Analysis
-
max time kernel
148s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 16:24
Static task
static1
Behavioral task
behavioral1
Sample
New Order.exe
Resource
win7-20240903-en
General
-
Target
New Order.exe
-
Size
930KB
-
MD5
72428a6ac37aef0e13873a0073d9c8ef
-
SHA1
3532378eefb34413d60e6d891e74ea4c26a82cab
-
SHA256
d4aeb9c4ddc4e76367bf99592f6f922336e21345833c44093deea1248a5fe844
-
SHA512
fc28fd26bccfea2290d3290575f0f49798abd2bb77a15b7af9817c1f929409847b9ee33f6e6229c39c1267d597d03c5f45824456e6edc05b481e1830ee0df5ac
-
SSDEEP
12288:i3csGI/cHv3QZJTpiHj3GqVP27dPPPIpFF1s+1gUth+qz5IZvmc4FTlhCKCMvd2U:i83QZJoD3GYgdfQhR5IZvkXnF
Malware Config
Extracted
formbook
4.1
odse
braedlifestyle.com
morganjohnsondesign.online
surup-v48.club
diypoolpaint.sydney
v-b7026-ghhh.space
vetyvar.com
lollydaisy.com
campsitesurvival.com
autocalibre.com
fusiontech3d.com
xn--udkog0cvez259c82sa.xyz
eccentricartist.com
jc-zg.com
wacwin.com
livehealthychoice.com
visijuara.com
phigsa.com
sabayawork.com
afcerd.com
joeyshousesessions.com
fancycn.com
fem-iam.com
sinopocasles.com
skypalaceportal.com
wqajecjeias.com
selfscienceslabs.com
workingtitle.agency
asianartsawards.com
healtyhouse.com
iloveme.life
espacioleiva.com
dac71047.com
soldbygenajohnson.com
motherhenscoop.com
polkadotcoins.com
muslimmediation.com
grub-groove.com
albertaeatsfood.com
mixedplaylists.com
miamimotorcycleshop.com
unegublog.com
generalssoccer.com
manhattanlandscapedesign.com
cuongnguyen3r2j.com
stonelodgeseniorliving.com
swissinternationaltrustb.com
novemento.club
bladesmts.com
espiaruncelular.net
talasoglufinans.com
sargeworld.com
newlifenowblog.com
sugaringpalms.com
xaoikevesesede.com
mintyline.com
paleonade.com
saharsaghi.com
kentchimney.com
whipitgudd.com
gmopst.com
likekopi.com
spoonproductions-catering.com
annotake.com
stm32heaven.com
guncelekspres.com
Signatures
-
Formbook family
-
Formbook payload 3 IoCs
resource yara_rule behavioral1/memory/2700-20-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/2700-24-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/2700-28-0x0000000000400000-0x000000000042E000-memory.dmp formbook -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 2492 set thread context of 2700 2492 New Order.exe 33 PID 2700 set thread context of 1212 2700 RegSvcs.exe 21 PID 2700 set thread context of 1212 2700 RegSvcs.exe 21 PID 2588 set thread context of 1212 2588 wuapp.exe 21 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language New Order.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuapp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2708 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 2492 New Order.exe 2700 RegSvcs.exe 2700 RegSvcs.exe 2700 RegSvcs.exe 2588 wuapp.exe 2588 wuapp.exe 2588 wuapp.exe 2588 wuapp.exe 2588 wuapp.exe 2588 wuapp.exe 2588 wuapp.exe 2588 wuapp.exe 2588 wuapp.exe 2588 wuapp.exe 2588 wuapp.exe 2588 wuapp.exe 2588 wuapp.exe 2588 wuapp.exe 2588 wuapp.exe 2588 wuapp.exe 2588 wuapp.exe 2588 wuapp.exe 2588 wuapp.exe 2588 wuapp.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 2700 RegSvcs.exe 2700 RegSvcs.exe 2700 RegSvcs.exe 2700 RegSvcs.exe 2588 wuapp.exe 2588 wuapp.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2492 New Order.exe Token: SeDebugPrivilege 2700 RegSvcs.exe Token: SeDebugPrivilege 2588 wuapp.exe -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 2492 wrote to memory of 2708 2492 New Order.exe 31 PID 2492 wrote to memory of 2708 2492 New Order.exe 31 PID 2492 wrote to memory of 2708 2492 New Order.exe 31 PID 2492 wrote to memory of 2708 2492 New Order.exe 31 PID 2492 wrote to memory of 2700 2492 New Order.exe 33 PID 2492 wrote to memory of 2700 2492 New Order.exe 33 PID 2492 wrote to memory of 2700 2492 New Order.exe 33 PID 2492 wrote to memory of 2700 2492 New Order.exe 33 PID 2492 wrote to memory of 2700 2492 New Order.exe 33 PID 2492 wrote to memory of 2700 2492 New Order.exe 33 PID 2492 wrote to memory of 2700 2492 New Order.exe 33 PID 2492 wrote to memory of 2700 2492 New Order.exe 33 PID 2492 wrote to memory of 2700 2492 New Order.exe 33 PID 2492 wrote to memory of 2700 2492 New Order.exe 33 PID 1212 wrote to memory of 2588 1212 Explorer.EXE 34 PID 1212 wrote to memory of 2588 1212 Explorer.EXE 34 PID 1212 wrote to memory of 2588 1212 Explorer.EXE 34 PID 1212 wrote to memory of 2588 1212 Explorer.EXE 34 PID 1212 wrote to memory of 2588 1212 Explorer.EXE 34 PID 1212 wrote to memory of 2588 1212 Explorer.EXE 34 PID 1212 wrote to memory of 2588 1212 Explorer.EXE 34 PID 2588 wrote to memory of 2976 2588 wuapp.exe 35 PID 2588 wrote to memory of 2976 2588 wuapp.exe 35 PID 2588 wrote to memory of 2976 2588 wuapp.exe 35 PID 2588 wrote to memory of 2976 2588 wuapp.exe 35
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\New Order.exe"C:\Users\Admin\AppData\Local\Temp\New Order.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gfwvJrxcf" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4885.tmp"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2708
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2700
-
-
-
C:\Windows\SysWOW64\wuapp.exe"C:\Windows\SysWOW64\wuapp.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2976
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5a966b3763e30da1314ab5fee23d9e724
SHA152677980441486077d8fe6ccf7b2e27914f14f54
SHA2560893d65949c972c84006e52e53bbaf8cd8fa4b121e72060c2434a312c1fd5d23
SHA512af1db55feebc4e94af2fa3d61c77e61afef7541cc2b297e86c1bac4c311be01b5a11c8e03bea3520a9cd7f4a072dab15aae80e4fdd631f346861ebbcccf2fb15