Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 12:50
Static task
static1
Behavioral task
behavioral1
Sample
INVOICE - MV CNC BANGKOK - ST24PJ-278.exe
Resource
win7-20240419-en
General
-
Target
INVOICE - MV CNC BANGKOK - ST24PJ-278.exe
-
Size
608KB
-
MD5
0559acbaacfcf93cefd8bcbfd498bfe4
-
SHA1
26142b0abd1848a4aeb96e63ed74836e5af67823
-
SHA256
251f9b9b5d35ad3ca96da825cea2a7b95f97872a5c6994a9123e203d41093a87
-
SHA512
e6ca8522526fcd0875d97ee1a77bcc3d11e78c6b72d7c2332331c59daae2bc2adb32ce6c803ebdaa27d4990575688acc09c6cca09664d419353f6f3ee848bcdd
-
SSDEEP
12288:yEJwtNcDfRDyLA7sGpEBVgWd/3cN1h89cdQpNIcaiwLjnp+YDj:lHfROLIsGUVD1cTh89BZaiQ7x/
Malware Config
Extracted
formbook
4.1
ps94
gokorgiboard.com
17tk558f.com
xbtdlz.com
agence-dyf.com
azovtour.com
refreshoutdoors.shop
muyidajs.com
bull007s.autos
huskyacres.net
nryijx628b.xyz
romansotam.com
norlac.xyz
dorsetbusinessforum.com
prpasti.shop
amycostellospeech.com
dpaijvpiajvpin.top
rinabet371.com
corporatebushcraft.com
0755xx.com
wxsjlwkj2019.com
cjyegfoj.net
t5u2s.xyz
light-in-the-heavens.com
forluvofcomedy.com
modevow.com
doising.com
mpcihjpo.xyz
readysetmarkit.com
0909000000.com
checkout4xgrow.shop
whatsapp-p.vip
vpdyt637j.xyz
sunnykiki.net
yesspin.vip
mbduattf.net
gkjjic1ti9.xyz
coindoody.com
st-petersburghpirates.com
khsv4r.top
xsmci844n.xyz
lottiedottieclayco.com
hregrhherdhretdhrt.xyz
rd15.top
parsendustriyel.com
southernsweetsboxco.com
swattonracing.com
streamfly.video
everygrow.xyz
4iszk17p.top
roofing-jobs-97892.bond
625251.com
slotgacor4dline.site
marykellerbechem.com
mjdwmft.life
theip.pro
htgithub.com
aianswerforaluminium.com
vtscw364x.xyz
eroshiroutomatomekojin.com
datanexusmarketing.com
premierdrops.agency
fareast-trading.com
ddsmb.club
transpecosexpress.com
rgrogerscreations.com
Signatures
-
Formbook payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1976-10-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1976-16-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4908-67-0x0000000000480000-0x00000000004AF000-memory.dmp formbook -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
INVOICE - MV CNC BANGKOK - ST24PJ-278.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation INVOICE - MV CNC BANGKOK - ST24PJ-278.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
INVOICE - MV CNC BANGKOK - ST24PJ-278.exeINVOICE - MV CNC BANGKOK - ST24PJ-278.exeipconfig.exedescription pid process target process PID 4808 set thread context of 1976 4808 INVOICE - MV CNC BANGKOK - ST24PJ-278.exe INVOICE - MV CNC BANGKOK - ST24PJ-278.exe PID 1976 set thread context of 3364 1976 INVOICE - MV CNC BANGKOK - ST24PJ-278.exe Explorer.EXE PID 4908 set thread context of 3364 4908 ipconfig.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid process 4908 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 60 IoCs
Processes:
INVOICE - MV CNC BANGKOK - ST24PJ-278.exepowershell.exeipconfig.exepid process 1976 INVOICE - MV CNC BANGKOK - ST24PJ-278.exe 1976 INVOICE - MV CNC BANGKOK - ST24PJ-278.exe 1976 INVOICE - MV CNC BANGKOK - ST24PJ-278.exe 1976 INVOICE - MV CNC BANGKOK - ST24PJ-278.exe 4856 powershell.exe 4856 powershell.exe 4908 ipconfig.exe 4908 ipconfig.exe 4908 ipconfig.exe 4908 ipconfig.exe 4908 ipconfig.exe 4908 ipconfig.exe 4908 ipconfig.exe 4908 ipconfig.exe 4908 ipconfig.exe 4908 ipconfig.exe 4908 ipconfig.exe 4908 ipconfig.exe 4908 ipconfig.exe 4908 ipconfig.exe 4908 ipconfig.exe 4908 ipconfig.exe 4908 ipconfig.exe 4908 ipconfig.exe 4908 ipconfig.exe 4908 ipconfig.exe 4908 ipconfig.exe 4908 ipconfig.exe 4908 ipconfig.exe 4908 ipconfig.exe 4908 ipconfig.exe 4908 ipconfig.exe 4908 ipconfig.exe 4908 ipconfig.exe 4908 ipconfig.exe 4908 ipconfig.exe 4908 ipconfig.exe 4908 ipconfig.exe 4908 ipconfig.exe 4908 ipconfig.exe 4908 ipconfig.exe 4908 ipconfig.exe 4908 ipconfig.exe 4908 ipconfig.exe 4908 ipconfig.exe 4908 ipconfig.exe 4908 ipconfig.exe 4908 ipconfig.exe 4908 ipconfig.exe 4908 ipconfig.exe 4908 ipconfig.exe 4908 ipconfig.exe 4908 ipconfig.exe 4908 ipconfig.exe 4908 ipconfig.exe 4908 ipconfig.exe 4908 ipconfig.exe 4908 ipconfig.exe 4908 ipconfig.exe 4908 ipconfig.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
INVOICE - MV CNC BANGKOK - ST24PJ-278.exeipconfig.exepid process 1976 INVOICE - MV CNC BANGKOK - ST24PJ-278.exe 1976 INVOICE - MV CNC BANGKOK - ST24PJ-278.exe 1976 INVOICE - MV CNC BANGKOK - ST24PJ-278.exe 4908 ipconfig.exe 4908 ipconfig.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
INVOICE - MV CNC BANGKOK - ST24PJ-278.exepowershell.exeipconfig.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1976 INVOICE - MV CNC BANGKOK - ST24PJ-278.exe Token: SeDebugPrivilege 4856 powershell.exe Token: SeDebugPrivilege 4908 ipconfig.exe Token: SeShutdownPrivilege 3364 Explorer.EXE Token: SeCreatePagefilePrivilege 3364 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3364 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
INVOICE - MV CNC BANGKOK - ST24PJ-278.exeExplorer.EXEipconfig.exedescription pid process target process PID 4808 wrote to memory of 4856 4808 INVOICE - MV CNC BANGKOK - ST24PJ-278.exe powershell.exe PID 4808 wrote to memory of 4856 4808 INVOICE - MV CNC BANGKOK - ST24PJ-278.exe powershell.exe PID 4808 wrote to memory of 4856 4808 INVOICE - MV CNC BANGKOK - ST24PJ-278.exe powershell.exe PID 4808 wrote to memory of 1976 4808 INVOICE - MV CNC BANGKOK - ST24PJ-278.exe INVOICE - MV CNC BANGKOK - ST24PJ-278.exe PID 4808 wrote to memory of 1976 4808 INVOICE - MV CNC BANGKOK - ST24PJ-278.exe INVOICE - MV CNC BANGKOK - ST24PJ-278.exe PID 4808 wrote to memory of 1976 4808 INVOICE - MV CNC BANGKOK - ST24PJ-278.exe INVOICE - MV CNC BANGKOK - ST24PJ-278.exe PID 4808 wrote to memory of 1976 4808 INVOICE - MV CNC BANGKOK - ST24PJ-278.exe INVOICE - MV CNC BANGKOK - ST24PJ-278.exe PID 4808 wrote to memory of 1976 4808 INVOICE - MV CNC BANGKOK - ST24PJ-278.exe INVOICE - MV CNC BANGKOK - ST24PJ-278.exe PID 4808 wrote to memory of 1976 4808 INVOICE - MV CNC BANGKOK - ST24PJ-278.exe INVOICE - MV CNC BANGKOK - ST24PJ-278.exe PID 3364 wrote to memory of 4908 3364 Explorer.EXE ipconfig.exe PID 3364 wrote to memory of 4908 3364 Explorer.EXE ipconfig.exe PID 3364 wrote to memory of 4908 3364 Explorer.EXE ipconfig.exe PID 4908 wrote to memory of 4844 4908 ipconfig.exe cmd.exe PID 4908 wrote to memory of 4844 4908 ipconfig.exe cmd.exe PID 4908 wrote to memory of 4844 4908 ipconfig.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\INVOICE - MV CNC BANGKOK - ST24PJ-278.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE - MV CNC BANGKOK - ST24PJ-278.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\INVOICE - MV CNC BANGKOK - ST24PJ-278.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\INVOICE - MV CNC BANGKOK - ST24PJ-278.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE - MV CNC BANGKOK - ST24PJ-278.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\INVOICE - MV CNC BANGKOK - ST24PJ-278.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bn23fum0.f0b.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/1976-10-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1976-16-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1976-17-0x0000000001640000-0x0000000001654000-memory.dmpFilesize
80KB
-
memory/1976-13-0x0000000001910000-0x0000000001C5A000-memory.dmpFilesize
3.3MB
-
memory/3364-20-0x000000000AFB0000-0x000000000B146000-memory.dmpFilesize
1.6MB
-
memory/3364-69-0x000000000AFB0000-0x000000000B146000-memory.dmpFilesize
1.6MB
-
memory/3364-71-0x0000000007900000-0x00000000079D5000-memory.dmpFilesize
852KB
-
memory/4808-5-0x0000000074BE0000-0x0000000075390000-memory.dmpFilesize
7.7MB
-
memory/4808-9-0x000000000C300000-0x000000000C39C000-memory.dmpFilesize
624KB
-
memory/4808-8-0x00000000063F0000-0x0000000006466000-memory.dmpFilesize
472KB
-
memory/4808-12-0x0000000074BE0000-0x0000000075390000-memory.dmpFilesize
7.7MB
-
memory/4808-7-0x00000000056E0000-0x00000000056EC000-memory.dmpFilesize
48KB
-
memory/4808-6-0x00000000054A0000-0x00000000054B0000-memory.dmpFilesize
64KB
-
memory/4808-4-0x00000000051F0000-0x00000000051FA000-memory.dmpFilesize
40KB
-
memory/4808-3-0x0000000005230000-0x00000000052C2000-memory.dmpFilesize
584KB
-
memory/4808-0-0x0000000074BEE000-0x0000000074BEF000-memory.dmpFilesize
4KB
-
memory/4808-2-0x0000000005740000-0x0000000005CE4000-memory.dmpFilesize
5.6MB
-
memory/4808-1-0x0000000000750000-0x00000000007EE000-memory.dmpFilesize
632KB
-
memory/4856-34-0x0000000005F20000-0x0000000005F86000-memory.dmpFilesize
408KB
-
memory/4856-53-0x00000000075D0000-0x0000000007673000-memory.dmpFilesize
652KB
-
memory/4856-28-0x00000000054C0000-0x00000000054E2000-memory.dmpFilesize
136KB
-
memory/4856-21-0x0000000004ED0000-0x0000000004EE0000-memory.dmpFilesize
64KB
-
memory/4856-33-0x0000000005E30000-0x0000000005E96000-memory.dmpFilesize
408KB
-
memory/4856-22-0x0000000005510000-0x0000000005B38000-memory.dmpFilesize
6.2MB
-
memory/4856-35-0x0000000005F90000-0x00000000062E4000-memory.dmpFilesize
3.3MB
-
memory/4856-36-0x00000000063C0000-0x00000000063DE000-memory.dmpFilesize
120KB
-
memory/4856-37-0x0000000006460000-0x00000000064AC000-memory.dmpFilesize
304KB
-
memory/4856-38-0x000000007F8F0000-0x000000007F900000-memory.dmpFilesize
64KB
-
memory/4856-39-0x0000000007390000-0x00000000073C2000-memory.dmpFilesize
200KB
-
memory/4856-40-0x0000000070A80000-0x0000000070ACC000-memory.dmpFilesize
304KB
-
memory/4856-50-0x0000000006990000-0x00000000069AE000-memory.dmpFilesize
120KB
-
memory/4856-52-0x0000000004ED0000-0x0000000004EE0000-memory.dmpFilesize
64KB
-
memory/4856-51-0x0000000004ED0000-0x0000000004EE0000-memory.dmpFilesize
64KB
-
memory/4856-15-0x0000000074C6E000-0x0000000074C6F000-memory.dmpFilesize
4KB
-
memory/4856-54-0x0000000007D30000-0x00000000083AA000-memory.dmpFilesize
6.5MB
-
memory/4856-55-0x00000000076E0000-0x00000000076FA000-memory.dmpFilesize
104KB
-
memory/4856-56-0x0000000007760000-0x000000000776A000-memory.dmpFilesize
40KB
-
memory/4856-57-0x0000000007960000-0x00000000079F6000-memory.dmpFilesize
600KB
-
memory/4856-58-0x00000000078E0000-0x00000000078F1000-memory.dmpFilesize
68KB
-
memory/4856-18-0x0000000004ED0000-0x0000000004EE0000-memory.dmpFilesize
64KB
-
memory/4856-19-0x0000000004D70000-0x0000000004DA6000-memory.dmpFilesize
216KB
-
memory/4856-61-0x0000000007910000-0x000000000791E000-memory.dmpFilesize
56KB
-
memory/4856-62-0x0000000007920000-0x0000000007934000-memory.dmpFilesize
80KB
-
memory/4856-63-0x0000000007A20000-0x0000000007A3A000-memory.dmpFilesize
104KB
-
memory/4856-64-0x0000000007A00000-0x0000000007A08000-memory.dmpFilesize
32KB
-
memory/4908-67-0x0000000000480000-0x00000000004AF000-memory.dmpFilesize
188KB
-
memory/4908-60-0x0000000000BA0000-0x0000000000BAB000-memory.dmpFilesize
44KB
-
memory/4908-59-0x0000000000BA0000-0x0000000000BAB000-memory.dmpFilesize
44KB