Analysis
-
max time kernel
148s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
12-07-2024 18:46
Static task
static1
Behavioral task
behavioral1
Sample
cb94f7e2d32391ffa226f27e39543a099f2867c9cc7602fb964b4358132b6a50.exe
Resource
win7-20240704-en
General
-
Target
cb94f7e2d32391ffa226f27e39543a099f2867c9cc7602fb964b4358132b6a50.exe
-
Size
1.0MB
-
MD5
8bd61d90030d503a329469db383abe88
-
SHA1
97f2606294fea4e18ce600f2d96bdfa8ba1856ae
-
SHA256
cb94f7e2d32391ffa226f27e39543a099f2867c9cc7602fb964b4358132b6a50
-
SHA512
eee0a1f7b422a3bbe7b2a09714cbc5155724e4e67de08dca3d02e695dcdd533c58b3a376e1cdafd91bdef7c3e9db0a884ce968c5fc12e800cbd0674347de8b98
-
SSDEEP
24576:lAHnh+eWsN3skA4RV1Hom2KXMmHaWDRMBST0M45:Uh+ZkldoPK8YaWDRM4T0T
Malware Config
Extracted
formbook
4.1
pt46
twinportslocal.com
rovor.store
98169.club
mdywl.com
jrd3s.rest
aston1717.top
floridawoodworkingmachinery.com
17tk555t.com
ankitsho.shop
seclameh.com
realrecordlabel.com
trenchonbirmingham.com
af28.top
rtp1kenzototo.com
theselflovesite.com
promotegetpaid.info
strategiclogisticsagency.com
learneracademy.net
per-watch.com
betbox2341.com
22958.xyz
birthdaywishestexts.com
nihilculturamail.com
vasymaman.com
evriukpostaes.sbs
winkingbots.com
cb214.pro
osakanacreation.com
kingchuxing.com
dr-cotton.net
iiixc759q.xyz
eraplay88rtpgacor.lat
wguujb.com
dental-implants-89083.bond
liposuction-89237.bond
harbalmaizik.com
seoservicesdelhi.net
fakefox.xyz
wimetimephotos.com
healthsaveplus.com
wvufcw948o.top
dieselrockpartners.com
istchannelnet.com
123moviesonl.com
arlatwestern.shop
cloudproduction.cloud
gv3l1.vip
casino-x-zerkalo27pm.xyz
serverdayz.com
dvdripguides.com
vitalfitness.site
c21candacedevillier.com
gory12.online
0452frl.com
escpethemtrix.top
koumimi.tech
me29hs38g1.com
dreziuy.xyz
uddyen.shop
asia76s.xyz
melliccine.com
olxelang.com
paincareathome.com
sliveringaf.christmas
wheresthechocolateat.com
Signatures
-
Formbook payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1480-11-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1480-14-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3248-20-0x00000000010A0000-0x00000000010CF000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
cb94f7e2d32391ffa226f27e39543a099f2867c9cc7602fb964b4358132b6a50.exesvchost.exemstsc.exedescription pid process target process PID 4268 set thread context of 1480 4268 cb94f7e2d32391ffa226f27e39543a099f2867c9cc7602fb964b4358132b6a50.exe svchost.exe PID 1480 set thread context of 3468 1480 svchost.exe Explorer.EXE PID 3248 set thread context of 3468 3248 mstsc.exe Explorer.EXE -
Modifies registry class 1 IoCs
Processes:
Explorer.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 62 IoCs
Processes:
svchost.exemstsc.exepid process 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 3248 mstsc.exe 3248 mstsc.exe 3248 mstsc.exe 3248 mstsc.exe 3248 mstsc.exe 3248 mstsc.exe 3248 mstsc.exe 3248 mstsc.exe 3248 mstsc.exe 3248 mstsc.exe 3248 mstsc.exe 3248 mstsc.exe 3248 mstsc.exe 3248 mstsc.exe 3248 mstsc.exe 3248 mstsc.exe 3248 mstsc.exe 3248 mstsc.exe 3248 mstsc.exe 3248 mstsc.exe 3248 mstsc.exe 3248 mstsc.exe 3248 mstsc.exe 3248 mstsc.exe 3248 mstsc.exe 3248 mstsc.exe 3248 mstsc.exe 3248 mstsc.exe 3248 mstsc.exe 3248 mstsc.exe 3248 mstsc.exe 3248 mstsc.exe 3248 mstsc.exe 3248 mstsc.exe 3248 mstsc.exe 3248 mstsc.exe 3248 mstsc.exe 3248 mstsc.exe 3248 mstsc.exe 3248 mstsc.exe 3248 mstsc.exe 3248 mstsc.exe 3248 mstsc.exe 3248 mstsc.exe 3248 mstsc.exe 3248 mstsc.exe 3248 mstsc.exe 3248 mstsc.exe 3248 mstsc.exe 3248 mstsc.exe 3248 mstsc.exe 3248 mstsc.exe 3248 mstsc.exe 3248 mstsc.exe 3248 mstsc.exe 3248 mstsc.exe 3248 mstsc.exe 3248 mstsc.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
cb94f7e2d32391ffa226f27e39543a099f2867c9cc7602fb964b4358132b6a50.exesvchost.exemstsc.exepid process 4268 cb94f7e2d32391ffa226f27e39543a099f2867c9cc7602fb964b4358132b6a50.exe 1480 svchost.exe 1480 svchost.exe 1480 svchost.exe 3248 mstsc.exe 3248 mstsc.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
svchost.exemstsc.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1480 svchost.exe Token: SeDebugPrivilege 3248 mstsc.exe Token: SeShutdownPrivilege 3468 Explorer.EXE Token: SeCreatePagefilePrivilege 3468 Explorer.EXE Token: SeShutdownPrivilege 3468 Explorer.EXE Token: SeCreatePagefilePrivilege 3468 Explorer.EXE Token: SeShutdownPrivilege 3468 Explorer.EXE Token: SeCreatePagefilePrivilege 3468 Explorer.EXE Token: SeShutdownPrivilege 3468 Explorer.EXE Token: SeCreatePagefilePrivilege 3468 Explorer.EXE -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
cb94f7e2d32391ffa226f27e39543a099f2867c9cc7602fb964b4358132b6a50.exeExplorer.EXEpid process 4268 cb94f7e2d32391ffa226f27e39543a099f2867c9cc7602fb964b4358132b6a50.exe 4268 cb94f7e2d32391ffa226f27e39543a099f2867c9cc7602fb964b4358132b6a50.exe 3468 Explorer.EXE 3468 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
cb94f7e2d32391ffa226f27e39543a099f2867c9cc7602fb964b4358132b6a50.exepid process 4268 cb94f7e2d32391ffa226f27e39543a099f2867c9cc7602fb964b4358132b6a50.exe 4268 cb94f7e2d32391ffa226f27e39543a099f2867c9cc7602fb964b4358132b6a50.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3468 Explorer.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
cb94f7e2d32391ffa226f27e39543a099f2867c9cc7602fb964b4358132b6a50.exeExplorer.EXEmstsc.exedescription pid process target process PID 4268 wrote to memory of 1480 4268 cb94f7e2d32391ffa226f27e39543a099f2867c9cc7602fb964b4358132b6a50.exe svchost.exe PID 4268 wrote to memory of 1480 4268 cb94f7e2d32391ffa226f27e39543a099f2867c9cc7602fb964b4358132b6a50.exe svchost.exe PID 4268 wrote to memory of 1480 4268 cb94f7e2d32391ffa226f27e39543a099f2867c9cc7602fb964b4358132b6a50.exe svchost.exe PID 4268 wrote to memory of 1480 4268 cb94f7e2d32391ffa226f27e39543a099f2867c9cc7602fb964b4358132b6a50.exe svchost.exe PID 3468 wrote to memory of 3248 3468 Explorer.EXE mstsc.exe PID 3468 wrote to memory of 3248 3468 Explorer.EXE mstsc.exe PID 3468 wrote to memory of 3248 3468 Explorer.EXE mstsc.exe PID 3248 wrote to memory of 4220 3248 mstsc.exe cmd.exe PID 3248 wrote to memory of 4220 3248 mstsc.exe cmd.exe PID 3248 wrote to memory of 4220 3248 mstsc.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\cb94f7e2d32391ffa226f27e39543a099f2867c9cc7602fb964b4358132b6a50.exe"C:\Users\Admin\AppData\Local\Temp\cb94f7e2d32391ffa226f27e39543a099f2867c9cc7602fb964b4358132b6a50.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\cb94f7e2d32391ffa226f27e39543a099f2867c9cc7602fb964b4358132b6a50.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1480 -
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵PID:4220