Analysis

  • max time kernel
    148s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    28-06-2022 09:45

General

  • Target

    cc3b22bd3d92f8209de3a45f1b49b05d.exe

  • Size

    854KB

  • MD5

    cc3b22bd3d92f8209de3a45f1b49b05d

  • SHA1

    46f5d875d74b9dc5f4519b6aff1efdf62df70c73

  • SHA256

    e10cbd14bad3693345f6fa7d09e1336c1b2033900e1b1b55ccf0a76a98b1c79a

  • SHA512

    81eef9b07333b31a8016986f15a6ad519e77643bab1f2c557a5bea4014e1626702854c5c180c883c517ecaebd8a1a823da63d2533e7f9f73c0b8a1d7fd4612cf

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ba17

Decoy

bearwant.com

sdsguanfang.com

steamcommunityvia.top

sugarplumtreasures.com

koronislakefishing.com

jmae.xyz

xhxnqemkiqe.xyz

playzcrew.com

zatwsbq.com

lankofix.com

sh-zhepeng.com

mibodamisxv.online

butterflyjewelry.store

finestrecitalto-spottoday.info

globomateria.com

royalmdarts.com

d4af10836709.com

shepwill.com

67aldrich.info

trustedmakers.club

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • Formbook Payload 5 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1208
    • C:\Users\Admin\AppData\Local\Temp\cc3b22bd3d92f8209de3a45f1b49b05d.exe
      "C:\Users\Admin\AppData\Local\Temp\cc3b22bd3d92f8209de3a45f1b49b05d.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1884
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OHyOwWfiz" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD1B2.tmp"
        3⤵
        • Creates scheduled task(s)
        PID:956
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "{path}"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:616
    • C:\Windows\SysWOW64\svchost.exe
      "C:\Windows\SysWOW64\svchost.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:820
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        3⤵
          PID:928

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Execution

    Scheduled Task

    1
    T1053

    Persistence

    Scheduled Task

    1
    T1053

    Privilege Escalation

    Scheduled Task

    1
    T1053

    Discovery

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmpD1B2.tmp
      Filesize

      1KB

      MD5

      34ebff0edf4d0cf20053259092082f18

      SHA1

      51edf31e8f5361f1060855b7585e3afcdba750f5

      SHA256

      1f378cbed7dfeb6053168337cf781e9a6c8b5bdeda3e9431e98321361b06fc65

      SHA512

      f59da27ec0059e951b7a70ad5db22287d8d09fcb0bafb3bb089e8a123deeb4b6a4fbeaec60f60dcdb13e539b9ce1b213ab4c90811c189caec081867bef78de26

    • memory/616-68-0x00000000002B0000-0x00000000002C5000-memory.dmp
      Filesize

      84KB

    • memory/616-62-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/616-67-0x0000000000800000-0x0000000000B03000-memory.dmp
      Filesize

      3.0MB

    • memory/616-71-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/616-65-0x000000000041F1E0-mapping.dmp
    • memory/616-64-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/616-61-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/820-73-0x0000000000F00000-0x0000000000F08000-memory.dmp
      Filesize

      32KB

    • memory/820-78-0x00000000000C0000-0x00000000000EF000-memory.dmp
      Filesize

      188KB

    • memory/820-76-0x0000000000620000-0x00000000006B4000-memory.dmp
      Filesize

      592KB

    • memory/820-75-0x00000000000C0000-0x00000000000EF000-memory.dmp
      Filesize

      188KB

    • memory/820-70-0x0000000000000000-mapping.dmp
    • memory/820-74-0x00000000007B0000-0x0000000000AB3000-memory.dmp
      Filesize

      3.0MB

    • memory/928-72-0x0000000000000000-mapping.dmp
    • memory/956-59-0x0000000000000000-mapping.dmp
    • memory/1208-79-0x0000000006090000-0x00000000061B1000-memory.dmp
      Filesize

      1.1MB

    • memory/1208-77-0x0000000006090000-0x00000000061B1000-memory.dmp
      Filesize

      1.1MB

    • memory/1208-69-0x00000000072A0000-0x000000000743E000-memory.dmp
      Filesize

      1.6MB

    • memory/1884-56-0x00000000006C0000-0x00000000006CA000-memory.dmp
      Filesize

      40KB

    • memory/1884-58-0x0000000000EC0000-0x0000000000F34000-memory.dmp
      Filesize

      464KB

    • memory/1884-55-0x00000000759E1000-0x00000000759E3000-memory.dmp
      Filesize

      8KB

    • memory/1884-57-0x0000000005850000-0x0000000005916000-memory.dmp
      Filesize

      792KB

    • memory/1884-54-0x0000000000F60000-0x000000000103C000-memory.dmp
      Filesize

      880KB