Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
17-12-2024 11:58
Static task
static1
Behavioral task
behavioral1
Sample
7e0e0bc4dd67c9e124e88b86e5dee610fc737bc40102656888772b4ded881704.exe
Resource
win7-20240903-en
General
-
Target
7e0e0bc4dd67c9e124e88b86e5dee610fc737bc40102656888772b4ded881704.exe
-
Size
693KB
-
MD5
eb3553d7605cd30697dae8b513ff6341
-
SHA1
242ddea5e4a332227601c7c5ab433ef051f493e0
-
SHA256
7e0e0bc4dd67c9e124e88b86e5dee610fc737bc40102656888772b4ded881704
-
SHA512
3fc226364bc3d6f8245460deda845fe6ad4ab31e4becb44bca4bca690358537e3635cc9457e71fdd81f8bc6c532756777a2ab09b264fd359d3a42823fab1d83a
-
SSDEEP
12288:AW3lK5SX0mH7pCJVMLqc34rB+5m430uJtLL8ROLPOeZb7bnxGzmNpsxIKF/PBIYU:DpCJVGqcorMsbuHwOLPOeZfbnosCBPm5
Malware Config
Extracted
formbook
4.1
sg11
rivileged.shop
itagomes.net
uncnp.shop
oodieshub.store
511110.com
vilertb.xyz
amlaketelaotions.online
arehouse-inventory-17910.bond
bwnkyjm.top
etrocognizant.info
rlokna.online
dgib.bid
vhgr.link
5106.loans
ollywoodbets.study
ndrewhussie.social
orkouttracker.net
odvoices.help
three6.buzz
gilesuite.app
2104.vip
fewd.boutique
enghis-solution.online
tpgamejagoan303.store
etsimple.dev
leaning-services-17930.bond
ountapi.net
thos-team.icu
fricamusicalworldtour.world
esus-game.site
ystest.info
uzgarotokurtarici.online
avelk.xyz
arax.online
rotechassisten.store
megaenz.xyz
orldlibertyfinanical.xyz
istribution-scroli.net
kwiqe.info
tbjqo.info
ingkong888.icu
etfamily.xyz
omoconectar.info
hoknows.life
osledniybogatyrnaslede.online
yotosphere.site
ensa777gacor.site
zxl.top
team-picturesys.online
iamesesandwichonsol.fun
ightyoak.industries
vdal.info
p663.top
opc.top
uy-now-pay-later-48656.bond
c5io1wz6.asia
oxboy.gay
owboytrader.online
ackpotrummy.icu
agorajaku4d.site
airplay365.net
eritagesportsb.shop
583377.app
istrictec.shop
ojws.website
Signatures
-
Formbook family
-
Formbook payload 1 IoCs
resource yara_rule behavioral1/memory/996-24-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2596 powershell.exe 2740 powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2260 set thread context of 996 2260 7e0e0bc4dd67c9e124e88b86e5dee610fc737bc40102656888772b4ded881704.exe 36 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7e0e0bc4dd67c9e124e88b86e5dee610fc737bc40102656888772b4ded881704.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2624 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2260 7e0e0bc4dd67c9e124e88b86e5dee610fc737bc40102656888772b4ded881704.exe 2260 7e0e0bc4dd67c9e124e88b86e5dee610fc737bc40102656888772b4ded881704.exe 2260 7e0e0bc4dd67c9e124e88b86e5dee610fc737bc40102656888772b4ded881704.exe 2260 7e0e0bc4dd67c9e124e88b86e5dee610fc737bc40102656888772b4ded881704.exe 2260 7e0e0bc4dd67c9e124e88b86e5dee610fc737bc40102656888772b4ded881704.exe 2260 7e0e0bc4dd67c9e124e88b86e5dee610fc737bc40102656888772b4ded881704.exe 2260 7e0e0bc4dd67c9e124e88b86e5dee610fc737bc40102656888772b4ded881704.exe 996 7e0e0bc4dd67c9e124e88b86e5dee610fc737bc40102656888772b4ded881704.exe 2596 powershell.exe 2740 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2260 7e0e0bc4dd67c9e124e88b86e5dee610fc737bc40102656888772b4ded881704.exe Token: SeDebugPrivilege 2596 powershell.exe Token: SeDebugPrivilege 2740 powershell.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 2260 wrote to memory of 2596 2260 7e0e0bc4dd67c9e124e88b86e5dee610fc737bc40102656888772b4ded881704.exe 30 PID 2260 wrote to memory of 2596 2260 7e0e0bc4dd67c9e124e88b86e5dee610fc737bc40102656888772b4ded881704.exe 30 PID 2260 wrote to memory of 2596 2260 7e0e0bc4dd67c9e124e88b86e5dee610fc737bc40102656888772b4ded881704.exe 30 PID 2260 wrote to memory of 2596 2260 7e0e0bc4dd67c9e124e88b86e5dee610fc737bc40102656888772b4ded881704.exe 30 PID 2260 wrote to memory of 2740 2260 7e0e0bc4dd67c9e124e88b86e5dee610fc737bc40102656888772b4ded881704.exe 32 PID 2260 wrote to memory of 2740 2260 7e0e0bc4dd67c9e124e88b86e5dee610fc737bc40102656888772b4ded881704.exe 32 PID 2260 wrote to memory of 2740 2260 7e0e0bc4dd67c9e124e88b86e5dee610fc737bc40102656888772b4ded881704.exe 32 PID 2260 wrote to memory of 2740 2260 7e0e0bc4dd67c9e124e88b86e5dee610fc737bc40102656888772b4ded881704.exe 32 PID 2260 wrote to memory of 2624 2260 7e0e0bc4dd67c9e124e88b86e5dee610fc737bc40102656888772b4ded881704.exe 33 PID 2260 wrote to memory of 2624 2260 7e0e0bc4dd67c9e124e88b86e5dee610fc737bc40102656888772b4ded881704.exe 33 PID 2260 wrote to memory of 2624 2260 7e0e0bc4dd67c9e124e88b86e5dee610fc737bc40102656888772b4ded881704.exe 33 PID 2260 wrote to memory of 2624 2260 7e0e0bc4dd67c9e124e88b86e5dee610fc737bc40102656888772b4ded881704.exe 33 PID 2260 wrote to memory of 996 2260 7e0e0bc4dd67c9e124e88b86e5dee610fc737bc40102656888772b4ded881704.exe 36 PID 2260 wrote to memory of 996 2260 7e0e0bc4dd67c9e124e88b86e5dee610fc737bc40102656888772b4ded881704.exe 36 PID 2260 wrote to memory of 996 2260 7e0e0bc4dd67c9e124e88b86e5dee610fc737bc40102656888772b4ded881704.exe 36 PID 2260 wrote to memory of 996 2260 7e0e0bc4dd67c9e124e88b86e5dee610fc737bc40102656888772b4ded881704.exe 36 PID 2260 wrote to memory of 996 2260 7e0e0bc4dd67c9e124e88b86e5dee610fc737bc40102656888772b4ded881704.exe 36 PID 2260 wrote to memory of 996 2260 7e0e0bc4dd67c9e124e88b86e5dee610fc737bc40102656888772b4ded881704.exe 36 PID 2260 wrote to memory of 996 2260 7e0e0bc4dd67c9e124e88b86e5dee610fc737bc40102656888772b4ded881704.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\7e0e0bc4dd67c9e124e88b86e5dee610fc737bc40102656888772b4ded881704.exe"C:\Users\Admin\AppData\Local\Temp\7e0e0bc4dd67c9e124e88b86e5dee610fc737bc40102656888772b4ded881704.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\7e0e0bc4dd67c9e124e88b86e5dee610fc737bc40102656888772b4ded881704.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2596
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\SQYXsFvPFd.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2740
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SQYXsFvPFd" /XML "C:\Users\Admin\AppData\Local\Temp\tmp95CA.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2624
-
-
C:\Users\Admin\AppData\Local\Temp\7e0e0bc4dd67c9e124e88b86e5dee610fc737bc40102656888772b4ded881704.exe"C:\Users\Admin\AppData\Local\Temp\7e0e0bc4dd67c9e124e88b86e5dee610fc737bc40102656888772b4ded881704.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:996
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD57d2371ae936416091577fcd2351a7162
SHA119cb2d026c805e298306db331915248767cbf310
SHA256f4ef4e5bc720fa2b3d77ed6da89904add558715a4779eee03e89c86189983908
SHA512df24fac7d748222357787a256292256ca087210b82c67b1ad154c118cffd6241da751c216522ee1dff26fdfacf116a417396e99df3d8abbadf164cb21cd62ebf
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\7SK4UYVONWJ4NXGD869V.temp
Filesize7KB
MD5123f3ad26803df2e86b332f08f7b27bc
SHA1c52c5f0f48dddec23c365c100e7008269fc06f66
SHA25615354972ab4139f310f0dd0db5568c2cf0d5a583c33cd21ff28a58402c2368a0
SHA51253f1506fbd3aa1ed78ba57d9a3e11d03f9ad141de2d4c241c2f71e62a8d7c3c8a45246a36bcfda251952b5914931888b6691e899f3bbd2de807945539ccc7e05