Analysis

  • max time kernel
    300s
  • max time network
    299s
  • platform
    windows7_x64
  • resource
    win7-en-20211104
  • submitted
    10-11-2021 14:15

General

  • Target

    2205821.xlsx

  • Size

    227KB

  • MD5

    3baed0b944b707cfc4dbc55f04d7c060

  • SHA1

    cd3b1eeadef3c0fc996286270912b2d39b117d33

  • SHA256

    49c28f562c417590a96bb63b2ff2f3b763ec65347c103cee014044349be2dde5

  • SHA512

    b25622eb3fde2da917ebe757ef42ece5516f29ebfed679db09d0af56484a3e05f6f35c1bbccc7e1f6290b4af14702ee861a1ca40a26a797fc7d0664d8a6aece2

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

og2w

C2

http://www.celikkaya.xyz/og2w/

Decoy

drivenexpress.info

pdfproxy.com

zyz999.top

oceanserver1.com

948289.com

nubilewoman.com

ibizadiamonds.com

bosniantv-australia.com

juliehutzell.com

poshesocial.events

icsrwk.xyz

nap-con.com

womansslippers.com

invictusfarm.com

search-panel-avg-rock.rest

desencriptar.com

imperialexoticreptiles.com

agastify.com

strinvstr.com

julianapeloi.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • Formbook Payload 4 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • NSIS installer 12 IoCs
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 57 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1384
    • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\2205821.xlsx
      2⤵
      • Enumerates system info in registry
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:1560
  • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
    1⤵
    • Blocklisted process makes network request
    • Loads dropped DLL
    • Launches Equation Editor
    • Suspicious use of WriteProcessMemory
    PID:692
    • C:\Users\Public\vbc.exe
      "C:\Users\Public\vbc.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1700
      • C:\Users\Public\vbc.exe
        "C:\Users\Public\vbc.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1516
        • C:\Windows\SysWOW64\wlanext.exe
          "C:\Windows\SysWOW64\wlanext.exe"
          4⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1732
          • C:\Windows\SysWOW64\cmd.exe
            /c del "C:\Users\Public\vbc.exe"
            5⤵
              PID:1040

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Public\vbc.exe

      MD5

      f134f42917fd13a922c487aef2740f24

      SHA1

      a4fe1567f1ad4491bc1dd2129759f12ad56eb76d

      SHA256

      c66dca83ee4bc84e680347d01e9ade22672fc4da7a464409b56e25ef3609e366

      SHA512

      5beb6f6cf3e58dc64b0bd7eae6a1cac7a438ceb980f890c74fdc138f4b2cbf68e486a98d48bca35e447ffa4fe935ce4750aaf8bd5623144e59e5b2daef8884d0

    • C:\Users\Public\vbc.exe

      MD5

      f134f42917fd13a922c487aef2740f24

      SHA1

      a4fe1567f1ad4491bc1dd2129759f12ad56eb76d

      SHA256

      c66dca83ee4bc84e680347d01e9ade22672fc4da7a464409b56e25ef3609e366

      SHA512

      5beb6f6cf3e58dc64b0bd7eae6a1cac7a438ceb980f890c74fdc138f4b2cbf68e486a98d48bca35e447ffa4fe935ce4750aaf8bd5623144e59e5b2daef8884d0

    • C:\Users\Public\vbc.exe

      MD5

      f134f42917fd13a922c487aef2740f24

      SHA1

      a4fe1567f1ad4491bc1dd2129759f12ad56eb76d

      SHA256

      c66dca83ee4bc84e680347d01e9ade22672fc4da7a464409b56e25ef3609e366

      SHA512

      5beb6f6cf3e58dc64b0bd7eae6a1cac7a438ceb980f890c74fdc138f4b2cbf68e486a98d48bca35e447ffa4fe935ce4750aaf8bd5623144e59e5b2daef8884d0

    • \Users\Admin\AppData\Local\Temp\nsiDFC5.tmp\bvjccnxkzid.dll

      MD5

      46d2f8c3f58087d9642471c77e9cba2c

      SHA1

      fcc159b4a182d43962a564db9d995472dbc81a3b

      SHA256

      cb9d19a9761cb59787184f680c0f164923fffdde311a5e0cc4eb9c983f16792d

      SHA512

      4caf9a1363e04a0fee0c14ded9891012699d12b17cb5e6bc46681b18923b60b9cbf9e98bb3f88cc776bc9ea9697cb8df1dbf5aa59f934df7376a5e4d841a8957

    • \Users\Public\vbc.exe

      MD5

      f134f42917fd13a922c487aef2740f24

      SHA1

      a4fe1567f1ad4491bc1dd2129759f12ad56eb76d

      SHA256

      c66dca83ee4bc84e680347d01e9ade22672fc4da7a464409b56e25ef3609e366

      SHA512

      5beb6f6cf3e58dc64b0bd7eae6a1cac7a438ceb980f890c74fdc138f4b2cbf68e486a98d48bca35e447ffa4fe935ce4750aaf8bd5623144e59e5b2daef8884d0

    • \Users\Public\vbc.exe

      MD5

      f134f42917fd13a922c487aef2740f24

      SHA1

      a4fe1567f1ad4491bc1dd2129759f12ad56eb76d

      SHA256

      c66dca83ee4bc84e680347d01e9ade22672fc4da7a464409b56e25ef3609e366

      SHA512

      5beb6f6cf3e58dc64b0bd7eae6a1cac7a438ceb980f890c74fdc138f4b2cbf68e486a98d48bca35e447ffa4fe935ce4750aaf8bd5623144e59e5b2daef8884d0

    • \Users\Public\vbc.exe

      MD5

      f134f42917fd13a922c487aef2740f24

      SHA1

      a4fe1567f1ad4491bc1dd2129759f12ad56eb76d

      SHA256

      c66dca83ee4bc84e680347d01e9ade22672fc4da7a464409b56e25ef3609e366

      SHA512

      5beb6f6cf3e58dc64b0bd7eae6a1cac7a438ceb980f890c74fdc138f4b2cbf68e486a98d48bca35e447ffa4fe935ce4750aaf8bd5623144e59e5b2daef8884d0

    • memory/692-58-0x0000000075E51000-0x0000000075E53000-memory.dmp

      Filesize

      8KB

    • memory/1040-78-0x0000000000000000-mapping.dmp

    • memory/1384-83-0x0000000007D70000-0x0000000007EB1000-memory.dmp

      Filesize

      1.3MB

    • memory/1384-76-0x0000000007260000-0x0000000007395000-memory.dmp

      Filesize

      1.2MB

    • memory/1384-73-0x0000000007150000-0x000000000725C000-memory.dmp

      Filesize

      1.0MB

    • memory/1516-68-0x000000000041F130-mapping.dmp

    • memory/1516-72-0x00000000003C0000-0x00000000003D4000-memory.dmp

      Filesize

      80KB

    • memory/1516-71-0x0000000000950000-0x0000000000C53000-memory.dmp

      Filesize

      3.0MB

    • memory/1516-67-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/1516-74-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/1516-75-0x0000000000560000-0x0000000000574000-memory.dmp

      Filesize

      80KB

    • memory/1560-57-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1560-55-0x000000002F021000-0x000000002F024000-memory.dmp

      Filesize

      12KB

    • memory/1560-56-0x0000000071DA1000-0x0000000071DA3000-memory.dmp

      Filesize

      8KB

    • memory/1700-62-0x0000000000000000-mapping.dmp

    • memory/1732-79-0x0000000000CF0000-0x0000000000D06000-memory.dmp

      Filesize

      88KB

    • memory/1732-80-0x0000000000080000-0x00000000000AF000-memory.dmp

      Filesize

      188KB

    • memory/1732-81-0x0000000002110000-0x0000000002413000-memory.dmp

      Filesize

      3.0MB

    • memory/1732-82-0x0000000000AA0000-0x0000000000B33000-memory.dmp

      Filesize

      588KB

    • memory/1732-77-0x0000000000000000-mapping.dmp