Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
15-08-2024 09:20
Static task
static1
Behavioral task
behavioral1
Sample
573d8ee9678cef8163e96937a6a5a4f14a5ade12f5646ab05550c0038c770e5d.exe
Resource
win7-20240704-en
General
-
Target
573d8ee9678cef8163e96937a6a5a4f14a5ade12f5646ab05550c0038c770e5d.exe
-
Size
2.2MB
-
MD5
15c4948711c3ac6250ff98d0e5272b27
-
SHA1
545a473d3a8fc3810fbb0ff04e2d4d28ab95bedb
-
SHA256
573d8ee9678cef8163e96937a6a5a4f14a5ade12f5646ab05550c0038c770e5d
-
SHA512
d3a0e2273fb307b456f8c860028a489c26011dc75ffd6075473babf320962530d690319706ef03ba2869c2c7d91ec95933ab4c4ed13d755de79d55d82ae58a41
-
SSDEEP
12288:WK9Xxc/7gzqLiOG1tBda9myeHjQPBPwrgiQa5o0fpfEXKX:n9XxcjgOG3Bda9WmPegiQa5Pftkm
Malware Config
Extracted
formbook
4.1
gy15
yb40w.top
286live.com
poozonlife.com
availableweedsonline.com
22926839.com
petlovepet.fun
halbaexpress.com
newswingbd.com
discountdesh.com
jwoalhbn.xyz
dandevonald.com
incrediblyxb.christmas
ailia.pro
ga3ki3.com
99812.photos
richiecom.net
ummahskills.online
peakleyva.store
a1cbloodtest.com
insurancebygarry.com
onz-cg3.xyz
erektiepil.com
hs-steuerberater.info
20allhen.online
mariaslakedistrict.com
losterrrcossmpm.com
tmb6x.rest
bagelsliders.com
njoku.net
tatoways.com
jmwmanglobalsolutionscom.com
midnightemporium.shop
gunaihotels.com
midsouthhealthcare.com
rtptt80.site
carmen-asa.com
gypsyjudyscott.com
djkleel.com
sophhia.site
tqqft8l5.xyz
00050385.xyz
oiupa.xyz
purenutrixion.com
worldinfopedia.com
8886493.com
1e0bfijiz43k6c8.skin
bunkerlabsgolf.com
twinportslocal.com
ttyijlaw.com
poiulkj.top
yuejiazy888.com
betbox2347.com
gettingcraftywitro.com
mantap303game.icu
skillspartner.net
cbla.info
rs-alohafactorysaleuua.shop
bt365434.com
redrivercompany.store
abc8win5.com
46431.club
vivehogar.net
menloparkshop.com
1776biz.live
dunia188j.store
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 573d8ee9678cef8163e96937a6a5a4f14a5ade12f5646ab05550c0038c770e5d.exe -
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Formbook payload 3 IoCs
resource yara_rule behavioral1/memory/564-13-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/564-18-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2804-21-0x00000000000C0000-0x00000000000EF000-memory.dmp formbook -
Adds policy Run key to start application 2 TTPs 1 IoCs
description ioc Process Key created \Registry\User\S-1-5-21-2212144002-1172735686-1556890956-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run control.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2912 powershell.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\VNU84NJ0 = "C:\\Program Files (x86)\\Windows Mail\\wab.exe" control.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 573d8ee9678cef8163e96937a6a5a4f14a5ade12f5646ab05550c0038c770e5d.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 573d8ee9678cef8163e96937a6a5a4f14a5ade12f5646ab05550c0038c770e5d.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3004 set thread context of 564 3004 573d8ee9678cef8163e96937a6a5a4f14a5ade12f5646ab05550c0038c770e5d.exe 32 PID 564 set thread context of 1208 564 wab.exe 20 PID 2804 set thread context of 1208 2804 control.exe 20 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language control.exe -
description ioc Process Key created \Registry\User\S-1-5-21-2212144002-1172735686-1556890956-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 control.exe -
Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 2912 powershell.exe 564 wab.exe 564 wab.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 564 wab.exe 564 wab.exe 564 wab.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2912 powershell.exe Token: SeDebugPrivilege 564 wab.exe Token: SeShutdownPrivilege 1208 Explorer.EXE Token: SeDebugPrivilege 2804 control.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 1208 Explorer.EXE -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 3004 wrote to memory of 2912 3004 573d8ee9678cef8163e96937a6a5a4f14a5ade12f5646ab05550c0038c770e5d.exe 30 PID 3004 wrote to memory of 2912 3004 573d8ee9678cef8163e96937a6a5a4f14a5ade12f5646ab05550c0038c770e5d.exe 30 PID 3004 wrote to memory of 2912 3004 573d8ee9678cef8163e96937a6a5a4f14a5ade12f5646ab05550c0038c770e5d.exe 30 PID 3004 wrote to memory of 564 3004 573d8ee9678cef8163e96937a6a5a4f14a5ade12f5646ab05550c0038c770e5d.exe 32 PID 3004 wrote to memory of 564 3004 573d8ee9678cef8163e96937a6a5a4f14a5ade12f5646ab05550c0038c770e5d.exe 32 PID 3004 wrote to memory of 564 3004 573d8ee9678cef8163e96937a6a5a4f14a5ade12f5646ab05550c0038c770e5d.exe 32 PID 3004 wrote to memory of 564 3004 573d8ee9678cef8163e96937a6a5a4f14a5ade12f5646ab05550c0038c770e5d.exe 32 PID 3004 wrote to memory of 564 3004 573d8ee9678cef8163e96937a6a5a4f14a5ade12f5646ab05550c0038c770e5d.exe 32 PID 3004 wrote to memory of 564 3004 573d8ee9678cef8163e96937a6a5a4f14a5ade12f5646ab05550c0038c770e5d.exe 32 PID 3004 wrote to memory of 564 3004 573d8ee9678cef8163e96937a6a5a4f14a5ade12f5646ab05550c0038c770e5d.exe 32 PID 3004 wrote to memory of 2116 3004 573d8ee9678cef8163e96937a6a5a4f14a5ade12f5646ab05550c0038c770e5d.exe 33 PID 3004 wrote to memory of 2116 3004 573d8ee9678cef8163e96937a6a5a4f14a5ade12f5646ab05550c0038c770e5d.exe 33 PID 3004 wrote to memory of 2116 3004 573d8ee9678cef8163e96937a6a5a4f14a5ade12f5646ab05550c0038c770e5d.exe 33 PID 1208 wrote to memory of 2804 1208 Explorer.EXE 34 PID 1208 wrote to memory of 2804 1208 Explorer.EXE 34 PID 1208 wrote to memory of 2804 1208 Explorer.EXE 34 PID 1208 wrote to memory of 2804 1208 Explorer.EXE 34 PID 2804 wrote to memory of 2668 2804 control.exe 35 PID 2804 wrote to memory of 2668 2804 control.exe 35 PID 2804 wrote to memory of 2668 2804 control.exe 35 PID 2804 wrote to memory of 2668 2804 control.exe 35 PID 2804 wrote to memory of 2668 2804 control.exe 35 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 573d8ee9678cef8163e96937a6a5a4f14a5ade12f5646ab05550c0038c770e5d.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\573d8ee9678cef8163e96937a6a5a4f14a5ade12f5646ab05550c0038c770e5d.exe"C:\Users\Admin\AppData\Local\Temp\573d8ee9678cef8163e96937a6a5a4f14a5ade12f5646ab05550c0038c770e5d.exe"2⤵
- UAC bypass
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3004 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\573d8ee9678cef8163e96937a6a5a4f14a5ade12f5646ab05550c0038c770e5d.exe" -Force3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2912
-
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:564
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3004 -s 8123⤵PID:2116
-
-
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:2668
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
77KB
MD52205e2a25f456de5b0c61847e06d61ba
SHA1473d391693f897cc1b8aafb3b82b494f1884383d
SHA2568cd9c9fe5e13e301a612d43985698a1c59a385a766d4389ed4393b6c9a83f0d4
SHA51293088a862f3f0531b66992e5c46c743c41b416cd9751af264a10daab900fee977f2f8404fdefca51793c7de3898187fc3721bc4098428a38d3df2cfd086150a6
-
Filesize
40B
MD52f245469795b865bdd1b956c23d7893d
SHA16ad80b974d3808f5a20ea1e766c7d2f88b9e5895
SHA2561662d01a2d47b875a34fc7a8cd92e78cb2ba7f34023c7fd2639cbb10b8d94361
SHA512909f189846a5d2db208a5eb2e7cb3042c0f164caf437e2b1b6de608c0a70e4f3510b81b85753dbeec1e211e6a83e6ea8c96aff896e9b6e8ed42014473a54dc4f
-
Filesize
40B
MD5d63a82e5d81e02e399090af26db0b9cb
SHA191d0014c8f54743bba141fd60c9d963f869d76c9
SHA256eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae
SHA51238afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad
-
Filesize
40B
MD5ba3b6bc807d4f76794c4b81b09bb9ba5
SHA124cb89501f0212ff3095ecc0aba97dd563718fb1
SHA2566eebf968962745b2e9de2ca969af7c424916d4e3fe3cc0bb9b3d414abfce9507
SHA512ecd07e601fc9e3cfc39addd7bd6f3d7f7ff3253afb40bf536e9eaac5a4c243e5ec40fbfd7b216cb0ea29f2517419601e335e33ba19dea4a46f65e38694d465bf