Analysis
-
max time kernel
147s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24-06-2024 22:09
Static task
static1
Behavioral task
behavioral1
Sample
invoice copypdf.exe
Resource
win7-20240221-en
General
-
Target
invoice copypdf.exe
-
Size
408KB
-
MD5
d9ae02ae949ec2aba95cda647fe09240
-
SHA1
3858a6e45d0031fcbd9081dee453fdf196cc95a4
-
SHA256
75a0f38d45e726a70992f82304bfb85b127c37e591c02c59fe5750d308a95bd6
-
SHA512
f724c3ab608fdd6393147a2534d035b2211848efc091bcf73fb20ef2476a1705df9a423ccfe732903b8ed4fd6bef1d361e9881d5c767089ae2f5377049c97a46
-
SSDEEP
12288:KnzmVzil201tDwa2rGcLSY5ndlqChvqeA:KnzmVzK5S0cLSY5ndlqov
Malware Config
Extracted
formbook
4.1
mnf
freeedomfencemn.com
corse-pollens.com
gellyc.com
mindplusgrind.com
gzrikang.com
horukac.com
aswaqina.com
lawofficeofjimhankey.com
everyoneshoroscope.com
freisaq.com
khimyoga.com
usmarketingdigital.com
artistagospel.com
stop-moskitos.com
sertecbasicos.com
mvmontessori.net
duke-a-website.com
arcaneunlocked.com
turnershydrographics.com
bipbopbling.com
bailey-grey-sage.com
laplatesforme.com
resistrebel.com
adskliq.com
riyapalace.com
hxdhn.net
kentbranding.company
peninsulamatchmakers.net
haarausfall-info.com
artesanatosincero.com
unboundpublish.tech
zhongtangwealth.com
seoultechpe.com
antimohg.com
geniuslims.com
usacarkit.com
thegenvalue.com
soulpainting.vision
chituma2004.com
enjoybespokenwords.com
movetolancaster.com
igmasteryclub.com
imtheonlyperson.com
playerucas.com
service-9902.com
youronlinewholesaler.com
goodjob.ink
bdypss.com
icpropertiesllc.com
baove.info
brokerltsas.com
vikegame.info
aventurahdrealty.com
neurologistaandreialamberti.com
goatfare.com
funservicesflorida.com
infinitehandyman.net
alhemmah-store.com
janasfuncakes.com
sekolahsukses.com
ooc.xyz
gohawthorne.com
spotr.net
420cardsaz.com
jerkerings.com
Signatures
-
Formbook payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2716-16-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/2716-19-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/2716-26-0x0000000000400000-0x000000000042E000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1664 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
invoice copypdf.exeinvoice copypdf.execmstp.exedescription pid process target process PID 2968 set thread context of 2716 2968 invoice copypdf.exe invoice copypdf.exe PID 2716 set thread context of 1180 2716 invoice copypdf.exe Explorer.EXE PID 2716 set thread context of 1180 2716 invoice copypdf.exe Explorer.EXE PID 332 set thread context of 1180 332 cmstp.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
invoice copypdf.exeinvoice copypdf.execmstp.exepid process 2968 invoice copypdf.exe 2968 invoice copypdf.exe 2968 invoice copypdf.exe 2716 invoice copypdf.exe 2716 invoice copypdf.exe 2716 invoice copypdf.exe 332 cmstp.exe 332 cmstp.exe 332 cmstp.exe 332 cmstp.exe 332 cmstp.exe 332 cmstp.exe 332 cmstp.exe 332 cmstp.exe 332 cmstp.exe 332 cmstp.exe 332 cmstp.exe 332 cmstp.exe 332 cmstp.exe 332 cmstp.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
invoice copypdf.execmstp.exepid process 2716 invoice copypdf.exe 2716 invoice copypdf.exe 2716 invoice copypdf.exe 2716 invoice copypdf.exe 332 cmstp.exe 332 cmstp.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
invoice copypdf.exeinvoice copypdf.execmstp.exedescription pid process Token: SeDebugPrivilege 2968 invoice copypdf.exe Token: SeDebugPrivilege 2716 invoice copypdf.exe Token: SeDebugPrivilege 332 cmstp.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
invoice copypdf.exeExplorer.EXEcmstp.exedescription pid process target process PID 2968 wrote to memory of 2980 2968 invoice copypdf.exe schtasks.exe PID 2968 wrote to memory of 2980 2968 invoice copypdf.exe schtasks.exe PID 2968 wrote to memory of 2980 2968 invoice copypdf.exe schtasks.exe PID 2968 wrote to memory of 2980 2968 invoice copypdf.exe schtasks.exe PID 2968 wrote to memory of 2636 2968 invoice copypdf.exe invoice copypdf.exe PID 2968 wrote to memory of 2636 2968 invoice copypdf.exe invoice copypdf.exe PID 2968 wrote to memory of 2636 2968 invoice copypdf.exe invoice copypdf.exe PID 2968 wrote to memory of 2636 2968 invoice copypdf.exe invoice copypdf.exe PID 2968 wrote to memory of 2472 2968 invoice copypdf.exe invoice copypdf.exe PID 2968 wrote to memory of 2472 2968 invoice copypdf.exe invoice copypdf.exe PID 2968 wrote to memory of 2472 2968 invoice copypdf.exe invoice copypdf.exe PID 2968 wrote to memory of 2472 2968 invoice copypdf.exe invoice copypdf.exe PID 2968 wrote to memory of 2716 2968 invoice copypdf.exe invoice copypdf.exe PID 2968 wrote to memory of 2716 2968 invoice copypdf.exe invoice copypdf.exe PID 2968 wrote to memory of 2716 2968 invoice copypdf.exe invoice copypdf.exe PID 2968 wrote to memory of 2716 2968 invoice copypdf.exe invoice copypdf.exe PID 2968 wrote to memory of 2716 2968 invoice copypdf.exe invoice copypdf.exe PID 2968 wrote to memory of 2716 2968 invoice copypdf.exe invoice copypdf.exe PID 2968 wrote to memory of 2716 2968 invoice copypdf.exe invoice copypdf.exe PID 1180 wrote to memory of 332 1180 Explorer.EXE cmstp.exe PID 1180 wrote to memory of 332 1180 Explorer.EXE cmstp.exe PID 1180 wrote to memory of 332 1180 Explorer.EXE cmstp.exe PID 1180 wrote to memory of 332 1180 Explorer.EXE cmstp.exe PID 1180 wrote to memory of 332 1180 Explorer.EXE cmstp.exe PID 1180 wrote to memory of 332 1180 Explorer.EXE cmstp.exe PID 1180 wrote to memory of 332 1180 Explorer.EXE cmstp.exe PID 332 wrote to memory of 1664 332 cmstp.exe cmd.exe PID 332 wrote to memory of 1664 332 cmstp.exe cmd.exe PID 332 wrote to memory of 1664 332 cmstp.exe cmd.exe PID 332 wrote to memory of 1664 332 cmstp.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\invoice copypdf.exe"C:\Users\Admin\AppData\Local\Temp\invoice copypdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nojDVIgkBT" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3830.tmp"3⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Users\Admin\AppData\Local\Temp\invoice copypdf.exe"C:\Users\Admin\AppData\Local\Temp\invoice copypdf.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\invoice copypdf.exe"C:\Users\Admin\AppData\Local\Temp\invoice copypdf.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\invoice copypdf.exe"C:\Users\Admin\AppData\Local\Temp\invoice copypdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\invoice copypdf.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp3830.tmpFilesize
1KB
MD5e7809a4bf4812104fbf0823d36e5f1a3
SHA1cda4290ba9b34e8531e7085ecdaf328149ce6222
SHA256cf38292505633220d70beecd9a766bc94e186d30c427005594c1e6b6999ca625
SHA512ef9443182d38aa826b9ffe32aff97a9cccd856e322a04261258da8ebfcbcb1fe914ec49d4d9a3b3a2370267465e7b284b0a2c5a7f2536e0a898e3cfda86589df
-
memory/332-30-0x0000000000430000-0x0000000000448000-memory.dmpFilesize
96KB
-
memory/332-29-0x0000000000430000-0x0000000000448000-memory.dmpFilesize
96KB
-
memory/1180-21-0x0000000002FF0000-0x00000000030F0000-memory.dmpFilesize
1024KB
-
memory/1180-34-0x0000000006E30000-0x0000000006FCC000-memory.dmpFilesize
1.6MB
-
memory/1180-28-0x0000000006E30000-0x0000000006FCC000-memory.dmpFilesize
1.6MB
-
memory/1180-25-0x0000000005010000-0x0000000005131000-memory.dmpFilesize
1.1MB
-
memory/1180-22-0x0000000005010000-0x0000000005131000-memory.dmpFilesize
1.1MB
-
memory/2716-17-0x0000000000770000-0x0000000000A73000-memory.dmpFilesize
3.0MB
-
memory/2716-27-0x0000000000610000-0x0000000000624000-memory.dmpFilesize
80KB
-
memory/2716-26-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/2716-20-0x00000000002B0000-0x00000000002C4000-memory.dmpFilesize
80KB
-
memory/2716-19-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/2716-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2716-16-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/2716-12-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/2716-10-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/2968-4-0x00000000747D0000-0x0000000074D7B000-memory.dmpFilesize
5.7MB
-
memory/2968-23-0x00000000747D0000-0x0000000074D7B000-memory.dmpFilesize
5.7MB
-
memory/2968-0-0x00000000747D1000-0x00000000747D2000-memory.dmpFilesize
4KB
-
memory/2968-3-0x00000000747D0000-0x0000000074D7B000-memory.dmpFilesize
5.7MB
-
memory/2968-2-0x00000000747D0000-0x0000000074D7B000-memory.dmpFilesize
5.7MB
-
memory/2968-1-0x00000000747D0000-0x0000000074D7B000-memory.dmpFilesize
5.7MB