Analysis
-
max time kernel
152s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
13-06-2024 10:35
Static task
static1
Behavioral task
behavioral1
Sample
usd23000scandoc.pdf.exe
Resource
win7-20240611-en
General
-
Target
usd23000scandoc.pdf.exe
-
Size
184KB
-
MD5
5f38331663118f710642957241c9238d
-
SHA1
04781426ede2fa8852f25ed2da5594db74783773
-
SHA256
ec4d14568d4e11d2f5a78f752eaaf3770eaf939d192affd7ef935e418f632024
-
SHA512
c0e8dbdd14f1963f41de266b58f427a83d80636ddf7c11bcbb8cb1a49fabf0b402b0895ba4f5328960a174bfcc11a75016bbc5c7588e2d7d1eb03e6297fcdd1e
-
SSDEEP
3072:SyvIcfKQjH4ULQtYyhEgHqjex7ob2TU5Nb8yW2vqwxmr7DQ03LiTIpe+HJeUlp:Sywc9DLQtYyhcjf6WGyFfC7DQcow
Malware Config
Extracted
formbook
3.8
mx40
vr-edu.group
mangobajo.com
390hash.com
coin-project.com
haninmax.com
ephotgraphyonline.info
gini.ltd
occurri.info
retireviainternet.com
thegoodkindacrazy.com
colebrookwines.com
fermartinezphotography.com
taurustal.com
lage.ltd
opportunisticnomnomivore.com
eoc-org.com
soinsdentaires-etranger.com
americanas-aniversario.com
weixindaochu.com
aliancabrindes.com
vbuhler.com
designsbydanyale.com
156beckwithavenue.com
takahashimiho.com
adkintl.com
humanitysharmonics.com
inquiry.company
isabellepoche.com
buymyrihouse.com
modabellezayhogar.com
wzydb.net
equifaxsecurity2017f.com
wajueshuju.com
nokohan.com
toru.ltd
jacuzzihottubsofirvine.com
hhjinyangguang.com
zhuoanvip.com
majorcrane.com
rcmco.info
saoav70701.com
thebluewatergroupinc.com
wartapuskesmas.com
energyeecd.party
bltgo.info
healthymealrecipes.net
oasisproductions.info
uzdxs.com
meenababu.com
grindcoreshop.com
sdbhgy7.ink
ihaztwojayz.com
felsrl.info
xpresspodhub.com
squarelump.com
hpxsupport.com
cienciasdelsuelo.com
lebistrotdutrolley.com
believers.graphics
smyeoforum.win
naturalpathmd.com
wpstairs.com
weizan.site
onaalandaclubmarbella.com
beemptty.com
Signatures
-
Formbook payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/5012-5-0x0000000000400000-0x000000000042A000-memory.dmp formbook behavioral2/memory/5012-10-0x0000000000400000-0x000000000042A000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
usd23000scandoc.pdf.exeusd23000scandoc.pdf.exeipconfig.exedescription pid process target process PID 404 set thread context of 5012 404 usd23000scandoc.pdf.exe usd23000scandoc.pdf.exe PID 5012 set thread context of 3428 5012 usd23000scandoc.pdf.exe Explorer.EXE PID 4172 set thread context of 3428 4172 ipconfig.exe Explorer.EXE -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid process 4172 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 46 IoCs
Processes:
usd23000scandoc.pdf.exeipconfig.exepid process 5012 usd23000scandoc.pdf.exe 5012 usd23000scandoc.pdf.exe 5012 usd23000scandoc.pdf.exe 5012 usd23000scandoc.pdf.exe 4172 ipconfig.exe 4172 ipconfig.exe 4172 ipconfig.exe 4172 ipconfig.exe 4172 ipconfig.exe 4172 ipconfig.exe 4172 ipconfig.exe 4172 ipconfig.exe 4172 ipconfig.exe 4172 ipconfig.exe 4172 ipconfig.exe 4172 ipconfig.exe 4172 ipconfig.exe 4172 ipconfig.exe 4172 ipconfig.exe 4172 ipconfig.exe 4172 ipconfig.exe 4172 ipconfig.exe 4172 ipconfig.exe 4172 ipconfig.exe 4172 ipconfig.exe 4172 ipconfig.exe 4172 ipconfig.exe 4172 ipconfig.exe 4172 ipconfig.exe 4172 ipconfig.exe 4172 ipconfig.exe 4172 ipconfig.exe 4172 ipconfig.exe 4172 ipconfig.exe 4172 ipconfig.exe 4172 ipconfig.exe 4172 ipconfig.exe 4172 ipconfig.exe 4172 ipconfig.exe 4172 ipconfig.exe 4172 ipconfig.exe 4172 ipconfig.exe 4172 ipconfig.exe 4172 ipconfig.exe 4172 ipconfig.exe 4172 ipconfig.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
usd23000scandoc.pdf.exeipconfig.exepid process 5012 usd23000scandoc.pdf.exe 5012 usd23000scandoc.pdf.exe 5012 usd23000scandoc.pdf.exe 4172 ipconfig.exe 4172 ipconfig.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
usd23000scandoc.pdf.exeusd23000scandoc.pdf.exeipconfig.exedescription pid process Token: SeDebugPrivilege 404 usd23000scandoc.pdf.exe Token: SeDebugPrivilege 5012 usd23000scandoc.pdf.exe Token: SeDebugPrivilege 4172 ipconfig.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
usd23000scandoc.pdf.exeExplorer.EXEipconfig.exedescription pid process target process PID 404 wrote to memory of 5012 404 usd23000scandoc.pdf.exe usd23000scandoc.pdf.exe PID 404 wrote to memory of 5012 404 usd23000scandoc.pdf.exe usd23000scandoc.pdf.exe PID 404 wrote to memory of 5012 404 usd23000scandoc.pdf.exe usd23000scandoc.pdf.exe PID 404 wrote to memory of 5012 404 usd23000scandoc.pdf.exe usd23000scandoc.pdf.exe PID 404 wrote to memory of 5012 404 usd23000scandoc.pdf.exe usd23000scandoc.pdf.exe PID 404 wrote to memory of 5012 404 usd23000scandoc.pdf.exe usd23000scandoc.pdf.exe PID 3428 wrote to memory of 4172 3428 Explorer.EXE ipconfig.exe PID 3428 wrote to memory of 4172 3428 Explorer.EXE ipconfig.exe PID 3428 wrote to memory of 4172 3428 Explorer.EXE ipconfig.exe PID 4172 wrote to memory of 2512 4172 ipconfig.exe cmd.exe PID 4172 wrote to memory of 2512 4172 ipconfig.exe cmd.exe PID 4172 wrote to memory of 2512 4172 ipconfig.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\usd23000scandoc.pdf.exe"C:\Users\Admin\AppData\Local\Temp\usd23000scandoc.pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\usd23000scandoc.pdf.exeC:\Users\Admin\AppData\Local\Temp\usd23000scandoc.pdf.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\usd23000scandoc.pdf.exe"3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1424 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/404-0-0x00000000753D2000-0x00000000753D3000-memory.dmpFilesize
4KB
-
memory/404-1-0x00000000753D0000-0x0000000075981000-memory.dmpFilesize
5.7MB
-
memory/404-2-0x00000000753D0000-0x0000000075981000-memory.dmpFilesize
5.7MB
-
memory/404-3-0x00000000753D2000-0x00000000753D3000-memory.dmpFilesize
4KB
-
memory/404-4-0x00000000753D0000-0x0000000075981000-memory.dmpFilesize
5.7MB
-
memory/404-7-0x00000000753D0000-0x0000000075981000-memory.dmpFilesize
5.7MB
-
memory/3428-27-0x0000000006C60000-0x0000000006CFA000-memory.dmpFilesize
616KB
-
memory/3428-23-0x0000000006C60000-0x0000000006CFA000-memory.dmpFilesize
616KB
-
memory/3428-22-0x0000000006C60000-0x0000000006CFA000-memory.dmpFilesize
616KB
-
memory/3428-16-0x0000000002A60000-0x0000000002B49000-memory.dmpFilesize
932KB
-
memory/3428-12-0x0000000002A60000-0x0000000002B49000-memory.dmpFilesize
932KB
-
memory/4172-14-0x00000000004D0000-0x00000000004DB000-memory.dmpFilesize
44KB
-
memory/4172-13-0x00000000004D0000-0x00000000004DB000-memory.dmpFilesize
44KB
-
memory/5012-10-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/5012-11-0x0000000000C10000-0x0000000000C24000-memory.dmpFilesize
80KB
-
memory/5012-8-0x0000000001110000-0x000000000145A000-memory.dmpFilesize
3.3MB
-
memory/5012-5-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB