Overview
overview
10Static
static
3Soboce.zip
windows7-x64
1Soboce.zip
windows10-2004-x64
1e6b82e1c-a...6d.eml
windows7-x64
5e6b82e1c-a...6d.eml
windows10-2004-x64
3Solicitud ...DF.rar
windows7-x64
3Solicitud ...DF.rar
windows10-2004-x64
3Formulario...DF.exe
windows7-x64
10Formulario...DF.exe
windows10-2004-x64
10email-html-2.html
windows7-x64
1email-html-2.html
windows10-2004-x64
1email-plain-1.txt
windows7-x64
1email-plain-1.txt
windows10-2004-x64
1image001.png
windows7-x64
3image001.png
windows10-2004-x64
3Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
18-07-2024 13:18
Static task
static1
Behavioral task
behavioral1
Sample
Soboce.zip
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
Soboce.zip
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
e6b82e1c-ac44-4023-8042-08dca5e19c90/4a7406b5-aea0-3461-afa2-c5f3f9b9a06d.eml
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
e6b82e1c-ac44-4023-8042-08dca5e19c90/4a7406b5-aea0-3461-afa2-c5f3f9b9a06d.eml
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
Solicitud de Pedido SP N° 17850_16 07 2024 Soboce S.A_PDF.rar
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
Solicitud de Pedido SP N° 17850_16 07 2024 Soboce S.A_PDF.rar
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
email-html-2.html
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
email-html-2.html
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
email-plain-1.txt
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
email-plain-1.txt
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
image001.png
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
image001.png
Resource
win10v2004-20240709-en
General
-
Target
Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe
-
Size
829KB
-
MD5
59188cacdad5d6c8e3a0dae4b4a6680d
-
SHA1
82dc5ba9a229e30d96b1eedd05c404a5b4d49288
-
SHA256
4a3155f670006fb3500ca917e16b710f06f2a5f0d1345fb5824f732ec9d34c37
-
SHA512
0e0e43544ec5f21f941b041bcef31bd4372f525c05f8c4c1d91a695b85baecf06c4f62c59be1bce2e374dc7dc672df91678f59cb36c4ffcb6839874a1acc7ad2
-
SSDEEP
24576:fXRv6ZaOmXiJx7E6rSyT6Oiq/sIwieBjsq9Nn:PJ1OGiXoOnTHIVieBjj9Nn
Malware Config
Extracted
formbook
4.1
pz12
paucanyes.com
autonwheels.com
cowboysandcaviarbar.com
fitnessengineeredworkouts.com
nuevobajonfavorito.com
dflx8.com
rothability.com
sxybet88.com
onesource.live
brenjitu1904.com
airdrop-zero1labs.com
guangdongqiangzhetc.com
apartments-for-rent-72254.bond
ombak99.lol
qqfoodsolutions.com
kyyzz.com
thepicklematch.com
ainth.com
missorris.com
gabbygomez.com
aromacuppa.com
kaskusbagus.com
zoox1.asia
hemophilia-treatment-41433.bond
meidupro.com
shrisona.com
sekanse.com
marcocostasax.com
loyalbahis356.com
mzmz97.com
ma-google.com
xiangadvanced.site
tuotalogis.com
xcxocef.shop
fidgetbottles.com
shuaninvolved.site
ambientelatino.com
98980901.com
singhbrothersframes.com
pureamyl.com
hgs0713.net
surejobzapp.com
slotgame99.bet
datalakeflow.com
ebehemin.com
vanessasmobilespa.com
317wb.com
motchillssss.top
huesch.net
salesgymshark.shop
mejorcompra99.com
tacubashop.com
jessicaxsimmons.com
roar-stores.com
chalkandthimble.com
84556.vip
luyutuwen.com
siliconcollege.icu
marvowhite.com
gjxuh82y0u3h6.top
e2taop5.top
businessbroadway.com
cripmz.xyz
4hu259.com
jnhdh8827.com
Signatures
-
Formbook payload 3 IoCs
Processes:
resource yara_rule behavioral8/memory/1972-10-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral8/memory/1972-19-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral8/memory/1620-71-0x00000000012B0000-0x00000000012DF000-memory.dmp formbook -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exeFormulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exemsiexec.exedescription pid process target process PID 1128 set thread context of 1972 1128 Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe PID 1972 set thread context of 3492 1972 Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe Explorer.EXE PID 1620 set thread context of 3492 1620 msiexec.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
Processes:
Explorer.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 58 IoCs
Processes:
Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exepowershell.exemsiexec.exepid process 1972 Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe 1972 Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe 1972 Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe 1972 Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe 3568 powershell.exe 3568 powershell.exe 1620 msiexec.exe 1620 msiexec.exe 1620 msiexec.exe 1620 msiexec.exe 1620 msiexec.exe 1620 msiexec.exe 1620 msiexec.exe 1620 msiexec.exe 1620 msiexec.exe 1620 msiexec.exe 1620 msiexec.exe 1620 msiexec.exe 1620 msiexec.exe 1620 msiexec.exe 1620 msiexec.exe 1620 msiexec.exe 1620 msiexec.exe 1620 msiexec.exe 1620 msiexec.exe 1620 msiexec.exe 1620 msiexec.exe 1620 msiexec.exe 1620 msiexec.exe 1620 msiexec.exe 1620 msiexec.exe 1620 msiexec.exe 1620 msiexec.exe 1620 msiexec.exe 1620 msiexec.exe 1620 msiexec.exe 1620 msiexec.exe 1620 msiexec.exe 1620 msiexec.exe 1620 msiexec.exe 1620 msiexec.exe 1620 msiexec.exe 1620 msiexec.exe 1620 msiexec.exe 1620 msiexec.exe 1620 msiexec.exe 1620 msiexec.exe 1620 msiexec.exe 1620 msiexec.exe 1620 msiexec.exe 1620 msiexec.exe 1620 msiexec.exe 1620 msiexec.exe 1620 msiexec.exe 1620 msiexec.exe 1620 msiexec.exe 1620 msiexec.exe 1620 msiexec.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exemsiexec.exepid process 1972 Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe 1972 Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe 1972 Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe 1620 msiexec.exe 1620 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
Processes:
Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exepowershell.exemsiexec.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1972 Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe Token: SeDebugPrivilege 3568 powershell.exe Token: SeDebugPrivilege 1620 msiexec.exe Token: SeShutdownPrivilege 3492 Explorer.EXE Token: SeCreatePagefilePrivilege 3492 Explorer.EXE Token: SeShutdownPrivilege 3492 Explorer.EXE Token: SeCreatePagefilePrivilege 3492 Explorer.EXE Token: SeShutdownPrivilege 3492 Explorer.EXE Token: SeCreatePagefilePrivilege 3492 Explorer.EXE Token: SeShutdownPrivilege 3492 Explorer.EXE Token: SeCreatePagefilePrivilege 3492 Explorer.EXE Token: SeShutdownPrivilege 3492 Explorer.EXE Token: SeCreatePagefilePrivilege 3492 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3492 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exeExplorer.EXEmsiexec.exedescription pid process target process PID 1128 wrote to memory of 3568 1128 Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe powershell.exe PID 1128 wrote to memory of 3568 1128 Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe powershell.exe PID 1128 wrote to memory of 3568 1128 Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe powershell.exe PID 1128 wrote to memory of 1972 1128 Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe PID 1128 wrote to memory of 1972 1128 Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe PID 1128 wrote to memory of 1972 1128 Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe PID 1128 wrote to memory of 1972 1128 Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe PID 1128 wrote to memory of 1972 1128 Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe PID 1128 wrote to memory of 1972 1128 Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe PID 3492 wrote to memory of 1620 3492 Explorer.EXE msiexec.exe PID 3492 wrote to memory of 1620 3492 Explorer.EXE msiexec.exe PID 3492 wrote to memory of 1620 3492 Explorer.EXE msiexec.exe PID 1620 wrote to memory of 3504 1620 msiexec.exe cmd.exe PID 1620 wrote to memory of 3504 1620 msiexec.exe cmd.exe PID 1620 wrote to memory of 3504 1620 msiexec.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe"C:\Users\Admin\AppData\Local\Temp\Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe"C:\Users\Admin\AppData\Local\Temp\Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1972 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Formulario de solicitud de pedido Soboce S A No 17850 16 07 2024_PDF.exe"3⤵PID:3504
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82