Analysis
-
max time kernel
146s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
24-06-2024 11:52
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order List.xls.exe
Resource
win7-20240611-en
General
-
Target
Purchase Order List.xls.exe
-
Size
448KB
-
MD5
7e35e387ee431ef08dfeec00552a6006
-
SHA1
3d67672311c989e58c18df87b92e671cc5100360
-
SHA256
e44f2c56314148dfe7f8e8ca016fd689f8fb72029a4c06b9020a322ba6ed1896
-
SHA512
de755174a1cd65c46b8969ea14044c06282ef8748ffc92b08d9130571b241a786618b91196b30354b85f5d2815a56c5fe246e9bc753be35e9d7122db8a1c8299
-
SSDEEP
6144:7Q3klTByZJvq7I3kv61Gn8UOFP0hEtUfv8AQDLv8mex0D9av1osh:s3YTEZJvqbOC8m688A4Err
Malware Config
Extracted
formbook
4.1
45er
depotpulsa.com
k2bilbao.online
bb4uoficial.com
rwc666.club
us-pservice.cyou
tricegottreats.com
zsystems.pro
qudouyin6.com
sfumaturedamore.net
pcetyy.icu
notbokin.online
beqprod.tech
flipbuilding.com
errormitigationzoo.com
zj5u603.xyz
jezzatravel.com
zmdniavysyi.shop
quinnsteele.com
522334.com
outdoorshopping.net
7140k.vip
appmonster.live
rvrentalsusane.com
berry-hut.com
h-m-32.com
aklnk.xyz
project.fail
thelbacollection.com
ternkm.com
331022.xyz
qhr86.com
casvivip.com
f661dsa-dsf564a.biz
holisticfox.com
taobaoo03.com
kursy-parikmaher.store
reignscents.com
wot4x4.com
axoloterosa.com
instzn.site
nn477.xyz
jwsalestx.com
cualuoinuhoang.com
sagehrsuiteindercloud.solutions
2ecxab.vip
lottery99nft.xyz
budakbetingbet43.click
plaay.live
drmediapulsehub.com
bahismax.com
clareleeuwinclark.com
clarimix.com
ssongg11913.cfd
shapoorji-kingstown.com
detoxifysupplements.info
easy100ksidegig.com
abramovatata.online
barillonfo.net
keendeed.com
yunosave.online
pptv05.xyz
malianbeini.net
polariscicuit.com
sahibindencomparamguvend.link
used-cars-99583.bond
Signatures
-
Formbook payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/3000-16-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/3000-21-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2660-22-0x00000000000C0000-0x00000000000EF000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Purchase Order List.xls.exeRegAsm.exehelp.exedescription pid process target process PID 1856 set thread context of 3000 1856 Purchase Order List.xls.exe RegAsm.exe PID 3000 set thread context of 1232 3000 RegAsm.exe Explorer.EXE PID 2660 set thread context of 1232 2660 help.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 32 IoCs
Processes:
Powershell.exeRegAsm.exehelp.exepid process 2904 Powershell.exe 3000 RegAsm.exe 3000 RegAsm.exe 2660 help.exe 2660 help.exe 2660 help.exe 2660 help.exe 2660 help.exe 2660 help.exe 2660 help.exe 2660 help.exe 2660 help.exe 2660 help.exe 2660 help.exe 2660 help.exe 2660 help.exe 2660 help.exe 2660 help.exe 2660 help.exe 2660 help.exe 2660 help.exe 2660 help.exe 2660 help.exe 2660 help.exe 2660 help.exe 2660 help.exe 2660 help.exe 2660 help.exe 2660 help.exe 2660 help.exe 2660 help.exe 2660 help.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegAsm.exehelp.exepid process 3000 RegAsm.exe 3000 RegAsm.exe 3000 RegAsm.exe 2660 help.exe 2660 help.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Powershell.exeRegAsm.exehelp.exedescription pid process Token: SeDebugPrivilege 2904 Powershell.exe Token: SeDebugPrivilege 3000 RegAsm.exe Token: SeDebugPrivilege 2660 help.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
Purchase Order List.xls.exeExplorer.EXEhelp.exedescription pid process target process PID 1856 wrote to memory of 2904 1856 Purchase Order List.xls.exe Powershell.exe PID 1856 wrote to memory of 2904 1856 Purchase Order List.xls.exe Powershell.exe PID 1856 wrote to memory of 2904 1856 Purchase Order List.xls.exe Powershell.exe PID 1856 wrote to memory of 2904 1856 Purchase Order List.xls.exe Powershell.exe PID 1856 wrote to memory of 3000 1856 Purchase Order List.xls.exe RegAsm.exe PID 1856 wrote to memory of 3000 1856 Purchase Order List.xls.exe RegAsm.exe PID 1856 wrote to memory of 3000 1856 Purchase Order List.xls.exe RegAsm.exe PID 1856 wrote to memory of 3000 1856 Purchase Order List.xls.exe RegAsm.exe PID 1856 wrote to memory of 3000 1856 Purchase Order List.xls.exe RegAsm.exe PID 1856 wrote to memory of 3000 1856 Purchase Order List.xls.exe RegAsm.exe PID 1856 wrote to memory of 3000 1856 Purchase Order List.xls.exe RegAsm.exe PID 1856 wrote to memory of 3000 1856 Purchase Order List.xls.exe RegAsm.exe PID 1856 wrote to memory of 3000 1856 Purchase Order List.xls.exe RegAsm.exe PID 1856 wrote to memory of 3000 1856 Purchase Order List.xls.exe RegAsm.exe PID 1232 wrote to memory of 2660 1232 Explorer.EXE help.exe PID 1232 wrote to memory of 2660 1232 Explorer.EXE help.exe PID 1232 wrote to memory of 2660 1232 Explorer.EXE help.exe PID 1232 wrote to memory of 2660 1232 Explorer.EXE help.exe PID 2660 wrote to memory of 2624 2660 help.exe cmd.exe PID 2660 wrote to memory of 2624 2660 help.exe cmd.exe PID 2660 wrote to memory of 2624 2660 help.exe cmd.exe PID 2660 wrote to memory of 2624 2660 help.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order List.xls.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order List.xls.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe"Powershell.exe" 東б屁एचтぎ儿ト丽-東б屁एचтぎ儿ト丽E東б屁एचтぎ儿ト丽x東б屁एचтぎ儿ト丽e東б屁एचтぎ儿ト丽c東б屁एचтぎ儿ト丽u東б屁एचтぎ儿ト丽t東б屁एचтぎ儿ト丽i東б屁एचтぎ儿ト丽o東б屁एचтぎ儿ト丽n東б屁एचтぎ儿ト丽P東б屁एचтぎ儿ト丽o東б屁एचтぎ儿ト丽l東б屁एचтぎ儿ト丽i東б屁एचтぎ儿ト丽c東б屁एचтぎ儿ト丽y東б屁एचтぎ儿ト丽 東б屁एचтぎ儿ト丽B東б屁एचтぎ儿ト丽y東б屁एचтぎ儿ト丽p東б屁एचтぎ儿ト丽a東б屁एचтぎ儿ト丽s東б屁एचтぎ儿ト丽s東б屁एचтぎ儿ト丽 東б屁एचтぎ儿ト丽-東б屁एचтぎ儿ト丽c東б屁एचтぎ儿ト丽o東б屁एचтぎ儿ト丽m東б屁एचтぎ儿ト丽m東б屁एचтぎ儿ト丽a東б屁एचтぎ儿ト丽n東б屁एचтぎ儿ト丽d 東б屁एचтぎ儿トC東б屁एचтぎ儿トo東б屁एचтぎ儿トp東б屁एचтぎ儿トy東б屁एचтぎ儿ト-東б屁एचтぎ儿トI東б屁एचтぎ儿トt東б屁एचтぎ儿トe東б屁एचтぎ儿トm 'C:\Users\Admin\AppData\Local\Temp\Purchase Order List.xls.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\command-line.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1232-18-0x0000000003A30000-0x0000000003B30000-memory.dmpFilesize
1024KB
-
memory/1856-1-0x00000000009C0000-0x0000000000A36000-memory.dmpFilesize
472KB
-
memory/1856-2-0x0000000000480000-0x00000000004C6000-memory.dmpFilesize
280KB
-
memory/1856-3-0x0000000074620000-0x0000000074D0E000-memory.dmpFilesize
6.9MB
-
memory/1856-0-0x000000007462E000-0x000000007462F000-memory.dmpFilesize
4KB
-
memory/1856-19-0x0000000074620000-0x0000000074D0E000-memory.dmpFilesize
6.9MB
-
memory/1856-10-0x00000000002D0000-0x00000000002DA000-memory.dmpFilesize
40KB
-
memory/2660-22-0x00000000000C0000-0x00000000000EF000-memory.dmpFilesize
188KB
-
memory/2660-20-0x00000000006F0000-0x00000000006F6000-memory.dmpFilesize
24KB
-
memory/2904-6-0x000000006FF91000-0x000000006FF92000-memory.dmpFilesize
4KB
-
memory/2904-11-0x000000006FF90000-0x000000007053B000-memory.dmpFilesize
5.7MB
-
memory/2904-9-0x000000006FF90000-0x000000007053B000-memory.dmpFilesize
5.7MB
-
memory/2904-8-0x000000006FF90000-0x000000007053B000-memory.dmpFilesize
5.7MB
-
memory/2904-7-0x000000006FF90000-0x000000007053B000-memory.dmpFilesize
5.7MB
-
memory/3000-16-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3000-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/3000-13-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3000-12-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3000-21-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB