Analysis
-
max time kernel
145s -
max time network
167s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 12:47
Behavioral task
behavioral1
Sample
Project Execution Order - (PO 546788) (PO 546789).exe
Resource
win7-20231129-en
General
-
Target
Project Execution Order - (PO 546788) (PO 546789).exe
-
Size
38KB
-
MD5
246238533bb596d52737946aaf4b4d37
-
SHA1
8c350aff45dbb05c1d61eb885a13b591544b70fa
-
SHA256
531e29b34f525987ef3210689b417ea3c1a0b4f5c8bcf180ef00148a3e6d0b1f
-
SHA512
8e5a0bd7a5dce0bf1927ade856aec94f2cb6ee611a832f8178fa7ede5199614b137cb8a5cb001b5d34afd9a8a0628967e68d3759e4b323ea887c59f2b8dda98e
-
SSDEEP
384:fsNjci832cy7jQNDy1SXNh2xEPICOVvHX9RL7D6p05iVXXXtXXXXXXtX41hoJOuy:vHwL7D6Shho16G+SIp1b5tPeWTU
Malware Config
Extracted
formbook
4.1
45er
depotpulsa.com
k2bilbao.online
bb4uoficial.com
rwc666.club
us-pservice.cyou
tricegottreats.com
zsystems.pro
qudouyin6.com
sfumaturedamore.net
pcetyy.icu
notbokin.online
beqprod.tech
flipbuilding.com
errormitigationzoo.com
zj5u603.xyz
jezzatravel.com
zmdniavysyi.shop
quinnsteele.com
522334.com
outdoorshopping.net
7140k.vip
appmonster.live
rvrentalsusane.com
berry-hut.com
h-m-32.com
aklnk.xyz
project.fail
thelbacollection.com
ternkm.com
331022.xyz
qhr86.com
casvivip.com
f661dsa-dsf564a.biz
holisticfox.com
taobaoo03.com
kursy-parikmaher.store
reignscents.com
wot4x4.com
axoloterosa.com
instzn.site
nn477.xyz
jwsalestx.com
cualuoinuhoang.com
sagehrsuiteindercloud.solutions
2ecxab.vip
lottery99nft.xyz
budakbetingbet43.click
plaay.live
drmediapulsehub.com
bahismax.com
clareleeuwinclark.com
clarimix.com
ssongg11913.cfd
shapoorji-kingstown.com
detoxifysupplements.info
easy100ksidegig.com
abramovatata.online
barillonfo.net
keendeed.com
yunosave.online
pptv05.xyz
malianbeini.net
polariscicuit.com
sahibindencomparamguvend.link
used-cars-99583.bond
Signatures
-
Formbook payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/636-17-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/636-21-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/5044-31-0x0000000000CD0000-0x0000000000CFF000-memory.dmp formbook -
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral2/memory/3364-1-0x0000000000840000-0x0000000000850000-memory.dmp agile_net -
Suspicious use of SetThreadContext 2 IoCs
Processes:
Project Execution Order - (PO 546788) (PO 546789).exeProject Execution Order - (PO 546788) (PO 546789).exedescription pid process target process PID 3364 set thread context of 636 3364 Project Execution Order - (PO 546788) (PO 546789).exe Project Execution Order - (PO 546788) (PO 546789).exe PID 636 set thread context of 3332 636 Project Execution Order - (PO 546788) (PO 546789).exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 32 IoCs
Processes:
Project Execution Order - (PO 546788) (PO 546789).exeProject Execution Order - (PO 546788) (PO 546789).exewlanext.exepid process 3364 Project Execution Order - (PO 546788) (PO 546789).exe 3364 Project Execution Order - (PO 546788) (PO 546789).exe 3364 Project Execution Order - (PO 546788) (PO 546789).exe 3364 Project Execution Order - (PO 546788) (PO 546789).exe 3364 Project Execution Order - (PO 546788) (PO 546789).exe 3364 Project Execution Order - (PO 546788) (PO 546789).exe 3364 Project Execution Order - (PO 546788) (PO 546789).exe 3364 Project Execution Order - (PO 546788) (PO 546789).exe 3364 Project Execution Order - (PO 546788) (PO 546789).exe 3364 Project Execution Order - (PO 546788) (PO 546789).exe 3364 Project Execution Order - (PO 546788) (PO 546789).exe 3364 Project Execution Order - (PO 546788) (PO 546789).exe 3364 Project Execution Order - (PO 546788) (PO 546789).exe 3364 Project Execution Order - (PO 546788) (PO 546789).exe 3364 Project Execution Order - (PO 546788) (PO 546789).exe 3364 Project Execution Order - (PO 546788) (PO 546789).exe 3364 Project Execution Order - (PO 546788) (PO 546789).exe 3364 Project Execution Order - (PO 546788) (PO 546789).exe 3364 Project Execution Order - (PO 546788) (PO 546789).exe 3364 Project Execution Order - (PO 546788) (PO 546789).exe 3364 Project Execution Order - (PO 546788) (PO 546789).exe 3364 Project Execution Order - (PO 546788) (PO 546789).exe 3364 Project Execution Order - (PO 546788) (PO 546789).exe 3364 Project Execution Order - (PO 546788) (PO 546789).exe 3364 Project Execution Order - (PO 546788) (PO 546789).exe 3364 Project Execution Order - (PO 546788) (PO 546789).exe 636 Project Execution Order - (PO 546788) (PO 546789).exe 636 Project Execution Order - (PO 546788) (PO 546789).exe 636 Project Execution Order - (PO 546788) (PO 546789).exe 636 Project Execution Order - (PO 546788) (PO 546789).exe 5044 wlanext.exe 5044 wlanext.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
Processes:
Project Execution Order - (PO 546788) (PO 546789).exepid process 636 Project Execution Order - (PO 546788) (PO 546789).exe 636 Project Execution Order - (PO 546788) (PO 546789).exe 636 Project Execution Order - (PO 546788) (PO 546789).exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
Project Execution Order - (PO 546788) (PO 546789).exeProject Execution Order - (PO 546788) (PO 546789).exePowershell.exewlanext.exedescription pid process Token: SeDebugPrivilege 3364 Project Execution Order - (PO 546788) (PO 546789).exe Token: SeDebugPrivilege 636 Project Execution Order - (PO 546788) (PO 546789).exe Token: SeDebugPrivilege 856 Powershell.exe Token: SeDebugPrivilege 5044 wlanext.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Project Execution Order - (PO 546788) (PO 546789).exeExplorer.EXEdescription pid process target process PID 3364 wrote to memory of 856 3364 Project Execution Order - (PO 546788) (PO 546789).exe Powershell.exe PID 3364 wrote to memory of 856 3364 Project Execution Order - (PO 546788) (PO 546789).exe Powershell.exe PID 3364 wrote to memory of 856 3364 Project Execution Order - (PO 546788) (PO 546789).exe Powershell.exe PID 3364 wrote to memory of 636 3364 Project Execution Order - (PO 546788) (PO 546789).exe Project Execution Order - (PO 546788) (PO 546789).exe PID 3364 wrote to memory of 636 3364 Project Execution Order - (PO 546788) (PO 546789).exe Project Execution Order - (PO 546788) (PO 546789).exe PID 3364 wrote to memory of 636 3364 Project Execution Order - (PO 546788) (PO 546789).exe Project Execution Order - (PO 546788) (PO 546789).exe PID 3364 wrote to memory of 636 3364 Project Execution Order - (PO 546788) (PO 546789).exe Project Execution Order - (PO 546788) (PO 546789).exe PID 3364 wrote to memory of 636 3364 Project Execution Order - (PO 546788) (PO 546789).exe Project Execution Order - (PO 546788) (PO 546789).exe PID 3364 wrote to memory of 636 3364 Project Execution Order - (PO 546788) (PO 546789).exe Project Execution Order - (PO 546788) (PO 546789).exe PID 3332 wrote to memory of 5044 3332 Explorer.EXE wlanext.exe PID 3332 wrote to memory of 5044 3332 Explorer.EXE wlanext.exe PID 3332 wrote to memory of 5044 3332 Explorer.EXE wlanext.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Project Execution Order - (PO 546788) (PO 546789).exe"C:\Users\Admin\AppData\Local\Temp\Project Execution Order - (PO 546788) (PO 546789).exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe"Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\Admin\AppData\Local\Temp\Project Execution Order - (PO 546788) (PO 546789).exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Project Execution Order - (PO 546788) (PO 546789).exe' -Force3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Project Execution Order - (PO 546788) (PO 546789).exe"C:\Users\Admin\AppData\Local\Temp\Project Execution Order - (PO 546788) (PO 546789).exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Project Execution Order - (PO 546788) (PO 546789).exe"3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4jljp5o4.tnh.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/636-17-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/636-22-0x00000000017A0000-0x00000000017B4000-memory.dmpFilesize
80KB
-
memory/636-21-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/636-19-0x00000000017E0000-0x0000000001B2A000-memory.dmpFilesize
3.3MB
-
memory/856-38-0x0000000006030000-0x0000000006384000-memory.dmpFilesize
3.3MB
-
memory/856-32-0x0000000005F50000-0x0000000005FB6000-memory.dmpFilesize
408KB
-
memory/856-30-0x0000000074ED0000-0x0000000075680000-memory.dmpFilesize
7.7MB
-
memory/856-29-0x0000000005EB0000-0x0000000005ED2000-memory.dmpFilesize
136KB
-
memory/856-24-0x00000000057F0000-0x0000000005E18000-memory.dmpFilesize
6.2MB
-
memory/856-39-0x0000000074ED0000-0x0000000075680000-memory.dmpFilesize
7.7MB
-
memory/856-41-0x0000000074ED0000-0x0000000075680000-memory.dmpFilesize
7.7MB
-
memory/856-13-0x0000000074ED0000-0x0000000075680000-memory.dmpFilesize
7.7MB
-
memory/856-14-0x0000000074ED0000-0x0000000075680000-memory.dmpFilesize
7.7MB
-
memory/856-15-0x0000000004FE0000-0x0000000005016000-memory.dmpFilesize
216KB
-
memory/856-16-0x0000000074ED0000-0x0000000075680000-memory.dmpFilesize
7.7MB
-
memory/3332-23-0x00000000083E0000-0x000000000856C000-memory.dmpFilesize
1.5MB
-
memory/3332-46-0x00000000083E0000-0x000000000856C000-memory.dmpFilesize
1.5MB
-
memory/3364-8-0x0000000074ED0000-0x0000000075680000-memory.dmpFilesize
7.7MB
-
memory/3364-7-0x00000000053F0000-0x00000000053FA000-memory.dmpFilesize
40KB
-
memory/3364-11-0x00000000068F0000-0x000000000698C000-memory.dmpFilesize
624KB
-
memory/3364-10-0x0000000000E10000-0x0000000000E58000-memory.dmpFilesize
288KB
-
memory/3364-9-0x00000000068C0000-0x00000000068DE000-memory.dmpFilesize
120KB
-
memory/3364-25-0x0000000074ED0000-0x0000000075680000-memory.dmpFilesize
7.7MB
-
memory/3364-1-0x0000000000840000-0x0000000000850000-memory.dmpFilesize
64KB
-
memory/3364-2-0x0000000005730000-0x0000000005CD4000-memory.dmpFilesize
5.6MB
-
memory/3364-0-0x0000000074EDE000-0x0000000074EDF000-memory.dmpFilesize
4KB
-
memory/3364-12-0x0000000006990000-0x00000000069F6000-memory.dmpFilesize
408KB
-
memory/3364-3-0x0000000005260000-0x00000000052F2000-memory.dmpFilesize
584KB
-
memory/3364-6-0x0000000005300000-0x0000000005376000-memory.dmpFilesize
472KB
-
memory/3364-5-0x0000000074ED0000-0x0000000075680000-memory.dmpFilesize
7.7MB
-
memory/3364-4-0x0000000074EDE000-0x0000000074EDF000-memory.dmpFilesize
4KB
-
memory/5044-31-0x0000000000CD0000-0x0000000000CFF000-memory.dmpFilesize
188KB
-
memory/5044-26-0x0000000000C20000-0x0000000000C37000-memory.dmpFilesize
92KB
-
memory/5044-28-0x0000000000C20000-0x0000000000C37000-memory.dmpFilesize
92KB