID 964 wrote to memory of 3904 964 d577dfa0273275bc6013e1c893a3da5e8744dd7a7dd52a7b072032b86e93c1b8.exe 92 PID 964 wrote to memory of 3904 964 d577dfa0273275bc6013e1c893a3da5e8744dd7a7dd52a7b072032b86e93c1b8.exe 92 PID 964 wrote to memory of 3680 964 d577dfa0273275bc6013e1c893a3da5e8744dd7a7dd52a7b072032b86e93c1b8.exe 93 PID 964 wrote to memory of 3680 964 d577dfa0273275bc6013e1c893a3da5e8744dd7a7dd52a7b072032b86e93c1b8.exe 93 PID 964 wrote to memory of 3680 964 d577dfa0273275bc6013e1c893a3da5e8744dd7a7dd52a7b072032b86e93c1b8.exe 93 PID 964 wrote to memory of 3680 964 d577dfa0273275bc6013e1c893a3da5e8744dd7a7dd52a7b072032b86e93c1b8.exe 93 PID 3440 wrote to memory of 3128 3440 Explorer.EXE 94 PID 3440 wrote to memory of 3128 3440 Explorer.EXE 94 PID 3440 wrote to memory of 3128 3440 Explorer.EXE 94 PID 3128 wrote to memory of 4952 3128 cscript.exe 95 PID 3128 wrote to memory of 4952 3128 cscript.exe 95 PID 3128 wrote to memory of 4952 3128 cscript.exe 95
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\d577dfa0273275bc6013e1c893a3da5e8744dd7a7dd52a7b072032b86e93c1b8.exe"C:\Users\Admin\AppData\Local\Temp\d577dfa0273275bc6013e1c893a3da5e8744dd7a7dd52a7b072032b86e93c1b8.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Users\Public\Libraries\jdavnpzT.pifC:\Users\Public\Libraries\jdavnpzT.pif3⤵
- Executes dropped EXE
PID:4996 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4996 -s 2244⤵
- Program crash
PID:2324
-
-
-
C:\Windows\SysWOW64\extrac32.exeC:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\Admin\AppData\Local\Temp\d577dfa0273275bc6013e1c893a3da5e8744dd7a7dd52a7b072032b86e93c1b8.exe C:\\Users\\Public\\Libraries\\Tzpnvadj.PIF3⤵PID:3904
-
-
C:\Windows\SysWOW64\SndVol.exeC:\Windows\System32\SndVol.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3680
-
-
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\SndVol.exe"3⤵PID:4952
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4996 -ip 49961⤵PID:2232
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Public\Libraries\jdavnpzT.pif
- Size 66KB
- SHA256 7bcdc2e607abc65ef93afd009c3048970d9e8d1c2a18fc571562396b13ebb301
- MD5 c116d3604ceafe7057d77ff27552c215
- SHA1 452b14432fb5758b46f2897aeccd89f7c82a727d
- SHA512 9202a00eeaf4c5be94de32fd41bfea40fc32d368955d49b7bad2b5c23c4ebc92dccb37d99f5a14e53ad674b63f1baa6efb1feb27225c86693ead3262a26d66c6
- SSDEEP 1536:lR2rJpByeL+39Ua1ITgA8wpuO5CU4GGMGcT4idU:lR2lg9Ua1egkCU60U
- MD5 SHA1 SHA512 SSDEEP