Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 12:44
Static task
static1
Behavioral task
behavioral1
Sample
doc094.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
doc094.exe
Resource
win10v2004-20220414-en
General
-
Target
doc094.exe
-
Size
345KB
-
MD5
aa4728fc8d920e596570904225ffaeca
-
SHA1
242c0f565ef343f4390b3090fcd1480ae07d50c1
-
SHA256
aa3a6c0efb81498bfda5ebc1319154af99114b3184a9dffd5924e778b25b1ab9
-
SHA512
b145c454ab49f26194ec3d4a6ab0cb4ec4208aee1ea624d5d48473d858e41a008c2cfd0778e9aaac79f83d4ec9c62d5e0a10c7c8b879a126237c041d2d47ef41
Malware Config
Extracted
formbook
3.9
s5l
greenstock.info
laurajaneaesthetics.com
817comm.com
dbprimery.com
slzu-vxtx9.biz
covetpro.com
50.ink
weick.email
88717888.com
tongyue0423.com
anchorsky.com
horapatarot.com
cadillacforless.com
primesupplyvintage.com
torchinstant.win
thebrandishere.com
www-69677.com
savestj.com
tommydad.com
xigjailbreak.com
contulinemotieeszere.info
virtualrealitydomainnames.com
oldschoolrentalcars.com
zerosumtoken.info
facingrods.com
bagodawatch.com
theecostone.com
fireangelstech.com
lendingnetworksmail.com
apartemenbegawan.com
oniapparel.com
sanjeevkumarvestige.com
jiqywrrcmyudxaydrw.com
ptt-store.com
affilifaq.net
eyezonsite.com
youreadorkable.com
eh-sc.com
diariodasnoticias.com
bcqts.com
9a176.com
triplicesports.com
thetravelguideindia.com
frottolesignoraggio.info
swiftlogistics-service.com
36lk.info
webuyoldmotorcycles.com
mikedtoyota.com
honghuyangguang.com
soft-bits.com
twheb.com
poshchain.com
socialgeeknwa.com
alltexvets.com
coscolg.com
theflyingwolves.com
stonebridgeiwm.info
requestforcollect.com
weatherdeep.com
webxhard.com
six.ltd
belamargarida.com
eskisehirkahvefestivali.com
sf8803.com
hearxy.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1732-63-0x0000000000400000-0x000000000042A000-memory.dmp formbook behavioral1/memory/1732-64-0x000000000041B6E0-mapping.dmp formbook behavioral1/memory/1732-66-0x0000000000400000-0x000000000042A000-memory.dmp formbook behavioral1/memory/1764-73-0x00000000000C0000-0x00000000000EA000-memory.dmp formbook -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
wininit.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run wininit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DRWTJREHF8 = "C:\\Program Files (x86)\\Kmrt8cnup\\servicesmffxxh-x.exe" wininit.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 760 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
doc094.exedoc094.exewininit.exedescription pid process target process PID 1668 set thread context of 1732 1668 doc094.exe doc094.exe PID 1732 set thread context of 1272 1732 doc094.exe Explorer.EXE PID 1764 set thread context of 1272 1764 wininit.exe Explorer.EXE -
Drops file in Program Files directory 1 IoCs
Processes:
wininit.exedescription ioc process File opened for modification C:\Program Files (x86)\Kmrt8cnup\servicesmffxxh-x.exe wininit.exe -
Processes:
wininit.exedescription ioc process Key created \Registry\User\S-1-5-21-1819626980-2277161760-1023733287-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 wininit.exe -
Suspicious behavior: EnumeratesProcesses 37 IoCs
Processes:
doc094.exedoc094.exewininit.exepid process 1668 doc094.exe 1668 doc094.exe 1668 doc094.exe 1668 doc094.exe 1668 doc094.exe 1668 doc094.exe 1668 doc094.exe 1668 doc094.exe 1668 doc094.exe 1668 doc094.exe 1668 doc094.exe 1668 doc094.exe 1668 doc094.exe 1668 doc094.exe 1668 doc094.exe 1668 doc094.exe 1732 doc094.exe 1732 doc094.exe 1764 wininit.exe 1764 wininit.exe 1764 wininit.exe 1764 wininit.exe 1764 wininit.exe 1764 wininit.exe 1764 wininit.exe 1764 wininit.exe 1764 wininit.exe 1764 wininit.exe 1764 wininit.exe 1764 wininit.exe 1764 wininit.exe 1764 wininit.exe 1764 wininit.exe 1764 wininit.exe 1764 wininit.exe 1764 wininit.exe 1764 wininit.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
doc094.exewininit.exepid process 1732 doc094.exe 1732 doc094.exe 1732 doc094.exe 1764 wininit.exe 1764 wininit.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
doc094.exedoc094.exewininit.exedescription pid process Token: SeDebugPrivilege 1668 doc094.exe Token: SeDebugPrivilege 1732 doc094.exe Token: SeDebugPrivilege 1764 wininit.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1272 Explorer.EXE 1272 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1272 Explorer.EXE 1272 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
doc094.exeExplorer.EXEwininit.exedescription pid process target process PID 1668 wrote to memory of 1732 1668 doc094.exe doc094.exe PID 1668 wrote to memory of 1732 1668 doc094.exe doc094.exe PID 1668 wrote to memory of 1732 1668 doc094.exe doc094.exe PID 1668 wrote to memory of 1732 1668 doc094.exe doc094.exe PID 1668 wrote to memory of 1732 1668 doc094.exe doc094.exe PID 1668 wrote to memory of 1732 1668 doc094.exe doc094.exe PID 1668 wrote to memory of 1732 1668 doc094.exe doc094.exe PID 1272 wrote to memory of 1764 1272 Explorer.EXE wininit.exe PID 1272 wrote to memory of 1764 1272 Explorer.EXE wininit.exe PID 1272 wrote to memory of 1764 1272 Explorer.EXE wininit.exe PID 1272 wrote to memory of 1764 1272 Explorer.EXE wininit.exe PID 1764 wrote to memory of 760 1764 wininit.exe cmd.exe PID 1764 wrote to memory of 760 1764 wininit.exe cmd.exe PID 1764 wrote to memory of 760 1764 wininit.exe cmd.exe PID 1764 wrote to memory of 760 1764 wininit.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\doc094.exe"C:\Users\Admin\AppData\Local\Temp\doc094.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\doc094.exe"C:\Users\Admin\AppData\Local\Temp\doc094.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wininit.exe"C:\Windows\SysWOW64\wininit.exe"2⤵
- Adds policy Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\doc094.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\JN052U35\JN0logim.jpegFilesize
63KB
MD58bcb3ab4265e36dab505fb69c96a06b9
SHA1bb745708e21f8ad2964677b050037a33afee0001
SHA25608844b2d21a3816825def3b15038b83db77b8f09f53dd640db1e8591efe73d7b
SHA512e54cf6457f3ccb998eebed446c653a893f6155dd5a9193f3de05280fedd8d79abc61f993327ce50d46ab4df1d4564ad6c23778320afc5a8e30af30498ba2cf16
-
C:\Users\Admin\AppData\Roaming\JN052U35\JN0logri.iniFilesize
40B
MD5d63a82e5d81e02e399090af26db0b9cb
SHA191d0014c8f54743bba141fd60c9d963f869d76c9
SHA256eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae
SHA51238afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad
-
C:\Users\Admin\AppData\Roaming\JN052U35\JN0logrv.iniFilesize
40B
MD5ba3b6bc807d4f76794c4b81b09bb9ba5
SHA124cb89501f0212ff3095ecc0aba97dd563718fb1
SHA2566eebf968962745b2e9de2ca969af7c424916d4e3fe3cc0bb9b3d414abfce9507
SHA512ecd07e601fc9e3cfc39addd7bd6f3d7f7ff3253afb40bf536e9eaac5a4c243e5ec40fbfd7b216cb0ea29f2517419601e335e33ba19dea4a46f65e38694d465bf
-
memory/760-71-0x0000000000000000-mapping.dmp
-
memory/1272-76-0x0000000005ED0000-0x0000000005F6C000-memory.dmpFilesize
624KB
-
memory/1272-69-0x0000000006FC0000-0x000000000714B000-memory.dmpFilesize
1.5MB
-
memory/1668-54-0x0000000000950000-0x00000000009AC000-memory.dmpFilesize
368KB
-
memory/1668-55-0x0000000075BA1000-0x0000000075BA3000-memory.dmpFilesize
8KB
-
memory/1668-56-0x0000000000710000-0x0000000000718000-memory.dmpFilesize
32KB
-
memory/1668-57-0x0000000000780000-0x00000000007B8000-memory.dmpFilesize
224KB
-
memory/1668-58-0x00000000007E0000-0x00000000007F6000-memory.dmpFilesize
88KB
-
memory/1668-59-0x0000000000940000-0x0000000000948000-memory.dmpFilesize
32KB
-
memory/1732-68-0x0000000000180000-0x0000000000194000-memory.dmpFilesize
80KB
-
memory/1732-67-0x00000000009B0000-0x0000000000CB3000-memory.dmpFilesize
3.0MB
-
memory/1732-66-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/1732-64-0x000000000041B6E0-mapping.dmp
-
memory/1732-63-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/1732-61-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/1732-60-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/1764-70-0x0000000000000000-mapping.dmp
-
memory/1764-72-0x0000000000710000-0x000000000072A000-memory.dmpFilesize
104KB
-
memory/1764-73-0x00000000000C0000-0x00000000000EA000-memory.dmpFilesize
168KB
-
memory/1764-74-0x0000000001FE0000-0x00000000022E3000-memory.dmpFilesize
3.0MB
-
memory/1764-75-0x0000000000470000-0x0000000000503000-memory.dmpFilesize
588KB