Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
24-09-2024 11:12
Static task
static1
Behavioral task
behavioral1
Sample
P.O 124.exe
Resource
win7-20240903-en
General
-
Target
P.O 124.exe
-
Size
603KB
-
MD5
5a7b139855700ca803dbc54daa52567e
-
SHA1
ed76b03d085d9a11a410c4f2bfa056d6c9639176
-
SHA256
223786813c2b26e84549506a10b63d6a7c619f99551cf4abaf636d1588f8a001
-
SHA512
64def05a152fc1c10ef1c8d27e27ef33338dabb5665d8d6897f6d7db0388cfbfc2a42a808ecdda96ce32d7dd14221ba4c84a22333626f26b40036fd0a83d6d2c
-
SSDEEP
12288:QOq8bQbKxrRaWJyBpk5Qs+/hsJntO3XOJWkdzdwSjNenBr0Q+p/PKxxQtmvV:Q0IKxhJwkO/intOOJNdz6ENGBYTZaN
Malware Config
Extracted
formbook
4.1
c24t
ealthbridgeccs.online
ngelicais.art
uktuksu1.sbs
fapoker.asia
hecreature.tech
orenzoplaybest14.xyz
op-smartphones-deal.today
delark.click
7395.asia
otnews.cfd
j16e.xyz
oko.events
fscxb.top
roudtxliberals.vote
asas-br.bond
ourhealthyourlife.shop
fbpd.top
j9u9.xyz
uijiuw.top
aming-chair-37588.bond
uaweiharmony.top
458881233.men
ewancash.boats
mss-rb2.net
472.top
yhomeshop.online
j88.travel
02s-pest-control-us-ze.fun
oinl.club
ouseware.today
1385.net
eviewmadu.top
khizmetlergirisyapzzz2024.net
dcnn.net
aketrtpmvpslot88.info
hoys.club
ealerslot.net
consuyt.xyz
ilw.legal
aithful.events
est-life-insurance-2507.today
rvinsadeli.dev
sx9u.shop
23fd595ig.autos
yrhbt.shop
commerce-74302.bond
lc-driving-school.net
7y1ps.shop
earing-tests-69481.bond
amilablackwell.online
venir-bienne.info
024tengxun396.buzz
ocoani.shop
arage-door-repair-1.today
entista-esp.today
vto.stream
loud-computing-intl-3455364.fyi
9790.club
us-inbox-messages.online
aser-hair-removal-90284.bond
etangkhap99.lol
leaningjobs-cz.today
nline-courses-classes-lv-1.bond
essislotgoal14.xyz
ridges-freezers-56090.bond
Signatures
-
Formbook payload 3 IoCs
resource yara_rule behavioral2/memory/2836-11-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2836-17-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3544-62-0x0000000000D00000-0x0000000000D2F000-memory.dmp formbook -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3480 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation P.O 124.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 712 set thread context of 2836 712 P.O 124.exe 84 PID 2836 set thread context of 3444 2836 P.O 124.exe 55 PID 3544 set thread context of 3444 3544 ipconfig.exe 55 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language P.O 124.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ipconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 3544 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 712 P.O 124.exe 712 P.O 124.exe 2836 P.O 124.exe 2836 P.O 124.exe 2836 P.O 124.exe 2836 P.O 124.exe 3480 powershell.exe 3480 powershell.exe 3544 ipconfig.exe 3544 ipconfig.exe 3544 ipconfig.exe 3544 ipconfig.exe 3544 ipconfig.exe 3544 ipconfig.exe 3544 ipconfig.exe 3544 ipconfig.exe 3544 ipconfig.exe 3544 ipconfig.exe 3544 ipconfig.exe 3544 ipconfig.exe 3544 ipconfig.exe 3544 ipconfig.exe 3544 ipconfig.exe 3544 ipconfig.exe 3544 ipconfig.exe 3544 ipconfig.exe 3544 ipconfig.exe 3544 ipconfig.exe 3544 ipconfig.exe 3544 ipconfig.exe 3544 ipconfig.exe 3544 ipconfig.exe 3544 ipconfig.exe 3544 ipconfig.exe 3544 ipconfig.exe 3544 ipconfig.exe 3544 ipconfig.exe 3544 ipconfig.exe 3544 ipconfig.exe 3544 ipconfig.exe 3544 ipconfig.exe 3544 ipconfig.exe 3544 ipconfig.exe 3544 ipconfig.exe 3544 ipconfig.exe 3544 ipconfig.exe 3544 ipconfig.exe 3544 ipconfig.exe 3544 ipconfig.exe 3544 ipconfig.exe 3544 ipconfig.exe 3544 ipconfig.exe 3544 ipconfig.exe 3544 ipconfig.exe 3544 ipconfig.exe 3544 ipconfig.exe 3544 ipconfig.exe 3544 ipconfig.exe 3544 ipconfig.exe 3544 ipconfig.exe 3544 ipconfig.exe 3544 ipconfig.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 2836 P.O 124.exe 2836 P.O 124.exe 2836 P.O 124.exe 3544 ipconfig.exe 3544 ipconfig.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 712 P.O 124.exe Token: SeDebugPrivilege 2836 P.O 124.exe Token: SeDebugPrivilege 3480 powershell.exe Token: SeDebugPrivilege 3544 ipconfig.exe Token: SeShutdownPrivilege 3444 Explorer.EXE Token: SeCreatePagefilePrivilege 3444 Explorer.EXE -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 3444 Explorer.EXE 3444 Explorer.EXE 3444 Explorer.EXE -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 3444 Explorer.EXE 3444 Explorer.EXE 3444 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 712 wrote to memory of 3480 712 P.O 124.exe 82 PID 712 wrote to memory of 3480 712 P.O 124.exe 82 PID 712 wrote to memory of 3480 712 P.O 124.exe 82 PID 712 wrote to memory of 2836 712 P.O 124.exe 84 PID 712 wrote to memory of 2836 712 P.O 124.exe 84 PID 712 wrote to memory of 2836 712 P.O 124.exe 84 PID 712 wrote to memory of 2836 712 P.O 124.exe 84 PID 712 wrote to memory of 2836 712 P.O 124.exe 84 PID 712 wrote to memory of 2836 712 P.O 124.exe 84 PID 3444 wrote to memory of 3544 3444 Explorer.EXE 85 PID 3444 wrote to memory of 3544 3444 Explorer.EXE 85 PID 3444 wrote to memory of 3544 3444 Explorer.EXE 85 PID 3544 wrote to memory of 3252 3544 ipconfig.exe 86 PID 3544 wrote to memory of 3252 3544 ipconfig.exe 86 PID 3544 wrote to memory of 3252 3544 ipconfig.exe 86
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\P.O 124.exe"C:\Users\Admin\AppData\Local\Temp\P.O 124.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:712 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\P.O 124.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3480
-
-
C:\Users\Admin\AppData\Local\Temp\P.O 124.exe"C:\Users\Admin\AppData\Local\Temp\P.O 124.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2836
-
-
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\P.O 124.exe"3⤵
- System Location Discovery: System Language Discovery
PID:3252
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82