Overview
overview
10Static
static
101/0178b79b...bd.exe
windows7-x64
101/0280cde4...60.exe
windows7-x64
101/08b76206...65.exe
windows7-x64
101/0e4fc438...91.exe
windows7-x64
31/0fb86a8b...05.exe
windows7-x64
101/25898c73...8f.exe
windows7-x64
101/2c2e9491...3c.exe
windows7-x64
31/2ef0f582...2e.exe
windows7-x64
31/39884fc0...82.exe
windows7-x64
101/3a72ecec...8a.exe
windows7-x64
101/3bfcb4f7...71.exe
windows7-x64
101/4103411f...f5.exe
windows7-x64
101/4e0fdb84...95.exe
windows7-x64
91/5297372f...33.exe
windows7-x64
51/68292f38...e4.exe
windows7-x64
31/6da4696b...e5.exe
windows7-x64
71/7021c9cb...78.exe
windows7-x64
101/752f5cc5...60.exe
windows7-x64
101/7c7cded8...0c.exe
windows7-x64
101/97d29ffc...84.exe
windows7-x64
101/a306cc84...03.exe
windows7-x64
31/ae1a168f...74.exe
windows7-x64
71/b13f2364...d6.exe
windows7-x64
81/b2a1d168...9d.bat
windows7-x64
81/bb29aeb6...bd.exe
windows7-x64
81/c8e5a24a...f5.bat
windows7-x64
81/c9736cdc...97.exe
windows7-x64
81/d58780d1...a0.exe
windows7-x64
101/de19e016...d0.exe
windows7-x64
31/e886016e...51.exe
windows7-x64
31/f0f496ec...f4.bat
windows7-x64
81/f28599b0...23.exe
windows7-x64
10Resubmissions
11-12-2024 15:32
241211-sy44nssrdm 1009-08-2024 21:57
240809-1t1vfs1cpm 1006-08-2024 13:01
240806-p9f97szdlm 1006-08-2024 12:52
240806-p3672stdkg 1006-08-2024 12:29
240806-ppa8fsygqr 1006-08-2024 12:26
240806-pmc92ashlh 10Analysis
-
max time kernel
146s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
06-08-2024 12:26
Behavioral task
behavioral1
Sample
1/0178b79bd084c2597b2de4e62e61a88bb8359e4fcac2fe672bb887e0e52e5dbd.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
1/0280cde4a65664a05361129dc1cfa10bc17b3fa9567103ce6eb9d07b06f8f160.exe
Resource
win7-20240708-en
Behavioral task
behavioral3
Sample
1/08b7620610fc30c54e5cc095a54ae6d2949f68b0f224c285283e1612c254ef65.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
1/0e4fc438decc9723b89bd0e71b9ee30c1a8390e697d790b2d5ce96e94accd791.exe
Resource
win7-20240704-en
Behavioral task
behavioral5
Sample
1/0fb86a8ba8fdf57990c283080a671c1320cbcdfd0e8b5f5a250d9c38a6fce305.exe
Resource
win7-20240729-en
Behavioral task
behavioral6
Sample
1/25898c73a877d87ba289bb4ab9585eb36eba9d27d47af678a86befdbf9aa938f.exe
Resource
win7-20240704-en
Behavioral task
behavioral7
Sample
1/2c2e949171d86da9b5c58901de2e4a99c4fe86fe92c47556f53b833ce77c503c.exe
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
1/2ef0f582367a7674aef245acb06977bf646419f1f8d05c7fb07881a6102f982e.exe
Resource
win7-20240704-en
Behavioral task
behavioral9
Sample
1/39884fc02ed9a51ffcc9b298916be79307f15f1518b6ae2021dd07af0aeecb82.exe
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
1/3a72ecec34a29f53a1d73677a0e6f4c2e19087a32f1808f8f4ff643f62128d8a.exe
Resource
win7-20240704-en
Behavioral task
behavioral11
Sample
1/3bfcb4f798ba63a1d18887cb67c90e083d5561a58136a892bd9944528c707671.exe
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
1/4103411f7bb66a033f9f5ce35839ba08b2a27d169e188a911185790f3b78bbf5.exe
Resource
win7-20240729-en
Behavioral task
behavioral13
Sample
1/4e0fdb84649ad15a0722789512aaef15c7bfbc4cab82b2a7b0ea52ac9594bb95.exe
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
1/5297372fe85eea3ecc0d271b5567f2c7ee75bd3a04e745debddb04c9b05dae33.exe
Resource
win7-20240705-en
Behavioral task
behavioral15
Sample
1/68292f388207f8ec69774dbad429e67420881ce46ecfad55f23182ec3a8893e4.exe
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
1/6da4696b804777582ae586a4e9f42f6c18ccf540222d70dcf3374ee291e674e5.exe
Resource
win7-20240705-en
Behavioral task
behavioral17
Sample
1/7021c9cba6c224272f01d04450c6c31c93857a21feacfa4295a878a4d7b04378.exe
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
1/752f5cc5a7b0f986286d09e8288c0958bc1b798477ca0d09dc2658c7ab109060.exe
Resource
win7-20240708-en
Behavioral task
behavioral19
Sample
1/7c7cded8d1c0784881859ed03340d81c24ea9bf5d9972963cedf0e40b9856a0c.exe
Resource
win7-20240704-en
Behavioral task
behavioral20
Sample
1/97d29ffc3556069c807b5c0ae2e2b109ae329feafc912d64f8b7f437bea47d84.exe
Resource
win7-20240705-en
Behavioral task
behavioral21
Sample
1/a306cc84c907d6d57af300d1181128b24ca03e90c38ca7df7e84d35e80a63e03.exe
Resource
win7-20240704-en
Behavioral task
behavioral22
Sample
1/ae1a168ff481173d18034d14a767c0801458e95cc3016dc8d82212d0c083a474.exe
Resource
win7-20240705-en
Behavioral task
behavioral23
Sample
1/b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6.exe
Resource
win7-20240704-en
Behavioral task
behavioral24
Sample
1/b2a1d168dc4234e687d0969b6a1901ac7e69c0d4bb72a1a4c76ba67fa6a14f9d.bat
Resource
win7-20240729-en
Behavioral task
behavioral25
Sample
1/bb29aeb6ceecc37829b40e36f91a4620d7e0aae16b1ceea70bb70135e11172bd.exe
Resource
win7-20240708-en
Behavioral task
behavioral26
Sample
1/c8e5a24a6d2fa68d7976457a19576b381e6211202500af5280b0f3b256446bf5.bat
Resource
win7-20240729-en
Behavioral task
behavioral27
Sample
1/c9736cdc4ade9fddb9b293e0366f182f972154d98169b58e532b7905c310bf97.exe
Resource
win7-20240708-en
Behavioral task
behavioral28
Sample
1/d58780d1d574bfe77c6f9cfad1cf4b51522231b2699081befd5bbd15f7309aa0.exe
Resource
win7-20240708-en
Behavioral task
behavioral29
Sample
1/de19e0163af15585c305f845b90262aee3c2bdf037f9fc733d3f1b379d00edd0.exe
Resource
win7-20240705-en
Behavioral task
behavioral30
Sample
1/e886016e48bf0e3cd100d627678f345743509fd5f57f3c9b182f2833352bd451.exe
Resource
win7-20240705-en
Behavioral task
behavioral31
Sample
1/f0f496eccc61594c53ded581b6683a77072f607ab018ec0a770a0aa7c7f45ff4.bat
Resource
win7-20240708-en
Behavioral task
behavioral32
Sample
1/f28599b06560617bccdfb56acc841f3e642ff51b9956632fcc4204f026711e23.exe
Resource
win7-20240729-en
General
-
Target
1/d58780d1d574bfe77c6f9cfad1cf4b51522231b2699081befd5bbd15f7309aa0.exe
-
Size
691KB
-
MD5
c2ae4fdb661a151be4876289ed7f8261
-
SHA1
f8fbb8b8ddb55aacc20449ff2bd5d671e4cbb9fa
-
SHA256
d58780d1d574bfe77c6f9cfad1cf4b51522231b2699081befd5bbd15f7309aa0
-
SHA512
2642eac12e6a42fbd503621871802da278e0c68a4678675ddbe71f66d7a2b7d0ed8a22640c13d153ea63bcb33f7f13ae32eaa3e444fc451c64a1839d8cc91c89
-
SSDEEP
12288:luCDWx2PQfnESfZ0nl+xD4u1JW31MlxwXY5oMY3tQMmVHMe3+L4Ull0l8fkR:/awMnESR0nl+Z9OSXwXuoaVse3+sCie6
Malware Config
Extracted
formbook
4.1
45er
depotpulsa.com
k2bilbao.online
bb4uoficial.com
rwc666.club
us-pservice.cyou
tricegottreats.com
zsystems.pro
qudouyin6.com
sfumaturedamore.net
pcetyy.icu
notbokin.online
beqprod.tech
flipbuilding.com
errormitigationzoo.com
zj5u603.xyz
jezzatravel.com
zmdniavysyi.shop
quinnsteele.com
522334.com
outdoorshopping.net
7140k.vip
appmonster.live
rvrentalsusane.com
berry-hut.com
h-m-32.com
aklnk.xyz
project.fail
thelbacollection.com
ternkm.com
331022.xyz
qhr86.com
casvivip.com
f661dsa-dsf564a.biz
holisticfox.com
taobaoo03.com
kursy-parikmaher.store
reignscents.com
wot4x4.com
axoloterosa.com
instzn.site
nn477.xyz
jwsalestx.com
cualuoinuhoang.com
sagehrsuiteindercloud.solutions
2ecxab.vip
lottery99nft.xyz
budakbetingbet43.click
plaay.live
drmediapulsehub.com
bahismax.com
clareleeuwinclark.com
clarimix.com
ssongg11913.cfd
shapoorji-kingstown.com
detoxifysupplements.info
easy100ksidegig.com
abramovatata.online
barillonfo.net
keendeed.com
yunosave.online
pptv05.xyz
malianbeini.net
polariscicuit.com
sahibindencomparamguvend.link
used-cars-99583.bond
Signatures
-
Formbook payload 3 IoCs
resource yara_rule behavioral28/memory/2592-18-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral28/memory/2592-22-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral28/memory/908-24-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2784 powershell.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 2704 set thread context of 2592 2704 d58780d1d574bfe77c6f9cfad1cf4b51522231b2699081befd5bbd15f7309aa0.exe 34 PID 2592 set thread context of 1208 2592 RegSvcs.exe 21 PID 2592 set thread context of 1208 2592 RegSvcs.exe 21 PID 908 set thread context of 1208 908 wlanext.exe 21 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d58780d1d574bfe77c6f9cfad1cf4b51522231b2699081befd5bbd15f7309aa0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wlanext.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2696 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 32 IoCs
pid Process 2704 d58780d1d574bfe77c6f9cfad1cf4b51522231b2699081befd5bbd15f7309aa0.exe 2704 d58780d1d574bfe77c6f9cfad1cf4b51522231b2699081befd5bbd15f7309aa0.exe 2704 d58780d1d574bfe77c6f9cfad1cf4b51522231b2699081befd5bbd15f7309aa0.exe 2704 d58780d1d574bfe77c6f9cfad1cf4b51522231b2699081befd5bbd15f7309aa0.exe 2592 RegSvcs.exe 2592 RegSvcs.exe 2784 powershell.exe 2592 RegSvcs.exe 908 wlanext.exe 908 wlanext.exe 908 wlanext.exe 908 wlanext.exe 908 wlanext.exe 908 wlanext.exe 908 wlanext.exe 908 wlanext.exe 908 wlanext.exe 908 wlanext.exe 908 wlanext.exe 908 wlanext.exe 908 wlanext.exe 908 wlanext.exe 908 wlanext.exe 908 wlanext.exe 908 wlanext.exe 908 wlanext.exe 908 wlanext.exe 908 wlanext.exe 908 wlanext.exe 908 wlanext.exe 908 wlanext.exe 908 wlanext.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 2592 RegSvcs.exe 2592 RegSvcs.exe 2592 RegSvcs.exe 2592 RegSvcs.exe 908 wlanext.exe 908 wlanext.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2704 d58780d1d574bfe77c6f9cfad1cf4b51522231b2699081befd5bbd15f7309aa0.exe Token: SeDebugPrivilege 2592 RegSvcs.exe Token: SeDebugPrivilege 2784 powershell.exe Token: SeDebugPrivilege 908 wlanext.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 2704 wrote to memory of 2784 2704 d58780d1d574bfe77c6f9cfad1cf4b51522231b2699081befd5bbd15f7309aa0.exe 30 PID 2704 wrote to memory of 2784 2704 d58780d1d574bfe77c6f9cfad1cf4b51522231b2699081befd5bbd15f7309aa0.exe 30 PID 2704 wrote to memory of 2784 2704 d58780d1d574bfe77c6f9cfad1cf4b51522231b2699081befd5bbd15f7309aa0.exe 30 PID 2704 wrote to memory of 2784 2704 d58780d1d574bfe77c6f9cfad1cf4b51522231b2699081befd5bbd15f7309aa0.exe 30 PID 2704 wrote to memory of 2696 2704 d58780d1d574bfe77c6f9cfad1cf4b51522231b2699081befd5bbd15f7309aa0.exe 31 PID 2704 wrote to memory of 2696 2704 d58780d1d574bfe77c6f9cfad1cf4b51522231b2699081befd5bbd15f7309aa0.exe 31 PID 2704 wrote to memory of 2696 2704 d58780d1d574bfe77c6f9cfad1cf4b51522231b2699081befd5bbd15f7309aa0.exe 31 PID 2704 wrote to memory of 2696 2704 d58780d1d574bfe77c6f9cfad1cf4b51522231b2699081befd5bbd15f7309aa0.exe 31 PID 2704 wrote to memory of 2592 2704 d58780d1d574bfe77c6f9cfad1cf4b51522231b2699081befd5bbd15f7309aa0.exe 34 PID 2704 wrote to memory of 2592 2704 d58780d1d574bfe77c6f9cfad1cf4b51522231b2699081befd5bbd15f7309aa0.exe 34 PID 2704 wrote to memory of 2592 2704 d58780d1d574bfe77c6f9cfad1cf4b51522231b2699081befd5bbd15f7309aa0.exe 34 PID 2704 wrote to memory of 2592 2704 d58780d1d574bfe77c6f9cfad1cf4b51522231b2699081befd5bbd15f7309aa0.exe 34 PID 2704 wrote to memory of 2592 2704 d58780d1d574bfe77c6f9cfad1cf4b51522231b2699081befd5bbd15f7309aa0.exe 34 PID 2704 wrote to memory of 2592 2704 d58780d1d574bfe77c6f9cfad1cf4b51522231b2699081befd5bbd15f7309aa0.exe 34 PID 2704 wrote to memory of 2592 2704 d58780d1d574bfe77c6f9cfad1cf4b51522231b2699081befd5bbd15f7309aa0.exe 34 PID 2704 wrote to memory of 2592 2704 d58780d1d574bfe77c6f9cfad1cf4b51522231b2699081befd5bbd15f7309aa0.exe 34 PID 2704 wrote to memory of 2592 2704 d58780d1d574bfe77c6f9cfad1cf4b51522231b2699081befd5bbd15f7309aa0.exe 34 PID 2704 wrote to memory of 2592 2704 d58780d1d574bfe77c6f9cfad1cf4b51522231b2699081befd5bbd15f7309aa0.exe 34 PID 2592 wrote to memory of 908 2592 RegSvcs.exe 35 PID 2592 wrote to memory of 908 2592 RegSvcs.exe 35 PID 2592 wrote to memory of 908 2592 RegSvcs.exe 35 PID 2592 wrote to memory of 908 2592 RegSvcs.exe 35 PID 908 wrote to memory of 3032 908 wlanext.exe 36 PID 908 wrote to memory of 3032 908 wlanext.exe 36 PID 908 wrote to memory of 3032 908 wlanext.exe 36 PID 908 wrote to memory of 3032 908 wlanext.exe 36
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\1\d58780d1d574bfe77c6f9cfad1cf4b51522231b2699081befd5bbd15f7309aa0.exe"C:\Users\Admin\AppData\Local\Temp\1\d58780d1d574bfe77c6f9cfad1cf4b51522231b2699081befd5bbd15f7309aa0.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\sXqUfHySpG.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2784
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sXqUfHySpG" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9389.tmp"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2696
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"4⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"5⤵
- System Location Discovery: System Language Discovery
PID:3032
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD58b6dace8bd24e4ea19d3b83d08a8b4f9
SHA178d2803aa8b96944e05c3b8dc41b5cf5cc1614a4
SHA256f0f441c4ef97349c7f62c2f0e66ed1f832b196a38b44499209f98a1f63be2ec0
SHA5123a4d0034946933e3a2b9a72f75b101d2cf312dd6b201504afb8609e60e329acdbfc73dd30004401f4febadac7e966072caec09d349f3297d79c5a53bdad1bb00