Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/08/2022, 06:30

General

  • Target

    TRANSFERENCIA 112987.17.js

  • Size

    50KB

  • MD5

    dee4b4c202f66b29874dc3513c6b6763

  • SHA1

    7ccb14c3747f40a03af2323a5ad4ced193ce898b

  • SHA256

    f09aaecd8326e6cfe7eb413ff97f62a7537d38da9eb11e89ad5fa3fc3f256ad9

  • SHA512

    3c7537e59d1f658482c8ef39ae8652b7cfd898556583d2890c2687f929d7837a440828ee366ef5710bb07cfac6f08d73fc6db86d5189f279b1e8623dd84489de

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

la33

Decoy

landscapingwithstyles.com

thepetpreneur.com

optimafame.sbs

ipymont.online

optimallyhealthy.com

ke88fu.top

aspieadventures.com

syjqgg.com

hkhightechindustry.com

used.systems

kumharicompany.com

2907crockerct.com

bluestarmuch.net

lostgirlhikes.com

thealtro.net

taart-maken.com

kriyativa.com

movemobilehome.com

desireedaniels.team

shumakova.site

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

  • Formbook payload 3 IoCs
  • Blocklisted process makes network request 31 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 52 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:740
    • C:\Windows\system32\wscript.exe
      wscript.exe "C:\Users\Admin\AppData\Local\Temp\TRANSFERENCIA 112987.17.js"
      2⤵
      • Blocklisted process makes network request
      • Checks computer location settings
      • Modifies system certificate store
      • Suspicious use of WriteProcessMemory
      PID:4988
      • C:\Windows\System32\wscript.exe
        "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\VPaotlcvgR.js"
        3⤵
        • Blocklisted process makes network request
        • Checks computer location settings
        • Drops startup file
        • Suspicious use of WriteProcessMemory
        PID:4872
        • C:\Windows\System32\wscript.exe
          "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\bZQEUbJxNj.js"
          4⤵
          • Blocklisted process makes network request
          • Drops startup file
          PID:4404
      • C:\Users\Admin\AppData\Local\Temp\bin.exe
        "C:\Users\Admin\AppData\Local\Temp\bin.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:4156
    • C:\Windows\SysWOW64\autoconv.exe
      "C:\Windows\SysWOW64\autoconv.exe"
      2⤵
        PID:2992
      • C:\Windows\SysWOW64\autoconv.exe
        "C:\Windows\SysWOW64\autoconv.exe"
        2⤵
          PID:3824
        • C:\Windows\SysWOW64\autoconv.exe
          "C:\Windows\SysWOW64\autoconv.exe"
          2⤵
            PID:4884
          • C:\Windows\SysWOW64\autoconv.exe
            "C:\Windows\SysWOW64\autoconv.exe"
            2⤵
              PID:2484
            • C:\Windows\SysWOW64\autoconv.exe
              "C:\Windows\SysWOW64\autoconv.exe"
              2⤵
                PID:340
              • C:\Windows\SysWOW64\autoconv.exe
                "C:\Windows\SysWOW64\autoconv.exe"
                2⤵
                  PID:3492
                • C:\Windows\SysWOW64\autoconv.exe
                  "C:\Windows\SysWOW64\autoconv.exe"
                  2⤵
                    PID:1472
                  • C:\Windows\SysWOW64\autoconv.exe
                    "C:\Windows\SysWOW64\autoconv.exe"
                    2⤵
                      PID:4512
                    • C:\Windows\SysWOW64\autoconv.exe
                      "C:\Windows\SysWOW64\autoconv.exe"
                      2⤵
                        PID:2016
                      • C:\Windows\SysWOW64\help.exe
                        "C:\Windows\SysWOW64\help.exe"
                        2⤵
                        • Suspicious use of SetThreadContext
                        • Modifies Internet Explorer settings
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious behavior: MapViewOfSection
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:32
                        • C:\Windows\SysWOW64\cmd.exe
                          /c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
                          3⤵
                            PID:3552
                          • C:\Program Files\Mozilla Firefox\Firefox.exe
                            "C:\Program Files\Mozilla Firefox\Firefox.exe"
                            3⤵
                              PID:2940

                        Network

                              MITRE ATT&CK Enterprise v6

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Temp\DB1

                                Filesize

                                40KB

                                MD5

                                b608d407fc15adea97c26936bc6f03f6

                                SHA1

                                953e7420801c76393902c0d6bb56148947e41571

                                SHA256

                                b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf

                                SHA512

                                cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4

                              • C:\Users\Admin\AppData\Local\Temp\bin.exe

                                Filesize

                                185KB

                                MD5

                                7578ec3deb440e8bffbc0eb52766fb3c

                                SHA1

                                8e33631cb47203bdae3fc2f2b0b0b3670de1335e

                                SHA256

                                252ce128d1491da94eb7936517f807a53e0b93bb2b7caacd981e0d51a8febd36

                                SHA512

                                9e3c04191330cf6a076bf5a82c8ae43afb7fe54bb136fe68ce9a412b3c02aa4e85dec89933d056ecf09f3e9a28d3cbdbe1912478e7bc0a7d68cd21806abc2276

                              • C:\Users\Admin\AppData\Local\Temp\bin.exe

                                Filesize

                                185KB

                                MD5

                                7578ec3deb440e8bffbc0eb52766fb3c

                                SHA1

                                8e33631cb47203bdae3fc2f2b0b0b3670de1335e

                                SHA256

                                252ce128d1491da94eb7936517f807a53e0b93bb2b7caacd981e0d51a8febd36

                                SHA512

                                9e3c04191330cf6a076bf5a82c8ae43afb7fe54bb136fe68ce9a412b3c02aa4e85dec89933d056ecf09f3e9a28d3cbdbe1912478e7bc0a7d68cd21806abc2276

                              • C:\Users\Admin\AppData\Roaming\2N0MC23V\2N0logim.jpeg

                                Filesize

                                73KB

                                MD5

                                fb0ab1cf6a8dc40d8cfa54f9d16542e3

                                SHA1

                                cd889a091d69352a30b79eb47f62cd9ad0b8982d

                                SHA256

                                d3704ed9be145f48811b12d645bd5489508644163f6b870ff610bc243c5c0e84

                                SHA512

                                7ce8e957e73e1f725cf7168ce443e5387fa1e56475da0b6d6a4119e6b388ae0955c81719b874c6273475df661af699f552aac0dc6a530592abbb7567c79b1217

                              • C:\Users\Admin\AppData\Roaming\2N0MC23V\2N0logrf.ini

                                Filesize

                                40B

                                MD5

                                2f245469795b865bdd1b956c23d7893d

                                SHA1

                                6ad80b974d3808f5a20ea1e766c7d2f88b9e5895

                                SHA256

                                1662d01a2d47b875a34fc7a8cd92e78cb2ba7f34023c7fd2639cbb10b8d94361

                                SHA512

                                909f189846a5d2db208a5eb2e7cb3042c0f164caf437e2b1b6de608c0a70e4f3510b81b85753dbeec1e211e6a83e6ea8c96aff896e9b6e8ed42014473a54dc4f

                              • C:\Users\Admin\AppData\Roaming\2N0MC23V\2N0logrg.ini

                                Filesize

                                38B

                                MD5

                                4aadf49fed30e4c9b3fe4a3dd6445ebe

                                SHA1

                                1e332822167c6f351b99615eada2c30a538ff037

                                SHA256

                                75034beb7bded9aeab5748f4592b9e1419256caec474065d43e531ec5cc21c56

                                SHA512

                                eb5b3908d5e7b43ba02165e092f05578f45f15a148b4c3769036aa542c23a0f7cd2bc2770cf4119a7e437de3f681d9e398511f69f66824c516d9b451bb95f945

                              • C:\Users\Admin\AppData\Roaming\2N0MC23V\2N0logri.ini

                                Filesize

                                40B

                                MD5

                                d63a82e5d81e02e399090af26db0b9cb

                                SHA1

                                91d0014c8f54743bba141fd60c9d963f869d76c9

                                SHA256

                                eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae

                                SHA512

                                38afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad

                              • C:\Users\Admin\AppData\Roaming\2N0MC23V\2N0logrv.ini

                                Filesize

                                872B

                                MD5

                                bbc41c78bae6c71e63cb544a6a284d94

                                SHA1

                                33f2c1d9fa0e9c99b80bc2500621e95af38b1f9a

                                SHA256

                                ee83c6bcea9353c74bfc0a7e739f3c4a765ace894470e09cdcdebba700b8d4cb

                                SHA512

                                0aea424b57adae3e14ad6491cab585f554b4dffe601b5a17bad6ee6177d2f0f995e419cde576e2d1782b9bddc0661aada11a2c9f1454ae625d9e3223635ec9f4

                              • C:\Users\Admin\AppData\Roaming\VPaotlcvgR.js

                                Filesize

                                26KB

                                MD5

                                8c05239516dbd3fd5501fa9a1eba063b

                                SHA1

                                cd983650af2353da97dd908f7027339e622ce819

                                SHA256

                                56226c2bbb8ba4586aea45ea618d7aa574280225036b22ac6e57aa907860c547

                                SHA512

                                8affbe22f0bc64aa685a5c38fbba0f9f43df726aa40392ad1b39792ceb15616bf2f6371b192fb7e4b492a44b953a8068ff82003d2bc51acb99d1aaee51d257d7

                              • C:\Users\Admin\AppData\Roaming\bZQEUbJxNj.js

                                Filesize

                                6KB

                                MD5

                                a542a21ecaba36f6ba8c6457b8ab67f9

                                SHA1

                                3f05ddc6d6e59554cd9870b9e4b17919b81eaa6c

                                SHA256

                                bc831f27e6da7b5e82be628a1564c8b6aee02ec9290c5d21f99733dd2d1db47b

                                SHA512

                                78ca13a83bbd029470978b1e465ee6b0c2a9345a1fe8ee3e86d9f1d48bd52b7927a16e607f71084a91706213d8ddc0293ed06a1927e478b9bbc21ab0b47b9a2a

                              • memory/32-145-0x0000000000D70000-0x0000000000D9F000-memory.dmp

                                Filesize

                                188KB

                              • memory/32-144-0x0000000000CE0000-0x0000000000CE7000-memory.dmp

                                Filesize

                                28KB

                              • memory/32-143-0x00000000016B0000-0x00000000019FA000-memory.dmp

                                Filesize

                                3.3MB

                              • memory/32-148-0x00000000014F0000-0x0000000001583000-memory.dmp

                                Filesize

                                588KB

                              • memory/740-150-0x0000000008C50000-0x0000000008DAD000-memory.dmp

                                Filesize

                                1.4MB

                              • memory/740-141-0x0000000008AF0000-0x0000000008C49000-memory.dmp

                                Filesize

                                1.3MB

                              • memory/740-149-0x0000000008C50000-0x0000000008DAD000-memory.dmp

                                Filesize

                                1.4MB

                              • memory/4156-140-0x0000000001AD0000-0x0000000001AE4000-memory.dmp

                                Filesize

                                80KB

                              • memory/4156-139-0x0000000001780000-0x0000000001ACA000-memory.dmp

                                Filesize

                                3.3MB