Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
18-07-2024 09:51
Static task
static1
Behavioral task
behavioral1
Sample
PO1511-pdf.exe
Resource
win7-20240704-en
General
-
Target
PO1511-pdf.exe
-
Size
134KB
-
MD5
7f723f9e10de5dd1ce6d4e6bde89abe4
-
SHA1
555e9af7d45b4436709150c474c28908225132f5
-
SHA256
dd36a21b3f11b6142a898ce80d046abf5f8e0b62fa112957db619c865272ce20
-
SHA512
ccce6e52dca4c11a8de88118b92b477c4f12f035557d6fe132d95e663d67721c76999cff688baeb349e494bfc89d49d636d8ff25207ed1c232f3b2f68508bb7e
-
SSDEEP
3072:/kHnTc+neY+r6MVpHQhIB2E+kgaJysLTVm1AYUb:/kHTi3US/
Malware Config
Extracted
formbook
4.1
mu94
thenextamendment.net
automatiza.xyz
psikologhazelgungor.com
90857.net
robertoblondetrealtor.site
rv0awy.rest
74657.ooo
adigidea.com
world-healing.online
health4world.com
shyan.fun
anviltotable.com
vinger.online
juizltd.com
twmk.asia
cakescrushbyruby.com
listxtreme.com
00050026.xyz
finessedesignhouse.com
jsmm-27.xyz
privet128.band
wyhl668.top
crystalcornerdesignn.com
kameltoe2024.xyz
mwquas.xyz
bt365860.com
c2r2h.xyz
bregylzj.xyz
dxlhu.asia
mythandbody.com
7y-sorte.net
gameogem.com
yourhug.xyz
reviewfreak.net
langitwin.lol
jkku2.rest
het789.com
cn00417984.shop
ry5ls1e02ai.top
cathedrals.shop
kaaatooni.com
ctventure.net
50732650.com
699519f.xyz
sailors.solutions
couples-therapy-39471.bond
eco-liga.com
youngtv.net
31hum.com
cocaincoutre.com
kzliw.xyz
online-business-70709.bond
cleliasfamilychildcare.com
commonhype.dev
tufabricadefiestas.com
playstayaussie.com
best-precious.com
kbk99.fun
cprcertificationcoach.com
mysleepfriend.shop
bt365437.com
rajasusu.pics
youtuberjumpstart.com
bfgj46578456454.vip
dmvdrivingpermit.com
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4832-4-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4832-7-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4832-12-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/716-18-0x0000000000D20000-0x0000000000D4F000-memory.dmp formbook -
Suspicious use of SetThreadContext 4 IoCs
Processes:
PO1511-pdf.exeMSBuild.exerundll32.exedescription pid process target process PID 404 set thread context of 4832 404 PO1511-pdf.exe MSBuild.exe PID 4832 set thread context of 3372 4832 MSBuild.exe Explorer.EXE PID 4832 set thread context of 3372 4832 MSBuild.exe Explorer.EXE PID 716 set thread context of 3372 716 rundll32.exe Explorer.EXE -
Modifies registry class 2 IoCs
Processes:
Explorer.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 62 IoCs
Processes:
MSBuild.exerundll32.exepid process 4832 MSBuild.exe 4832 MSBuild.exe 4832 MSBuild.exe 4832 MSBuild.exe 4832 MSBuild.exe 4832 MSBuild.exe 716 rundll32.exe 716 rundll32.exe 716 rundll32.exe 716 rundll32.exe 716 rundll32.exe 716 rundll32.exe 716 rundll32.exe 716 rundll32.exe 716 rundll32.exe 716 rundll32.exe 716 rundll32.exe 716 rundll32.exe 716 rundll32.exe 716 rundll32.exe 716 rundll32.exe 716 rundll32.exe 716 rundll32.exe 716 rundll32.exe 716 rundll32.exe 716 rundll32.exe 716 rundll32.exe 716 rundll32.exe 716 rundll32.exe 716 rundll32.exe 716 rundll32.exe 716 rundll32.exe 716 rundll32.exe 716 rundll32.exe 716 rundll32.exe 716 rundll32.exe 716 rundll32.exe 716 rundll32.exe 716 rundll32.exe 716 rundll32.exe 716 rundll32.exe 716 rundll32.exe 716 rundll32.exe 716 rundll32.exe 716 rundll32.exe 716 rundll32.exe 716 rundll32.exe 716 rundll32.exe 716 rundll32.exe 716 rundll32.exe 716 rundll32.exe 716 rundll32.exe 716 rundll32.exe 716 rundll32.exe 716 rundll32.exe 716 rundll32.exe 716 rundll32.exe 716 rundll32.exe 716 rundll32.exe 716 rundll32.exe 716 rundll32.exe 716 rundll32.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
MSBuild.exerundll32.exepid process 4832 MSBuild.exe 4832 MSBuild.exe 4832 MSBuild.exe 4832 MSBuild.exe 716 rundll32.exe 716 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
Processes:
PO1511-pdf.exeMSBuild.exeExplorer.EXErundll32.exedescription pid process Token: SeDebugPrivilege 404 PO1511-pdf.exe Token: SeDebugPrivilege 4832 MSBuild.exe Token: SeShutdownPrivilege 3372 Explorer.EXE Token: SeCreatePagefilePrivilege 3372 Explorer.EXE Token: SeDebugPrivilege 716 rundll32.exe Token: SeShutdownPrivilege 3372 Explorer.EXE Token: SeCreatePagefilePrivilege 3372 Explorer.EXE Token: SeShutdownPrivilege 3372 Explorer.EXE Token: SeCreatePagefilePrivilege 3372 Explorer.EXE Token: SeShutdownPrivilege 3372 Explorer.EXE Token: SeCreatePagefilePrivilege 3372 Explorer.EXE Token: SeShutdownPrivilege 3372 Explorer.EXE Token: SeCreatePagefilePrivilege 3372 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3372 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
PO1511-pdf.exeExplorer.EXErundll32.exedescription pid process target process PID 404 wrote to memory of 4832 404 PO1511-pdf.exe MSBuild.exe PID 404 wrote to memory of 4832 404 PO1511-pdf.exe MSBuild.exe PID 404 wrote to memory of 4832 404 PO1511-pdf.exe MSBuild.exe PID 404 wrote to memory of 4832 404 PO1511-pdf.exe MSBuild.exe PID 404 wrote to memory of 4832 404 PO1511-pdf.exe MSBuild.exe PID 404 wrote to memory of 4832 404 PO1511-pdf.exe MSBuild.exe PID 3372 wrote to memory of 716 3372 Explorer.EXE rundll32.exe PID 3372 wrote to memory of 716 3372 Explorer.EXE rundll32.exe PID 3372 wrote to memory of 716 3372 Explorer.EXE rundll32.exe PID 716 wrote to memory of 4124 716 rundll32.exe cmd.exe PID 716 wrote to memory of 4124 716 rundll32.exe cmd.exe PID 716 wrote to memory of 4124 716 rundll32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\PO1511-pdf.exe"C:\Users\Admin\AppData\Local\Temp\PO1511-pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" NoLabel3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4832 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:716 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵PID:4124