Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 05:57
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order Project No.8873_ECOFIX.exe
Resource
win7-20240508-en
General
-
Target
Purchase Order Project No.8873_ECOFIX.exe
-
Size
101KB
-
MD5
5b93648ff0ed23f7a77cf8ba1c7dfd29
-
SHA1
4ab10dc761f140b00a880699b5b71d67d000f4b9
-
SHA256
9cca5ee417bb9929c186dc8c2daa8f645e23fc7b1c32c0cb18fef77ef728c7ca
-
SHA512
be2c33e988f20a153e0c922b9458c997ca93e349e7127bc83c95cc45d440dc2734870f862c0f7dede4a81f5fa5ecbf6d006aa65a63a7bbb3d38b42ac90df88af
-
SSDEEP
1536:n8D9sbgCMGEEEEEEEEEEEbEEzEEEbEEEEEEbEEEEEEbEEEEEEbEEEEEEEbEbE3kK:n8D9sbgCM5M7C34gj7
Malware Config
Extracted
formbook
4.1
b2du
jaiesgae.online
rorysmysticrodeo.com
wd-freight.net
nfttwinning.com
yuguomall.com
lobotomizai.com
dermatologist-jobs-62886.bond
laineway.com
epistlesmultimedia.com
135w52st30a.com
kqoik2x6me.asia
murinoreactsrf.online
donnarainslegacy.com
maison-roc.com
majestyjewelss.com
suksesbersama.live
skillpraxis.com
lncnln.top
79iwin.top
rentasmoking.shop
i-maroc.online
uagerin.site
vitalwatchofficial.com
75840.xyz
bonavi.net
yilianmail.com
brandongarrett.biz
2182275.com
682032.com
nowstack.dev
dscostruzioni1982.com
harprus.xyz
kynanglanhdao.com
aquatum.com
weepitch.com
tokaiboyschallenger.com
bambzoo.com
bajandoideas.com
hgcustomcabinets.com
onjabet724164.top
padisahbet587.com
aleksi1.com
scoyf.net
barcaparfum.com
checosbar.online
wujin1.site
sedmac.com
ggdrop.uno
chatient.com
oleksandr.fun
olitoyoga.com
07876.store
megadurian.com
cahayaanugerahkreasi.com
sinisterfairytales.com
istanbulyeditepe.net
emt9933.click
lundellpartnersllp.com
jaw3l.dev
drprji.cfd
be5e.com
bong.ooo
wjziyuan.com
jgo-bitume.com
5ggt22m8.xyz
Signatures
-
Formbook payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2040-48-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\Purchase Order Project No.8873_ECOFIX = "C:\\Users\\Admin\\Documents\\Purchase Order Project No.8873_ECOFIX.pif" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Purchase Order Project No.8873_ECOFIX.exedescription pid process target process PID 1900 set thread context of 2040 1900 Purchase Order Project No.8873_ECOFIX.exe Purchase Order Project No.8873_ECOFIX.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2344 2040 WerFault.exe Purchase Order Project No.8873_ECOFIX.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
Processes:
Purchase Order Project No.8873_ECOFIX.exepid process 1900 Purchase Order Project No.8873_ECOFIX.exe 1900 Purchase Order Project No.8873_ECOFIX.exe 1900 Purchase Order Project No.8873_ECOFIX.exe 1900 Purchase Order Project No.8873_ECOFIX.exe 1900 Purchase Order Project No.8873_ECOFIX.exe 1900 Purchase Order Project No.8873_ECOFIX.exe 1900 Purchase Order Project No.8873_ECOFIX.exe 1900 Purchase Order Project No.8873_ECOFIX.exe 1900 Purchase Order Project No.8873_ECOFIX.exe 1900 Purchase Order Project No.8873_ECOFIX.exe 1900 Purchase Order Project No.8873_ECOFIX.exe 1900 Purchase Order Project No.8873_ECOFIX.exe 1900 Purchase Order Project No.8873_ECOFIX.exe 1900 Purchase Order Project No.8873_ECOFIX.exe 1900 Purchase Order Project No.8873_ECOFIX.exe 1900 Purchase Order Project No.8873_ECOFIX.exe 1900 Purchase Order Project No.8873_ECOFIX.exe 1900 Purchase Order Project No.8873_ECOFIX.exe 1900 Purchase Order Project No.8873_ECOFIX.exe 1900 Purchase Order Project No.8873_ECOFIX.exe 1900 Purchase Order Project No.8873_ECOFIX.exe 1900 Purchase Order Project No.8873_ECOFIX.exe 1900 Purchase Order Project No.8873_ECOFIX.exe 1900 Purchase Order Project No.8873_ECOFIX.exe 1900 Purchase Order Project No.8873_ECOFIX.exe 1900 Purchase Order Project No.8873_ECOFIX.exe 1900 Purchase Order Project No.8873_ECOFIX.exe 1900 Purchase Order Project No.8873_ECOFIX.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Purchase Order Project No.8873_ECOFIX.exedescription pid process Token: SeDebugPrivilege 1900 Purchase Order Project No.8873_ECOFIX.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
Purchase Order Project No.8873_ECOFIX.execmd.exePurchase Order Project No.8873_ECOFIX.exedescription pid process target process PID 1900 wrote to memory of 2620 1900 Purchase Order Project No.8873_ECOFIX.exe cmd.exe PID 1900 wrote to memory of 2620 1900 Purchase Order Project No.8873_ECOFIX.exe cmd.exe PID 1900 wrote to memory of 2620 1900 Purchase Order Project No.8873_ECOFIX.exe cmd.exe PID 1900 wrote to memory of 2620 1900 Purchase Order Project No.8873_ECOFIX.exe cmd.exe PID 2620 wrote to memory of 2352 2620 cmd.exe reg.exe PID 2620 wrote to memory of 2352 2620 cmd.exe reg.exe PID 2620 wrote to memory of 2352 2620 cmd.exe reg.exe PID 2620 wrote to memory of 2352 2620 cmd.exe reg.exe PID 1900 wrote to memory of 2516 1900 Purchase Order Project No.8873_ECOFIX.exe cmd.exe PID 1900 wrote to memory of 2516 1900 Purchase Order Project No.8873_ECOFIX.exe cmd.exe PID 1900 wrote to memory of 2516 1900 Purchase Order Project No.8873_ECOFIX.exe cmd.exe PID 1900 wrote to memory of 2516 1900 Purchase Order Project No.8873_ECOFIX.exe cmd.exe PID 1900 wrote to memory of 2988 1900 Purchase Order Project No.8873_ECOFIX.exe Purchase Order Project No.8873_ECOFIX.exe PID 1900 wrote to memory of 2988 1900 Purchase Order Project No.8873_ECOFIX.exe Purchase Order Project No.8873_ECOFIX.exe PID 1900 wrote to memory of 2988 1900 Purchase Order Project No.8873_ECOFIX.exe Purchase Order Project No.8873_ECOFIX.exe PID 1900 wrote to memory of 2988 1900 Purchase Order Project No.8873_ECOFIX.exe Purchase Order Project No.8873_ECOFIX.exe PID 1900 wrote to memory of 2040 1900 Purchase Order Project No.8873_ECOFIX.exe Purchase Order Project No.8873_ECOFIX.exe PID 1900 wrote to memory of 2040 1900 Purchase Order Project No.8873_ECOFIX.exe Purchase Order Project No.8873_ECOFIX.exe PID 1900 wrote to memory of 2040 1900 Purchase Order Project No.8873_ECOFIX.exe Purchase Order Project No.8873_ECOFIX.exe PID 1900 wrote to memory of 2040 1900 Purchase Order Project No.8873_ECOFIX.exe Purchase Order Project No.8873_ECOFIX.exe PID 1900 wrote to memory of 2040 1900 Purchase Order Project No.8873_ECOFIX.exe Purchase Order Project No.8873_ECOFIX.exe PID 1900 wrote to memory of 2040 1900 Purchase Order Project No.8873_ECOFIX.exe Purchase Order Project No.8873_ECOFIX.exe PID 1900 wrote to memory of 2040 1900 Purchase Order Project No.8873_ECOFIX.exe Purchase Order Project No.8873_ECOFIX.exe PID 2040 wrote to memory of 2344 2040 Purchase Order Project No.8873_ECOFIX.exe WerFault.exe PID 2040 wrote to memory of 2344 2040 Purchase Order Project No.8873_ECOFIX.exe WerFault.exe PID 2040 wrote to memory of 2344 2040 Purchase Order Project No.8873_ECOFIX.exe WerFault.exe PID 2040 wrote to memory of 2344 2040 Purchase Order Project No.8873_ECOFIX.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order Project No.8873_ECOFIX.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order Project No.8873_ECOFIX.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Purchase Order Project No.8873_ECOFIX" /t REG_SZ /F /D "C:\Users\Admin\Documents\Purchase Order Project No.8873_ECOFIX.pif"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Purchase Order Project No.8873_ECOFIX" /t REG_SZ /F /D "C:\Users\Admin\Documents\Purchase Order Project No.8873_ECOFIX.pif"3⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.execmd /c Copy "C:\Users\Admin\AppData\Local\Temp\Purchase Order Project No.8873_ECOFIX.exe" "C:\Users\Admin\Documents\Purchase Order Project No.8873_ECOFIX.pif"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order Project No.8873_ECOFIX.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order Project No.8873_ECOFIX.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order Project No.8873_ECOFIX.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order Project No.8873_ECOFIX.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 363⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\Local\Temp\Tar35F6.tmpFilesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
memory/1900-0-0x000000007464E000-0x000000007464F000-memory.dmpFilesize
4KB
-
memory/1900-1-0x0000000000DA0000-0x0000000000DC0000-memory.dmpFilesize
128KB
-
memory/1900-2-0x0000000074640000-0x0000000074D2E000-memory.dmpFilesize
6.9MB
-
memory/1900-40-0x00000000008D0000-0x0000000000918000-memory.dmpFilesize
288KB
-
memory/1900-49-0x0000000074640000-0x0000000074D2E000-memory.dmpFilesize
6.9MB
-
memory/2040-43-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2040-48-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2040-46-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2040-45-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB