Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
18-07-2024 16:09
Static task
static1
Behavioral task
behavioral1
Sample
PO-2024151-pdf.exe
Resource
win7-20240704-en
General
-
Target
PO-2024151-pdf.exe
-
Size
519KB
-
MD5
a7350ccb586d53c4f28bdc8db696b6a9
-
SHA1
c8cd7d3c0aa6233109b92c3976bb8a9a680b7397
-
SHA256
a94ee8ea98674e1714740123c2564eeac148992b5a1596972ace096bc8d9aa4a
-
SHA512
b29d7c9a0a24bfd2ecbe21efe7a8594fdb5a757e666b43deae0d68130eb10143c55e6fe9306a55a44e7aa24c03b914a87e651aa65bdda309c358931cdf5fbe44
-
SSDEEP
6144:OCent7w+F+HhCsLQcS7xI4KhwoGrC+skf8vKutKpfCLJHT6c:OCS9w+F+HgfHKhwoG2EEvK9ELJHT6c
Malware Config
Extracted
formbook
4.1
mu94
thenextamendment.net
automatiza.xyz
psikologhazelgungor.com
90857.net
robertoblondetrealtor.site
rv0awy.rest
74657.ooo
adigidea.com
world-healing.online
health4world.com
shyan.fun
anviltotable.com
vinger.online
juizltd.com
twmk.asia
cakescrushbyruby.com
listxtreme.com
00050026.xyz
finessedesignhouse.com
jsmm-27.xyz
privet128.band
wyhl668.top
crystalcornerdesignn.com
kameltoe2024.xyz
mwquas.xyz
bt365860.com
c2r2h.xyz
bregylzj.xyz
dxlhu.asia
mythandbody.com
7y-sorte.net
gameogem.com
yourhug.xyz
reviewfreak.net
langitwin.lol
jkku2.rest
het789.com
cn00417984.shop
ry5ls1e02ai.top
cathedrals.shop
kaaatooni.com
ctventure.net
50732650.com
699519f.xyz
sailors.solutions
couples-therapy-39471.bond
eco-liga.com
youngtv.net
31hum.com
cocaincoutre.com
kzliw.xyz
online-business-70709.bond
cleliasfamilychildcare.com
commonhype.dev
tufabricadefiestas.com
playstayaussie.com
best-precious.com
kbk99.fun
cprcertificationcoach.com
mysleepfriend.shop
bt365437.com
rajasusu.pics
youtuberjumpstart.com
bfgj46578456454.vip
dmvdrivingpermit.com
Signatures
-
Formbook payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4352-14-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/5096-21-0x00000000012A0000-0x00000000012CF000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
PO-2024151-pdf.exeMSBuild.exechkdsk.exedescription pid process target process PID 3600 set thread context of 4352 3600 PO-2024151-pdf.exe MSBuild.exe PID 4352 set thread context of 3420 4352 MSBuild.exe Explorer.EXE PID 5096 set thread context of 3420 5096 chkdsk.exe Explorer.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 62 IoCs
Processes:
MSBuild.exechkdsk.exepid process 4352 MSBuild.exe 4352 MSBuild.exe 4352 MSBuild.exe 4352 MSBuild.exe 5096 chkdsk.exe 5096 chkdsk.exe 5096 chkdsk.exe 5096 chkdsk.exe 5096 chkdsk.exe 5096 chkdsk.exe 5096 chkdsk.exe 5096 chkdsk.exe 5096 chkdsk.exe 5096 chkdsk.exe 5096 chkdsk.exe 5096 chkdsk.exe 5096 chkdsk.exe 5096 chkdsk.exe 5096 chkdsk.exe 5096 chkdsk.exe 5096 chkdsk.exe 5096 chkdsk.exe 5096 chkdsk.exe 5096 chkdsk.exe 5096 chkdsk.exe 5096 chkdsk.exe 5096 chkdsk.exe 5096 chkdsk.exe 5096 chkdsk.exe 5096 chkdsk.exe 5096 chkdsk.exe 5096 chkdsk.exe 5096 chkdsk.exe 5096 chkdsk.exe 5096 chkdsk.exe 5096 chkdsk.exe 5096 chkdsk.exe 5096 chkdsk.exe 5096 chkdsk.exe 5096 chkdsk.exe 5096 chkdsk.exe 5096 chkdsk.exe 5096 chkdsk.exe 5096 chkdsk.exe 5096 chkdsk.exe 5096 chkdsk.exe 5096 chkdsk.exe 5096 chkdsk.exe 5096 chkdsk.exe 5096 chkdsk.exe 5096 chkdsk.exe 5096 chkdsk.exe 5096 chkdsk.exe 5096 chkdsk.exe 5096 chkdsk.exe 5096 chkdsk.exe 5096 chkdsk.exe 5096 chkdsk.exe 5096 chkdsk.exe 5096 chkdsk.exe 5096 chkdsk.exe 5096 chkdsk.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
MSBuild.exechkdsk.exepid process 4352 MSBuild.exe 4352 MSBuild.exe 4352 MSBuild.exe 5096 chkdsk.exe 5096 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
MSBuild.exeExplorer.EXEchkdsk.exedescription pid process Token: SeDebugPrivilege 4352 MSBuild.exe Token: SeShutdownPrivilege 3420 Explorer.EXE Token: SeCreatePagefilePrivilege 3420 Explorer.EXE Token: SeDebugPrivilege 5096 chkdsk.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3420 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
PO-2024151-pdf.exeExplorer.EXEchkdsk.exedescription pid process target process PID 3600 wrote to memory of 4352 3600 PO-2024151-pdf.exe MSBuild.exe PID 3600 wrote to memory of 4352 3600 PO-2024151-pdf.exe MSBuild.exe PID 3600 wrote to memory of 4352 3600 PO-2024151-pdf.exe MSBuild.exe PID 3600 wrote to memory of 4352 3600 PO-2024151-pdf.exe MSBuild.exe PID 3600 wrote to memory of 4352 3600 PO-2024151-pdf.exe MSBuild.exe PID 3600 wrote to memory of 4352 3600 PO-2024151-pdf.exe MSBuild.exe PID 3420 wrote to memory of 5096 3420 Explorer.EXE chkdsk.exe PID 3420 wrote to memory of 5096 3420 Explorer.EXE chkdsk.exe PID 3420 wrote to memory of 5096 3420 Explorer.EXE chkdsk.exe PID 5096 wrote to memory of 2748 5096 chkdsk.exe cmd.exe PID 5096 wrote to memory of 2748 5096 chkdsk.exe cmd.exe PID 5096 wrote to memory of 2748 5096 chkdsk.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\PO-2024151-pdf.exe"C:\Users\Admin\AppData\Local\Temp\PO-2024151-pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4352 -
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵PID:2748