Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    12-08-2022 20:34

General

  • Target

    SecuriteInfo.com.W32.AIDetectNet.01.10877.exe

  • Size

    919KB

  • MD5

    78cce3c1d0cadadd8be8fe9022be5f44

  • SHA1

    dd881fdfca2d2dd2a466e49f46811c38a1172327

  • SHA256

    6de750cf7e7a9f7a3fced7712ebde1360102bf175362c71e3f304d01eaa59e30

  • SHA512

    f2dec41a90a0b52e1354cd75daca5fd7f614c78b8f7a57762548f24ef5ebd78dace3c915307e06ea5d133a3301d12bbf898aec850eb041d8d421c5aa15971a69

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

de08

Decoy

retirecloudyyard.com

fabiyan.xyz

chrisarlyde.com

selapex.com

vivalosgales.com

specialty-medicine.com

contasesolucoes.com

satunusanews.net

allyibc.com

alameda1876.com

artofdala.com

yukoidusp.xyz

steeldrumbandnearme.com

stonewedgetechnology.com

kentonai.com

macquarie-private.com

ddgwy.com

megagreenhousekits.com

descomplicaomarketing.com

inclusiverealtor.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 6 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 19 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1192
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.10877.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.10877.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:2044
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\jQQlGgDoQsDzy.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1460
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jQQlGgDoQsDzy" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE216.tmp"
        3⤵
        • Creates scheduled task(s)
        PID:1556
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1316
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\SysWOW64\cmd.exe"
          4⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:960
          • C:\Windows\SysWOW64\cmd.exe
            /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
            5⤵
              PID:1348

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Execution

    Scheduled Task

    1
    T1053

    Persistence

    Scheduled Task

    1
    T1053

    Privilege Escalation

    Scheduled Task

    1
    T1053

    Discovery

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmpE216.tmp
      Filesize

      1KB

      MD5

      093ef6a64f4d08617f52341734cee073

      SHA1

      7c48ea7478d0f94da7a00521d12272462c50b80f

      SHA256

      b5eece50f1455e028bcc1302cdddafbfa7d9de794855c20e2b7e43621352c517

      SHA512

      4ceabec90ee458b9dc686e0508495a1ad7b296213dcd17fa9474efc86adf82600a6cf59a5c25a9d71ca6caafa239d084729bd25230e4f90573319284d917b280

    • memory/960-90-0x0000000000190000-0x00000000001BF000-memory.dmp
      Filesize

      188KB

    • memory/960-88-0x0000000001DF0000-0x0000000001E83000-memory.dmp
      Filesize

      588KB

    • memory/960-87-0x0000000001F60000-0x0000000002263000-memory.dmp
      Filesize

      3.0MB

    • memory/960-86-0x0000000000190000-0x00000000001BF000-memory.dmp
      Filesize

      188KB

    • memory/960-85-0x000000004A650000-0x000000004A69C000-memory.dmp
      Filesize

      304KB

    • memory/960-82-0x0000000000000000-mapping.dmp
    • memory/1192-91-0x0000000004BA0000-0x0000000004C75000-memory.dmp
      Filesize

      852KB

    • memory/1192-89-0x0000000004BA0000-0x0000000004C75000-memory.dmp
      Filesize

      852KB

    • memory/1192-81-0x0000000004DF0000-0x0000000004F33000-memory.dmp
      Filesize

      1.3MB

    • memory/1192-78-0x0000000002AA0000-0x0000000002B79000-memory.dmp
      Filesize

      868KB

    • memory/1316-72-0x000000000041F120-mapping.dmp
    • memory/1316-77-0x0000000000290000-0x00000000002A4000-memory.dmp
      Filesize

      80KB

    • memory/1316-68-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/1316-69-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/1316-71-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/1316-83-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/1316-80-0x00000000002F0000-0x0000000000304000-memory.dmp
      Filesize

      80KB

    • memory/1316-79-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/1316-76-0x0000000000910000-0x0000000000C13000-memory.dmp
      Filesize

      3.0MB

    • memory/1348-84-0x0000000000000000-mapping.dmp
    • memory/1460-75-0x000000006F010000-0x000000006F5BB000-memory.dmp
      Filesize

      5.7MB

    • memory/1460-73-0x000000006F010000-0x000000006F5BB000-memory.dmp
      Filesize

      5.7MB

    • memory/1460-63-0x0000000000000000-mapping.dmp
    • memory/1556-64-0x0000000000000000-mapping.dmp
    • memory/2044-67-0x0000000005B00000-0x0000000005B34000-memory.dmp
      Filesize

      208KB

    • memory/2044-54-0x0000000000130000-0x000000000021C000-memory.dmp
      Filesize

      944KB

    • memory/2044-62-0x0000000005100000-0x0000000005174000-memory.dmp
      Filesize

      464KB

    • memory/2044-61-0x0000000001F80000-0x0000000001F8C000-memory.dmp
      Filesize

      48KB

    • memory/2044-60-0x00000000022B0000-0x00000000022D4000-memory.dmp
      Filesize

      144KB

    • memory/2044-59-0x0000000002270000-0x0000000002294000-memory.dmp
      Filesize

      144KB

    • memory/2044-58-0x00000000020B0000-0x00000000020D4000-memory.dmp
      Filesize

      144KB

    • memory/2044-57-0x00000000007E0000-0x0000000000804000-memory.dmp
      Filesize

      144KB

    • memory/2044-56-0x0000000000610000-0x0000000000634000-memory.dmp
      Filesize

      144KB

    • memory/2044-55-0x0000000076761000-0x0000000076763000-memory.dmp
      Filesize

      8KB