Analysis
-
max time kernel
147s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
22-12-2024 18:40
Static task
static1
Behavioral task
behavioral1
Sample
jetssofftr543.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
jetssofftr543.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
mnfvgv.exe
Resource
win7-20241023-en
Behavioral task
behavioral4
Sample
mnfvgv.exe
Resource
win10v2004-20241007-en
General
-
Target
jetssofftr543.exe
-
Size
221KB
-
MD5
c7c81ed3f21ca0f92316446946656c39
-
SHA1
d1a3c9c4a1ac579184967f604193f8c1f1c41693
-
SHA256
aad5593f8b48c2e45fb2344146ac1a16e79addf9fe859cf74c005b8c0b5bc452
-
SHA512
38b49646496bdaed201b855b0fe6fa5783102a780ff8a55bfa97a37cf53ccc9ab6cd36a234ae6bab1e488c741bc42879fe96a32aff3ed7906653d9e78ae25121
-
SSDEEP
6144:MEa0NUspTCne0ehbO4+MfVzDPdTG3xVzu5W+3uf:XUsp2epf+mT6VzaK
Malware Config
Extracted
formbook
4.1
je14
innervisionbuildings.com
theenergysocialite.com
565548.com
panghr.com
onlyonesolutions.com
stjohnzone6.com
cnotes.rest
helfeb.online
xixi-s-inc.club
easilyentered.com
theshopx.store
mrclean-ac.com
miamibeachwateradventures.com
jpearce.co.uk
seseragi-bunkou.com
minimaddie.com
commbank-help-849c3.com
segohandelsonderneming.com
namthanhreal.com
fototerapi.online
your-download.com
klindt.one
sellerscourt.com
francoislambert.store
smokedoutvapes.co.uk
rundacg.com
flavors-and-spices-lyon.com
qifengsuo.com
sunnyislesgardens.com
tunneldutransit.com
restorecodes.website
blast4me.com
bingser.space
co-gpco.com
emporioaliwen.com
mr5g.com
abcp666.com
consulvip.net
sagaming168.info
zjpbhsuz.top
socal-labworx.com
arethaglennevents.com
rafiqsiregar.com
esgh2.com
veirdmusic.com
abzcc.xyz
8065yp.com
dronebazar.com
duetpbr.com
apartamentoslaencantada.com
digigold.info
homedecorsuppliers.com
duenorthrm.com
xmmdsy.com
ddstennessee.com
marmeluz.com
ragnallhess.com
methinelli.com
randomlymetheseer.com
magicgrowthproducts.com
shreejistudio.com
mattress-37684.com
yellyfishfilms.com
www1111cpw.com
tigermedlagroup.com
Signatures
-
Formbook family
-
Formbook payload 3 IoCs
resource yara_rule behavioral1/memory/3032-12-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/3032-15-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2916-22-0x0000000000070000-0x000000000009F000-memory.dmp formbook -
Executes dropped EXE 2 IoCs
pid Process 2288 mnfvgv.exe 3032 mnfvgv.exe -
Loads dropped DLL 2 IoCs
pid Process 3012 jetssofftr543.exe 2288 mnfvgv.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2288 set thread context of 3032 2288 mnfvgv.exe 31 PID 3032 set thread context of 1344 3032 mnfvgv.exe 21 PID 2916 set thread context of 1344 2916 wscript.exe 21 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jetssofftr543.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mnfvgv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
pid Process 3032 mnfvgv.exe 3032 mnfvgv.exe 2916 wscript.exe 2916 wscript.exe 2916 wscript.exe 2916 wscript.exe 2916 wscript.exe 2916 wscript.exe 2916 wscript.exe 2916 wscript.exe 2916 wscript.exe 2916 wscript.exe 2916 wscript.exe 2916 wscript.exe 2916 wscript.exe 2916 wscript.exe 2916 wscript.exe 2916 wscript.exe 2916 wscript.exe 2916 wscript.exe 2916 wscript.exe 2916 wscript.exe 2916 wscript.exe 2916 wscript.exe 2916 wscript.exe 2916 wscript.exe 2916 wscript.exe 2916 wscript.exe 2916 wscript.exe 2916 wscript.exe 2916 wscript.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 2288 mnfvgv.exe 3032 mnfvgv.exe 3032 mnfvgv.exe 3032 mnfvgv.exe 2916 wscript.exe 2916 wscript.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3032 mnfvgv.exe Token: SeDebugPrivilege 2916 wscript.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 3012 wrote to memory of 2288 3012 jetssofftr543.exe 30 PID 3012 wrote to memory of 2288 3012 jetssofftr543.exe 30 PID 3012 wrote to memory of 2288 3012 jetssofftr543.exe 30 PID 3012 wrote to memory of 2288 3012 jetssofftr543.exe 30 PID 2288 wrote to memory of 3032 2288 mnfvgv.exe 31 PID 2288 wrote to memory of 3032 2288 mnfvgv.exe 31 PID 2288 wrote to memory of 3032 2288 mnfvgv.exe 31 PID 2288 wrote to memory of 3032 2288 mnfvgv.exe 31 PID 2288 wrote to memory of 3032 2288 mnfvgv.exe 31 PID 1344 wrote to memory of 2916 1344 Explorer.EXE 32 PID 1344 wrote to memory of 2916 1344 Explorer.EXE 32 PID 1344 wrote to memory of 2916 1344 Explorer.EXE 32 PID 1344 wrote to memory of 2916 1344 Explorer.EXE 32 PID 2916 wrote to memory of 2488 2916 wscript.exe 33 PID 2916 wrote to memory of 2488 2916 wscript.exe 33 PID 2916 wrote to memory of 2488 2916 wscript.exe 33 PID 2916 wrote to memory of 2488 2916 wscript.exe 33
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\jetssofftr543.exe"C:\Users\Admin\AppData\Local\Temp\jetssofftr543.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\mnfvgv.exe"C:\Users\Admin\AppData\Local\Temp\mnfvgv.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\mnfvgv.exe"C:\Users\Admin\AppData\Local\Temp\mnfvgv.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3032
-
-
-
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\mnfvgv.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2488
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD53d4499d3223b637035a9ea797bc04a9b
SHA1979e0f0f542f473406c121187ba0d2833da5f3ce
SHA256e8ac6c1d309e48d85d535d7b14cd44cfa2228fb5b5db89365320daa112fcb799
SHA512581b2daf1591afb5125ff4bb79159ac22870a40a13927bd6f0cd3dac6753b3a3227003bead69afdb0fa59cfabc6dfc051f287d58fca87ccbd07c7054a041fbba
-
Filesize
5KB
MD5137b470cf175ff012ce04ab666292bb9
SHA1a209a552395357ad7eed4d1fd11e79af8de125a0
SHA2565fb54480c1a5ea91ed623fdc7301c8d09c8d7c8dd55de4a4b9b5357586760f3e
SHA5120852a552f77146847d39a24e8dd30f78ffa210d07942941478133cc5ddb98544a12b15c9d25f85d78859327af4dcc7204b8955c620583a90b26b87d0db037b12
-
Filesize
185KB
MD58b391f4eea0c400d8a2dab4b4d7539b3
SHA18a5efe608e38f6dd2dda851d9bc442a0150112af
SHA2563f4063d573ecd85272fc92547af4e7d8406d192f4e67bc62c846172e9e4ee14b
SHA512f9e3aa22e625dadcfc6a45e14568a638c42bfc2a9e1685c2ad5281f629594c73d12618e1c86c2cccfd99d4571a9bfa2471051f6de1fe998f97d8d7d5b64c83e6