Resubmissions
06-07-2022 16:55
220706-ve9wxsfafp 10Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
06-07-2022 16:55
Static task
static1
Behavioral task
behavioral1
Sample
400000.InstallUtil.exe
Resource
win7-20220414-en
General
-
Target
400000.InstallUtil.exe
-
Size
180KB
-
MD5
fe24b17cba6092bd2da1e5a172a33846
-
SHA1
df46ed6222eee121dd697e4ff6c7bab3d077c4cf
-
SHA256
cd375b3eeffbdb97aaaaa7d568e04c92ecb76d99c43894c291c31c24dd0f4e98
-
SHA512
ba8852dbf1cdb30fcc84b97e12b629f3229d83f2d1217ba172917059bc33e9c4227067e13e42346248f33f047cb04632599d2cdcbb96c4fff36aca028553c40b
Malware Config
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Executes dropped EXE 1 IoCs
Processes:
configtrzx0nnh.exepid process 1572 configtrzx0nnh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
400000.InstallUtil.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Control Panel\International\Geo\Nation 400000.InstallUtil.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 936 cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
msdt.exepid process 908 msdt.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
msdt.exedescription ioc process Key created \Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run msdt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HZ-TQZ9P1NY = "C:\\Program Files (x86)\\Qlrxtz2e0\\configtrzx0nnh.exe" msdt.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
400000.InstallUtil.exemsdt.exedescription pid process target process PID 1072 set thread context of 1204 1072 400000.InstallUtil.exe Explorer.EXE PID 908 set thread context of 1204 908 msdt.exe Explorer.EXE -
Drops file in Program Files directory 2 IoCs
Processes:
msdt.exeExplorer.EXEdescription ioc process File opened for modification C:\Program Files (x86)\Qlrxtz2e0\configtrzx0nnh.exe msdt.exe File created C:\Program Files (x86)\Qlrxtz2e0\configtrzx0nnh.exe Explorer.EXE -
Processes:
msdt.exedescription ioc process Key created \Registry\User\S-1-5-21-790309383-526510583-3802439154-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 msdt.exe -
Suspicious behavior: EnumeratesProcesses 27 IoCs
Processes:
400000.InstallUtil.exemsdt.execonfigtrzx0nnh.exepid process 1072 400000.InstallUtil.exe 1072 400000.InstallUtil.exe 1072 400000.InstallUtil.exe 1072 400000.InstallUtil.exe 908 msdt.exe 908 msdt.exe 908 msdt.exe 908 msdt.exe 908 msdt.exe 908 msdt.exe 908 msdt.exe 908 msdt.exe 908 msdt.exe 908 msdt.exe 908 msdt.exe 908 msdt.exe 908 msdt.exe 908 msdt.exe 908 msdt.exe 908 msdt.exe 908 msdt.exe 908 msdt.exe 908 msdt.exe 908 msdt.exe 1572 configtrzx0nnh.exe 908 msdt.exe 908 msdt.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
400000.InstallUtil.exemsdt.exepid process 1072 400000.InstallUtil.exe 1072 400000.InstallUtil.exe 1072 400000.InstallUtil.exe 908 msdt.exe 908 msdt.exe 908 msdt.exe 908 msdt.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
400000.InstallUtil.exemsdt.execonfigtrzx0nnh.exedescription pid process Token: SeDebugPrivilege 1072 400000.InstallUtil.exe Token: SeDebugPrivilege 908 msdt.exe Token: SeDebugPrivilege 1572 configtrzx0nnh.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1204 Explorer.EXE 1204 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1204 Explorer.EXE 1204 Explorer.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
Explorer.EXEmsdt.exedescription pid process target process PID 1204 wrote to memory of 908 1204 Explorer.EXE msdt.exe PID 1204 wrote to memory of 908 1204 Explorer.EXE msdt.exe PID 1204 wrote to memory of 908 1204 Explorer.EXE msdt.exe PID 1204 wrote to memory of 908 1204 Explorer.EXE msdt.exe PID 908 wrote to memory of 936 908 msdt.exe cmd.exe PID 908 wrote to memory of 936 908 msdt.exe cmd.exe PID 908 wrote to memory of 936 908 msdt.exe cmd.exe PID 908 wrote to memory of 936 908 msdt.exe cmd.exe PID 908 wrote to memory of 476 908 msdt.exe Firefox.exe PID 908 wrote to memory of 476 908 msdt.exe Firefox.exe PID 908 wrote to memory of 476 908 msdt.exe Firefox.exe PID 908 wrote to memory of 476 908 msdt.exe Firefox.exe PID 908 wrote to memory of 476 908 msdt.exe Firefox.exe PID 1204 wrote to memory of 1572 1204 Explorer.EXE configtrzx0nnh.exe PID 1204 wrote to memory of 1572 1204 Explorer.EXE configtrzx0nnh.exe PID 1204 wrote to memory of 1572 1204 Explorer.EXE configtrzx0nnh.exe PID 1204 wrote to memory of 1572 1204 Explorer.EXE configtrzx0nnh.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\400000.InstallUtil.exe"C:\Users\Admin\AppData\Local\Temp\400000.InstallUtil.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\400000.InstallUtil.exe"3⤵
- Deletes itself
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
C:\Program Files (x86)\Qlrxtz2e0\configtrzx0nnh.exe"C:\Program Files (x86)\Qlrxtz2e0\configtrzx0nnh.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Qlrxtz2e0\configtrzx0nnh.exeFilesize
180KB
MD5fe24b17cba6092bd2da1e5a172a33846
SHA1df46ed6222eee121dd697e4ff6c7bab3d077c4cf
SHA256cd375b3eeffbdb97aaaaa7d568e04c92ecb76d99c43894c291c31c24dd0f4e98
SHA512ba8852dbf1cdb30fcc84b97e12b629f3229d83f2d1217ba172917059bc33e9c4227067e13e42346248f33f047cb04632599d2cdcbb96c4fff36aca028553c40b
-
C:\Program Files (x86)\Qlrxtz2e0\configtrzx0nnh.exeFilesize
180KB
MD5fe24b17cba6092bd2da1e5a172a33846
SHA1df46ed6222eee121dd697e4ff6c7bab3d077c4cf
SHA256cd375b3eeffbdb97aaaaa7d568e04c92ecb76d99c43894c291c31c24dd0f4e98
SHA512ba8852dbf1cdb30fcc84b97e12b629f3229d83f2d1217ba172917059bc33e9c4227067e13e42346248f33f047cb04632599d2cdcbb96c4fff36aca028553c40b
-
\Users\Admin\AppData\Local\Temp\sqlite3.dllFilesize
630KB
MD506b455698aba68f911c2f6d17bbefc6a
SHA14116e1345134012a0fc8a84b4bbf6c681621a266
SHA2566d81a69544457d3db38f97932869e0589feed4d7249462cce7aa8b15c6c00bd2
SHA512d64c0219933a0600702d54ca158e794b2784b1040e15d4657d87f46c091ed7ed1addcf3c46859e87c811f5c1543928596990103ae5de29a00eab7999ba7a1b3e
-
memory/908-63-0x0000000000B80000-0x0000000000E83000-memory.dmpFilesize
3.0MB
-
memory/908-61-0x0000000000F10000-0x0000000001004000-memory.dmpFilesize
976KB
-
memory/908-62-0x0000000000110000-0x000000000013D000-memory.dmpFilesize
180KB
-
memory/908-64-0x0000000000A50000-0x0000000000AE0000-memory.dmpFilesize
576KB
-
memory/908-58-0x0000000000000000-mapping.dmp
-
memory/908-66-0x0000000000110000-0x000000000013D000-memory.dmpFilesize
180KB
-
memory/936-60-0x0000000000000000-mapping.dmp
-
memory/1072-56-0x00000000001B0000-0x00000000001C1000-memory.dmpFilesize
68KB
-
memory/1072-54-0x00000000753E1000-0x00000000753E3000-memory.dmpFilesize
8KB
-
memory/1072-55-0x0000000000DA0000-0x00000000010A3000-memory.dmpFilesize
3.0MB
-
memory/1204-65-0x0000000004270000-0x0000000004325000-memory.dmpFilesize
724KB
-
memory/1204-57-0x0000000006080000-0x00000000061D3000-memory.dmpFilesize
1.3MB
-
memory/1204-67-0x0000000004270000-0x0000000004325000-memory.dmpFilesize
724KB
-
memory/1572-69-0x0000000000000000-mapping.dmp
-
memory/1572-71-0x00000000008B0000-0x0000000000BB3000-memory.dmpFilesize
3.0MB