Analysis
-
max time kernel
149s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 12:50
Static task
static1
Behavioral task
behavioral1
Sample
PROFORMA INVOICE - MV CNC BANGKOK - ST24PJ-287.exe
Resource
win7-20240221-en
General
-
Target
PROFORMA INVOICE - MV CNC BANGKOK - ST24PJ-287.exe
-
Size
1.0MB
-
MD5
f44bc4e0027f0f44d75fed04b8416be2
-
SHA1
70fffcae8382f82570ec5b8e0389e7378c5db522
-
SHA256
c019951411af4b89614d39e15b69e1798f267c54aebfe7e61852e4626bf00cbe
-
SHA512
506d386d7fbd7506930017ba869573bb1e21762c002fb686740ef9cfd906459886fba519486600582f5ab903a958ddfeed81d5df92af6a16c2cc6951e34e9458
-
SSDEEP
12288:5D9Q6t+p9J/s61NobMm1k4Wcqx9cpwtNHdlIoXcPANAe5WdNH6gsmxhgR6ZdEyGk:yoYck4JqncElfcINPewgsw26ZdxAx87
Malware Config
Extracted
formbook
4.1
ps94
gokorgiboard.com
17tk558f.com
xbtdlz.com
agence-dyf.com
azovtour.com
refreshoutdoors.shop
muyidajs.com
bull007s.autos
huskyacres.net
nryijx628b.xyz
romansotam.com
norlac.xyz
dorsetbusinessforum.com
prpasti.shop
amycostellospeech.com
dpaijvpiajvpin.top
rinabet371.com
corporatebushcraft.com
0755xx.com
wxsjlwkj2019.com
cjyegfoj.net
t5u2s.xyz
light-in-the-heavens.com
forluvofcomedy.com
modevow.com
doising.com
mpcihjpo.xyz
readysetmarkit.com
0909000000.com
checkout4xgrow.shop
whatsapp-p.vip
vpdyt637j.xyz
sunnykiki.net
yesspin.vip
mbduattf.net
gkjjic1ti9.xyz
coindoody.com
st-petersburghpirates.com
khsv4r.top
xsmci844n.xyz
lottiedottieclayco.com
hregrhherdhretdhrt.xyz
rd15.top
parsendustriyel.com
southernsweetsboxco.com
swattonracing.com
streamfly.video
everygrow.xyz
4iszk17p.top
roofing-jobs-97892.bond
625251.com
slotgacor4dline.site
marykellerbechem.com
mjdwmft.life
theip.pro
htgithub.com
aianswerforaluminium.com
vtscw364x.xyz
eroshiroutomatomekojin.com
datanexusmarketing.com
premierdrops.agency
fareast-trading.com
ddsmb.club
transpecosexpress.com
rgrogerscreations.com
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3672-13-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3672-21-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3672-68-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1576-73-0x0000000000120000-0x000000000014F000-memory.dmp formbook -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
PROFORMA INVOICE - MV CNC BANGKOK - ST24PJ-287.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation PROFORMA INVOICE - MV CNC BANGKOK - ST24PJ-287.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
PROFORMA INVOICE - MV CNC BANGKOK - ST24PJ-287.exePROFORMA INVOICE - MV CNC BANGKOK - ST24PJ-287.exehelp.exedescription pid process target process PID 2740 set thread context of 3672 2740 PROFORMA INVOICE - MV CNC BANGKOK - ST24PJ-287.exe PROFORMA INVOICE - MV CNC BANGKOK - ST24PJ-287.exe PID 3672 set thread context of 3456 3672 PROFORMA INVOICE - MV CNC BANGKOK - ST24PJ-287.exe Explorer.EXE PID 3672 set thread context of 3456 3672 PROFORMA INVOICE - MV CNC BANGKOK - ST24PJ-287.exe Explorer.EXE PID 1576 set thread context of 3456 1576 help.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 60 IoCs
Processes:
PROFORMA INVOICE - MV CNC BANGKOK - ST24PJ-287.exepowershell.exehelp.exepid process 3672 PROFORMA INVOICE - MV CNC BANGKOK - ST24PJ-287.exe 3672 PROFORMA INVOICE - MV CNC BANGKOK - ST24PJ-287.exe 3672 PROFORMA INVOICE - MV CNC BANGKOK - ST24PJ-287.exe 3672 PROFORMA INVOICE - MV CNC BANGKOK - ST24PJ-287.exe 5116 powershell.exe 5116 powershell.exe 3672 PROFORMA INVOICE - MV CNC BANGKOK - ST24PJ-287.exe 3672 PROFORMA INVOICE - MV CNC BANGKOK - ST24PJ-287.exe 1576 help.exe 1576 help.exe 1576 help.exe 1576 help.exe 1576 help.exe 1576 help.exe 1576 help.exe 1576 help.exe 1576 help.exe 1576 help.exe 1576 help.exe 1576 help.exe 1576 help.exe 1576 help.exe 1576 help.exe 1576 help.exe 1576 help.exe 1576 help.exe 1576 help.exe 1576 help.exe 1576 help.exe 1576 help.exe 1576 help.exe 1576 help.exe 1576 help.exe 1576 help.exe 1576 help.exe 1576 help.exe 1576 help.exe 1576 help.exe 1576 help.exe 1576 help.exe 1576 help.exe 1576 help.exe 1576 help.exe 1576 help.exe 1576 help.exe 1576 help.exe 1576 help.exe 1576 help.exe 1576 help.exe 1576 help.exe 1576 help.exe 1576 help.exe 1576 help.exe 1576 help.exe 1576 help.exe 1576 help.exe 1576 help.exe 1576 help.exe 1576 help.exe 1576 help.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
PROFORMA INVOICE - MV CNC BANGKOK - ST24PJ-287.exehelp.exepid process 3672 PROFORMA INVOICE - MV CNC BANGKOK - ST24PJ-287.exe 3672 PROFORMA INVOICE - MV CNC BANGKOK - ST24PJ-287.exe 3672 PROFORMA INVOICE - MV CNC BANGKOK - ST24PJ-287.exe 3672 PROFORMA INVOICE - MV CNC BANGKOK - ST24PJ-287.exe 1576 help.exe 1576 help.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
PROFORMA INVOICE - MV CNC BANGKOK - ST24PJ-287.exepowershell.exeExplorer.EXEhelp.exedescription pid process Token: SeDebugPrivilege 3672 PROFORMA INVOICE - MV CNC BANGKOK - ST24PJ-287.exe Token: SeDebugPrivilege 5116 powershell.exe Token: SeShutdownPrivilege 3456 Explorer.EXE Token: SeCreatePagefilePrivilege 3456 Explorer.EXE Token: SeDebugPrivilege 1576 help.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
PROFORMA INVOICE - MV CNC BANGKOK - ST24PJ-287.exeExplorer.EXEhelp.exedescription pid process target process PID 2740 wrote to memory of 5116 2740 PROFORMA INVOICE - MV CNC BANGKOK - ST24PJ-287.exe powershell.exe PID 2740 wrote to memory of 5116 2740 PROFORMA INVOICE - MV CNC BANGKOK - ST24PJ-287.exe powershell.exe PID 2740 wrote to memory of 5116 2740 PROFORMA INVOICE - MV CNC BANGKOK - ST24PJ-287.exe powershell.exe PID 2740 wrote to memory of 3672 2740 PROFORMA INVOICE - MV CNC BANGKOK - ST24PJ-287.exe PROFORMA INVOICE - MV CNC BANGKOK - ST24PJ-287.exe PID 2740 wrote to memory of 3672 2740 PROFORMA INVOICE - MV CNC BANGKOK - ST24PJ-287.exe PROFORMA INVOICE - MV CNC BANGKOK - ST24PJ-287.exe PID 2740 wrote to memory of 3672 2740 PROFORMA INVOICE - MV CNC BANGKOK - ST24PJ-287.exe PROFORMA INVOICE - MV CNC BANGKOK - ST24PJ-287.exe PID 2740 wrote to memory of 3672 2740 PROFORMA INVOICE - MV CNC BANGKOK - ST24PJ-287.exe PROFORMA INVOICE - MV CNC BANGKOK - ST24PJ-287.exe PID 2740 wrote to memory of 3672 2740 PROFORMA INVOICE - MV CNC BANGKOK - ST24PJ-287.exe PROFORMA INVOICE - MV CNC BANGKOK - ST24PJ-287.exe PID 2740 wrote to memory of 3672 2740 PROFORMA INVOICE - MV CNC BANGKOK - ST24PJ-287.exe PROFORMA INVOICE - MV CNC BANGKOK - ST24PJ-287.exe PID 3456 wrote to memory of 1576 3456 Explorer.EXE help.exe PID 3456 wrote to memory of 1576 3456 Explorer.EXE help.exe PID 3456 wrote to memory of 1576 3456 Explorer.EXE help.exe PID 1576 wrote to memory of 5024 1576 help.exe cmd.exe PID 1576 wrote to memory of 5024 1576 help.exe cmd.exe PID 1576 wrote to memory of 5024 1576 help.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PROFORMA INVOICE - MV CNC BANGKOK - ST24PJ-287.exe"C:\Users\Admin\AppData\Local\Temp\PROFORMA INVOICE - MV CNC BANGKOK - ST24PJ-287.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PROFORMA INVOICE - MV CNC BANGKOK - ST24PJ-287.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\PROFORMA INVOICE - MV CNC BANGKOK - ST24PJ-287.exe"C:\Users\Admin\AppData\Local\Temp\PROFORMA INVOICE - MV CNC BANGKOK - ST24PJ-287.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PROFORMA INVOICE - MV CNC BANGKOK - ST24PJ-287.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ypzhfeqj.4yj.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/1576-73-0x0000000000120000-0x000000000014F000-memory.dmpFilesize
188KB
-
memory/1576-72-0x0000000000FA0000-0x0000000000FA7000-memory.dmpFilesize
28KB
-
memory/1576-71-0x0000000000FA0000-0x0000000000FA7000-memory.dmpFilesize
28KB
-
memory/2740-8-0x0000000005220000-0x0000000005232000-memory.dmpFilesize
72KB
-
memory/2740-11-0x0000000008130000-0x000000000813C000-memory.dmpFilesize
48KB
-
memory/2740-6-0x0000000005A90000-0x0000000005DE4000-memory.dmpFilesize
3.3MB
-
memory/2740-7-0x0000000005250000-0x00000000052EC000-memory.dmpFilesize
624KB
-
memory/2740-0-0x0000000074DBE000-0x0000000074DBF000-memory.dmpFilesize
4KB
-
memory/2740-9-0x0000000006CD0000-0x0000000006CF2000-memory.dmpFilesize
136KB
-
memory/2740-10-0x0000000008000000-0x0000000008010000-memory.dmpFilesize
64KB
-
memory/2740-4-0x0000000004F10000-0x0000000004F1A000-memory.dmpFilesize
40KB
-
memory/2740-12-0x0000000008160000-0x00000000081D6000-memory.dmpFilesize
472KB
-
memory/2740-5-0x0000000074DB0000-0x0000000075560000-memory.dmpFilesize
7.7MB
-
memory/2740-15-0x0000000074DB0000-0x0000000075560000-memory.dmpFilesize
7.7MB
-
memory/2740-3-0x0000000004F30000-0x0000000004FC2000-memory.dmpFilesize
584KB
-
memory/2740-2-0x00000000054E0000-0x0000000005A84000-memory.dmpFilesize
5.6MB
-
memory/2740-1-0x0000000000450000-0x000000000055A000-memory.dmpFilesize
1.0MB
-
memory/3456-27-0x00000000034F0000-0x00000000035D0000-memory.dmpFilesize
896KB
-
memory/3456-70-0x000000000B0B0000-0x000000000B1F7000-memory.dmpFilesize
1.3MB
-
memory/3456-79-0x0000000008FE0000-0x0000000009118000-memory.dmpFilesize
1.2MB
-
memory/3456-76-0x000000000B0B0000-0x000000000B1F7000-memory.dmpFilesize
1.3MB
-
memory/3456-74-0x00000000034F0000-0x00000000035D0000-memory.dmpFilesize
896KB
-
memory/3672-21-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3672-13-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3672-16-0x0000000001050000-0x000000000139A000-memory.dmpFilesize
3.3MB
-
memory/3672-68-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3672-69-0x0000000000D20000-0x0000000000D34000-memory.dmpFilesize
80KB
-
memory/3672-22-0x0000000000B90000-0x0000000000BA4000-memory.dmpFilesize
80KB
-
memory/5116-38-0x0000000005BD0000-0x0000000005BEE000-memory.dmpFilesize
120KB
-
memory/5116-61-0x0000000007140000-0x0000000007154000-memory.dmpFilesize
80KB
-
memory/5116-41-0x00000000061A0000-0x00000000061D2000-memory.dmpFilesize
200KB
-
memory/5116-52-0x0000000006180000-0x000000000619E000-memory.dmpFilesize
120KB
-
memory/5116-42-0x0000000070C50000-0x0000000070C9C000-memory.dmpFilesize
304KB
-
memory/5116-53-0x0000000002270000-0x0000000002280000-memory.dmpFilesize
64KB
-
memory/5116-54-0x0000000006BA0000-0x0000000006C43000-memory.dmpFilesize
652KB
-
memory/5116-56-0x0000000006F00000-0x0000000006F1A000-memory.dmpFilesize
104KB
-
memory/5116-55-0x0000000007540000-0x0000000007BBA000-memory.dmpFilesize
6.5MB
-
memory/5116-57-0x0000000006F70000-0x0000000006F7A000-memory.dmpFilesize
40KB
-
memory/5116-58-0x0000000007180000-0x0000000007216000-memory.dmpFilesize
600KB
-
memory/5116-59-0x0000000007100000-0x0000000007111000-memory.dmpFilesize
68KB
-
memory/5116-60-0x0000000007130000-0x000000000713E000-memory.dmpFilesize
56KB
-
memory/5116-40-0x000000007F340000-0x000000007F350000-memory.dmpFilesize
64KB
-
memory/5116-62-0x0000000007240000-0x000000000725A000-memory.dmpFilesize
104KB
-
memory/5116-63-0x0000000007220000-0x0000000007228000-memory.dmpFilesize
32KB
-
memory/5116-66-0x0000000074E30000-0x00000000755E0000-memory.dmpFilesize
7.7MB
-
memory/5116-39-0x0000000005C00000-0x0000000005C4C000-memory.dmpFilesize
304KB
-
memory/5116-24-0x0000000004D80000-0x00000000053A8000-memory.dmpFilesize
6.2MB
-
memory/5116-28-0x0000000005610000-0x0000000005964000-memory.dmpFilesize
3.3MB
-
memory/5116-17-0x0000000074E3E000-0x0000000074E3F000-memory.dmpFilesize
4KB
-
memory/5116-23-0x0000000002270000-0x0000000002280000-memory.dmpFilesize
64KB
-
memory/5116-25-0x0000000004BA0000-0x0000000004C06000-memory.dmpFilesize
408KB
-
memory/5116-26-0x00000000054A0000-0x0000000005506000-memory.dmpFilesize
408KB
-
memory/5116-19-0x00000000022C0000-0x00000000022F6000-memory.dmpFilesize
216KB
-
memory/5116-20-0x0000000074E30000-0x00000000755E0000-memory.dmpFilesize
7.7MB