Analysis
-
max time kernel
146s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
25-09-2024 01:39
General
-
Target
SOA CARGO SHIPPING-202409-USD-24405.00.exe
-
Size
1.1MB
-
MD5
d2e4e90dd7b91cdedd4f5f2fe58184b0
-
SHA1
9bb020d804cb5119842b15dd6cec240337ebb5b3
-
SHA256
d680261fb4d68f03216d8cb56648bce8a416b821a9692e14789eccbe24c8f04f
-
SHA512
38a37a4c69286b7d34b86ae5ab27ac76d26868a329e86ff0342f31d5ef25c408f25328999bfa970b86f2fac67cf7f00875bdd8b5d5751b1d8d281c44028563ed
-
SSDEEP
24576:uRmJkcoQricOIQxiZY1iaC+Yu82vCaskCebDy0DQ:7JZoQrbTFZY1iaC+QgC5Svy7
Malware Config
Extracted
formbook
4.1
e62s
ellinksa.shop
uckyspinph.xyz
owdark.net
arriage-therapy-72241.bond
w7ijko4rv4p97b.top
heirbuzzwords.buzz
aspart.shop
ctivemail5-kagoya-com.info
shacertification9.shop
zitcd65k3.buzz
llkosoi.info
ru8.info
rhgtrdjdjykyetrdjftd.buzz
yschoollist.kiwi
oftfolio.online
rograma-de-almacen-2.online
oudoarms.top
mwquas.xyz
orjagaucha.website
nlinechat-mh.online
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload 3 IoCs
-
Suspicious use of SetThreadContext 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Suspicious behavior: EnumeratesProcesses 60 IoCs
-
Suspicious behavior: MapViewOfSection 7 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 6 IoCs
-
Suspicious use of SendNotifyMessage 6 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SOA CARGO SHIPPING-202409-USD-24405.00.exe"C:\Users\Admin\AppData\Local\Temp\SOA CARGO SHIPPING-202409-USD-24405.00.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\SOA CARGO SHIPPING-202409-USD-24405.00.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1420,i,11708048364682646792,608099842549576907,262144 --variations-seed-version --mojo-platform-channel-handle=1020 /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
188KB
-
Filesize
3.3MB
-
Filesize
188KB
-
Filesize
84KB
-
Filesize
4.0MB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
188KB