Analysis
-
max time kernel
149s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
10-08-2024 04:03
Static task
static1
Behavioral task
behavioral1
Sample
Nuevo orden pdf.exe
Resource
win7-20240705-en
General
-
Target
Nuevo orden pdf.exe
-
Size
1.4MB
-
MD5
5c73505b356cb427ef1817910a9d8c8d
-
SHA1
e9c18e17d3701db467879f83e0bf71a98a35c89f
-
SHA256
877609ad75eb29e1b0813478089df76928fabbaa41538c10f08b4497a2da9f9f
-
SHA512
27f9fe8b7069d8d5ace439d7bfc56f02930d0a8cd24e470c17585365600084d6e6912556b5b2317155ea03828e631378651438877cb2dff69da3dfbe187baf29
-
SSDEEP
12288:mwnPf8auHABbBXRzwHAMauf4WhAjNzDy8jXz2Vk1tNpTH2G:B9uHABZdwHpr4Wu1RTV1tNpTWG
Malware Config
Extracted
formbook
4.1
gy15
yb40w.top
286live.com
poozonlife.com
availableweedsonline.com
22926839.com
petlovepet.fun
halbaexpress.com
newswingbd.com
discountdesh.com
jwoalhbn.xyz
dandevonald.com
incrediblyxb.christmas
ailia.pro
ga3ki3.com
99812.photos
richiecom.net
ummahskills.online
peakleyva.store
a1cbloodtest.com
insurancebygarry.com
onz-cg3.xyz
erektiepil.com
hs-steuerberater.info
20allhen.online
mariaslakedistrict.com
losterrrcossmpm.com
tmb6x.rest
bagelsliders.com
njoku.net
tatoways.com
jmwmanglobalsolutionscom.com
midnightemporium.shop
gunaihotels.com
midsouthhealthcare.com
rtptt80.site
carmen-asa.com
gypsyjudyscott.com
djkleel.com
sophhia.site
tqqft8l5.xyz
00050385.xyz
oiupa.xyz
purenutrixion.com
worldinfopedia.com
8886493.com
1e0bfijiz43k6c8.skin
bunkerlabsgolf.com
twinportslocal.com
ttyijlaw.com
poiulkj.top
yuejiazy888.com
betbox2347.com
gettingcraftywitro.com
mantap303game.icu
skillspartner.net
cbla.info
rs-alohafactorysaleuua.shop
bt365434.com
redrivercompany.store
abc8win5.com
46431.club
vivehogar.net
menloparkshop.com
1776biz.live
dunia188j.store
Signatures
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Formbook payload 4 IoCs
resource yara_rule behavioral1/memory/2640-11-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2640-15-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2640-19-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2792-27-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Adds policy Run key to start application 2 TTPs 1 IoCs
description ioc Process Key created \Registry\User\S-1-5-21-2172136094-3310281978-782691160-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run systray.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\DBFPJTBPWFBH = "C:\\Program Files (x86)\\Windows Mail\\wab.exe" systray.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1496 set thread context of 2640 1496 Nuevo orden pdf.exe 31 PID 2640 set thread context of 1244 2640 wab.exe 21 PID 2640 set thread context of 1244 2640 wab.exe 21 PID 2792 set thread context of 1244 2792 systray.exe 21 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systray.exe -
description ioc Process Key created \Registry\User\S-1-5-21-2172136094-3310281978-782691160-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 systray.exe -
Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 2640 wab.exe 2640 wab.exe 2640 wab.exe 2792 systray.exe 2792 systray.exe 2792 systray.exe 2792 systray.exe 2792 systray.exe 2792 systray.exe 2792 systray.exe 2792 systray.exe 2792 systray.exe 2792 systray.exe 2792 systray.exe 2792 systray.exe 2792 systray.exe 2792 systray.exe 2792 systray.exe 2792 systray.exe 2792 systray.exe 2792 systray.exe 2792 systray.exe 2792 systray.exe 2792 systray.exe 2792 systray.exe 2792 systray.exe 2792 systray.exe 2792 systray.exe 2792 systray.exe 2792 systray.exe -
Suspicious behavior: MapViewOfSection 8 IoCs
pid Process 2640 wab.exe 2640 wab.exe 2640 wab.exe 2640 wab.exe 2792 systray.exe 2792 systray.exe 2792 systray.exe 2792 systray.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2640 wab.exe Token: SeShutdownPrivilege 1244 Explorer.EXE Token: SeDebugPrivilege 2792 systray.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 1244 Explorer.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 1496 wrote to memory of 2640 1496 Nuevo orden pdf.exe 31 PID 1496 wrote to memory of 2640 1496 Nuevo orden pdf.exe 31 PID 1496 wrote to memory of 2640 1496 Nuevo orden pdf.exe 31 PID 1496 wrote to memory of 2640 1496 Nuevo orden pdf.exe 31 PID 1496 wrote to memory of 2640 1496 Nuevo orden pdf.exe 31 PID 1496 wrote to memory of 2640 1496 Nuevo orden pdf.exe 31 PID 1496 wrote to memory of 2640 1496 Nuevo orden pdf.exe 31 PID 1496 wrote to memory of 2804 1496 Nuevo orden pdf.exe 32 PID 1496 wrote to memory of 2804 1496 Nuevo orden pdf.exe 32 PID 1496 wrote to memory of 2804 1496 Nuevo orden pdf.exe 32 PID 1244 wrote to memory of 2792 1244 Explorer.EXE 33 PID 1244 wrote to memory of 2792 1244 Explorer.EXE 33 PID 1244 wrote to memory of 2792 1244 Explorer.EXE 33 PID 1244 wrote to memory of 2792 1244 Explorer.EXE 33 PID 2792 wrote to memory of 2912 2792 systray.exe 34 PID 2792 wrote to memory of 2912 2792 systray.exe 34 PID 2792 wrote to memory of 2912 2792 systray.exe 34 PID 2792 wrote to memory of 2912 2792 systray.exe 34 PID 2792 wrote to memory of 2912 2792 systray.exe 34
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\Nuevo orden pdf.exe"C:\Users\Admin\AppData\Local\Temp\Nuevo orden pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2640
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1496 -s 6163⤵PID:2804
-
-
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:2912
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
91KB
MD54c3ae3724b19922d8e03b2d6544454b3
SHA1bf2224146c80005f0288c9d6b0d9aa4c686898fa
SHA256cdff13d039c9e24939ef9a6c9ed269ad35b8f5825f17c29871a6df0f2b0b800e
SHA512ee2fbf20e2fdbc8949a1b216c51767bbf84a1e65a6c8b8c8eb6c4d1af19e1f7c495fad4f9f2b931ab7455de962a5e7a19b05dbbea2cf08ab5342eee9c8f18d21
-
Filesize
40B
MD52f245469795b865bdd1b956c23d7893d
SHA16ad80b974d3808f5a20ea1e766c7d2f88b9e5895
SHA2561662d01a2d47b875a34fc7a8cd92e78cb2ba7f34023c7fd2639cbb10b8d94361
SHA512909f189846a5d2db208a5eb2e7cb3042c0f164caf437e2b1b6de608c0a70e4f3510b81b85753dbeec1e211e6a83e6ea8c96aff896e9b6e8ed42014473a54dc4f
-
Filesize
40B
MD5d63a82e5d81e02e399090af26db0b9cb
SHA191d0014c8f54743bba141fd60c9d963f869d76c9
SHA256eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae
SHA51238afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad
-
Filesize
40B
MD5ba3b6bc807d4f76794c4b81b09bb9ba5
SHA124cb89501f0212ff3095ecc0aba97dd563718fb1
SHA2566eebf968962745b2e9de2ca969af7c424916d4e3fe3cc0bb9b3d414abfce9507
SHA512ecd07e601fc9e3cfc39addd7bd6f3d7f7ff3253afb40bf536e9eaac5a4c243e5ec40fbfd7b216cb0ea29f2517419601e335e33ba19dea4a46f65e38694d465bf