Analysis
-
max time kernel
103s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
18-07-2024 00:31
Static task
static1
Behavioral task
behavioral1
Sample
39311b433f6276e149337d9a2dc1ab00N.exe
Resource
win7-20240708-en
General
-
Target
39311b433f6276e149337d9a2dc1ab00N.exe
-
Size
628KB
-
MD5
39311b433f6276e149337d9a2dc1ab00
-
SHA1
fae8205b2a25d3d3b904352d30b9f986a2e5d653
-
SHA256
a6c0617a5675430db1e325776159f156c4fba0a6592f87bd4145a614a2163b73
-
SHA512
ddc3672e209d65221ccdc6ac1a58c4a8d8aea29b617061dd8813f5502547e6de06cdf6dd07e48aa28e3333147bd439dcb33633c97944f3b634f0650209e524cc
-
SSDEEP
12288:D+Wx2PQfLfEpCv8IFaCvSi07zUQSx2kKpv3YJix+JMmJkm:TwMrYQaCvSHn1tv3Y48Nd
Malware Config
Extracted
formbook
4.1
pz12
paucanyes.com
autonwheels.com
cowboysandcaviarbar.com
fitnessengineeredworkouts.com
nuevobajonfavorito.com
dflx8.com
rothability.com
sxybet88.com
onesource.live
brenjitu1904.com
airdrop-zero1labs.com
guangdongqiangzhetc.com
apartments-for-rent-72254.bond
ombak99.lol
qqfoodsolutions.com
kyyzz.com
thepicklematch.com
ainth.com
missorris.com
gabbygomez.com
aromacuppa.com
kaskusbagus.com
zoox1.asia
hemophilia-treatment-41433.bond
meidupro.com
shrisona.com
sekanse.com
marcocostasax.com
loyalbahis356.com
mzmz97.com
ma-google.com
xiangadvanced.site
tuotalogis.com
xcxocef.shop
fidgetbottles.com
shuaninvolved.site
ambientelatino.com
98980901.com
singhbrothersframes.com
pureamyl.com
hgs0713.net
surejobzapp.com
slotgame99.bet
datalakeflow.com
ebehemin.com
vanessasmobilespa.com
317wb.com
motchillssss.top
huesch.net
salesgymshark.shop
mejorcompra99.com
tacubashop.com
jessicaxsimmons.com
roar-stores.com
chalkandthimble.com
84556.vip
luyutuwen.com
siliconcollege.icu
marvowhite.com
gjxuh82y0u3h6.top
e2taop5.top
businessbroadway.com
cripmz.xyz
4hu259.com
jnhdh8827.com
Signatures
-
Formbook payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4708-10-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
39311b433f6276e149337d9a2dc1ab00N.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation 39311b433f6276e149337d9a2dc1ab00N.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
39311b433f6276e149337d9a2dc1ab00N.exedescription pid process target process PID 3560 set thread context of 4708 3560 39311b433f6276e149337d9a2dc1ab00N.exe 39311b433f6276e149337d9a2dc1ab00N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
39311b433f6276e149337d9a2dc1ab00N.exepowershell.exepid process 4708 39311b433f6276e149337d9a2dc1ab00N.exe 4708 39311b433f6276e149337d9a2dc1ab00N.exe 1284 powershell.exe 1284 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1284 powershell.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
39311b433f6276e149337d9a2dc1ab00N.exepid process 3560 39311b433f6276e149337d9a2dc1ab00N.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
39311b433f6276e149337d9a2dc1ab00N.exepid process 3560 39311b433f6276e149337d9a2dc1ab00N.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
39311b433f6276e149337d9a2dc1ab00N.exedescription pid process target process PID 3560 wrote to memory of 1284 3560 39311b433f6276e149337d9a2dc1ab00N.exe powershell.exe PID 3560 wrote to memory of 1284 3560 39311b433f6276e149337d9a2dc1ab00N.exe powershell.exe PID 3560 wrote to memory of 1284 3560 39311b433f6276e149337d9a2dc1ab00N.exe powershell.exe PID 3560 wrote to memory of 4708 3560 39311b433f6276e149337d9a2dc1ab00N.exe 39311b433f6276e149337d9a2dc1ab00N.exe PID 3560 wrote to memory of 4708 3560 39311b433f6276e149337d9a2dc1ab00N.exe 39311b433f6276e149337d9a2dc1ab00N.exe PID 3560 wrote to memory of 4708 3560 39311b433f6276e149337d9a2dc1ab00N.exe 39311b433f6276e149337d9a2dc1ab00N.exe PID 3560 wrote to memory of 4708 3560 39311b433f6276e149337d9a2dc1ab00N.exe 39311b433f6276e149337d9a2dc1ab00N.exe PID 3560 wrote to memory of 4708 3560 39311b433f6276e149337d9a2dc1ab00N.exe 39311b433f6276e149337d9a2dc1ab00N.exe PID 3560 wrote to memory of 4708 3560 39311b433f6276e149337d9a2dc1ab00N.exe 39311b433f6276e149337d9a2dc1ab00N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\39311b433f6276e149337d9a2dc1ab00N.exe"C:\Users\Admin\AppData\Local\Temp\39311b433f6276e149337d9a2dc1ab00N.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\39311b433f6276e149337d9a2dc1ab00N.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\39311b433f6276e149337d9a2dc1ab00N.exe"C:\Users\Admin\AppData\Local\Temp\39311b433f6276e149337d9a2dc1ab00N.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4708
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82