Analysis
-
max time kernel
299s -
max time network
300s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13-11-2024 00:09
Static task
static1
Behavioral task
behavioral1
Sample
decontare facturi pentru plata 12 noiembrie 2024.xlsx.exe
Resource
win7-20240903-en
windows7-x64
General
-
Target
decontare facturi pentru plata 12 noiembrie 2024.xlsx.exe
-
Size
845KB
-
MD5
7971ff7b23d758f07c695b8098759dc5
-
SHA1
c666b84f9b789cc6f56438b4d957795ab72db07b
-
SHA256
abd47ee3632ba7314a51a4f87cc129b9aa28fb684426f26c865fca09ad0ce46b
-
SHA512
ccb6bf09366b551a20700b58e355f72deb0dd4d42810cc66573483de8c925f9cd1bfbfccd3f1d90159787ea0be32cd348ac84d5b4e4fd70f1a509f9af30c1b36
-
SSDEEP
12288:ehkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4aCSFYeV0LPG8vkWO:uRmJkcoQricOIQxiZY1iaCTIvD
Malware Config
Extracted
formbook
4.1
ud04
oum7.pro
ovonordisk.online
akrzus.pro
tendmtedcpsa.site
mm.foo
animevyhgsft29817.click
digdxxb.info
1130.vip
uy-now-pay-later-74776.bond
ybzert.online
edcn.link
rime-flow-bay.xyz
nd777id.beauty
otoyama.shop
lranchomx.xyz
unluoren.top
uglesang-troms.net
udulbet88.net
raquewear.shop
ijanarko.net
iuxy.host
itaxia.dev
hisewntbqg.makeup
talianfood.store
22gxx.app
tandkite.fun
rovideoeditor.shop
ires-86307.bond
elitjatarjoukset.click
rofilern.net
uycarpaylater-02-t1e-01.today
futurum.xyz
inance15.site
alance-ton-budget.net
tpuniplay.shop
dlpli.xyz
riteon.online
rippyshaker.shop
rn10.top
linko1win.icu
ugeniolopez.art
raphic-design-degree-68380.bond
narchists.info
uy-now-pay-later-25573.bond
gzvmt.info
df.clinic
onesome.store
imba-168.net
ayef.xyz
64axyozkgl.top
dult-diapers-53774.bond
ec.baby
el-radu-easy4y.one
asik-eye-surgery-63293.bond
p-inbox4.click
0417.one
ualitystore.shop
partments-for-rent-61932.bond
enobscotlobster.online
fhou.link
eo56a3oouu.top
cweb.cyou
hoe-organizer-za.today
p806.top
2creativedesign.online
Signatures
-
Formbook family
-
Formbook payload 3 IoCs
resource yara_rule behavioral2/memory/2332-12-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2332-15-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2380-20-0x0000000000180000-0x00000000001AF000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 468 set thread context of 2332 468 decontare facturi pentru plata 12 noiembrie 2024.xlsx.exe 86 PID 2332 set thread context of 3560 2332 svchost.exe 56 PID 2380 set thread context of 3560 2380 cmmon32.exe 56 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language decontare facturi pentru plata 12 noiembrie 2024.xlsx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmmon32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2332 svchost.exe 2332 svchost.exe 2332 svchost.exe 2332 svchost.exe 2380 cmmon32.exe 2380 cmmon32.exe 2380 cmmon32.exe 2380 cmmon32.exe 2380 cmmon32.exe 2380 cmmon32.exe 2380 cmmon32.exe 2380 cmmon32.exe 2380 cmmon32.exe 2380 cmmon32.exe 2380 cmmon32.exe 2380 cmmon32.exe 2380 cmmon32.exe 2380 cmmon32.exe 2380 cmmon32.exe 2380 cmmon32.exe 2380 cmmon32.exe 2380 cmmon32.exe 2380 cmmon32.exe 2380 cmmon32.exe 2380 cmmon32.exe 2380 cmmon32.exe 2380 cmmon32.exe 2380 cmmon32.exe 2380 cmmon32.exe 2380 cmmon32.exe 2380 cmmon32.exe 2380 cmmon32.exe 2380 cmmon32.exe 2380 cmmon32.exe 2380 cmmon32.exe 2380 cmmon32.exe 2380 cmmon32.exe 2380 cmmon32.exe 2380 cmmon32.exe 2380 cmmon32.exe 2380 cmmon32.exe 2380 cmmon32.exe 2380 cmmon32.exe 2380 cmmon32.exe 2380 cmmon32.exe 2380 cmmon32.exe 2380 cmmon32.exe 2380 cmmon32.exe 2380 cmmon32.exe 2380 cmmon32.exe 2380 cmmon32.exe 2380 cmmon32.exe 2380 cmmon32.exe 2380 cmmon32.exe 2380 cmmon32.exe 2380 cmmon32.exe 2380 cmmon32.exe 2380 cmmon32.exe 2380 cmmon32.exe 2380 cmmon32.exe 2380 cmmon32.exe 2380 cmmon32.exe 2380 cmmon32.exe 2380 cmmon32.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 468 decontare facturi pentru plata 12 noiembrie 2024.xlsx.exe 2332 svchost.exe 2332 svchost.exe 2332 svchost.exe 2380 cmmon32.exe 2380 cmmon32.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeDebugPrivilege 2332 svchost.exe Token: SeShutdownPrivilege 3560 Explorer.EXE Token: SeCreatePagefilePrivilege 3560 Explorer.EXE Token: SeShutdownPrivilege 3560 Explorer.EXE Token: SeCreatePagefilePrivilege 3560 Explorer.EXE Token: SeShutdownPrivilege 3560 Explorer.EXE Token: SeCreatePagefilePrivilege 3560 Explorer.EXE Token: SeShutdownPrivilege 3560 Explorer.EXE Token: SeCreatePagefilePrivilege 3560 Explorer.EXE Token: SeShutdownPrivilege 3560 Explorer.EXE Token: SeCreatePagefilePrivilege 3560 Explorer.EXE Token: SeShutdownPrivilege 3560 Explorer.EXE Token: SeCreatePagefilePrivilege 3560 Explorer.EXE Token: SeShutdownPrivilege 3560 Explorer.EXE Token: SeCreatePagefilePrivilege 3560 Explorer.EXE Token: SeShutdownPrivilege 3560 Explorer.EXE Token: SeCreatePagefilePrivilege 3560 Explorer.EXE Token: SeShutdownPrivilege 3560 Explorer.EXE Token: SeCreatePagefilePrivilege 3560 Explorer.EXE Token: SeShutdownPrivilege 3560 Explorer.EXE Token: SeCreatePagefilePrivilege 3560 Explorer.EXE Token: SeDebugPrivilege 2380 cmmon32.exe Token: SeShutdownPrivilege 3560 Explorer.EXE Token: SeCreatePagefilePrivilege 3560 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3560 Explorer.EXE 3560 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3560 Explorer.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 468 wrote to memory of 2332 468 decontare facturi pentru plata 12 noiembrie 2024.xlsx.exe 86 PID 468 wrote to memory of 2332 468 decontare facturi pentru plata 12 noiembrie 2024.xlsx.exe 86 PID 468 wrote to memory of 2332 468 decontare facturi pentru plata 12 noiembrie 2024.xlsx.exe 86 PID 468 wrote to memory of 2332 468 decontare facturi pentru plata 12 noiembrie 2024.xlsx.exe 86 PID 3560 wrote to memory of 2380 3560 Explorer.EXE 87 PID 3560 wrote to memory of 2380 3560 Explorer.EXE 87 PID 3560 wrote to memory of 2380 3560 Explorer.EXE 87 PID 2380 wrote to memory of 3648 2380 cmmon32.exe 95 PID 2380 wrote to memory of 3648 2380 cmmon32.exe 95 PID 2380 wrote to memory of 3648 2380 cmmon32.exe 95
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\decontare facturi pentru plata 12 noiembrie 2024.xlsx.exe"C:\Users\Admin\AppData\Local\Temp\decontare facturi pentru plata 12 noiembrie 2024.xlsx.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\decontare facturi pentru plata 12 noiembrie 2024.xlsx.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2332
-
-
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵
- System Location Discovery: System Language Discovery
PID:3648
-
-