Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
12-07-2024 23:12
Static task
static1
Behavioral task
behavioral1
Sample
Ticket Receipt and Fine.exe
Resource
win7-20240704-en
General
-
Target
Ticket Receipt and Fine.exe
-
Size
1.0MB
-
MD5
3d0257f3b89012fc88087b77ceecf50f
-
SHA1
59118559fee4ef72669e9bdcdfb59fee3223a04a
-
SHA256
d2944ccc7a3e0b9ca0ff84c52abaa3d05c00f6cfc6ff0e669cc152fbb79fd961
-
SHA512
daee1002806fdc7bdf425159dd28b29f5156a429302567c33d03bd945249d1d147022d5505e9c11cff00ab9908d22fd3ec2090d78b5ada85e8742cdc9203c666
-
SSDEEP
24576:8AHnh+eWsN3skA4RV1Hom2KXMmHaC9NazKZrTUnQWIsrKZ5:bh+ZkldoPK8YaCOzKZrTUndIsro
Malware Config
Extracted
formbook
4.1
pt46
twinportslocal.com
rovor.store
98169.club
mdywl.com
jrd3s.rest
aston1717.top
floridawoodworkingmachinery.com
17tk555t.com
ankitsho.shop
seclameh.com
realrecordlabel.com
trenchonbirmingham.com
af28.top
rtp1kenzototo.com
theselflovesite.com
promotegetpaid.info
strategiclogisticsagency.com
learneracademy.net
per-watch.com
betbox2341.com
22958.xyz
birthdaywishestexts.com
nihilculturamail.com
vasymaman.com
evriukpostaes.sbs
winkingbots.com
cb214.pro
osakanacreation.com
kingchuxing.com
dr-cotton.net
iiixc759q.xyz
eraplay88rtpgacor.lat
wguujb.com
dental-implants-89083.bond
liposuction-89237.bond
harbalmaizik.com
seoservicesdelhi.net
fakefox.xyz
wimetimephotos.com
healthsaveplus.com
wvufcw948o.top
dieselrockpartners.com
istchannelnet.com
123moviesonl.com
arlatwestern.shop
cloudproduction.cloud
gv3l1.vip
casino-x-zerkalo27pm.xyz
serverdayz.com
dvdripguides.com
vitalfitness.site
c21candacedevillier.com
gory12.online
0452frl.com
escpethemtrix.top
koumimi.tech
me29hs38g1.com
dreziuy.xyz
uddyen.shop
asia76s.xyz
melliccine.com
olxelang.com
paincareathome.com
sliveringaf.christmas
wheresthechocolateat.com
Signatures
-
Formbook payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2176-11-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2176-14-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2720-20-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Ticket Receipt and Fine.exesvchost.exesvchost.exedescription pid process target process PID 1968 set thread context of 2176 1968 Ticket Receipt and Fine.exe svchost.exe PID 2176 set thread context of 1200 2176 svchost.exe Explorer.EXE PID 2720 set thread context of 1200 2720 svchost.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 31 IoCs
Processes:
svchost.exesvchost.exepid process 2176 svchost.exe 2176 svchost.exe 2720 svchost.exe 2720 svchost.exe 2720 svchost.exe 2720 svchost.exe 2720 svchost.exe 2720 svchost.exe 2720 svchost.exe 2720 svchost.exe 2720 svchost.exe 2720 svchost.exe 2720 svchost.exe 2720 svchost.exe 2720 svchost.exe 2720 svchost.exe 2720 svchost.exe 2720 svchost.exe 2720 svchost.exe 2720 svchost.exe 2720 svchost.exe 2720 svchost.exe 2720 svchost.exe 2720 svchost.exe 2720 svchost.exe 2720 svchost.exe 2720 svchost.exe 2720 svchost.exe 2720 svchost.exe 2720 svchost.exe 2720 svchost.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
Ticket Receipt and Fine.exesvchost.exesvchost.exepid process 1968 Ticket Receipt and Fine.exe 2176 svchost.exe 2176 svchost.exe 2176 svchost.exe 2720 svchost.exe 2720 svchost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
svchost.exesvchost.exedescription pid process Token: SeDebugPrivilege 2176 svchost.exe Token: SeDebugPrivilege 2720 svchost.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
Ticket Receipt and Fine.exeExplorer.EXEsvchost.exedescription pid process target process PID 1968 wrote to memory of 2176 1968 Ticket Receipt and Fine.exe svchost.exe PID 1968 wrote to memory of 2176 1968 Ticket Receipt and Fine.exe svchost.exe PID 1968 wrote to memory of 2176 1968 Ticket Receipt and Fine.exe svchost.exe PID 1968 wrote to memory of 2176 1968 Ticket Receipt and Fine.exe svchost.exe PID 1968 wrote to memory of 2176 1968 Ticket Receipt and Fine.exe svchost.exe PID 1200 wrote to memory of 2720 1200 Explorer.EXE svchost.exe PID 1200 wrote to memory of 2720 1200 Explorer.EXE svchost.exe PID 1200 wrote to memory of 2720 1200 Explorer.EXE svchost.exe PID 1200 wrote to memory of 2720 1200 Explorer.EXE svchost.exe PID 2720 wrote to memory of 2792 2720 svchost.exe cmd.exe PID 2720 wrote to memory of 2792 2720 svchost.exe cmd.exe PID 2720 wrote to memory of 2792 2720 svchost.exe cmd.exe PID 2720 wrote to memory of 2792 2720 svchost.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\Ticket Receipt and Fine.exe"C:\Users\Admin\AppData\Local\Temp\Ticket Receipt and Fine.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\Ticket Receipt and Fine.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2176 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵PID:2792