Analysis
-
max time kernel
146s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
12-07-2024 23:12
Static task
static1
Behavioral task
behavioral1
Sample
Ticket Receipt and Fine.exe
Resource
win7-20240704-en
General
-
Target
Ticket Receipt and Fine.exe
-
Size
1.0MB
-
MD5
3d0257f3b89012fc88087b77ceecf50f
-
SHA1
59118559fee4ef72669e9bdcdfb59fee3223a04a
-
SHA256
d2944ccc7a3e0b9ca0ff84c52abaa3d05c00f6cfc6ff0e669cc152fbb79fd961
-
SHA512
daee1002806fdc7bdf425159dd28b29f5156a429302567c33d03bd945249d1d147022d5505e9c11cff00ab9908d22fd3ec2090d78b5ada85e8742cdc9203c666
-
SSDEEP
24576:8AHnh+eWsN3skA4RV1Hom2KXMmHaC9NazKZrTUnQWIsrKZ5:bh+ZkldoPK8YaCOzKZrTUndIsro
Malware Config
Extracted
formbook
4.1
pt46
twinportslocal.com
rovor.store
98169.club
mdywl.com
jrd3s.rest
aston1717.top
floridawoodworkingmachinery.com
17tk555t.com
ankitsho.shop
seclameh.com
realrecordlabel.com
trenchonbirmingham.com
af28.top
rtp1kenzototo.com
theselflovesite.com
promotegetpaid.info
strategiclogisticsagency.com
learneracademy.net
per-watch.com
betbox2341.com
22958.xyz
birthdaywishestexts.com
nihilculturamail.com
vasymaman.com
evriukpostaes.sbs
winkingbots.com
cb214.pro
osakanacreation.com
kingchuxing.com
dr-cotton.net
iiixc759q.xyz
eraplay88rtpgacor.lat
wguujb.com
dental-implants-89083.bond
liposuction-89237.bond
harbalmaizik.com
seoservicesdelhi.net
fakefox.xyz
wimetimephotos.com
healthsaveplus.com
wvufcw948o.top
dieselrockpartners.com
istchannelnet.com
123moviesonl.com
arlatwestern.shop
cloudproduction.cloud
gv3l1.vip
casino-x-zerkalo27pm.xyz
serverdayz.com
dvdripguides.com
vitalfitness.site
c21candacedevillier.com
gory12.online
0452frl.com
escpethemtrix.top
koumimi.tech
me29hs38g1.com
dreziuy.xyz
uddyen.shop
asia76s.xyz
melliccine.com
olxelang.com
paincareathome.com
sliveringaf.christmas
wheresthechocolateat.com
Signatures
-
Formbook payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3012-11-0x00000000003B0000-0x00000000003DF000-memory.dmp formbook behavioral2/memory/3012-15-0x00000000003B0000-0x00000000003DF000-memory.dmp formbook behavioral2/memory/5000-20-0x0000000000A50000-0x0000000000A7F000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Ticket Receipt and Fine.exesvchost.exemsdt.exedescription pid process target process PID 532 set thread context of 3012 532 Ticket Receipt and Fine.exe svchost.exe PID 3012 set thread context of 3564 3012 svchost.exe Explorer.EXE PID 5000 set thread context of 3564 5000 msdt.exe Explorer.EXE -
Modifies registry class 1 IoCs
Processes:
Explorer.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 62 IoCs
Processes:
svchost.exemsdt.exepid process 3012 svchost.exe 3012 svchost.exe 3012 svchost.exe 3012 svchost.exe 5000 msdt.exe 5000 msdt.exe 5000 msdt.exe 5000 msdt.exe 5000 msdt.exe 5000 msdt.exe 5000 msdt.exe 5000 msdt.exe 5000 msdt.exe 5000 msdt.exe 5000 msdt.exe 5000 msdt.exe 5000 msdt.exe 5000 msdt.exe 5000 msdt.exe 5000 msdt.exe 5000 msdt.exe 5000 msdt.exe 5000 msdt.exe 5000 msdt.exe 5000 msdt.exe 5000 msdt.exe 5000 msdt.exe 5000 msdt.exe 5000 msdt.exe 5000 msdt.exe 5000 msdt.exe 5000 msdt.exe 5000 msdt.exe 5000 msdt.exe 5000 msdt.exe 5000 msdt.exe 5000 msdt.exe 5000 msdt.exe 5000 msdt.exe 5000 msdt.exe 5000 msdt.exe 5000 msdt.exe 5000 msdt.exe 5000 msdt.exe 5000 msdt.exe 5000 msdt.exe 5000 msdt.exe 5000 msdt.exe 5000 msdt.exe 5000 msdt.exe 5000 msdt.exe 5000 msdt.exe 5000 msdt.exe 5000 msdt.exe 5000 msdt.exe 5000 msdt.exe 5000 msdt.exe 5000 msdt.exe 5000 msdt.exe 5000 msdt.exe 5000 msdt.exe 5000 msdt.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
Ticket Receipt and Fine.exesvchost.exemsdt.exepid process 532 Ticket Receipt and Fine.exe 532 Ticket Receipt and Fine.exe 3012 svchost.exe 3012 svchost.exe 3012 svchost.exe 5000 msdt.exe 5000 msdt.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
svchost.exemsdt.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 3012 svchost.exe Token: SeDebugPrivilege 5000 msdt.exe Token: SeShutdownPrivilege 3564 Explorer.EXE Token: SeCreatePagefilePrivilege 3564 Explorer.EXE Token: SeShutdownPrivilege 3564 Explorer.EXE Token: SeCreatePagefilePrivilege 3564 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 3564 Explorer.EXE 3564 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3564 Explorer.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
Ticket Receipt and Fine.exeExplorer.EXEmsdt.exedescription pid process target process PID 532 wrote to memory of 3012 532 Ticket Receipt and Fine.exe svchost.exe PID 532 wrote to memory of 3012 532 Ticket Receipt and Fine.exe svchost.exe PID 532 wrote to memory of 3012 532 Ticket Receipt and Fine.exe svchost.exe PID 532 wrote to memory of 3012 532 Ticket Receipt and Fine.exe svchost.exe PID 3564 wrote to memory of 5000 3564 Explorer.EXE msdt.exe PID 3564 wrote to memory of 5000 3564 Explorer.EXE msdt.exe PID 3564 wrote to memory of 5000 3564 Explorer.EXE msdt.exe PID 5000 wrote to memory of 2680 5000 msdt.exe cmd.exe PID 5000 wrote to memory of 2680 5000 msdt.exe cmd.exe PID 5000 wrote to memory of 2680 5000 msdt.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\Ticket Receipt and Fine.exe"C:\Users\Admin\AppData\Local\Temp\Ticket Receipt and Fine.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:532 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\Ticket Receipt and Fine.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3012 -
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵PID:2680