Analysis

  • max time kernel
    148s
  • max time network
    135s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    23-06-2022 14:36

General

  • Target

    38f284c6ac68831d066f9325b4f8508145ef62146b4c257e3c0a10fdf2305b0a.rtf

  • Size

    3.7MB

  • MD5

    fd00d713c843371c82be116049b5a6d9

  • SHA1

    e46e115e003d6088655a5c364d6d03551cb0e41b

  • SHA256

    38f284c6ac68831d066f9325b4f8508145ef62146b4c257e3c0a10fdf2305b0a

  • SHA512

    3f5c7ff62a3f3e7d03c7dd69a3195a93ad0490864ffa10af155085755a1de89f9b27a92e67c84594923b87348b5f192714f33467abbd072ee9a9050b2442c07f

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

u31y

Decoy

writer-career.com

thecozymosey.com

cesarashop.com

tcdfzx.com

redknightsaus6.com

hbczz.com

u0959.com

hyyssy.com

ytbangsi.com

popularepoch.com

jenesgloparties.site

belbo-shop.com

fundeim-ucv.com

buttersdesignco.com

ingiluzim.xyz

visithimalayatours.com

aridahaaf.xyz

emocjilindre.xyz

rcfunhobby.com

taminndir.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • Formbook Payload 4 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 29 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1208
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\38f284c6ac68831d066f9325b4f8508145ef62146b4c257e3c0a10fdf2305b0a.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:536
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:1616
      • C:\Windows\SysWOW64\svchost.exe
        "C:\Windows\SysWOW64\svchost.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:624
        • C:\Windows\SysWOW64\cmd.exe
          /c del "C:\Windows\SysWOW64\notepad.exe"
          3⤵
            PID:564
      • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
        "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
        1⤵
        • Launches Equation Editor
        • Suspicious use of WriteProcessMemory
        PID:1144
        • C:\Windows\SysWOW64\CmD.exe
          CmD.exe /C %tmp%\Client.exe A C
          2⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:1708
          • C:\Users\Admin\AppData\Local\Temp\Client.exe
            C:\Users\Admin\AppData\Local\Temp\Client.exe A C
            3⤵
            • Suspicious use of NtCreateUserProcessOtherParentProcess
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1060
          • C:\Windows\SysWOW64\notepad.exe
            C:\Windows\SysWOW64\notepad.exe /Processid:{BD8D4234-244F-4FFB-862A-350022A75F5A}
            3⤵
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of AdjustPrivilegeToken
            PID:1740

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Execution

      Exploitation for Client Execution

      1
      T1203

      Defense Evasion

      Modify Registry

      1
      T1112

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\Client.exe
        Filesize

        916KB

        MD5

        0d88f6e6248bc4f9a5865eb968d93670

        SHA1

        24f8be0a2d6eff1e119333d7b55d159cd89bfc90

        SHA256

        a27283e26cbacea227b535b1a18a4d3cb9f39ef012c97c35e98c04a4cb9ca61a

        SHA512

        57fd190d0505a9807683fe7452814d009a168dd0fd983e5dd52a1826f37e3b40ee3f2c7f74c61a3072c6f4d64ce35bd212fccb52086fed8a4e7d6baae24e2020

      • C:\Users\Admin\AppData\Local\Temp\Client.exe
        Filesize

        916KB

        MD5

        0d88f6e6248bc4f9a5865eb968d93670

        SHA1

        24f8be0a2d6eff1e119333d7b55d159cd89bfc90

        SHA256

        a27283e26cbacea227b535b1a18a4d3cb9f39ef012c97c35e98c04a4cb9ca61a

        SHA512

        57fd190d0505a9807683fe7452814d009a168dd0fd983e5dd52a1826f37e3b40ee3f2c7f74c61a3072c6f4d64ce35bd212fccb52086fed8a4e7d6baae24e2020

      • \Users\Admin\AppData\Local\Temp\Client.exe
        Filesize

        916KB

        MD5

        0d88f6e6248bc4f9a5865eb968d93670

        SHA1

        24f8be0a2d6eff1e119333d7b55d159cd89bfc90

        SHA256

        a27283e26cbacea227b535b1a18a4d3cb9f39ef012c97c35e98c04a4cb9ca61a

        SHA512

        57fd190d0505a9807683fe7452814d009a168dd0fd983e5dd52a1826f37e3b40ee3f2c7f74c61a3072c6f4d64ce35bd212fccb52086fed8a4e7d6baae24e2020

      • memory/536-77-0x0000000070CAD000-0x0000000070CB8000-memory.dmp
        Filesize

        44KB

      • memory/536-83-0x0000000070CAD000-0x0000000070CB8000-memory.dmp
        Filesize

        44KB

      • memory/536-57-0x0000000075B61000-0x0000000075B63000-memory.dmp
        Filesize

        8KB

      • memory/536-56-0x000000005FFF0000-0x0000000060000000-memory.dmp
        Filesize

        64KB

      • memory/536-82-0x000000005FFF0000-0x0000000060000000-memory.dmp
        Filesize

        64KB

      • memory/536-55-0x000000006FCC1000-0x000000006FCC3000-memory.dmp
        Filesize

        8KB

      • memory/536-58-0x0000000070CAD000-0x0000000070CB8000-memory.dmp
        Filesize

        44KB

      • memory/536-54-0x0000000072241000-0x0000000072244000-memory.dmp
        Filesize

        12KB

      • memory/564-75-0x0000000000000000-mapping.dmp
      • memory/624-78-0x0000000000590000-0x0000000000623000-memory.dmp
        Filesize

        588KB

      • memory/624-79-0x0000000000080000-0x00000000000AF000-memory.dmp
        Filesize

        188KB

      • memory/624-72-0x0000000000000000-mapping.dmp
      • memory/624-73-0x0000000000890000-0x0000000000B93000-memory.dmp
        Filesize

        3.0MB

      • memory/624-74-0x0000000000880000-0x0000000000888000-memory.dmp
        Filesize

        32KB

      • memory/624-76-0x0000000000080000-0x00000000000AF000-memory.dmp
        Filesize

        188KB

      • memory/1060-63-0x0000000000000000-mapping.dmp
      • memory/1060-65-0x0000000000C40000-0x0000000000D2E000-memory.dmp
        Filesize

        952KB

      • memory/1208-85-0x0000000007300000-0x0000000007418000-memory.dmp
        Filesize

        1.1MB

      • memory/1208-71-0x0000000007170000-0x00000000072FF000-memory.dmp
        Filesize

        1.6MB

      • memory/1208-84-0x0000000007300000-0x0000000007418000-memory.dmp
        Filesize

        1.1MB

      • memory/1616-81-0x000007FEFB721000-0x000007FEFB723000-memory.dmp
        Filesize

        8KB

      • memory/1616-80-0x0000000000000000-mapping.dmp
      • memory/1708-60-0x0000000000000000-mapping.dmp
      • memory/1740-69-0x0000000000A00000-0x0000000000D03000-memory.dmp
        Filesize

        3.0MB

      • memory/1740-66-0x0000000000400000-0x000000000042F000-memory.dmp
        Filesize

        188KB

      • memory/1740-67-0x000000000041F110-mapping.dmp
      • memory/1740-70-0x00000000000D0000-0x00000000000E4000-memory.dmp
        Filesize

        80KB