Analysis
- max time kernel
148s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
26/04/2022, 07:59
General
- Target Shipping Documents.exe
- Size 617KB
- Sample220426-jvdymsffhn
- SHA256 b3d586ea6f954e72cd9c39838dece4a7e019d7f1916f0984da816d107d03ffe3
Malware Config
Extracted
-
formbook
-
4.1
-
o18j
-
qfnft.xyz
-
ninjshib.com
-
884uc.com
-
edisonsbar.com
-
leopardbuffalo.com
-
yifansw.com
-
suncoastcreditsunion.com
-
solidity.codes
-
thrapyappointment.com
-
cloi.xyz
-
wwcsv.com
-
berdayabersama.com
-
mirrorlesscamerareview.com
-
alphathomas.com
-
doulapsychomot.com
-
singmos.online
-
earthfrequencygoddess.com
-
any-shirt.com
-
tylersdayoff.com
-
gs4te44sh.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Formbook Payload 2 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Modifies registry class 3 IoCs
- Suspicious behavior: EnumeratesProcesses 42 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Shipping Documents.exe"C:\Users\Admin\AppData\Local\Temp\Shipping Documents.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wJCOllNwD.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wJCOllNwD" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1F9E.tmp"3⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\Shipping Documents.exe"C:\Users\Admin\AppData\Local\Temp\Shipping Documents.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Shipping Documents.exe"3⤵
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s camsvc1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
tmp1F9E.tmp
memory/548-149-0x0000000002465000-0x0000000002467000-memory.dmp
memory/548-150-0x0000000006E90000-0x0000000006EC2000-memory.dmp
memory/548-164-0x00000000072F0000-0x00000000072F8000-memory.dmp
memory/548-163-0x0000000007310000-0x000000000732A000-memory.dmp
memory/548-162-0x0000000007200000-0x000000000720E000-memory.dmp
memory/548-137-0x00000000023A0000-0x00000000023D6000-memory.dmp
memory/548-157-0x0000000007250000-0x00000000072E6000-memory.dmp
memory/548-140-0x0000000004E10000-0x0000000005438000-memory.dmp
memory/548-155-0x0000000007040000-0x000000000704A000-memory.dmp
memory/548-154-0x0000000006FD0000-0x0000000006FEA000-memory.dmp
memory/548-142-0x0000000005540000-0x0000000005562000-memory.dmp
memory/548-143-0x00000000055E0000-0x0000000005646000-memory.dmp
memory/548-145-0x0000000005CC0000-0x0000000005CDE000-memory.dmp
memory/548-153-0x0000000007610000-0x0000000007C8A000-memory.dmp
memory/548-152-0x0000000006250000-0x000000000626E000-memory.dmp
memory/548-151-0x00000000719F0000-0x0000000071A3C000-memory.dmp
memory/1540-130-0x0000000000120000-0x00000000001C0000-memory.dmp
memory/1540-134-0x0000000005C90000-0x0000000005CF6000-memory.dmp
memory/1540-132-0x0000000004D40000-0x0000000004DD2000-memory.dmp
memory/1540-133-0x0000000005080000-0x000000000511C000-memory.dmp
memory/1540-131-0x00000000052F0000-0x0000000005894000-memory.dmp
memory/1972-147-0x0000000000EF0000-0x0000000000F04000-memory.dmp
memory/1972-146-0x00000000011E0000-0x000000000152A000-memory.dmp
memory/1972-141-0x0000000000400000-0x000000000042F000-memory.dmp
memory/3136-148-0x0000000008660000-0x000000000878F000-memory.dmp
memory/3136-166-0x0000000008A40000-0x0000000008BAF000-memory.dmp
memory/5104-159-0x0000000000770000-0x0000000000786000-memory.dmp
memory/5104-160-0x0000000000470000-0x000000000049F000-memory.dmp
memory/5104-161-0x0000000002360000-0x00000000026AA000-memory.dmp
memory/5104-165-0x0000000002260000-0x00000000022F3000-memory.dmp