Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows10-1703_x64
  • resource
    win10-20220722-en
  • resource tags

    arch:x64arch:x86image:win10-20220722-enlocale:en-usos:windows10-1703-x64system
  • submitted
    27-07-2022 14:00

General

  • Target

    e240812c35bacf92c202060e8cf794cea45794d87188d0aa8d20957f07299b01.exe

  • Size

    28KB

  • MD5

    6aa3ec01c02065ec554c4d9e7c487a82

  • SHA1

    53b6ae871fdd19e420b2723f2f35465d8b791ad5

  • SHA256

    e240812c35bacf92c202060e8cf794cea45794d87188d0aa8d20957f07299b01

  • SHA512

    ee4df39cd8b306f7a1cd6e1bdf442b197cad984cab8659e8342ae7a07f7e189e4c3a8f2d7136ce1a9cf0db5fb6065d16b3871c6bbb5704431a2bc4dfe58a2169

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

s4s9

Decoy

qianyuandianshang.com

bernardklein.com

slhomeservices.com

findasaas.com

janellelancaster.xyz

umkpro.site

nr6949.online

mersquare.club

lanariproperties.com

3rdeyefocused.com

giftexpress8260.xyz

hilleleven.xyz

beajod.com

kosazs.online

ishare.team

mb314.com

xjjinxingda.com

ayekooprojectamazing.com

ballsybanter.com

todayshoppingbd.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 7 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 55 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:2908
    • C:\Users\Admin\AppData\Local\Temp\e240812c35bacf92c202060e8cf794cea45794d87188d0aa8d20957f07299b01.exe
      "C:\Users\Admin\AppData\Local\Temp\e240812c35bacf92c202060e8cf794cea45794d87188d0aa8d20957f07299b01.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2764
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgA=
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3420
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:4052
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\SysWOW64\cmd.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5060
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        3⤵
          PID:4556

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Discovery

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2764-127-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-128-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-129-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-130-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-131-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-132-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-133-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-134-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-135-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-136-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-137-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-138-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-139-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-140-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-141-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-142-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-143-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-144-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-145-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-146-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-147-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-148-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-149-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-150-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-151-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-152-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-153-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-154-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-155-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-156-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-157-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-158-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-159-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-160-0x0000000000320000-0x000000000032C000-memory.dmp
      Filesize

      48KB

    • memory/2764-161-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-162-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-163-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-164-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-165-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-166-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-167-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-168-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-169-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-170-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-172-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-171-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-173-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-174-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-175-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-176-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-177-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-178-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-179-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-180-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-181-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-182-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-183-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-184-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-185-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-186-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-188-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-187-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-189-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-190-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-191-0x0000000077630000-0x00000000777BE000-memory.dmp
      Filesize

      1.6MB

    • memory/2764-195-0x0000000005960000-0x0000000005E5E000-memory.dmp
      Filesize

      5.0MB

    • memory/2764-200-0x00000000054C0000-0x0000000005538000-memory.dmp
      Filesize

      480KB

    • memory/2764-201-0x00000000055C0000-0x0000000005652000-memory.dmp
      Filesize

      584KB

    • memory/2764-202-0x00000000056C0000-0x00000000056E2000-memory.dmp
      Filesize

      136KB

    • memory/2764-204-0x0000000005E60000-0x00000000061B0000-memory.dmp
      Filesize

      3.3MB

    • memory/2908-329-0x00000000055D0000-0x0000000005745000-memory.dmp
      Filesize

      1.5MB

    • memory/2908-362-0x0000000005750000-0x00000000058CF000-memory.dmp
      Filesize

      1.5MB

    • memory/2908-365-0x0000000005750000-0x00000000058CF000-memory.dmp
      Filesize

      1.5MB

    • memory/3420-215-0x0000000000000000-mapping.dmp
    • memory/3420-251-0x0000000000EA0000-0x0000000000ED6000-memory.dmp
      Filesize

      216KB

    • memory/3420-256-0x0000000007080000-0x00000000076A8000-memory.dmp
      Filesize

      6.2MB

    • memory/3420-274-0x0000000006E10000-0x0000000006E76000-memory.dmp
      Filesize

      408KB

    • memory/3420-276-0x0000000006EF0000-0x0000000006F56000-memory.dmp
      Filesize

      408KB

    • memory/3420-279-0x0000000006FA0000-0x0000000006FBC000-memory.dmp
      Filesize

      112KB

    • memory/3420-280-0x0000000007F40000-0x0000000007F8B000-memory.dmp
      Filesize

      300KB

    • memory/3420-284-0x0000000007E30000-0x0000000007EA6000-memory.dmp
      Filesize

      472KB

    • memory/3420-295-0x0000000009690000-0x0000000009D08000-memory.dmp
      Filesize

      6.5MB

    • memory/3420-296-0x0000000008C20000-0x0000000008C3A000-memory.dmp
      Filesize

      104KB

    • memory/4052-303-0x000000000041F0E0-mapping.dmp
    • memory/4052-317-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/4052-319-0x0000000000E60000-0x0000000001180000-memory.dmp
      Filesize

      3.1MB

    • memory/4052-328-0x0000000000CC0000-0x0000000000E53000-memory.dmp
      Filesize

      1.6MB

    • memory/4052-331-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/4556-343-0x0000000000000000-mapping.dmp
    • memory/5060-330-0x0000000000000000-mapping.dmp
    • memory/5060-349-0x0000000001000000-0x0000000001059000-memory.dmp
      Filesize

      356KB

    • memory/5060-350-0x00000000005C0000-0x00000000005EF000-memory.dmp
      Filesize

      188KB

    • memory/5060-351-0x0000000003060000-0x0000000003380000-memory.dmp
      Filesize

      3.1MB

    • memory/5060-361-0x0000000000B80000-0x0000000000D1A000-memory.dmp
      Filesize

      1.6MB

    • memory/5060-363-0x00000000005C0000-0x00000000005EF000-memory.dmp
      Filesize

      188KB

    • memory/5060-364-0x0000000000B80000-0x0000000000D1A000-memory.dmp
      Filesize

      1.6MB