Analysis
-
max time kernel
147s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
13-06-2024 10:35
Static task
static1
Behavioral task
behavioral1
Sample
usd23000scandoc.pdf.exe
Resource
win7-20240611-en
General
-
Target
usd23000scandoc.pdf.exe
-
Size
184KB
-
MD5
5f38331663118f710642957241c9238d
-
SHA1
04781426ede2fa8852f25ed2da5594db74783773
-
SHA256
ec4d14568d4e11d2f5a78f752eaaf3770eaf939d192affd7ef935e418f632024
-
SHA512
c0e8dbdd14f1963f41de266b58f427a83d80636ddf7c11bcbb8cb1a49fabf0b402b0895ba4f5328960a174bfcc11a75016bbc5c7588e2d7d1eb03e6297fcdd1e
-
SSDEEP
3072:SyvIcfKQjH4ULQtYyhEgHqjex7ob2TU5Nb8yW2vqwxmr7DQ03LiTIpe+HJeUlp:Sywc9DLQtYyhcjf6WGyFfC7DQcow
Malware Config
Extracted
formbook
3.8
mx40
vr-edu.group
mangobajo.com
390hash.com
coin-project.com
haninmax.com
ephotgraphyonline.info
gini.ltd
occurri.info
retireviainternet.com
thegoodkindacrazy.com
colebrookwines.com
fermartinezphotography.com
taurustal.com
lage.ltd
opportunisticnomnomivore.com
eoc-org.com
soinsdentaires-etranger.com
americanas-aniversario.com
weixindaochu.com
aliancabrindes.com
vbuhler.com
designsbydanyale.com
156beckwithavenue.com
takahashimiho.com
adkintl.com
humanitysharmonics.com
inquiry.company
isabellepoche.com
buymyrihouse.com
modabellezayhogar.com
wzydb.net
equifaxsecurity2017f.com
wajueshuju.com
nokohan.com
toru.ltd
jacuzzihottubsofirvine.com
hhjinyangguang.com
zhuoanvip.com
majorcrane.com
rcmco.info
saoav70701.com
thebluewatergroupinc.com
wartapuskesmas.com
energyeecd.party
bltgo.info
healthymealrecipes.net
oasisproductions.info
uzdxs.com
meenababu.com
grindcoreshop.com
sdbhgy7.ink
ihaztwojayz.com
felsrl.info
xpresspodhub.com
squarelump.com
hpxsupport.com
cienciasdelsuelo.com
lebistrotdutrolley.com
believers.graphics
smyeoforum.win
naturalpathmd.com
wpstairs.com
weizan.site
onaalandaclubmarbella.com
beemptty.com
Signatures
-
Formbook payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2656-4-0x0000000000400000-0x000000000042A000-memory.dmp formbook behavioral1/memory/2656-9-0x0000000000400000-0x000000000042A000-memory.dmp formbook behavioral1/memory/2656-14-0x0000000000400000-0x000000000042A000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2460 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
usd23000scandoc.pdf.exeusd23000scandoc.pdf.exenetsh.exedescription pid process target process PID 2148 set thread context of 2656 2148 usd23000scandoc.pdf.exe usd23000scandoc.pdf.exe PID 2656 set thread context of 1176 2656 usd23000scandoc.pdf.exe Explorer.EXE PID 2656 set thread context of 1176 2656 usd23000scandoc.pdf.exe Explorer.EXE PID 3016 set thread context of 1176 3016 netsh.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 25 IoCs
Processes:
usd23000scandoc.pdf.exenetsh.exepid process 2656 usd23000scandoc.pdf.exe 2656 usd23000scandoc.pdf.exe 2656 usd23000scandoc.pdf.exe 3016 netsh.exe 3016 netsh.exe 3016 netsh.exe 3016 netsh.exe 3016 netsh.exe 3016 netsh.exe 3016 netsh.exe 3016 netsh.exe 3016 netsh.exe 3016 netsh.exe 3016 netsh.exe 3016 netsh.exe 3016 netsh.exe 3016 netsh.exe 3016 netsh.exe 3016 netsh.exe 3016 netsh.exe 3016 netsh.exe 3016 netsh.exe 3016 netsh.exe 3016 netsh.exe 3016 netsh.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
usd23000scandoc.pdf.exenetsh.exepid process 2656 usd23000scandoc.pdf.exe 2656 usd23000scandoc.pdf.exe 2656 usd23000scandoc.pdf.exe 2656 usd23000scandoc.pdf.exe 3016 netsh.exe 3016 netsh.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
usd23000scandoc.pdf.exeusd23000scandoc.pdf.exenetsh.exedescription pid process Token: SeDebugPrivilege 2148 usd23000scandoc.pdf.exe Token: SeDebugPrivilege 2656 usd23000scandoc.pdf.exe Token: SeDebugPrivilege 3016 netsh.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
usd23000scandoc.pdf.exeExplorer.EXEnetsh.exedescription pid process target process PID 2148 wrote to memory of 2656 2148 usd23000scandoc.pdf.exe usd23000scandoc.pdf.exe PID 2148 wrote to memory of 2656 2148 usd23000scandoc.pdf.exe usd23000scandoc.pdf.exe PID 2148 wrote to memory of 2656 2148 usd23000scandoc.pdf.exe usd23000scandoc.pdf.exe PID 2148 wrote to memory of 2656 2148 usd23000scandoc.pdf.exe usd23000scandoc.pdf.exe PID 2148 wrote to memory of 2656 2148 usd23000scandoc.pdf.exe usd23000scandoc.pdf.exe PID 2148 wrote to memory of 2656 2148 usd23000scandoc.pdf.exe usd23000scandoc.pdf.exe PID 2148 wrote to memory of 2656 2148 usd23000scandoc.pdf.exe usd23000scandoc.pdf.exe PID 1176 wrote to memory of 3016 1176 Explorer.EXE netsh.exe PID 1176 wrote to memory of 3016 1176 Explorer.EXE netsh.exe PID 1176 wrote to memory of 3016 1176 Explorer.EXE netsh.exe PID 1176 wrote to memory of 3016 1176 Explorer.EXE netsh.exe PID 3016 wrote to memory of 2460 3016 netsh.exe cmd.exe PID 3016 wrote to memory of 2460 3016 netsh.exe cmd.exe PID 3016 wrote to memory of 2460 3016 netsh.exe cmd.exe PID 3016 wrote to memory of 2460 3016 netsh.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\usd23000scandoc.pdf.exe"C:\Users\Admin\AppData\Local\Temp\usd23000scandoc.pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\usd23000scandoc.pdf.exeC:\Users\Admin\AppData\Local\Temp\usd23000scandoc.pdf.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\usd23000scandoc.pdf.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1176-8-0x0000000002B80000-0x0000000002C80000-memory.dmpFilesize
1024KB
-
memory/1176-21-0x00000000069C0000-0x0000000006ACB000-memory.dmpFilesize
1.0MB
-
memory/1176-11-0x0000000004C00000-0x0000000004CC1000-memory.dmpFilesize
772KB
-
memory/1176-16-0x00000000069C0000-0x0000000006ACB000-memory.dmpFilesize
1.0MB
-
memory/1176-13-0x0000000004C00000-0x0000000004CC1000-memory.dmpFilesize
772KB
-
memory/2148-1-0x0000000074310000-0x00000000748BB000-memory.dmpFilesize
5.7MB
-
memory/2148-2-0x0000000074310000-0x00000000748BB000-memory.dmpFilesize
5.7MB
-
memory/2148-3-0x0000000074310000-0x00000000748BB000-memory.dmpFilesize
5.7MB
-
memory/2148-0-0x0000000074311000-0x0000000074312000-memory.dmpFilesize
4KB
-
memory/2148-5-0x0000000074310000-0x00000000748BB000-memory.dmpFilesize
5.7MB
-
memory/2656-4-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/2656-9-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/2656-10-0x00000000002D0000-0x00000000002E4000-memory.dmpFilesize
80KB
-
memory/2656-15-0x0000000000310000-0x0000000000324000-memory.dmpFilesize
80KB
-
memory/2656-14-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/2656-6-0x0000000000870000-0x0000000000B73000-memory.dmpFilesize
3.0MB
-
memory/3016-17-0x0000000000CC0000-0x0000000000CDB000-memory.dmpFilesize
108KB
-
memory/3016-18-0x0000000000CC0000-0x0000000000CDB000-memory.dmpFilesize
108KB