Analysis
-
max time kernel
149s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
18-07-2024 05:47
Static task
static1
Behavioral task
behavioral1
Sample
H37012.exe
Resource
win7-20240708-en
General
-
Target
H37012.exe
-
Size
677KB
-
MD5
6c63cd4270013e1d03abde4d6acf18fe
-
SHA1
70a81b1b6d7b773d48e6293d23cb7858d69d4a7b
-
SHA256
94f29a8158717b4c268b41e8eb72bc7301f2d4578dc41a06deabe79ff8e767dd
-
SHA512
e05335e284dc5941fe678f24307ea08d5a5a12ce769cc1be1541cc544f3eac99970f6757e0dd93b687569f165e4bb022965be87fc3041095d718abd9f904d0d8
-
SSDEEP
12288:BJbDWx2PQf9YGtFgiscZBpOf9DtMu461PxlWGsxthsQYG:BFawMZ/g0p0su163HyQYG
Malware Config
Extracted
formbook
4.1
h209
sbtstuff.site
omlyes.com
movershifting.com
gearballer.com
oketoto.pro
myringleader.com
lrcjc750s.xyz
ata2024.xyz
password-manager-89409.bond
aiassistanthub.net
changvolt.cfd
netino.site
wear-wale.com
omnipresenceagency.com
huangguan.ooo
propersonnelmedia.com
9332952.com
k3s.support
ciytrw.xyz
cb095.pro
royalreshortbooking.xyz
studio29photography.com
62472.xyz
offerseshop.com
xn--mjru74buk5boca.store
jzzkjvaz.com
qzbt7s.com
atsinvest.com
goldengoosemultiplier.com
investing-courses-66663.bond
blueflamenews.com
xn--72cb0bab2pc6b3j3b.com
damtv24.xyz
ya1w.top
margueritemeilleure.com
zinittech.com
testingdomain.xyz
zakenlatyn.xyz
jungdofire.com
jackpfenninger.com
comfyquiltsbysusan.com
weststarconstructions.com
accrevcenglobal.com
ok9km1.fun
cxbqchm.life
review-with-hossain.com
webmedianews.com
visioncaretutor.com
r9x4g.xyz
nicorinehart.com
airhead.icu
genesisproj.online
hebatduta77.com
xiaopangonsol.com
cilynder.com
nestnerd.xyz
95476.photos
wearepartisan.rocks
snowshop4.com
podoc.fun
psicologaceciliabarros.com
klassens.info
therocketlobsters.com
world-palace.com
antibirdnetservices.com
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/1988-22-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1988-39-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1988-71-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/796-73-0x0000000000800000-0x000000000082F000-memory.dmp formbook -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
H37012.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\Control Panel\International\Geo\Nation H37012.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
H37012.exeH37012.exenetsh.exedescription pid process target process PID 452 set thread context of 1988 452 H37012.exe H37012.exe PID 1988 set thread context of 3420 1988 H37012.exe Explorer.EXE PID 1988 set thread context of 3420 1988 H37012.exe Explorer.EXE PID 796 set thread context of 3420 796 netsh.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 60 IoCs
Processes:
powershell.exeH37012.exenetsh.exepid process 3456 powershell.exe 1988 H37012.exe 1988 H37012.exe 1988 H37012.exe 1988 H37012.exe 3456 powershell.exe 1988 H37012.exe 1988 H37012.exe 796 netsh.exe 796 netsh.exe 796 netsh.exe 796 netsh.exe 796 netsh.exe 796 netsh.exe 796 netsh.exe 796 netsh.exe 796 netsh.exe 796 netsh.exe 796 netsh.exe 796 netsh.exe 796 netsh.exe 796 netsh.exe 796 netsh.exe 796 netsh.exe 796 netsh.exe 796 netsh.exe 796 netsh.exe 796 netsh.exe 796 netsh.exe 796 netsh.exe 796 netsh.exe 796 netsh.exe 796 netsh.exe 796 netsh.exe 796 netsh.exe 796 netsh.exe 796 netsh.exe 796 netsh.exe 796 netsh.exe 796 netsh.exe 796 netsh.exe 796 netsh.exe 796 netsh.exe 796 netsh.exe 796 netsh.exe 796 netsh.exe 796 netsh.exe 796 netsh.exe 796 netsh.exe 796 netsh.exe 796 netsh.exe 796 netsh.exe 796 netsh.exe 796 netsh.exe 796 netsh.exe 796 netsh.exe 796 netsh.exe 796 netsh.exe 796 netsh.exe 796 netsh.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
H37012.exenetsh.exepid process 1988 H37012.exe 1988 H37012.exe 1988 H37012.exe 1988 H37012.exe 796 netsh.exe 796 netsh.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
powershell.exeH37012.exeExplorer.EXEnetsh.exedescription pid process Token: SeDebugPrivilege 3456 powershell.exe Token: SeDebugPrivilege 1988 H37012.exe Token: SeShutdownPrivilege 3420 Explorer.EXE Token: SeCreatePagefilePrivilege 3420 Explorer.EXE Token: SeDebugPrivilege 796 netsh.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3420 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
H37012.exeExplorer.EXEnetsh.exedescription pid process target process PID 452 wrote to memory of 3456 452 H37012.exe powershell.exe PID 452 wrote to memory of 3456 452 H37012.exe powershell.exe PID 452 wrote to memory of 3456 452 H37012.exe powershell.exe PID 452 wrote to memory of 3724 452 H37012.exe schtasks.exe PID 452 wrote to memory of 3724 452 H37012.exe schtasks.exe PID 452 wrote to memory of 3724 452 H37012.exe schtasks.exe PID 452 wrote to memory of 1988 452 H37012.exe H37012.exe PID 452 wrote to memory of 1988 452 H37012.exe H37012.exe PID 452 wrote to memory of 1988 452 H37012.exe H37012.exe PID 452 wrote to memory of 1988 452 H37012.exe H37012.exe PID 452 wrote to memory of 1988 452 H37012.exe H37012.exe PID 452 wrote to memory of 1988 452 H37012.exe H37012.exe PID 3420 wrote to memory of 796 3420 Explorer.EXE netsh.exe PID 3420 wrote to memory of 796 3420 Explorer.EXE netsh.exe PID 3420 wrote to memory of 796 3420 Explorer.EXE netsh.exe PID 796 wrote to memory of 4932 796 netsh.exe cmd.exe PID 796 wrote to memory of 4932 796 netsh.exe cmd.exe PID 796 wrote to memory of 4932 796 netsh.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\H37012.exe"C:\Users\Admin\AppData\Local\Temp\H37012.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\emFutmUjEJiXFv.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3456 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\emFutmUjEJiXFv" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDADF.tmp"3⤵
- Scheduled Task/Job: Scheduled Task
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\H37012.exe"C:\Users\Admin\AppData\Local\Temp\H37012.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1988 -
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\H37012.exe"3⤵PID:4932
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD5c6db3d96a61df4c6f1ba172ba826ad04
SHA13b9a5e655f340155a5f0ccbda870458c00c92d9a
SHA256fe37d26306c23b40a8db77207a2ab2c3e8b986e62521f0990d259a177ae171b5
SHA512661cffe47fb24a75cf64de1e2de6bd87ee0301287fc18e01a5625b72230ee6a9098549d2ac3995536fc5bb137f8d7c32719b8acbbbf6ca007923f3a7b4182d36