Analysis

  • max time kernel
    151s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    17/08/2022, 06:30

General

  • Target

    TRANSFERENCIA 112987.17.js

  • Size

    50KB

  • MD5

    dee4b4c202f66b29874dc3513c6b6763

  • SHA1

    7ccb14c3747f40a03af2323a5ad4ced193ce898b

  • SHA256

    f09aaecd8326e6cfe7eb413ff97f62a7537d38da9eb11e89ad5fa3fc3f256ad9

  • SHA512

    3c7537e59d1f658482c8ef39ae8652b7cfd898556583d2890c2687f929d7837a440828ee366ef5710bb07cfac6f08d73fc6db86d5189f279b1e8623dd84489de

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

la33

Decoy

landscapingwithstyles.com

thepetpreneur.com

optimafame.sbs

ipymont.online

optimallyhealthy.com

ke88fu.top

aspieadventures.com

syjqgg.com

hkhightechindustry.com

used.systems

kumharicompany.com

2907crockerct.com

bluestarmuch.net

lostgirlhikes.com

thealtro.net

taart-maken.com

kriyativa.com

movemobilehome.com

desireedaniels.team

shumakova.site

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

  • Formbook payload 3 IoCs
  • Blocklisted process makes network request 34 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Drops startup file 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1220
    • C:\Windows\system32\wscript.exe
      wscript.exe "C:\Users\Admin\AppData\Local\Temp\TRANSFERENCIA 112987.17.js"
      2⤵
      • Blocklisted process makes network request
      • Suspicious use of WriteProcessMemory
      PID:828
      • C:\Windows\System32\wscript.exe
        "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\VPaotlcvgR.js"
        3⤵
        • Blocklisted process makes network request
        • Drops startup file
        • Suspicious use of WriteProcessMemory
        PID:748
        • C:\Windows\System32\wscript.exe
          "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\bZQEUbJxNj.js"
          4⤵
          • Blocklisted process makes network request
          • Drops startup file
          PID:912
      • C:\Users\Admin\AppData\Local\Temp\bin.exe
        "C:\Users\Admin\AppData\Local\Temp\bin.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:1580
    • C:\Windows\SysWOW64\wscript.exe
      "C:\Windows\SysWOW64\wscript.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1592
      • C:\Program Files\Mozilla Firefox\Firefox.exe
        "C:\Program Files\Mozilla Firefox\Firefox.exe"
        3⤵
          PID:1992

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\bin.exe

            Filesize

            185KB

            MD5

            7578ec3deb440e8bffbc0eb52766fb3c

            SHA1

            8e33631cb47203bdae3fc2f2b0b0b3670de1335e

            SHA256

            252ce128d1491da94eb7936517f807a53e0b93bb2b7caacd981e0d51a8febd36

            SHA512

            9e3c04191330cf6a076bf5a82c8ae43afb7fe54bb136fe68ce9a412b3c02aa4e85dec89933d056ecf09f3e9a28d3cbdbe1912478e7bc0a7d68cd21806abc2276

          • C:\Users\Admin\AppData\Local\Temp\bin.exe

            Filesize

            185KB

            MD5

            7578ec3deb440e8bffbc0eb52766fb3c

            SHA1

            8e33631cb47203bdae3fc2f2b0b0b3670de1335e

            SHA256

            252ce128d1491da94eb7936517f807a53e0b93bb2b7caacd981e0d51a8febd36

            SHA512

            9e3c04191330cf6a076bf5a82c8ae43afb7fe54bb136fe68ce9a412b3c02aa4e85dec89933d056ecf09f3e9a28d3cbdbe1912478e7bc0a7d68cd21806abc2276

          • C:\Users\Admin\AppData\Roaming\2N0MC23V\2N0logim.jpeg

            Filesize

            61KB

            MD5

            586cfe5292bc68cbea4733842d690714

            SHA1

            b69c82df750ad29620915f81c51ca2d2d26fca2b

            SHA256

            8fa13955a82bd027e4e684047b8db4ff1857654dc436d748a2f593615d390ce8

            SHA512

            5c77b84bf0641834f8247a3f2356c5f9dcc4f9e691e5eda5fa33d1583149efbcd54670c368f49c54db3b6c4c99fed0329a3bc1ecc87e056720e044b272c9ae74

          • C:\Users\Admin\AppData\Roaming\2N0MC23V\2N0logrf.ini

            Filesize

            40B

            MD5

            2f245469795b865bdd1b956c23d7893d

            SHA1

            6ad80b974d3808f5a20ea1e766c7d2f88b9e5895

            SHA256

            1662d01a2d47b875a34fc7a8cd92e78cb2ba7f34023c7fd2639cbb10b8d94361

            SHA512

            909f189846a5d2db208a5eb2e7cb3042c0f164caf437e2b1b6de608c0a70e4f3510b81b85753dbeec1e211e6a83e6ea8c96aff896e9b6e8ed42014473a54dc4f

          • C:\Users\Admin\AppData\Roaming\2N0MC23V\2N0logri.ini

            Filesize

            40B

            MD5

            d63a82e5d81e02e399090af26db0b9cb

            SHA1

            91d0014c8f54743bba141fd60c9d963f869d76c9

            SHA256

            eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae

            SHA512

            38afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad

          • C:\Users\Admin\AppData\Roaming\2N0MC23V\2N0logrv.ini

            Filesize

            40B

            MD5

            ba3b6bc807d4f76794c4b81b09bb9ba5

            SHA1

            24cb89501f0212ff3095ecc0aba97dd563718fb1

            SHA256

            6eebf968962745b2e9de2ca969af7c424916d4e3fe3cc0bb9b3d414abfce9507

            SHA512

            ecd07e601fc9e3cfc39addd7bd6f3d7f7ff3253afb40bf536e9eaac5a4c243e5ec40fbfd7b216cb0ea29f2517419601e335e33ba19dea4a46f65e38694d465bf

          • C:\Users\Admin\AppData\Roaming\VPaotlcvgR.js

            Filesize

            26KB

            MD5

            8c05239516dbd3fd5501fa9a1eba063b

            SHA1

            cd983650af2353da97dd908f7027339e622ce819

            SHA256

            56226c2bbb8ba4586aea45ea618d7aa574280225036b22ac6e57aa907860c547

            SHA512

            8affbe22f0bc64aa685a5c38fbba0f9f43df726aa40392ad1b39792ceb15616bf2f6371b192fb7e4b492a44b953a8068ff82003d2bc51acb99d1aaee51d257d7

          • C:\Users\Admin\AppData\Roaming\bZQEUbJxNj.js

            Filesize

            6KB

            MD5

            a542a21ecaba36f6ba8c6457b8ab67f9

            SHA1

            3f05ddc6d6e59554cd9870b9e4b17919b81eaa6c

            SHA256

            bc831f27e6da7b5e82be628a1564c8b6aee02ec9290c5d21f99733dd2d1db47b

            SHA512

            78ca13a83bbd029470978b1e465ee6b0c2a9345a1fe8ee3e86d9f1d48bd52b7927a16e607f71084a91706213d8ddc0293ed06a1927e478b9bbc21ab0b47b9a2a

          • memory/912-58-0x000007FEFB881000-0x000007FEFB883000-memory.dmp

            Filesize

            8KB

          • memory/1220-63-0x0000000007550000-0x00000000076C5000-memory.dmp

            Filesize

            1.5MB

          • memory/1220-71-0x0000000004DC0000-0x0000000004EAA000-memory.dmp

            Filesize

            936KB

          • memory/1220-73-0x0000000004DC0000-0x0000000004EAA000-memory.dmp

            Filesize

            936KB

          • memory/1580-62-0x0000000000180000-0x0000000000194000-memory.dmp

            Filesize

            80KB

          • memory/1580-61-0x0000000000740000-0x0000000000A43000-memory.dmp

            Filesize

            3.0MB

          • memory/1592-66-0x0000000000420000-0x0000000000446000-memory.dmp

            Filesize

            152KB

          • memory/1592-72-0x0000000001CC0000-0x0000000001D53000-memory.dmp

            Filesize

            588KB

          • memory/1592-70-0x0000000001CC0000-0x0000000001D53000-memory.dmp

            Filesize

            588KB

          • memory/1592-69-0x0000000075A11000-0x0000000075A13000-memory.dmp

            Filesize

            8KB

          • memory/1592-68-0x0000000000170000-0x000000000019F000-memory.dmp

            Filesize

            188KB

          • memory/1592-67-0x0000000001E60000-0x0000000002163000-memory.dmp

            Filesize

            3.0MB