Analysis
-
max time kernel
148s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04-09-2024 15:15
Static task
static1
Behavioral task
behavioral1
Sample
Scan-budget.00543647.pdf.exe
Resource
win7-20240903-en
General
-
Target
Scan-budget.00543647.pdf.exe
-
Size
620KB
-
MD5
ae8ca2a7cb793758ff88dee979ac1291
-
SHA1
d1892e62c48e1d184aed4e7f0aebe4851a8db0c9
-
SHA256
57c00a4d8594511f335f5b1664d9f681e6803a50c0f0af72dc92f0428ed76fb6
-
SHA512
07d9157d17230b3311556e726f728193606b4225bdb4b5e6137976d9a19bb564b4f0a2c761b67d44da31ff7c4df49f05a233defdb2744e7ec0c1d1fd02013752
-
SSDEEP
12288:iTt8JwIF8Q+aYDlQYik944YQsmb2kICDdH7/5fHO6vP0gkR:Wt8GIOa/R4YQsmS9CDdHVm+PE
Malware Config
Extracted
formbook
4.1
m49z
ormswarm.xyz
awn-care-63587.bond
uymetanail5.online
mergencyloan007.xyz
545.top
eiliao596.pro
ackersandmoverschennai.net
ehdiahmadvandmusicbest.click
tlgxmb2024.cloud
ulfcoastharborhopper.pro
rohns-disease-early-signs.today
oldenhorizonsbgcl.click
weetindulgencepro.xyz
yexoiup.xyz
yself-solar.net
kfirsatimla.online
bropub3.online
ouljourney.online
usvf76f.shop
onnaberich.online
erminia.net
nline-advertising-91281.bond
pt-23.live
ayhentai.vip
ockyjapan.net
est-mortgage-loan-2507.today
uikfox.click
870077.vip
hzjjys88.vip
hayrain.shop
63638d.xyz
ines.cafe
oomed.shop
addy-cazino.online
ellybharat.net
razeonthego.net
ickbrady.dev
872277.vip
nwoebz.shop
udatoga.xyz
j10j.xyz
utogongcom.net
14oz957dd.autos
sgarasjeport.online
xrmxfh150.xyz
3win2.top
alrv9s8.christmas
0847.photo
aturally-canadian.beauty
artnelide.top
ropertiesforrentfr.bond
j11j.xyz
otaislifexd.xyz
zesuteta.shop
avaburrn.rest
azavivianonline.tech
ealthcare-software-96535.bond
atrixdon.online
group.tech
ertiberiaterra.net
pneesxw.christmas
assaporteapn.shop
hangwuyi.cfd
ounter-courses.world
ysticastrospain.online
Signatures
-
Formbook payload 3 IoCs
resource yara_rule behavioral2/memory/4604-11-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4604-18-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1172-71-0x0000000000B80000-0x0000000000BAF000-memory.dmp formbook -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 5040 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation Scan-budget.00543647.pdf.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3956 set thread context of 4604 3956 Scan-budget.00543647.pdf.exe 96 PID 4604 set thread context of 3440 4604 RegSvcs.exe 56 PID 1172 set thread context of 3440 1172 msiexec.exe 56 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Scan-budget.00543647.pdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 4604 RegSvcs.exe 4604 RegSvcs.exe 4604 RegSvcs.exe 4604 RegSvcs.exe 5040 powershell.exe 5040 powershell.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 4604 RegSvcs.exe 4604 RegSvcs.exe 4604 RegSvcs.exe 1172 msiexec.exe 1172 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4604 RegSvcs.exe Token: SeDebugPrivilege 5040 powershell.exe Token: SeDebugPrivilege 1172 msiexec.exe Token: SeShutdownPrivilege 3440 Explorer.EXE Token: SeCreatePagefilePrivilege 3440 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3440 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3956 wrote to memory of 5040 3956 Scan-budget.00543647.pdf.exe 94 PID 3956 wrote to memory of 5040 3956 Scan-budget.00543647.pdf.exe 94 PID 3956 wrote to memory of 5040 3956 Scan-budget.00543647.pdf.exe 94 PID 3956 wrote to memory of 4604 3956 Scan-budget.00543647.pdf.exe 96 PID 3956 wrote to memory of 4604 3956 Scan-budget.00543647.pdf.exe 96 PID 3956 wrote to memory of 4604 3956 Scan-budget.00543647.pdf.exe 96 PID 3956 wrote to memory of 4604 3956 Scan-budget.00543647.pdf.exe 96 PID 3956 wrote to memory of 4604 3956 Scan-budget.00543647.pdf.exe 96 PID 3956 wrote to memory of 4604 3956 Scan-budget.00543647.pdf.exe 96 PID 3440 wrote to memory of 1172 3440 Explorer.EXE 97 PID 3440 wrote to memory of 1172 3440 Explorer.EXE 97 PID 3440 wrote to memory of 1172 3440 Explorer.EXE 97 PID 1172 wrote to memory of 1156 1172 msiexec.exe 98 PID 1172 wrote to memory of 1156 1172 msiexec.exe 98 PID 1172 wrote to memory of 1156 1172 msiexec.exe 98
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\Scan-budget.00543647.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Scan-budget.00543647.pdf.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Scan-budget.00543647.pdf.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5040
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4604
-
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- System Location Discovery: System Language Discovery
PID:1156
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82