Analysis
- max time kernel
147s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - resource tags
- submitted
15/07/2022, 12:34
General
- Target order request on product_Doc.exe
- Size 372KB
- Sample220715-prrm8abfdm
- SHA256 7163a32593b5045deb3bdce59153aa423a4fb8a7b155d233040945455e9c23fc
Malware Config
Signatures
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Blocklisted process makes network request 1 IoCs
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 60 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\order request on product_Doc.exe"C:\Users\Admin\AppData\Local\Temp\order request on product_Doc.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAwAA==3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\order request on product_Doc.exe"C:\Users\Admin\AppData\Local\Temp\order request on product_Doc.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2512-130-0x0000000000D60000-0x0000000000DC2000-memory.dmp
memory/2560-154-0x0000000002990000-0x0000000002A48000-memory.dmp
memory/2560-152-0x0000000002990000-0x0000000002A48000-memory.dmp
memory/2560-145-0x0000000002DA0000-0x0000000002EAE000-memory.dmp
memory/2908-153-0x0000000000FC0000-0x0000000000FED000-memory.dmp
memory/2908-151-0x0000000002EC0000-0x0000000002F50000-memory.dmp
memory/2908-150-0x0000000003120000-0x000000000346A000-memory.dmp
memory/2908-149-0x0000000000FC0000-0x0000000000FED000-memory.dmp
memory/2908-148-0x0000000000DA0000-0x0000000000DB2000-memory.dmp
memory/3512-143-0x0000000001B90000-0x0000000001EDA000-memory.dmp
memory/3512-147-0x0000000000400000-0x000000000042D000-memory.dmp
memory/3512-144-0x00000000016E0000-0x00000000016F1000-memory.dmp
memory/3512-141-0x0000000000400000-0x000000000042D000-memory.dmp
memory/4044-137-0x0000000005A50000-0x0000000005A6E000-memory.dmp
memory/4044-138-0x00000000070A0000-0x000000000771A000-memory.dmp
memory/4044-139-0x0000000005F00000-0x0000000005F1A000-memory.dmp
memory/4044-136-0x00000000053D0000-0x0000000005436000-memory.dmp
memory/4044-135-0x0000000005360000-0x00000000053C6000-memory.dmp
memory/4044-134-0x00000000052C0000-0x00000000052E2000-memory.dmp
memory/4044-133-0x0000000004B60000-0x0000000005188000-memory.dmp
memory/4044-132-0x0000000002490000-0x00000000024C6000-memory.dmp