Analysis
-
max time kernel
146s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
26-07-2024 18:03
Static task
static1
Behavioral task
behavioral1
Sample
Ticari Siparis Belgesi 26 07 2024 17545000600.exe
Resource
win7-20240708-en
General
-
Target
Ticari Siparis Belgesi 26 07 2024 17545000600.exe
-
Size
559KB
-
MD5
4a699c45efa52f13210361413ebd9358
-
SHA1
4243cc3717a371b2fdf4a7eb0387ea3b19a62764
-
SHA256
078b3704bde85e8ad84e4c21ca910f5d5367843bbecc2a384acc3fd89cd3553c
-
SHA512
376fa8883301ecf050277c9e4eeeb902f1cab14902bbedd0366918e5c4f010b1e83a00c641f00cb27d2fbd0e61c9dc278b59b553264682cc572dd36a3a246ed9
-
SSDEEP
12288:CLHaT8l/bECvA5LWZv31r3KXDtlv0eKpXcyoEFvR9FOv4Qx11:2aTC/bECvA5LWZv31r3gDtlcexENR9Fo
Malware Config
Extracted
formbook
4.1
pz12
paucanyes.com
autonwheels.com
cowboysandcaviarbar.com
fitnessengineeredworkouts.com
nuevobajonfavorito.com
dflx8.com
rothability.com
sxybet88.com
onesource.live
brenjitu1904.com
airdrop-zero1labs.com
guangdongqiangzhetc.com
apartments-for-rent-72254.bond
ombak99.lol
qqfoodsolutions.com
kyyzz.com
thepicklematch.com
ainth.com
missorris.com
gabbygomez.com
aromacuppa.com
kaskusbagus.com
zoox1.asia
hemophilia-treatment-41433.bond
meidupro.com
shrisona.com
sekanse.com
marcocostasax.com
loyalbahis356.com
mzmz97.com
ma-google.com
xiangadvanced.site
tuotalogis.com
xcxocef.shop
fidgetbottles.com
shuaninvolved.site
ambientelatino.com
98980901.com
singhbrothersframes.com
pureamyl.com
hgs0713.net
surejobzapp.com
slotgame99.bet
datalakeflow.com
ebehemin.com
vanessasmobilespa.com
317wb.com
motchillssss.top
huesch.net
salesgymshark.shop
mejorcompra99.com
tacubashop.com
jessicaxsimmons.com
roar-stores.com
chalkandthimble.com
84556.vip
luyutuwen.com
siliconcollege.icu
marvowhite.com
gjxuh82y0u3h6.top
e2taop5.top
businessbroadway.com
cripmz.xyz
4hu259.com
jnhdh8827.com
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/3020-11-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/3020-18-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/3020-24-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2768-26-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2556 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Ticari Siparis Belgesi 26 07 2024 17545000600.exeTicari Siparis Belgesi 26 07 2024 17545000600.execontrol.exedescription pid process target process PID 2628 set thread context of 3020 2628 Ticari Siparis Belgesi 26 07 2024 17545000600.exe Ticari Siparis Belgesi 26 07 2024 17545000600.exe PID 3020 set thread context of 1220 3020 Ticari Siparis Belgesi 26 07 2024 17545000600.exe Explorer.EXE PID 3020 set thread context of 1220 3020 Ticari Siparis Belgesi 26 07 2024 17545000600.exe Explorer.EXE PID 2768 set thread context of 1220 2768 control.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Ticari Siparis Belgesi 26 07 2024 17545000600.exepowershell.exeTicari Siparis Belgesi 26 07 2024 17545000600.execontrol.execmd.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ticari Siparis Belgesi 26 07 2024 17545000600.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ticari Siparis Belgesi 26 07 2024 17545000600.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language control.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
Processes:
Ticari Siparis Belgesi 26 07 2024 17545000600.exepowershell.execontrol.exepid process 3020 Ticari Siparis Belgesi 26 07 2024 17545000600.exe 3020 Ticari Siparis Belgesi 26 07 2024 17545000600.exe 1500 powershell.exe 3020 Ticari Siparis Belgesi 26 07 2024 17545000600.exe 2768 control.exe 2768 control.exe 2768 control.exe 2768 control.exe 2768 control.exe 2768 control.exe 2768 control.exe 2768 control.exe 2768 control.exe 2768 control.exe 2768 control.exe 2768 control.exe 2768 control.exe 2768 control.exe 2768 control.exe 2768 control.exe 2768 control.exe 2768 control.exe 2768 control.exe 2768 control.exe 2768 control.exe 2768 control.exe 2768 control.exe 2768 control.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
Ticari Siparis Belgesi 26 07 2024 17545000600.execontrol.exepid process 3020 Ticari Siparis Belgesi 26 07 2024 17545000600.exe 3020 Ticari Siparis Belgesi 26 07 2024 17545000600.exe 3020 Ticari Siparis Belgesi 26 07 2024 17545000600.exe 3020 Ticari Siparis Belgesi 26 07 2024 17545000600.exe 2768 control.exe 2768 control.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Ticari Siparis Belgesi 26 07 2024 17545000600.exepowershell.execontrol.exedescription pid process Token: SeDebugPrivilege 3020 Ticari Siparis Belgesi 26 07 2024 17545000600.exe Token: SeDebugPrivilege 1500 powershell.exe Token: SeDebugPrivilege 2768 control.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
Ticari Siparis Belgesi 26 07 2024 17545000600.exeTicari Siparis Belgesi 26 07 2024 17545000600.execontrol.exedescription pid process target process PID 2628 wrote to memory of 1500 2628 Ticari Siparis Belgesi 26 07 2024 17545000600.exe powershell.exe PID 2628 wrote to memory of 1500 2628 Ticari Siparis Belgesi 26 07 2024 17545000600.exe powershell.exe PID 2628 wrote to memory of 1500 2628 Ticari Siparis Belgesi 26 07 2024 17545000600.exe powershell.exe PID 2628 wrote to memory of 1500 2628 Ticari Siparis Belgesi 26 07 2024 17545000600.exe powershell.exe PID 2628 wrote to memory of 3020 2628 Ticari Siparis Belgesi 26 07 2024 17545000600.exe Ticari Siparis Belgesi 26 07 2024 17545000600.exe PID 2628 wrote to memory of 3020 2628 Ticari Siparis Belgesi 26 07 2024 17545000600.exe Ticari Siparis Belgesi 26 07 2024 17545000600.exe PID 2628 wrote to memory of 3020 2628 Ticari Siparis Belgesi 26 07 2024 17545000600.exe Ticari Siparis Belgesi 26 07 2024 17545000600.exe PID 2628 wrote to memory of 3020 2628 Ticari Siparis Belgesi 26 07 2024 17545000600.exe Ticari Siparis Belgesi 26 07 2024 17545000600.exe PID 2628 wrote to memory of 3020 2628 Ticari Siparis Belgesi 26 07 2024 17545000600.exe Ticari Siparis Belgesi 26 07 2024 17545000600.exe PID 2628 wrote to memory of 3020 2628 Ticari Siparis Belgesi 26 07 2024 17545000600.exe Ticari Siparis Belgesi 26 07 2024 17545000600.exe PID 2628 wrote to memory of 3020 2628 Ticari Siparis Belgesi 26 07 2024 17545000600.exe Ticari Siparis Belgesi 26 07 2024 17545000600.exe PID 3020 wrote to memory of 2768 3020 Ticari Siparis Belgesi 26 07 2024 17545000600.exe control.exe PID 3020 wrote to memory of 2768 3020 Ticari Siparis Belgesi 26 07 2024 17545000600.exe control.exe PID 3020 wrote to memory of 2768 3020 Ticari Siparis Belgesi 26 07 2024 17545000600.exe control.exe PID 3020 wrote to memory of 2768 3020 Ticari Siparis Belgesi 26 07 2024 17545000600.exe control.exe PID 2768 wrote to memory of 2556 2768 control.exe cmd.exe PID 2768 wrote to memory of 2556 2768 control.exe cmd.exe PID 2768 wrote to memory of 2556 2768 control.exe cmd.exe PID 2768 wrote to memory of 2556 2768 control.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\Ticari Siparis Belgesi 26 07 2024 17545000600.exe"C:\Users\Admin\AppData\Local\Temp\Ticari Siparis Belgesi 26 07 2024 17545000600.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Ticari Siparis Belgesi 26 07 2024 17545000600.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\Ticari Siparis Belgesi 26 07 2024 17545000600.exe"C:\Users\Admin\AppData\Local\Temp\Ticari Siparis Belgesi 26 07 2024 17545000600.exe"3⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"4⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Ticari Siparis Belgesi 26 07 2024 17545000600.exe"5⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2556