Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
02-09-2024 07:05
Static task
static1
Behavioral task
behavioral1
Sample
RFQOCEAN5645457788.scr.exe
Resource
win7-20240704-en
General
-
Target
RFQOCEAN5645457788.scr.exe
-
Size
698KB
-
MD5
37deb8c1285c7787fe88a51b5064a435
-
SHA1
e1b6a0133717759f4eff3072b3930996004df498
-
SHA256
c8500adf5318aa42e5cfe9d6efe18d328538a6d8b36765d68820d2b99c3c9626
-
SHA512
178bad353bf4b837a743f972bde48a357a48c0d747a5ea23294030811eef60f5fac02a3f0cfe7c50e27a2d0eaeb9f3144ecd8aeb6c3684cae8acbf5782c7521e
-
SSDEEP
12288:aGZKzvFdBKYvI8TNmO6y4l22pStzZrwV7FD+j6o7jTFUNPkR:EdO6NN74lj8zRwV7AXnFUNK
Malware Config
Extracted
formbook
4.1
m49z
ormswarm.xyz
awn-care-63587.bond
uymetanail5.online
mergencyloan007.xyz
545.top
eiliao596.pro
ackersandmoverschennai.net
ehdiahmadvandmusicbest.click
tlgxmb2024.cloud
ulfcoastharborhopper.pro
rohns-disease-early-signs.today
oldenhorizonsbgcl.click
weetindulgencepro.xyz
yexoiup.xyz
yself-solar.net
kfirsatimla.online
bropub3.online
ouljourney.online
usvf76f.shop
onnaberich.online
erminia.net
nline-advertising-91281.bond
pt-23.live
ayhentai.vip
ockyjapan.net
est-mortgage-loan-2507.today
uikfox.click
870077.vip
hzjjys88.vip
hayrain.shop
63638d.xyz
ines.cafe
oomed.shop
addy-cazino.online
ellybharat.net
razeonthego.net
ickbrady.dev
872277.vip
nwoebz.shop
udatoga.xyz
j10j.xyz
utogongcom.net
14oz957dd.autos
sgarasjeport.online
xrmxfh150.xyz
3win2.top
alrv9s8.christmas
0847.photo
aturally-canadian.beauty
artnelide.top
ropertiesforrentfr.bond
j11j.xyz
otaislifexd.xyz
zesuteta.shop
avaburrn.rest
azavivianonline.tech
ealthcare-software-96535.bond
atrixdon.online
group.tech
ertiberiaterra.net
pneesxw.christmas
assaporteapn.shop
hangwuyi.cfd
ounter-courses.world
ysticastrospain.online
Signatures
-
Formbook payload 3 IoCs
resource yara_rule behavioral1/memory/2708-13-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2708-17-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2636-24-0x00000000000D0000-0x00000000000FF000-memory.dmp formbook -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2824 powershell.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2484 set thread context of 2708 2484 RFQOCEAN5645457788.scr.exe 32 PID 2708 set thread context of 1328 2708 RegSvcs.exe 21 PID 2636 set thread context of 1328 2636 chkdsk.exe 21 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RFQOCEAN5645457788.scr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chkdsk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 2708 RegSvcs.exe 2708 RegSvcs.exe 2824 powershell.exe 2636 chkdsk.exe 2636 chkdsk.exe 2636 chkdsk.exe 2636 chkdsk.exe 2636 chkdsk.exe 2636 chkdsk.exe 2636 chkdsk.exe 2636 chkdsk.exe 2636 chkdsk.exe 2636 chkdsk.exe 2636 chkdsk.exe 2636 chkdsk.exe 2636 chkdsk.exe 2636 chkdsk.exe 2636 chkdsk.exe 2636 chkdsk.exe 2636 chkdsk.exe 2636 chkdsk.exe 2636 chkdsk.exe 2636 chkdsk.exe 2636 chkdsk.exe 2636 chkdsk.exe 2636 chkdsk.exe 2636 chkdsk.exe 2636 chkdsk.exe 2636 chkdsk.exe 2636 chkdsk.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 2708 RegSvcs.exe 2708 RegSvcs.exe 2708 RegSvcs.exe 2636 chkdsk.exe 2636 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2708 RegSvcs.exe Token: SeDebugPrivilege 2824 powershell.exe Token: SeDebugPrivilege 2636 chkdsk.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 2484 wrote to memory of 2824 2484 RFQOCEAN5645457788.scr.exe 30 PID 2484 wrote to memory of 2824 2484 RFQOCEAN5645457788.scr.exe 30 PID 2484 wrote to memory of 2824 2484 RFQOCEAN5645457788.scr.exe 30 PID 2484 wrote to memory of 2824 2484 RFQOCEAN5645457788.scr.exe 30 PID 2484 wrote to memory of 2708 2484 RFQOCEAN5645457788.scr.exe 32 PID 2484 wrote to memory of 2708 2484 RFQOCEAN5645457788.scr.exe 32 PID 2484 wrote to memory of 2708 2484 RFQOCEAN5645457788.scr.exe 32 PID 2484 wrote to memory of 2708 2484 RFQOCEAN5645457788.scr.exe 32 PID 2484 wrote to memory of 2708 2484 RFQOCEAN5645457788.scr.exe 32 PID 2484 wrote to memory of 2708 2484 RFQOCEAN5645457788.scr.exe 32 PID 2484 wrote to memory of 2708 2484 RFQOCEAN5645457788.scr.exe 32 PID 2484 wrote to memory of 2708 2484 RFQOCEAN5645457788.scr.exe 32 PID 2484 wrote to memory of 2708 2484 RFQOCEAN5645457788.scr.exe 32 PID 2484 wrote to memory of 2708 2484 RFQOCEAN5645457788.scr.exe 32 PID 1328 wrote to memory of 2636 1328 Explorer.EXE 33 PID 1328 wrote to memory of 2636 1328 Explorer.EXE 33 PID 1328 wrote to memory of 2636 1328 Explorer.EXE 33 PID 1328 wrote to memory of 2636 1328 Explorer.EXE 33 PID 2636 wrote to memory of 2148 2636 chkdsk.exe 34 PID 2636 wrote to memory of 2148 2636 chkdsk.exe 34 PID 2636 wrote to memory of 2148 2636 chkdsk.exe 34 PID 2636 wrote to memory of 2148 2636 chkdsk.exe 34
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\RFQOCEAN5645457788.scr.exe"C:\Users\Admin\AppData\Local\Temp\RFQOCEAN5645457788.scr.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\RFQOCEAN5645457788.scr.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2824
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2708
-
-
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2148
-
-