Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
31-10-2024 14:32
Static task
static1
Behavioral task
behavioral1
Sample
fattura di pagamento.exe
Resource
win7-20240903-en
windows7-x64
General
-
Target
fattura di pagamento.exe
-
Size
1.1MB
-
MD5
1b279ea4e3f5c082c7ec98c138e86c1c
-
SHA1
7f4a38dadd8891334f49d07359933d41c8830f67
-
SHA256
77fa31d14cbf45df9fb36ebe8a7252e18cffca5add1d9a52a601b44367b5aad5
-
SHA512
e441b8967f27a4f03fd5bbd1140e00394190cb92afd9c4eb3c7076ac50a424ed2102ce3e478f4550f5e3f03cb87f892733703d745637a3cdafe834b1ea4a46ca
-
SSDEEP
24576:0RmJkcoQricOIQxiZY1iaBPXyiJqQEa7bEw20doU7OiCjNd:RJZoQrbTFZY1iaBPseEw20frid
Malware Config
Extracted
formbook
4.1
nu01
ickleball.codes
avornow.top
rejike.shop
zean.pro
yanbeyan.net
atwithsushi.fun
heimpactphilanthropy.info
ersonal-loans-82514.bond
pringfestpro.xyz
eniorhousings.live
anda-tax.online
d8ul135j.top
nder168.xyz
ealthcare-softwares-my-pl.xyz
7w1q.bond
83167836550.online
etinjo.net
hukira.xyz
ocalip.cloud
cqnh6.digital
503.top
lockchaincommunity.africa
q2vtm.club
6yy.xyz
inling.world
edroomsinmx-in.bond
oing3.cfd
ite.style
v7spf78.christmas
lein-curacao.info
rkyzgnmwd.xyz
ar-loans-86831.bond
outh32hubs.top
agamento-aiiepress.online
utritionistscourse.shop
nvaya.info
ygqntly.shop
heur365swiss.net
uelcard112.shop
eluniverses.xyz
panish-classes-62417.bond
ndsm.top
g6z5ndpx.mobi
ociobuzzyour.top
hiagency.net
ankeverything.net
nline-dating-sf-dz.online
all.school
0f57.bond
arinelayersaleshops.shop
askuda.pro
pttraining.info
riginaltheme.shop
nlinesuccesswithben.biz
jane1620.club
ysnails.net
ompleteconciergeliving.xyz
u-opts.shop
eamkakakads177.buzz
ealthcare-trends-60670.bond
t0rm23.top
gfdro.xyz
oundwav.xyz
ugarshift.net
trategicgrowthpartner.app
Signatures
-
Formbook family
-
Formbook payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2580-3-0x0000000000270000-0x000000000029F000-memory.dmp formbook behavioral2/memory/2580-7-0x0000000000270000-0x000000000029F000-memory.dmp formbook behavioral2/memory/2460-12-0x0000000001130000-0x000000000115F000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
fattura di pagamento.exesvchost.exewscript.exedescription pid Process procid_target PID 2040 set thread context of 2580 2040 fattura di pagamento.exe 87 PID 2580 set thread context of 3444 2580 svchost.exe 56 PID 2460 set thread context of 3444 2460 wscript.exe 56 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
fattura di pagamento.exewscript.execmd.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fattura di pagamento.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 3 IoCs
Processes:
Explorer.EXEdescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 62 IoCs
Processes:
svchost.exewscript.exepid Process 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2460 wscript.exe 2460 wscript.exe 2460 wscript.exe 2460 wscript.exe 2460 wscript.exe 2460 wscript.exe 2460 wscript.exe 2460 wscript.exe 2460 wscript.exe 2460 wscript.exe 2460 wscript.exe 2460 wscript.exe 2460 wscript.exe 2460 wscript.exe 2460 wscript.exe 2460 wscript.exe 2460 wscript.exe 2460 wscript.exe 2460 wscript.exe 2460 wscript.exe 2460 wscript.exe 2460 wscript.exe 2460 wscript.exe 2460 wscript.exe 2460 wscript.exe 2460 wscript.exe 2460 wscript.exe 2460 wscript.exe 2460 wscript.exe 2460 wscript.exe 2460 wscript.exe 2460 wscript.exe 2460 wscript.exe 2460 wscript.exe 2460 wscript.exe 2460 wscript.exe 2460 wscript.exe 2460 wscript.exe 2460 wscript.exe 2460 wscript.exe 2460 wscript.exe 2460 wscript.exe 2460 wscript.exe 2460 wscript.exe 2460 wscript.exe 2460 wscript.exe 2460 wscript.exe 2460 wscript.exe 2460 wscript.exe 2460 wscript.exe 2460 wscript.exe 2460 wscript.exe 2460 wscript.exe 2460 wscript.exe 2460 wscript.exe 2460 wscript.exe 2460 wscript.exe 2460 wscript.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
fattura di pagamento.exesvchost.exewscript.exepid Process 2040 fattura di pagamento.exe 2040 fattura di pagamento.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2460 wscript.exe 2460 wscript.exe -
Suspicious use of AdjustPrivilegeToken 18 IoCs
Processes:
svchost.exeExplorer.EXEwscript.exedescription pid Process Token: SeDebugPrivilege 2580 svchost.exe Token: SeShutdownPrivilege 3444 Explorer.EXE Token: SeCreatePagefilePrivilege 3444 Explorer.EXE Token: SeShutdownPrivilege 3444 Explorer.EXE Token: SeCreatePagefilePrivilege 3444 Explorer.EXE Token: SeShutdownPrivilege 3444 Explorer.EXE Token: SeCreatePagefilePrivilege 3444 Explorer.EXE Token: SeShutdownPrivilege 3444 Explorer.EXE Token: SeCreatePagefilePrivilege 3444 Explorer.EXE Token: SeDebugPrivilege 2460 wscript.exe Token: SeShutdownPrivilege 3444 Explorer.EXE Token: SeCreatePagefilePrivilege 3444 Explorer.EXE Token: SeShutdownPrivilege 3444 Explorer.EXE Token: SeCreatePagefilePrivilege 3444 Explorer.EXE Token: SeShutdownPrivilege 3444 Explorer.EXE Token: SeCreatePagefilePrivilege 3444 Explorer.EXE Token: SeShutdownPrivilege 3444 Explorer.EXE Token: SeCreatePagefilePrivilege 3444 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid Process 3444 Explorer.EXE 3444 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid Process 3444 Explorer.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
fattura di pagamento.exeExplorer.EXEwscript.exedescription pid Process procid_target PID 2040 wrote to memory of 2580 2040 fattura di pagamento.exe 87 PID 2040 wrote to memory of 2580 2040 fattura di pagamento.exe 87 PID 2040 wrote to memory of 2580 2040 fattura di pagamento.exe 87 PID 2040 wrote to memory of 2580 2040 fattura di pagamento.exe 87 PID 3444 wrote to memory of 2460 3444 Explorer.EXE 88 PID 3444 wrote to memory of 2460 3444 Explorer.EXE 88 PID 3444 wrote to memory of 2460 3444 Explorer.EXE 88 PID 2460 wrote to memory of 2848 2460 wscript.exe 92 PID 2460 wrote to memory of 2848 2460 wscript.exe 92 PID 2460 wrote to memory of 2848 2460 wscript.exe 92
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\fattura di pagamento.exe"C:\Users\Admin\AppData\Local\Temp\fattura di pagamento.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\fattura di pagamento.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2580
-
-
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2848
-
-