Analysis
-
max time kernel
147s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
31-08-2024 15:08
Static task
static1
Behavioral task
behavioral1
Sample
Payment Slip copy.scr
Resource
win7-20240729-en
General
-
Target
Payment Slip copy.scr
-
Size
618KB
-
MD5
9516fc51941956b460ca13cce642284f
-
SHA1
dd0844cffa29d997465067f127d850a9924768cf
-
SHA256
795a83d84b04c245a8b0ad9221ea20a4635ad6654f22d533f499a5523ee2fe71
-
SHA512
69e33849cf1631d2f998a7c3f168eea0de7065f5acd7c246f32e85e28cd2aa129918cb59f19b6227829bb4bc1d89c197547db683bfaa54af3dadd2106d4c94ec
-
SSDEEP
12288:2U+ovYgcf3FgNsOS86CKLlxO9D78qp/+lXvk1yxmnInyroBrFBGkJmAiyUkR:x+oBcf3mNsODp2lX8Ym58BrnGkIANT
Malware Config
Extracted
formbook
4.1
m49z
ormswarm.xyz
awn-care-63587.bond
uymetanail5.online
mergencyloan007.xyz
545.top
eiliao596.pro
ackersandmoverschennai.net
ehdiahmadvandmusicbest.click
tlgxmb2024.cloud
ulfcoastharborhopper.pro
rohns-disease-early-signs.today
oldenhorizonsbgcl.click
weetindulgencepro.xyz
yexoiup.xyz
yself-solar.net
kfirsatimla.online
bropub3.online
ouljourney.online
usvf76f.shop
onnaberich.online
erminia.net
nline-advertising-91281.bond
pt-23.live
ayhentai.vip
ockyjapan.net
est-mortgage-loan-2507.today
uikfox.click
870077.vip
hzjjys88.vip
hayrain.shop
63638d.xyz
ines.cafe
oomed.shop
addy-cazino.online
ellybharat.net
razeonthego.net
ickbrady.dev
872277.vip
nwoebz.shop
udatoga.xyz
j10j.xyz
utogongcom.net
14oz957dd.autos
sgarasjeport.online
xrmxfh150.xyz
3win2.top
alrv9s8.christmas
0847.photo
aturally-canadian.beauty
artnelide.top
ropertiesforrentfr.bond
j11j.xyz
otaislifexd.xyz
zesuteta.shop
avaburrn.rest
azavivianonline.tech
ealthcare-software-96535.bond
atrixdon.online
group.tech
ertiberiaterra.net
pneesxw.christmas
assaporteapn.shop
hangwuyi.cfd
ounter-courses.world
ysticastrospain.online
Signatures
-
Formbook payload 4 IoCs
resource yara_rule behavioral2/memory/1060-12-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1060-19-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1060-68-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2204-75-0x0000000000440000-0x000000000046F000-memory.dmp formbook -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1504 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation Payment Slip copy.scr -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 5092 set thread context of 1060 5092 Payment Slip copy.scr 97 PID 1060 set thread context of 3476 1060 RegSvcs.exe 56 PID 1060 set thread context of 3476 1060 RegSvcs.exe 56 PID 2204 set thread context of 3476 2204 help.exe 56 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language help.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Payment Slip copy.scr Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 5092 Payment Slip copy.scr 5092 Payment Slip copy.scr 1060 RegSvcs.exe 1060 RegSvcs.exe 1060 RegSvcs.exe 1060 RegSvcs.exe 1504 powershell.exe 1504 powershell.exe 1060 RegSvcs.exe 1060 RegSvcs.exe 2204 help.exe 2204 help.exe 2204 help.exe 2204 help.exe 2204 help.exe 2204 help.exe 2204 help.exe 2204 help.exe 2204 help.exe 2204 help.exe 2204 help.exe 2204 help.exe 2204 help.exe 2204 help.exe 2204 help.exe 2204 help.exe 2204 help.exe 2204 help.exe 2204 help.exe 2204 help.exe 2204 help.exe 2204 help.exe 2204 help.exe 2204 help.exe 2204 help.exe 2204 help.exe 2204 help.exe 2204 help.exe 2204 help.exe 2204 help.exe 2204 help.exe 2204 help.exe 2204 help.exe 2204 help.exe 2204 help.exe 2204 help.exe 2204 help.exe 2204 help.exe 2204 help.exe 2204 help.exe 2204 help.exe 2204 help.exe 2204 help.exe 2204 help.exe 2204 help.exe 2204 help.exe 2204 help.exe 2204 help.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 1060 RegSvcs.exe 1060 RegSvcs.exe 1060 RegSvcs.exe 1060 RegSvcs.exe 2204 help.exe 2204 help.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 5092 Payment Slip copy.scr Token: SeDebugPrivilege 1060 RegSvcs.exe Token: SeDebugPrivilege 1504 powershell.exe Token: SeShutdownPrivilege 3476 Explorer.EXE Token: SeCreatePagefilePrivilege 3476 Explorer.EXE Token: SeDebugPrivilege 2204 help.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3476 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 5092 wrote to memory of 1504 5092 Payment Slip copy.scr 94 PID 5092 wrote to memory of 1504 5092 Payment Slip copy.scr 94 PID 5092 wrote to memory of 1504 5092 Payment Slip copy.scr 94 PID 5092 wrote to memory of 4480 5092 Payment Slip copy.scr 96 PID 5092 wrote to memory of 4480 5092 Payment Slip copy.scr 96 PID 5092 wrote to memory of 4480 5092 Payment Slip copy.scr 96 PID 5092 wrote to memory of 1060 5092 Payment Slip copy.scr 97 PID 5092 wrote to memory of 1060 5092 Payment Slip copy.scr 97 PID 5092 wrote to memory of 1060 5092 Payment Slip copy.scr 97 PID 5092 wrote to memory of 1060 5092 Payment Slip copy.scr 97 PID 5092 wrote to memory of 1060 5092 Payment Slip copy.scr 97 PID 5092 wrote to memory of 1060 5092 Payment Slip copy.scr 97 PID 1060 wrote to memory of 2204 1060 RegSvcs.exe 98 PID 1060 wrote to memory of 2204 1060 RegSvcs.exe 98 PID 1060 wrote to memory of 2204 1060 RegSvcs.exe 98 PID 2204 wrote to memory of 868 2204 help.exe 99 PID 2204 wrote to memory of 868 2204 help.exe 99 PID 2204 wrote to memory of 868 2204 help.exe 99
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\Payment Slip copy.scr"C:\Users\Admin\AppData\Local\Temp\Payment Slip copy.scr" /S2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Payment Slip copy.scr"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1504
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵PID:4480
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"4⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"5⤵
- System Location Discovery: System Language Discovery
PID:868
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82