Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
20-09-2024 08:23
Static task
static1
Behavioral task
behavioral1
Sample
48de7633a9738c2392d6a449f59fcbcb.exe
Resource
win7-20240704-en
General
-
Target
48de7633a9738c2392d6a449f59fcbcb.exe
-
Size
1.6MB
-
MD5
48de7633a9738c2392d6a449f59fcbcb
-
SHA1
f30905ce8f900e86f67d27bda53e1e8e42885356
-
SHA256
d722071e87692ef2f7b94aa22e2b5153219dea78de81315b8fdaf18a3dc4cf6a
-
SHA512
e8976d81a2d0039a90ccb5ddfc5dc86e541b59625a0f3901e6e3a422e1873290f8bcc936fa27b53b56411c9fc98bb7eac90f58c9b31d2d2c6750a40dece0bea2
-
SSDEEP
49152:IAodtaG9kS2U84B+FLan9k5TRM9zlFVjrW22:Y/B1x2
Malware Config
Extracted
formbook
4.1
kmge
jia0752d.com
cq0jt.sbs
whimsicalweddingrentals.com
meetsex-here.life
hhe-crv220.com
bedbillionaire.com
soycmo.com
mrawkward.xyz
11ramshornroad.com
motoyonaturals.com
thischicloves.com
gacorbet.pro
ihsanid.com
pancaketurner.com
santanarstore.com
cr3dtv.com
negotools.com
landfillequip.com
sejasuapropriachefe.com
diamant-verkopen.store
builtonmybrother.art
teoti.beauty
kickssoccercamp.com
chickfrau.com
compare-energy.com
icvp5o.xyz
susan-writes.com
dropletcoin.com
sivertool.com
sup-25987659.com
weedz-seeds.today
agritamaperkasaindonesia.com
safwankhalil.com
jm2s8a3mz.com
wfjwjm.com
be-heatpumps.life
hcwoodpanel.com
n5l780.com
mandalah.art
szexvideokingyen.sbs
justinroemmick.com
thecoolkidsdontfitin.com
gsolartech.com
swisswearables.com
chicagocarpetcleaneril.com
terrazahills-cbre.com
santatainha.com
sacksmantenimiento.store
wzhem.rest
shearwaterpembrokeshire.com
baansantiburi.com
mid-size-suv-87652.com
solunchina.com
nandos.moe
blucretebistro.com
identificatiekvk.digital
8772876.com
longfangyun.com
litblacklit.com
mobilferrari.com
zeeedajewelermusic.com
allenbach.swiss
industrialrevolution.ink
cmgamingtrack.com
a2zglobalimports.com
Signatures
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Formbook payload 4 IoCs
resource yara_rule behavioral1/memory/2708-14-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2708-17-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2708-22-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1840-28-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2744 powershell.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 2692 set thread context of 2708 2692 48de7633a9738c2392d6a449f59fcbcb.exe 37 PID 2708 set thread context of 1180 2708 wmplayer.exe 21 PID 2708 set thread context of 1180 2708 wmplayer.exe 21 PID 1840 set thread context of 1180 1840 colorcpl.exe 21 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmplayer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language colorcpl.exe -
description ioc Process Key created \Registry\User\S-1-5-21-3434294380-2554721341-1919518612-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 colorcpl.exe -
Runs regedit.exe 1 IoCs
pid Process 2632 regedit.exe -
Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 2744 powershell.exe 2708 wmplayer.exe 2708 wmplayer.exe 2708 wmplayer.exe 1840 colorcpl.exe 1840 colorcpl.exe 1840 colorcpl.exe 1840 colorcpl.exe 1840 colorcpl.exe 1840 colorcpl.exe 1840 colorcpl.exe 1840 colorcpl.exe 1840 colorcpl.exe 1840 colorcpl.exe 1840 colorcpl.exe 1840 colorcpl.exe 1840 colorcpl.exe 1840 colorcpl.exe 1840 colorcpl.exe 1840 colorcpl.exe 1840 colorcpl.exe 1840 colorcpl.exe 1840 colorcpl.exe 1840 colorcpl.exe 1840 colorcpl.exe 1840 colorcpl.exe 1840 colorcpl.exe 1840 colorcpl.exe 1840 colorcpl.exe 1840 colorcpl.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1180 Explorer.EXE -
Suspicious behavior: MapViewOfSection 8 IoCs
pid Process 2708 wmplayer.exe 2708 wmplayer.exe 2708 wmplayer.exe 2708 wmplayer.exe 1840 colorcpl.exe 1840 colorcpl.exe 1840 colorcpl.exe 1840 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2692 48de7633a9738c2392d6a449f59fcbcb.exe Token: SeDebugPrivilege 2744 powershell.exe Token: SeDebugPrivilege 2708 wmplayer.exe Token: SeDebugPrivilege 1840 colorcpl.exe -
Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 2692 wrote to memory of 2744 2692 48de7633a9738c2392d6a449f59fcbcb.exe 31 PID 2692 wrote to memory of 2744 2692 48de7633a9738c2392d6a449f59fcbcb.exe 31 PID 2692 wrote to memory of 2744 2692 48de7633a9738c2392d6a449f59fcbcb.exe 31 PID 2692 wrote to memory of 2204 2692 48de7633a9738c2392d6a449f59fcbcb.exe 33 PID 2692 wrote to memory of 2204 2692 48de7633a9738c2392d6a449f59fcbcb.exe 33 PID 2692 wrote to memory of 2204 2692 48de7633a9738c2392d6a449f59fcbcb.exe 33 PID 2692 wrote to memory of 2204 2692 48de7633a9738c2392d6a449f59fcbcb.exe 33 PID 2692 wrote to memory of 2204 2692 48de7633a9738c2392d6a449f59fcbcb.exe 33 PID 2692 wrote to memory of 2632 2692 48de7633a9738c2392d6a449f59fcbcb.exe 34 PID 2692 wrote to memory of 2632 2692 48de7633a9738c2392d6a449f59fcbcb.exe 34 PID 2692 wrote to memory of 2632 2692 48de7633a9738c2392d6a449f59fcbcb.exe 34 PID 2692 wrote to memory of 2632 2692 48de7633a9738c2392d6a449f59fcbcb.exe 34 PID 2692 wrote to memory of 2632 2692 48de7633a9738c2392d6a449f59fcbcb.exe 34 PID 2692 wrote to memory of 1316 2692 48de7633a9738c2392d6a449f59fcbcb.exe 35 PID 2692 wrote to memory of 1316 2692 48de7633a9738c2392d6a449f59fcbcb.exe 35 PID 2692 wrote to memory of 1316 2692 48de7633a9738c2392d6a449f59fcbcb.exe 35 PID 2692 wrote to memory of 1316 2692 48de7633a9738c2392d6a449f59fcbcb.exe 35 PID 2692 wrote to memory of 1316 2692 48de7633a9738c2392d6a449f59fcbcb.exe 35 PID 2692 wrote to memory of 2660 2692 48de7633a9738c2392d6a449f59fcbcb.exe 36 PID 2692 wrote to memory of 2660 2692 48de7633a9738c2392d6a449f59fcbcb.exe 36 PID 2692 wrote to memory of 2660 2692 48de7633a9738c2392d6a449f59fcbcb.exe 36 PID 2692 wrote to memory of 2660 2692 48de7633a9738c2392d6a449f59fcbcb.exe 36 PID 2692 wrote to memory of 2660 2692 48de7633a9738c2392d6a449f59fcbcb.exe 36 PID 2692 wrote to memory of 2708 2692 48de7633a9738c2392d6a449f59fcbcb.exe 37 PID 2692 wrote to memory of 2708 2692 48de7633a9738c2392d6a449f59fcbcb.exe 37 PID 2692 wrote to memory of 2708 2692 48de7633a9738c2392d6a449f59fcbcb.exe 37 PID 2692 wrote to memory of 2708 2692 48de7633a9738c2392d6a449f59fcbcb.exe 37 PID 2692 wrote to memory of 2708 2692 48de7633a9738c2392d6a449f59fcbcb.exe 37 PID 2692 wrote to memory of 2708 2692 48de7633a9738c2392d6a449f59fcbcb.exe 37 PID 2692 wrote to memory of 2708 2692 48de7633a9738c2392d6a449f59fcbcb.exe 37 PID 2708 wrote to memory of 1840 2708 wmplayer.exe 38 PID 2708 wrote to memory of 1840 2708 wmplayer.exe 38 PID 2708 wrote to memory of 1840 2708 wmplayer.exe 38 PID 2708 wrote to memory of 1840 2708 wmplayer.exe 38 PID 1840 wrote to memory of 264 1840 colorcpl.exe 40 PID 1840 wrote to memory of 264 1840 colorcpl.exe 40 PID 1840 wrote to memory of 264 1840 colorcpl.exe 40 PID 1840 wrote to memory of 264 1840 colorcpl.exe 40 PID 1840 wrote to memory of 264 1840 colorcpl.exe 40
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\48de7633a9738c2392d6a449f59fcbcb.exe"C:\Users\Admin\AppData\Local\Temp\48de7633a9738c2392d6a449f59fcbcb.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:UserProfile3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2744
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵PID:2204
-
-
C:\Windows\regedit.exe"C:\Windows\regedit.exe"3⤵
- Runs regedit.exe
PID:2632
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"3⤵PID:1316
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"3⤵PID:2660
-
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe"3⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"4⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"5⤵PID:264
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5b35f4a2eea6c80ecc9d58c18811a12d4
SHA155b717e4286df35ca87c8dbd7703b8f395bd45f8
SHA25680d2a7152d3703c702232735c1ac812d8744375dee989928c1f2a51aaf49d513
SHA5127f560d1eeb090f0c9dfbf2a09a96d4aaf62410a781ac2f813297f7e37651916540ec9bd96ed54acca5dda67f210970912547bb35b18956e14878c8dbec3610b7
-
Filesize
40B
MD52f245469795b865bdd1b956c23d7893d
SHA16ad80b974d3808f5a20ea1e766c7d2f88b9e5895
SHA2561662d01a2d47b875a34fc7a8cd92e78cb2ba7f34023c7fd2639cbb10b8d94361
SHA512909f189846a5d2db208a5eb2e7cb3042c0f164caf437e2b1b6de608c0a70e4f3510b81b85753dbeec1e211e6a83e6ea8c96aff896e9b6e8ed42014473a54dc4f
-
Filesize
40B
MD5d63a82e5d81e02e399090af26db0b9cb
SHA191d0014c8f54743bba141fd60c9d963f869d76c9
SHA256eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae
SHA51238afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad
-
Filesize
40B
MD5ba3b6bc807d4f76794c4b81b09bb9ba5
SHA124cb89501f0212ff3095ecc0aba97dd563718fb1
SHA2566eebf968962745b2e9de2ca969af7c424916d4e3fe3cc0bb9b3d414abfce9507
SHA512ecd07e601fc9e3cfc39addd7bd6f3d7f7ff3253afb40bf536e9eaac5a4c243e5ec40fbfd7b216cb0ea29f2517419601e335e33ba19dea4a46f65e38694d465bf