Analysis
-
max time kernel
149s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 12:50
Static task
static1
Behavioral task
behavioral1
Sample
PO - 04755 .bat.exe
Resource
win7-20240419-en
General
-
Target
PO - 04755 .bat.exe
-
Size
541KB
-
MD5
37f3b2a7f84422ea9fce13bcc170461b
-
SHA1
b2d8ac2774b12ffc4412435224398f3909bc8ceb
-
SHA256
7cd0f4968e27515f466f0a6e6967dbc9bca2c9b75a9592e38709a2ca884c6d71
-
SHA512
604aeeaf52c3aaab4e1a46ec2879d7b8e6f68ce0168e2f7ffc4f970b1633a2752959816bde10bbe19946a0ae7a2e9d373979554729fc7ed9366e1c5516b6639a
-
SSDEEP
12288:YEuIQ8LBZ0BJxONHZZZxa3qBHkKbdUKSaEpkAE5YWOzxRwzPE58bm:XlXBWDxOpxk3qBHkcWgEppEWzxRw458K
Malware Config
Extracted
formbook
4.1
45er
depotpulsa.com
k2bilbao.online
bb4uoficial.com
rwc666.club
us-pservice.cyou
tricegottreats.com
zsystems.pro
qudouyin6.com
sfumaturedamore.net
pcetyy.icu
notbokin.online
beqprod.tech
flipbuilding.com
errormitigationzoo.com
zj5u603.xyz
jezzatravel.com
zmdniavysyi.shop
quinnsteele.com
522334.com
outdoorshopping.net
7140k.vip
appmonster.live
rvrentalsusane.com
berry-hut.com
h-m-32.com
aklnk.xyz
project.fail
thelbacollection.com
ternkm.com
331022.xyz
qhr86.com
casvivip.com
f661dsa-dsf564a.biz
holisticfox.com
taobaoo03.com
kursy-parikmaher.store
reignscents.com
wot4x4.com
axoloterosa.com
instzn.site
nn477.xyz
jwsalestx.com
cualuoinuhoang.com
sagehrsuiteindercloud.solutions
2ecxab.vip
lottery99nft.xyz
budakbetingbet43.click
plaay.live
drmediapulsehub.com
bahismax.com
clareleeuwinclark.com
clarimix.com
ssongg11913.cfd
shapoorji-kingstown.com
detoxifysupplements.info
easy100ksidegig.com
abramovatata.online
barillonfo.net
keendeed.com
yunosave.online
pptv05.xyz
malianbeini.net
polariscicuit.com
sahibindencomparamguvend.link
used-cars-99583.bond
Signatures
-
Formbook payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1520-48-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1044-96-0x0000000000530000-0x000000000055F000-memory.dmp formbook -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepid process 1424 powershell.exe 1396 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
PO - 04755 .bat.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation PO - 04755 .bat.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
PO - 04755 .bat.exePO - 04755 .bat.exesvchost.exedescription pid process target process PID 3192 set thread context of 1520 3192 PO - 04755 .bat.exe PO - 04755 .bat.exe PID 1520 set thread context of 3508 1520 PO - 04755 .bat.exe Explorer.EXE PID 1044 set thread context of 3508 1044 svchost.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
PO - 04755 .bat.exepowershell.exepowershell.exePO - 04755 .bat.exesvchost.exepid process 3192 PO - 04755 .bat.exe 3192 PO - 04755 .bat.exe 3192 PO - 04755 .bat.exe 3192 PO - 04755 .bat.exe 3192 PO - 04755 .bat.exe 3192 PO - 04755 .bat.exe 1424 powershell.exe 1396 powershell.exe 3192 PO - 04755 .bat.exe 1520 PO - 04755 .bat.exe 1520 PO - 04755 .bat.exe 1520 PO - 04755 .bat.exe 1520 PO - 04755 .bat.exe 1424 powershell.exe 1396 powershell.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe 1044 svchost.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
PO - 04755 .bat.exesvchost.exepid process 1520 PO - 04755 .bat.exe 1520 PO - 04755 .bat.exe 1520 PO - 04755 .bat.exe 1044 svchost.exe 1044 svchost.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
PO - 04755 .bat.exepowershell.exepowershell.exePO - 04755 .bat.exesvchost.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 3192 PO - 04755 .bat.exe Token: SeDebugPrivilege 1396 powershell.exe Token: SeDebugPrivilege 1424 powershell.exe Token: SeDebugPrivilege 1520 PO - 04755 .bat.exe Token: SeDebugPrivilege 1044 svchost.exe Token: SeShutdownPrivilege 3508 Explorer.EXE Token: SeCreatePagefilePrivilege 3508 Explorer.EXE Token: SeShutdownPrivilege 3508 Explorer.EXE Token: SeCreatePagefilePrivilege 3508 Explorer.EXE -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
PO - 04755 .bat.exeExplorer.EXEsvchost.exedescription pid process target process PID 3192 wrote to memory of 1396 3192 PO - 04755 .bat.exe powershell.exe PID 3192 wrote to memory of 1396 3192 PO - 04755 .bat.exe powershell.exe PID 3192 wrote to memory of 1396 3192 PO - 04755 .bat.exe powershell.exe PID 3192 wrote to memory of 1424 3192 PO - 04755 .bat.exe powershell.exe PID 3192 wrote to memory of 1424 3192 PO - 04755 .bat.exe powershell.exe PID 3192 wrote to memory of 1424 3192 PO - 04755 .bat.exe powershell.exe PID 3192 wrote to memory of 4604 3192 PO - 04755 .bat.exe schtasks.exe PID 3192 wrote to memory of 4604 3192 PO - 04755 .bat.exe schtasks.exe PID 3192 wrote to memory of 4604 3192 PO - 04755 .bat.exe schtasks.exe PID 3192 wrote to memory of 1520 3192 PO - 04755 .bat.exe PO - 04755 .bat.exe PID 3192 wrote to memory of 1520 3192 PO - 04755 .bat.exe PO - 04755 .bat.exe PID 3192 wrote to memory of 1520 3192 PO - 04755 .bat.exe PO - 04755 .bat.exe PID 3192 wrote to memory of 1520 3192 PO - 04755 .bat.exe PO - 04755 .bat.exe PID 3192 wrote to memory of 1520 3192 PO - 04755 .bat.exe PO - 04755 .bat.exe PID 3192 wrote to memory of 1520 3192 PO - 04755 .bat.exe PO - 04755 .bat.exe PID 3508 wrote to memory of 1044 3508 Explorer.EXE svchost.exe PID 3508 wrote to memory of 1044 3508 Explorer.EXE svchost.exe PID 3508 wrote to memory of 1044 3508 Explorer.EXE svchost.exe PID 1044 wrote to memory of 4192 1044 svchost.exe cmd.exe PID 1044 wrote to memory of 4192 1044 svchost.exe cmd.exe PID 1044 wrote to memory of 4192 1044 svchost.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO - 04755 .bat.exe"C:\Users\Admin\AppData\Local\Temp\PO - 04755 .bat.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PO - 04755 .bat.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\iRfUxRRiZtkySe.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iRfUxRRiZtkySe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8FCC.tmp"3⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Users\Admin\AppData\Local\Temp\PO - 04755 .bat.exe"C:\Users\Admin\AppData\Local\Temp\PO - 04755 .bat.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO - 04755 .bat.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5c4bc95ee1ef7c1a0592b7b36aa8219da
SHA1bf943311795528ff2d358e5c74b702c0a6621a29
SHA25677a27df281a6a1a6b920ed2c17c553676adc66d8cdec05d8da899ee17783c630
SHA51273c310b256b876f9c6415ff5e161c8fba0ca4c5ea8ca7108651c7f71699fae9db381c800730128d32154545cd8083c502468a0cb1580852ceac068814d233ceb
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qntlmf0y.4lp.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmp8FCC.tmpFilesize
1KB
MD5710b721c852be7b0259c61fd37b78aeb
SHA10ed5466076b95556e043310b7898f4ab7386999a
SHA2565d59a86e6e56c746d3e728a3b22f9d4067ace038729efc9b9f9debdcb0e04c4a
SHA512aac58bba792d6aa6dbbb3eb27a7be8b42eee7cff2ddc64817809f7354c47aa7937d7e670d9ac3c32ec01d5fc2b764092132d83c2fc2d204de3c49350574c374f
-
memory/1044-96-0x0000000000530000-0x000000000055F000-memory.dmpFilesize
188KB
-
memory/1044-87-0x00000000006A0000-0x00000000006AE000-memory.dmpFilesize
56KB
-
memory/1044-88-0x00000000006A0000-0x00000000006AE000-memory.dmpFilesize
56KB
-
memory/1396-16-0x0000000004A70000-0x0000000004AA6000-memory.dmpFilesize
216KB
-
memory/1396-21-0x00000000057F0000-0x0000000005856000-memory.dmpFilesize
408KB
-
memory/1396-84-0x0000000007500000-0x0000000007514000-memory.dmpFilesize
80KB
-
memory/1396-83-0x00000000074F0000-0x00000000074FE000-memory.dmpFilesize
56KB
-
memory/1396-80-0x0000000007130000-0x000000000713A000-memory.dmpFilesize
40KB
-
memory/1396-54-0x0000000005FC0000-0x000000000600C000-memory.dmpFilesize
304KB
-
memory/1396-56-0x0000000075970000-0x00000000759BC000-memory.dmpFilesize
304KB
-
memory/1396-19-0x00000000750E0000-0x0000000075890000-memory.dmpFilesize
7.7MB
-
memory/1396-18-0x00000000051C0000-0x00000000057E8000-memory.dmpFilesize
6.2MB
-
memory/1396-85-0x0000000007600000-0x000000000761A000-memory.dmpFilesize
104KB
-
memory/1396-22-0x00000000750E0000-0x0000000075890000-memory.dmpFilesize
7.7MB
-
memory/1396-20-0x0000000004EF0000-0x0000000004F12000-memory.dmpFilesize
136KB
-
memory/1396-23-0x0000000005860000-0x00000000058C6000-memory.dmpFilesize
408KB
-
memory/1396-24-0x00000000750E0000-0x0000000075890000-memory.dmpFilesize
7.7MB
-
memory/1396-86-0x00000000075E0000-0x00000000075E8000-memory.dmpFilesize
32KB
-
memory/1396-30-0x00000000059D0000-0x0000000005D24000-memory.dmpFilesize
3.3MB
-
memory/1396-95-0x00000000750E0000-0x0000000075890000-memory.dmpFilesize
7.7MB
-
memory/1396-66-0x0000000006530000-0x000000000654E000-memory.dmpFilesize
120KB
-
memory/1396-67-0x0000000006F60000-0x0000000007003000-memory.dmpFilesize
652KB
-
memory/1396-55-0x0000000006560000-0x0000000006592000-memory.dmpFilesize
200KB
-
memory/1424-78-0x0000000007B70000-0x00000000081EA000-memory.dmpFilesize
6.5MB
-
memory/1424-79-0x0000000007520000-0x000000000753A000-memory.dmpFilesize
104KB
-
memory/1424-91-0x00000000750E0000-0x0000000075890000-memory.dmpFilesize
7.7MB
-
memory/1424-53-0x0000000006200000-0x000000000621E000-memory.dmpFilesize
120KB
-
memory/1424-46-0x00000000750E0000-0x0000000075890000-memory.dmpFilesize
7.7MB
-
memory/1424-82-0x0000000007720000-0x0000000007731000-memory.dmpFilesize
68KB
-
memory/1424-68-0x0000000075970000-0x00000000759BC000-memory.dmpFilesize
304KB
-
memory/1424-49-0x00000000750E0000-0x0000000075890000-memory.dmpFilesize
7.7MB
-
memory/1424-42-0x00000000750E0000-0x0000000075890000-memory.dmpFilesize
7.7MB
-
memory/1424-81-0x00000000077A0000-0x0000000007836000-memory.dmpFilesize
600KB
-
memory/1520-48-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3192-6-0x0000000006B20000-0x000000000704C000-memory.dmpFilesize
5.2MB
-
memory/3192-8-0x0000000005DC0000-0x0000000005E4A000-memory.dmpFilesize
552KB
-
memory/3192-17-0x00000000750EE000-0x00000000750EF000-memory.dmpFilesize
4KB
-
memory/3192-47-0x00000000750E0000-0x0000000075890000-memory.dmpFilesize
7.7MB
-
memory/3192-0-0x00000000750EE000-0x00000000750EF000-memory.dmpFilesize
4KB
-
memory/3192-9-0x0000000005ED0000-0x0000000005EE0000-memory.dmpFilesize
64KB
-
memory/3192-11-0x0000000006870000-0x00000000068E6000-memory.dmpFilesize
472KB
-
memory/3192-7-0x0000000005D20000-0x0000000005DBC000-memory.dmpFilesize
624KB
-
memory/3192-10-0x0000000006020000-0x000000000602C000-memory.dmpFilesize
48KB
-
memory/3192-5-0x00000000750E0000-0x0000000075890000-memory.dmpFilesize
7.7MB
-
memory/3192-51-0x00000000750E0000-0x0000000075890000-memory.dmpFilesize
7.7MB
-
memory/3192-4-0x0000000005A40000-0x0000000005A4A000-memory.dmpFilesize
40KB
-
memory/3192-3-0x0000000005A90000-0x0000000005B22000-memory.dmpFilesize
584KB
-
memory/3192-2-0x0000000006040000-0x00000000065E4000-memory.dmpFilesize
5.6MB
-
memory/3192-1-0x0000000000FD0000-0x000000000105E000-memory.dmpFilesize
568KB
-
memory/3508-100-0x00000000087C0000-0x00000000088E2000-memory.dmpFilesize
1.1MB