Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-01-2025 14:10
Static task
static1
Behavioral task
behavioral1
Sample
890983726372673.exe
Resource
win7-20240903-en
General
-
Target
890983726372673.exe
-
Size
722KB
-
MD5
0c883414fcda149f14bfe37c2bd9fc79
-
SHA1
cf99ca86cfac68a7414ce261bdbc04263de1ee77
-
SHA256
2040a0fdd0eddf11176cddce8489b0906e9bb6ed39b2c825f883e26a3309db57
-
SHA512
2cdce3e4094cd4c72d3f4618fdcbaac2548bbddb4b4471d7f3838817913574a8b63b890be5a1ed8ce0a244fe24114d6cc25004dcd6be8ae62c0703b7e1815067
-
SSDEEP
12288:ZSihRSUunB2fP+rnhBR44lSQ5XUIT7sLzm1BHS/YlJ/GOX89rUU0+KlQlNLn:0xnumz1UITez4BlR7XQ59KaHLn
Malware Config
Extracted
formbook
4.1
3nop
subur88wap.sbs
tyai1.top
skillbeast.site
kcclassiccars.net
lghomes.net
eijanno.cyou
work-in-usa-60100.bond
268chill.store
bharatwin.biz
cakjitu01.xyz
misafert.xyz
hiretemp.net
lvekz-onearmed.top
amanda-manopo.info
seo-companies22.online
casinowalletth.net
maynrson.monster
bewizi.com
thedronetechhub.shop
car-insurance-93947.bond
javabits.net
dzcodelab.xyz
adeelrao.online
amazing-cruise-pakages.today
wftoutsource.services
stormbeauty.online
a8dz7m5.com
875capehornrdjeffersonny.com
odadesign.site
reejunkremoval7.life
g59q18eq.top
wk0003.top
rtpradar138af.xyz
wnsyl11.vip
nexilis.rest
top-dubai-cruise-deals.today
zoril.lol
englishmaterials.net
uzumluescortg.xyz
dutchpay.net
visprintdesign.biz
kneepain661.shop
xuq-smart-fridge-uj0.rest
jam-nins.com
rentabay.shop
victoryvo2.info
i2c2.tech
wck37.top
refrigerators-69792.bond
abc1network.net
amilia-do-gil.net
806477628.xyz
luxdrive.vip
unika.lat
sculptify.today
winatwork.today
onlinegamehub.online
petnino.club
amtrade.icu
macular-degeneration-39252.bond
argastipster.click
1nvuti.fun
beautifyaura.com
savings-accounts-57645.bond
ok33r.shop
Signatures
-
Formbook family
-
Formbook payload 4 IoCs
resource yara_rule behavioral2/memory/1720-21-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1720-25-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1720-77-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4476-79-0x0000000000CA0000-0x0000000000CCF000-memory.dmp formbook -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4592 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation 890983726372673.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 4336 set thread context of 1720 4336 890983726372673.exe 99 PID 1720 set thread context of 3416 1720 RegSvcs.exe 56 PID 1720 set thread context of 3416 1720 RegSvcs.exe 56 PID 4476 set thread context of 3416 4476 mstsc.exe 56 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 890983726372673.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mstsc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3724 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 4336 890983726372673.exe 4336 890983726372673.exe 1720 RegSvcs.exe 1720 RegSvcs.exe 1720 RegSvcs.exe 1720 RegSvcs.exe 4592 powershell.exe 4592 powershell.exe 1720 RegSvcs.exe 1720 RegSvcs.exe 4476 mstsc.exe 4476 mstsc.exe 4476 mstsc.exe 4476 mstsc.exe 4476 mstsc.exe 4476 mstsc.exe 4476 mstsc.exe 4476 mstsc.exe 4476 mstsc.exe 4476 mstsc.exe 4476 mstsc.exe 4476 mstsc.exe 4476 mstsc.exe 4476 mstsc.exe 4476 mstsc.exe 4476 mstsc.exe 4476 mstsc.exe 4476 mstsc.exe 4476 mstsc.exe 4476 mstsc.exe 4476 mstsc.exe 4476 mstsc.exe 4476 mstsc.exe 4476 mstsc.exe 4476 mstsc.exe 4476 mstsc.exe 4476 mstsc.exe 4476 mstsc.exe 4476 mstsc.exe 4476 mstsc.exe 4476 mstsc.exe 4476 mstsc.exe 4476 mstsc.exe 4476 mstsc.exe 4476 mstsc.exe 4476 mstsc.exe 4476 mstsc.exe 4476 mstsc.exe 4476 mstsc.exe 4476 mstsc.exe 4476 mstsc.exe 4476 mstsc.exe 4476 mstsc.exe 4476 mstsc.exe 4476 mstsc.exe 4476 mstsc.exe 4476 mstsc.exe 4476 mstsc.exe 4476 mstsc.exe 4476 mstsc.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 1720 RegSvcs.exe 1720 RegSvcs.exe 1720 RegSvcs.exe 1720 RegSvcs.exe 4476 mstsc.exe 4476 mstsc.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 4336 890983726372673.exe Token: SeDebugPrivilege 1720 RegSvcs.exe Token: SeDebugPrivilege 4592 powershell.exe Token: SeShutdownPrivilege 3416 Explorer.EXE Token: SeCreatePagefilePrivilege 3416 Explorer.EXE Token: SeDebugPrivilege 4476 mstsc.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 4336 wrote to memory of 4592 4336 890983726372673.exe 95 PID 4336 wrote to memory of 4592 4336 890983726372673.exe 95 PID 4336 wrote to memory of 4592 4336 890983726372673.exe 95 PID 4336 wrote to memory of 3724 4336 890983726372673.exe 97 PID 4336 wrote to memory of 3724 4336 890983726372673.exe 97 PID 4336 wrote to memory of 3724 4336 890983726372673.exe 97 PID 4336 wrote to memory of 1720 4336 890983726372673.exe 99 PID 4336 wrote to memory of 1720 4336 890983726372673.exe 99 PID 4336 wrote to memory of 1720 4336 890983726372673.exe 99 PID 4336 wrote to memory of 1720 4336 890983726372673.exe 99 PID 4336 wrote to memory of 1720 4336 890983726372673.exe 99 PID 4336 wrote to memory of 1720 4336 890983726372673.exe 99 PID 3416 wrote to memory of 4476 3416 Explorer.EXE 101 PID 3416 wrote to memory of 4476 3416 Explorer.EXE 101 PID 3416 wrote to memory of 4476 3416 Explorer.EXE 101 PID 4476 wrote to memory of 216 4476 mstsc.exe 102 PID 4476 wrote to memory of 216 4476 mstsc.exe 102 PID 4476 wrote to memory of 216 4476 mstsc.exe 102
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\890983726372673.exe"C:\Users\Admin\AppData\Local\Temp\890983726372673.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\mZanCtInfW.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4592
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mZanCtInfW" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAA69.tmp"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3724
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1720
-
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:5024
-
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- System Location Discovery: System Language Discovery
PID:216
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD55c93927dbc3ff37ccb3cee97f9871f23
SHA12d79b1a3f96da6398eceb55d3886d4cde69080c1
SHA256d24c39304931302a69213fbd7b842ee16d606fb38bba8536669d843452f13ca4
SHA512d44ea157c34f17d95c2f13fc89bf31d34429d097d1da96ecf83fbb6af49ab83d0d3c919f9089dfa697e2b49cf3270f97a92971e68cb7664aae9636784913aeda