Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
13-06-2024 10:30
Static task
static1
Behavioral task
behavioral1
Sample
Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exe
Resource
win7-20240611-en
General
-
Target
Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exe
-
Size
628KB
-
MD5
6b799c2e76b37bf96ef35ba8580f0bfc
-
SHA1
b710a5aa6385f9424c37c944ef27d10ef99df97f
-
SHA256
e10280c91dc1fb46756d9473163eec9052b8c8a352955d0f21a24246da054ba2
-
SHA512
3d24d60ddf69dfe6c6124df627dadcb833d8339e59b446cf44a9ecf222d36e58e3d222c8b8f1937554236a0d6121d3fb0d423160ea473a5cd412c8aecac92823
-
SSDEEP
12288:3fGyCK2xrOonraIEGL78bDS8k67E7KJIojZKBZnU02gvPQ3WEF00QiHM:uyC5raI9L+DS8jkoVgT2KPQ3B9
Malware Config
Extracted
formbook
4.1
pz12
paucanyes.com
autonwheels.com
cowboysandcaviarbar.com
fitnessengineeredworkouts.com
nuevobajonfavorito.com
dflx8.com
rothability.com
sxybet88.com
onesource.live
brenjitu1904.com
airdrop-zero1labs.com
guangdongqiangzhetc.com
apartments-for-rent-72254.bond
ombak99.lol
qqfoodsolutions.com
kyyzz.com
thepicklematch.com
ainth.com
missorris.com
gabbygomez.com
aromacuppa.com
kaskusbagus.com
zoox1.asia
hemophilia-treatment-41433.bond
meidupro.com
shrisona.com
sekanse.com
marcocostasax.com
loyalbahis356.com
mzmz97.com
ma-google.com
xiangadvanced.site
tuotalogis.com
xcxocef.shop
fidgetbottles.com
shuaninvolved.site
ambientelatino.com
98980901.com
singhbrothersframes.com
pureamyl.com
hgs0713.net
surejobzapp.com
slotgame99.bet
datalakeflow.com
ebehemin.com
vanessasmobilespa.com
317wb.com
motchillssss.top
huesch.net
salesgymshark.shop
mejorcompra99.com
tacubashop.com
jessicaxsimmons.com
roar-stores.com
chalkandthimble.com
84556.vip
luyutuwen.com
siliconcollege.icu
marvowhite.com
gjxuh82y0u3h6.top
e2taop5.top
businessbroadway.com
cripmz.xyz
4hu259.com
jnhdh8827.com
Signatures
-
Formbook payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/688-10-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/688-19-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2644-68-0x00000000004B0000-0x00000000004DF000-memory.dmp formbook -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exeDocumento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exesvchost.exedescription pid process target process PID 1856 set thread context of 688 1856 Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exe Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exe PID 688 set thread context of 3440 688 Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exe Explorer.EXE PID 2644 set thread context of 3440 2644 svchost.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 60 IoCs
Processes:
Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exeDocumento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exepowershell.exesvchost.exepid process 1856 Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exe 1856 Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exe 688 Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exe 688 Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exe 688 Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exe 688 Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exe 3000 powershell.exe 3000 powershell.exe 2644 svchost.exe 2644 svchost.exe 2644 svchost.exe 2644 svchost.exe 2644 svchost.exe 2644 svchost.exe 2644 svchost.exe 2644 svchost.exe 2644 svchost.exe 2644 svchost.exe 2644 svchost.exe 2644 svchost.exe 2644 svchost.exe 2644 svchost.exe 2644 svchost.exe 2644 svchost.exe 2644 svchost.exe 2644 svchost.exe 2644 svchost.exe 2644 svchost.exe 2644 svchost.exe 2644 svchost.exe 2644 svchost.exe 2644 svchost.exe 2644 svchost.exe 2644 svchost.exe 2644 svchost.exe 2644 svchost.exe 2644 svchost.exe 2644 svchost.exe 2644 svchost.exe 2644 svchost.exe 2644 svchost.exe 2644 svchost.exe 2644 svchost.exe 2644 svchost.exe 2644 svchost.exe 2644 svchost.exe 2644 svchost.exe 2644 svchost.exe 2644 svchost.exe 2644 svchost.exe 2644 svchost.exe 2644 svchost.exe 2644 svchost.exe 2644 svchost.exe 2644 svchost.exe 2644 svchost.exe 2644 svchost.exe 2644 svchost.exe 2644 svchost.exe 2644 svchost.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exesvchost.exepid process 688 Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exe 688 Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exe 688 Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exe 2644 svchost.exe 2644 svchost.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exeDocumento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exepowershell.exesvchost.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1856 Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exe Token: SeDebugPrivilege 688 Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exe Token: SeDebugPrivilege 3000 powershell.exe Token: SeDebugPrivilege 2644 svchost.exe Token: SeShutdownPrivilege 3440 Explorer.EXE Token: SeCreatePagefilePrivilege 3440 Explorer.EXE -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
Explorer.EXEpid process 3440 Explorer.EXE 3440 Explorer.EXE 3440 Explorer.EXE -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
Explorer.EXEpid process 3440 Explorer.EXE 3440 Explorer.EXE 3440 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3440 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exeExplorer.EXEsvchost.exedescription pid process target process PID 1856 wrote to memory of 3000 1856 Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exe powershell.exe PID 1856 wrote to memory of 3000 1856 Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exe powershell.exe PID 1856 wrote to memory of 3000 1856 Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exe powershell.exe PID 1856 wrote to memory of 3684 1856 Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exe Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exe PID 1856 wrote to memory of 3684 1856 Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exe Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exe PID 1856 wrote to memory of 3684 1856 Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exe Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exe PID 1856 wrote to memory of 688 1856 Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exe Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exe PID 1856 wrote to memory of 688 1856 Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exe Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exe PID 1856 wrote to memory of 688 1856 Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exe Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exe PID 1856 wrote to memory of 688 1856 Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exe Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exe PID 1856 wrote to memory of 688 1856 Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exe Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exe PID 1856 wrote to memory of 688 1856 Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exe Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exe PID 3440 wrote to memory of 2644 3440 Explorer.EXE svchost.exe PID 3440 wrote to memory of 2644 3440 Explorer.EXE svchost.exe PID 3440 wrote to memory of 2644 3440 Explorer.EXE svchost.exe PID 2644 wrote to memory of 2684 2644 svchost.exe cmd.exe PID 2644 wrote to memory of 2684 2644 svchost.exe cmd.exe PID 2644 wrote to memory of 2684 2644 svchost.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exe"C:\Users\Admin\AppData\Local\Temp\Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exe"C:\Users\Admin\AppData\Local\Temp\Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exe"C:\Users\Admin\AppData\Local\Temp\Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xe4c5vr4.zns.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/688-15-0x00000000012C0000-0x000000000160A000-memory.dmpFilesize
3.3MB
-
memory/688-19-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/688-20-0x0000000001270000-0x0000000001284000-memory.dmpFilesize
80KB
-
memory/688-10-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1856-8-0x0000000006E80000-0x0000000006EF6000-memory.dmpFilesize
472KB
-
memory/1856-0-0x000000007484E000-0x000000007484F000-memory.dmpFilesize
4KB
-
memory/1856-7-0x0000000005AD0000-0x0000000005AE0000-memory.dmpFilesize
64KB
-
memory/1856-5-0x00000000059B0000-0x00000000059BA000-memory.dmpFilesize
40KB
-
memory/1856-9-0x000000000AB00000-0x000000000AB9C000-memory.dmpFilesize
624KB
-
memory/1856-4-0x0000000074840000-0x0000000074FF0000-memory.dmpFilesize
7.7MB
-
memory/1856-12-0x0000000074840000-0x0000000074FF0000-memory.dmpFilesize
7.7MB
-
memory/1856-6-0x0000000005B70000-0x0000000005B8A000-memory.dmpFilesize
104KB
-
memory/1856-1-0x0000000000D70000-0x0000000000E14000-memory.dmpFilesize
656KB
-
memory/1856-3-0x0000000005800000-0x0000000005892000-memory.dmpFilesize
584KB
-
memory/1856-2-0x0000000005E60000-0x0000000006404000-memory.dmpFilesize
5.6MB
-
memory/2644-58-0x0000000000970000-0x000000000097E000-memory.dmpFilesize
56KB
-
memory/2644-61-0x0000000000970000-0x000000000097E000-memory.dmpFilesize
56KB
-
memory/2644-68-0x00000000004B0000-0x00000000004DF000-memory.dmpFilesize
188KB
-
memory/3000-13-0x0000000002D50000-0x0000000002D86000-memory.dmpFilesize
216KB
-
memory/3000-53-0x0000000007FF0000-0x000000000866A000-memory.dmpFilesize
6.5MB
-
memory/3000-24-0x0000000005FC0000-0x0000000006026000-memory.dmpFilesize
408KB
-
memory/3000-25-0x0000000006030000-0x0000000006096000-memory.dmpFilesize
408KB
-
memory/3000-23-0x00000000056C0000-0x00000000056E2000-memory.dmpFilesize
136KB
-
memory/3000-14-0x000000007484E000-0x000000007484F000-memory.dmpFilesize
4KB
-
memory/3000-32-0x00000000060A0000-0x00000000063F4000-memory.dmpFilesize
3.3MB
-
memory/3000-36-0x0000000006680000-0x000000000669E000-memory.dmpFilesize
120KB
-
memory/3000-37-0x0000000006710000-0x000000000675C000-memory.dmpFilesize
304KB
-
memory/3000-38-0x000000007F600000-0x000000007F610000-memory.dmpFilesize
64KB
-
memory/3000-39-0x0000000007850000-0x0000000007882000-memory.dmpFilesize
200KB
-
memory/3000-40-0x0000000071100000-0x000000007114C000-memory.dmpFilesize
304KB
-
memory/3000-51-0x00000000051E0000-0x00000000051F0000-memory.dmpFilesize
64KB
-
memory/3000-50-0x0000000006C20000-0x0000000006C3E000-memory.dmpFilesize
120KB
-
memory/3000-52-0x0000000007890000-0x0000000007933000-memory.dmpFilesize
652KB
-
memory/3000-22-0x0000000005820000-0x0000000005E48000-memory.dmpFilesize
6.2MB
-
memory/3000-54-0x00000000079A0000-0x00000000079BA000-memory.dmpFilesize
104KB
-
memory/3000-55-0x0000000007A20000-0x0000000007A2A000-memory.dmpFilesize
40KB
-
memory/3000-56-0x0000000007C20000-0x0000000007CB6000-memory.dmpFilesize
600KB
-
memory/3000-57-0x0000000007BA0000-0x0000000007BB1000-memory.dmpFilesize
68KB
-
memory/3000-16-0x00000000051E0000-0x00000000051F0000-memory.dmpFilesize
64KB
-
memory/3000-17-0x00000000051E0000-0x00000000051F0000-memory.dmpFilesize
64KB
-
memory/3000-62-0x0000000007BD0000-0x0000000007BDE000-memory.dmpFilesize
56KB
-
memory/3000-63-0x0000000007BE0000-0x0000000007BF4000-memory.dmpFilesize
80KB
-
memory/3000-64-0x0000000007CE0000-0x0000000007CFA000-memory.dmpFilesize
104KB
-
memory/3000-65-0x0000000007CC0000-0x0000000007CC8000-memory.dmpFilesize
32KB
-
memory/3440-21-0x000000000A610000-0x000000000A74D000-memory.dmpFilesize
1.2MB
-
memory/3440-70-0x000000000A610000-0x000000000A74D000-memory.dmpFilesize
1.2MB
-
memory/3440-71-0x0000000008830000-0x0000000008964000-memory.dmpFilesize
1.2MB