Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
13-06-2024 02:21
Static task
static1
Behavioral task
behavioral1
Sample
48e036467595c63c65d8640a84f4bcf9545a20a9ac2596e8e555a4126c4e7cf7.exe
Resource
win7-20240611-en
General
-
Target
48e036467595c63c65d8640a84f4bcf9545a20a9ac2596e8e555a4126c4e7cf7.exe
-
Size
820KB
-
MD5
cf4167c690383362c4b42ab32a0ee1ba
-
SHA1
09a8e7792a20df75fc6c466c921c6e3fb1b92985
-
SHA256
48e036467595c63c65d8640a84f4bcf9545a20a9ac2596e8e555a4126c4e7cf7
-
SHA512
11174ee27f1b4b7ce870d13d4ddc3be5772b844b9a28baac78b467ab916a46ebc2cebfb938e5768a1a89a9d2f12fff24adf707144e9d10fe8f25888707ef126a
-
SSDEEP
12288:bwuD3HH3DI+Q9vAKJDnbEMNC2pWPHuHKzCFcqx8rO9Hl5eIcdAAykR:cujH3DIT94yCqEOwmx869hmAI
Malware Config
Extracted
formbook
4.1
dd20
unblurd.com
docu-zign.com
randijpaulsen.com
angsabet.com
sedatelynx.com
opiumcore.store
thelordismysaviormerch.com
mindstudio.support
waterbygraceteam.com
furnitureinspiredbythesea.com
amablanca.com
hespelerdental.com
arcalid.net
balajinursingbureau.online
caixias.shop
solingen-buergerstiftung.com
194916.top
6travel-insurance.xyz
xn--fiqp9b17y.xn--czr694b
syntixi.trade
dataaudit.xyz
judgefever.com
agapornis.pet
sparkasse-banking-service.app
holylandmerch.com
synive.com
knittingbyangela.com
keytorapidweightloss.com
maradesarrollos.store
asherveer.com
kalame.info
khuwezu.top
myfreebd.com
jeepcherokeedeals.xyz
pointschauds.net
narae.xyz
nsivyyu.top
vetlinx360.com
1709frankford.com
checchintrasportilogistica.com
grupoagrarius.com
themasternoi.com
wurdsspeledrong.com
xn--diseafacil-w9a.com
playtoown.shop
butrikl.xyz
amazonpublisherservice.com
belihape.com
ajaysilverpalace.in
geredehanhotel.com
cruises-11028.bond
catering-57592.bond
haloogi.com
compasstransportaion.com
713952.site
downloadfirekirin.xyz
soapcoverr.store
wellnesswomenassociation.com
nortiapro.com
trustedoakllc.info
canadasimnigeria.com
aiappsreviews.com
dct15.com
venenciadorapp.com
fight4yourhappiness.com
Signatures
-
Formbook payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/4908-23-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4908-86-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2096-89-0x00000000002D0000-0x00000000002FF000-memory.dmp formbook -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepid process 3980 powershell.exe 4728 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
48e036467595c63c65d8640a84f4bcf9545a20a9ac2596e8e555a4126c4e7cf7.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation 48e036467595c63c65d8640a84f4bcf9545a20a9ac2596e8e555a4126c4e7cf7.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
48e036467595c63c65d8640a84f4bcf9545a20a9ac2596e8e555a4126c4e7cf7.exeRegSvcs.exeWWAHost.exedescription pid process target process PID 1632 set thread context of 4908 1632 48e036467595c63c65d8640a84f4bcf9545a20a9ac2596e8e555a4126c4e7cf7.exe RegSvcs.exe PID 4908 set thread context of 3444 4908 RegSvcs.exe Explorer.EXE PID 4908 set thread context of 3444 4908 RegSvcs.exe Explorer.EXE PID 2096 set thread context of 3444 2096 WWAHost.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 63 IoCs
Processes:
48e036467595c63c65d8640a84f4bcf9545a20a9ac2596e8e555a4126c4e7cf7.exepowershell.exepowershell.exeRegSvcs.exeWWAHost.exepid process 1632 48e036467595c63c65d8640a84f4bcf9545a20a9ac2596e8e555a4126c4e7cf7.exe 1632 48e036467595c63c65d8640a84f4bcf9545a20a9ac2596e8e555a4126c4e7cf7.exe 3980 powershell.exe 1632 48e036467595c63c65d8640a84f4bcf9545a20a9ac2596e8e555a4126c4e7cf7.exe 4728 powershell.exe 4908 RegSvcs.exe 4908 RegSvcs.exe 4908 RegSvcs.exe 4908 RegSvcs.exe 3980 powershell.exe 4728 powershell.exe 4908 RegSvcs.exe 4908 RegSvcs.exe 2096 WWAHost.exe 2096 WWAHost.exe 2096 WWAHost.exe 2096 WWAHost.exe 2096 WWAHost.exe 2096 WWAHost.exe 2096 WWAHost.exe 2096 WWAHost.exe 2096 WWAHost.exe 2096 WWAHost.exe 2096 WWAHost.exe 2096 WWAHost.exe 2096 WWAHost.exe 2096 WWAHost.exe 2096 WWAHost.exe 2096 WWAHost.exe 2096 WWAHost.exe 2096 WWAHost.exe 2096 WWAHost.exe 2096 WWAHost.exe 2096 WWAHost.exe 2096 WWAHost.exe 2096 WWAHost.exe 2096 WWAHost.exe 2096 WWAHost.exe 2096 WWAHost.exe 2096 WWAHost.exe 2096 WWAHost.exe 2096 WWAHost.exe 2096 WWAHost.exe 2096 WWAHost.exe 2096 WWAHost.exe 2096 WWAHost.exe 2096 WWAHost.exe 2096 WWAHost.exe 2096 WWAHost.exe 2096 WWAHost.exe 2096 WWAHost.exe 2096 WWAHost.exe 2096 WWAHost.exe 2096 WWAHost.exe 2096 WWAHost.exe 2096 WWAHost.exe 2096 WWAHost.exe 2096 WWAHost.exe 2096 WWAHost.exe 2096 WWAHost.exe 2096 WWAHost.exe 2096 WWAHost.exe 2096 WWAHost.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
RegSvcs.exeWWAHost.exepid process 4908 RegSvcs.exe 4908 RegSvcs.exe 4908 RegSvcs.exe 4908 RegSvcs.exe 2096 WWAHost.exe 2096 WWAHost.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
48e036467595c63c65d8640a84f4bcf9545a20a9ac2596e8e555a4126c4e7cf7.exepowershell.exepowershell.exeRegSvcs.exeExplorer.EXEWWAHost.exedescription pid process Token: SeDebugPrivilege 1632 48e036467595c63c65d8640a84f4bcf9545a20a9ac2596e8e555a4126c4e7cf7.exe Token: SeDebugPrivilege 4728 powershell.exe Token: SeDebugPrivilege 3980 powershell.exe Token: SeDebugPrivilege 4908 RegSvcs.exe Token: SeShutdownPrivilege 3444 Explorer.EXE Token: SeCreatePagefilePrivilege 3444 Explorer.EXE Token: SeShutdownPrivilege 3444 Explorer.EXE Token: SeCreatePagefilePrivilege 3444 Explorer.EXE Token: SeDebugPrivilege 2096 WWAHost.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
Explorer.EXEpid process 3444 Explorer.EXE 3444 Explorer.EXE 3444 Explorer.EXE -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
Explorer.EXEpid process 3444 Explorer.EXE 3444 Explorer.EXE 3444 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3444 Explorer.EXE -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
48e036467595c63c65d8640a84f4bcf9545a20a9ac2596e8e555a4126c4e7cf7.exeExplorer.EXEWWAHost.exedescription pid process target process PID 1632 wrote to memory of 3980 1632 48e036467595c63c65d8640a84f4bcf9545a20a9ac2596e8e555a4126c4e7cf7.exe powershell.exe PID 1632 wrote to memory of 3980 1632 48e036467595c63c65d8640a84f4bcf9545a20a9ac2596e8e555a4126c4e7cf7.exe powershell.exe PID 1632 wrote to memory of 3980 1632 48e036467595c63c65d8640a84f4bcf9545a20a9ac2596e8e555a4126c4e7cf7.exe powershell.exe PID 1632 wrote to memory of 4728 1632 48e036467595c63c65d8640a84f4bcf9545a20a9ac2596e8e555a4126c4e7cf7.exe powershell.exe PID 1632 wrote to memory of 4728 1632 48e036467595c63c65d8640a84f4bcf9545a20a9ac2596e8e555a4126c4e7cf7.exe powershell.exe PID 1632 wrote to memory of 4728 1632 48e036467595c63c65d8640a84f4bcf9545a20a9ac2596e8e555a4126c4e7cf7.exe powershell.exe PID 1632 wrote to memory of 4696 1632 48e036467595c63c65d8640a84f4bcf9545a20a9ac2596e8e555a4126c4e7cf7.exe schtasks.exe PID 1632 wrote to memory of 4696 1632 48e036467595c63c65d8640a84f4bcf9545a20a9ac2596e8e555a4126c4e7cf7.exe schtasks.exe PID 1632 wrote to memory of 4696 1632 48e036467595c63c65d8640a84f4bcf9545a20a9ac2596e8e555a4126c4e7cf7.exe schtasks.exe PID 1632 wrote to memory of 4908 1632 48e036467595c63c65d8640a84f4bcf9545a20a9ac2596e8e555a4126c4e7cf7.exe RegSvcs.exe PID 1632 wrote to memory of 4908 1632 48e036467595c63c65d8640a84f4bcf9545a20a9ac2596e8e555a4126c4e7cf7.exe RegSvcs.exe PID 1632 wrote to memory of 4908 1632 48e036467595c63c65d8640a84f4bcf9545a20a9ac2596e8e555a4126c4e7cf7.exe RegSvcs.exe PID 1632 wrote to memory of 4908 1632 48e036467595c63c65d8640a84f4bcf9545a20a9ac2596e8e555a4126c4e7cf7.exe RegSvcs.exe PID 1632 wrote to memory of 4908 1632 48e036467595c63c65d8640a84f4bcf9545a20a9ac2596e8e555a4126c4e7cf7.exe RegSvcs.exe PID 1632 wrote to memory of 4908 1632 48e036467595c63c65d8640a84f4bcf9545a20a9ac2596e8e555a4126c4e7cf7.exe RegSvcs.exe PID 3444 wrote to memory of 2096 3444 Explorer.EXE WWAHost.exe PID 3444 wrote to memory of 2096 3444 Explorer.EXE WWAHost.exe PID 3444 wrote to memory of 2096 3444 Explorer.EXE WWAHost.exe PID 2096 wrote to memory of 1544 2096 WWAHost.exe cmd.exe PID 2096 wrote to memory of 1544 2096 WWAHost.exe cmd.exe PID 2096 wrote to memory of 1544 2096 WWAHost.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\48e036467595c63c65d8640a84f4bcf9545a20a9ac2596e8e555a4126c4e7cf7.exe"C:\Users\Admin\AppData\Local\Temp\48e036467595c63c65d8640a84f4bcf9545a20a9ac2596e8e555a4126c4e7cf7.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\48e036467595c63c65d8640a84f4bcf9545a20a9ac2596e8e555a4126c4e7cf7.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\JdSqumW.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JdSqumW" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6978.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WWAHost.exe"C:\Windows\SysWOW64\WWAHost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tev4p3kw.iqx.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmp6978.tmpFilesize
1KB
MD5b709a7fc9042b1565d41332cf01cb174
SHA1beeac3d5451ef96bc9719d6bcc146d5453468b05
SHA256538045b20577786ec2b37fc147b3c55a35542409e8d001356588ca4184fe4d84
SHA5125939f125a967816fcda2fe6b2664fb2fd939882bb75d5dd901b4bf8ed12352d8448af2e0c44c23a072b67d7183a7aebdc0453e124b2dc62388088a0324ad2dff
-
memory/1632-8-0x0000000006140000-0x00000000061B6000-memory.dmpFilesize
472KB
-
memory/1632-9-0x0000000009B20000-0x0000000009BBC000-memory.dmpFilesize
624KB
-
memory/1632-4-0x0000000004D30000-0x0000000004D3A000-memory.dmpFilesize
40KB
-
memory/1632-5-0x00000000744D0000-0x0000000074C80000-memory.dmpFilesize
7.7MB
-
memory/1632-6-0x0000000004EB0000-0x0000000004ECA000-memory.dmpFilesize
104KB
-
memory/1632-7-0x0000000005E80000-0x0000000005E90000-memory.dmpFilesize
64KB
-
memory/1632-2-0x00000000051D0000-0x0000000005774000-memory.dmpFilesize
5.6MB
-
memory/1632-3-0x0000000004B70000-0x0000000004C02000-memory.dmpFilesize
584KB
-
memory/1632-29-0x00000000744D0000-0x0000000074C80000-memory.dmpFilesize
7.7MB
-
memory/1632-1-0x00000000000D0000-0x00000000001A0000-memory.dmpFilesize
832KB
-
memory/1632-0-0x00000000744DE000-0x00000000744DF000-memory.dmpFilesize
4KB
-
memory/2096-88-0x00000000003C0000-0x000000000049C000-memory.dmpFilesize
880KB
-
memory/2096-89-0x00000000002D0000-0x00000000002FF000-memory.dmpFilesize
188KB
-
memory/2096-87-0x00000000003C0000-0x000000000049C000-memory.dmpFilesize
880KB
-
memory/3444-92-0x0000000008DA0000-0x0000000008EAB000-memory.dmpFilesize
1.0MB
-
memory/3980-16-0x00000000744D0000-0x0000000074C80000-memory.dmpFilesize
7.7MB
-
memory/3980-85-0x00000000744D0000-0x0000000074C80000-memory.dmpFilesize
7.7MB
-
memory/3980-14-0x00000000024C0000-0x00000000024F6000-memory.dmpFilesize
216KB
-
memory/3980-15-0x0000000005250000-0x0000000005878000-memory.dmpFilesize
6.2MB
-
memory/3980-24-0x0000000005880000-0x0000000005BD4000-memory.dmpFilesize
3.3MB
-
memory/3980-17-0x00000000744D0000-0x0000000074C80000-memory.dmpFilesize
7.7MB
-
memory/3980-20-0x0000000004D80000-0x0000000004DA2000-memory.dmpFilesize
136KB
-
memory/3980-21-0x0000000004E60000-0x0000000004EC6000-memory.dmpFilesize
408KB
-
memory/3980-22-0x0000000005180000-0x00000000051E6000-memory.dmpFilesize
408KB
-
memory/3980-75-0x00000000071A0000-0x00000000071AA000-memory.dmpFilesize
40KB
-
memory/3980-70-0x0000000006330000-0x000000000634E000-memory.dmpFilesize
120KB
-
memory/3980-72-0x0000000006FE0000-0x0000000007083000-memory.dmpFilesize
652KB
-
memory/3980-79-0x0000000007360000-0x0000000007374000-memory.dmpFilesize
80KB
-
memory/3980-51-0x0000000074D60000-0x0000000074DAC000-memory.dmpFilesize
304KB
-
memory/3980-50-0x0000000006DA0000-0x0000000006DD2000-memory.dmpFilesize
200KB
-
memory/3980-74-0x0000000007770000-0x0000000007DEA000-memory.dmpFilesize
6.5MB
-
memory/3980-77-0x0000000007320000-0x0000000007331000-memory.dmpFilesize
68KB
-
memory/4728-48-0x0000000006800000-0x000000000681E000-memory.dmpFilesize
120KB
-
memory/4728-49-0x0000000006890000-0x00000000068DC000-memory.dmpFilesize
304KB
-
memory/4728-73-0x0000000007B40000-0x0000000007B5A000-memory.dmpFilesize
104KB
-
memory/4728-78-0x0000000007D70000-0x0000000007D7E000-memory.dmpFilesize
56KB
-
memory/4728-52-0x0000000074D60000-0x0000000074DAC000-memory.dmpFilesize
304KB
-
memory/4728-81-0x0000000007E60000-0x0000000007E68000-memory.dmpFilesize
32KB
-
memory/4728-80-0x0000000007E80000-0x0000000007E9A000-memory.dmpFilesize
104KB
-
memory/4728-76-0x0000000007DC0000-0x0000000007E56000-memory.dmpFilesize
600KB
-
memory/4728-84-0x00000000744D0000-0x0000000074C80000-memory.dmpFilesize
7.7MB
-
memory/4728-19-0x00000000744D0000-0x0000000074C80000-memory.dmpFilesize
7.7MB
-
memory/4728-25-0x00000000744D0000-0x0000000074C80000-memory.dmpFilesize
7.7MB
-
memory/4728-27-0x00000000744D0000-0x0000000074C80000-memory.dmpFilesize
7.7MB
-
memory/4908-23-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4908-86-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB