Analysis

  • max time kernel
    147s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    18-07-2024 13:18

General

  • Target

    Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe

  • Size

    829KB

  • MD5

    59188cacdad5d6c8e3a0dae4b4a6680d

  • SHA1

    82dc5ba9a229e30d96b1eedd05c404a5b4d49288

  • SHA256

    4a3155f670006fb3500ca917e16b710f06f2a5f0d1345fb5824f732ec9d34c37

  • SHA512

    0e0e43544ec5f21f941b041bcef31bd4372f525c05f8c4c1d91a695b85baecf06c4f62c59be1bce2e374dc7dc672df91678f59cb36c4ffcb6839874a1acc7ad2

  • SSDEEP

    24576:fXRv6ZaOmXiJx7E6rSyT6Oiq/sIwieBjsq9Nn:PJ1OGiXoOnTHIVieBjj9Nn

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

pz12

Decoy

paucanyes.com

autonwheels.com

cowboysandcaviarbar.com

fitnessengineeredworkouts.com

nuevobajonfavorito.com

dflx8.com

rothability.com

sxybet88.com

onesource.live

brenjitu1904.com

airdrop-zero1labs.com

guangdongqiangzhetc.com

apartments-for-rent-72254.bond

ombak99.lol

qqfoodsolutions.com

kyyzz.com

thepicklematch.com

ainth.com

missorris.com

gabbygomez.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 3 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Deletes itself 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 31 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1196
    • C:\Users\Admin\AppData\Local\Temp\Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe
      "C:\Users\Admin\AppData\Local\Temp\Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2932
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1480
      • C:\Users\Admin\AppData\Local\Temp\Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe
        "C:\Users\Admin\AppData\Local\Temp\Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe"
        3⤵
          PID:1420
        • C:\Users\Admin\AppData\Local\Temp\Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe
          "C:\Users\Admin\AppData\Local\Temp\Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe"
          3⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:2348
      • C:\Windows\SysWOW64\msdt.exe
        "C:\Windows\SysWOW64\msdt.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2904
        • C:\Windows\SysWOW64\cmd.exe
          /c del "C:\Users\Admin\AppData\Local\Temp\Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe"
          3⤵
          • Deletes itself
          PID:2632

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2348-6-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/2348-14-0x0000000000AA0000-0x0000000000DA3000-memory.dmp

      Filesize

      3.0MB

    • memory/2348-18-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/2348-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2348-12-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/2348-8-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/2904-19-0x00000000005D0000-0x00000000006C4000-memory.dmp

      Filesize

      976KB

    • memory/2904-20-0x00000000000D0000-0x00000000000FF000-memory.dmp

      Filesize

      188KB

    • memory/2932-1-0x00000000002C0000-0x0000000000396000-memory.dmp

      Filesize

      856KB

    • memory/2932-5-0x0000000004EC0000-0x0000000004F36000-memory.dmp

      Filesize

      472KB

    • memory/2932-4-0x00000000003A0000-0x00000000003AE000-memory.dmp

      Filesize

      56KB

    • memory/2932-0-0x0000000074CEE000-0x0000000074CEF000-memory.dmp

      Filesize

      4KB

    • memory/2932-3-0x00000000003F0000-0x000000000040A000-memory.dmp

      Filesize

      104KB

    • memory/2932-13-0x0000000074CE0000-0x00000000753CE000-memory.dmp

      Filesize

      6.9MB

    • memory/2932-2-0x0000000074CE0000-0x00000000753CE000-memory.dmp

      Filesize

      6.9MB