Analysis
-
max time kernel
141s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
12-07-2024 18:46
Static task
static1
Behavioral task
behavioral1
Sample
cb94f7e2d32391ffa226f27e39543a099f2867c9cc7602fb964b4358132b6a50.exe
Resource
win7-20240704-en
General
-
Target
cb94f7e2d32391ffa226f27e39543a099f2867c9cc7602fb964b4358132b6a50.exe
-
Size
1.0MB
-
MD5
8bd61d90030d503a329469db383abe88
-
SHA1
97f2606294fea4e18ce600f2d96bdfa8ba1856ae
-
SHA256
cb94f7e2d32391ffa226f27e39543a099f2867c9cc7602fb964b4358132b6a50
-
SHA512
eee0a1f7b422a3bbe7b2a09714cbc5155724e4e67de08dca3d02e695dcdd533c58b3a376e1cdafd91bdef7c3e9db0a884ce968c5fc12e800cbd0674347de8b98
-
SSDEEP
24576:lAHnh+eWsN3skA4RV1Hom2KXMmHaWDRMBST0M45:Uh+ZkldoPK8YaWDRM4T0T
Malware Config
Extracted
formbook
4.1
pt46
twinportslocal.com
rovor.store
98169.club
mdywl.com
jrd3s.rest
aston1717.top
floridawoodworkingmachinery.com
17tk555t.com
ankitsho.shop
seclameh.com
realrecordlabel.com
trenchonbirmingham.com
af28.top
rtp1kenzototo.com
theselflovesite.com
promotegetpaid.info
strategiclogisticsagency.com
learneracademy.net
per-watch.com
betbox2341.com
22958.xyz
birthdaywishestexts.com
nihilculturamail.com
vasymaman.com
evriukpostaes.sbs
winkingbots.com
cb214.pro
osakanacreation.com
kingchuxing.com
dr-cotton.net
iiixc759q.xyz
eraplay88rtpgacor.lat
wguujb.com
dental-implants-89083.bond
liposuction-89237.bond
harbalmaizik.com
seoservicesdelhi.net
fakefox.xyz
wimetimephotos.com
healthsaveplus.com
wvufcw948o.top
dieselrockpartners.com
istchannelnet.com
123moviesonl.com
arlatwestern.shop
cloudproduction.cloud
gv3l1.vip
casino-x-zerkalo27pm.xyz
serverdayz.com
dvdripguides.com
vitalfitness.site
c21candacedevillier.com
gory12.online
0452frl.com
escpethemtrix.top
koumimi.tech
me29hs38g1.com
dreziuy.xyz
uddyen.shop
asia76s.xyz
melliccine.com
olxelang.com
paincareathome.com
sliveringaf.christmas
wheresthechocolateat.com
Signatures
-
Formbook payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2528-11-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2528-16-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Suspicious use of SetThreadContext 2 IoCs
Processes:
cb94f7e2d32391ffa226f27e39543a099f2867c9cc7602fb964b4358132b6a50.exesvchost.exedescription pid process target process PID 836 set thread context of 2528 836 cb94f7e2d32391ffa226f27e39543a099f2867c9cc7602fb964b4358132b6a50.exe svchost.exe PID 2528 set thread context of 1192 2528 svchost.exe Explorer.EXE -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2856 2236 WerFault.exe msiexec.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
svchost.exepid process 2528 svchost.exe 2528 svchost.exe -
Suspicious behavior: MapViewOfSection 4 IoCs
Processes:
cb94f7e2d32391ffa226f27e39543a099f2867c9cc7602fb964b4358132b6a50.exesvchost.exepid process 836 cb94f7e2d32391ffa226f27e39543a099f2867c9cc7602fb964b4358132b6a50.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
svchost.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 2528 svchost.exe Token: SeShutdownPrivilege 1192 Explorer.EXE -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
cb94f7e2d32391ffa226f27e39543a099f2867c9cc7602fb964b4358132b6a50.exeExplorer.EXEpid process 836 cb94f7e2d32391ffa226f27e39543a099f2867c9cc7602fb964b4358132b6a50.exe 836 cb94f7e2d32391ffa226f27e39543a099f2867c9cc7602fb964b4358132b6a50.exe 1192 Explorer.EXE 1192 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
cb94f7e2d32391ffa226f27e39543a099f2867c9cc7602fb964b4358132b6a50.exepid process 836 cb94f7e2d32391ffa226f27e39543a099f2867c9cc7602fb964b4358132b6a50.exe 836 cb94f7e2d32391ffa226f27e39543a099f2867c9cc7602fb964b4358132b6a50.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
cb94f7e2d32391ffa226f27e39543a099f2867c9cc7602fb964b4358132b6a50.exeExplorer.EXEmsiexec.exedescription pid process target process PID 836 wrote to memory of 2528 836 cb94f7e2d32391ffa226f27e39543a099f2867c9cc7602fb964b4358132b6a50.exe svchost.exe PID 836 wrote to memory of 2528 836 cb94f7e2d32391ffa226f27e39543a099f2867c9cc7602fb964b4358132b6a50.exe svchost.exe PID 836 wrote to memory of 2528 836 cb94f7e2d32391ffa226f27e39543a099f2867c9cc7602fb964b4358132b6a50.exe svchost.exe PID 836 wrote to memory of 2528 836 cb94f7e2d32391ffa226f27e39543a099f2867c9cc7602fb964b4358132b6a50.exe svchost.exe PID 836 wrote to memory of 2528 836 cb94f7e2d32391ffa226f27e39543a099f2867c9cc7602fb964b4358132b6a50.exe svchost.exe PID 1192 wrote to memory of 2236 1192 Explorer.EXE msiexec.exe PID 1192 wrote to memory of 2236 1192 Explorer.EXE msiexec.exe PID 1192 wrote to memory of 2236 1192 Explorer.EXE msiexec.exe PID 1192 wrote to memory of 2236 1192 Explorer.EXE msiexec.exe PID 1192 wrote to memory of 2236 1192 Explorer.EXE msiexec.exe PID 1192 wrote to memory of 2236 1192 Explorer.EXE msiexec.exe PID 1192 wrote to memory of 2236 1192 Explorer.EXE msiexec.exe PID 2236 wrote to memory of 2856 2236 msiexec.exe WerFault.exe PID 2236 wrote to memory of 2856 2236 msiexec.exe WerFault.exe PID 2236 wrote to memory of 2856 2236 msiexec.exe WerFault.exe PID 2236 wrote to memory of 2856 2236 msiexec.exe WerFault.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\cb94f7e2d32391ffa226f27e39543a099f2867c9cc7602fb964b4358132b6a50.exe"C:\Users\Admin\AppData\Local\Temp\cb94f7e2d32391ffa226f27e39543a099f2867c9cc7602fb964b4358132b6a50.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\cb94f7e2d32391ffa226f27e39543a099f2867c9cc7602fb964b4358132b6a50.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2528 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 2683⤵
- Program crash
PID:2856