Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    22/09/2022, 10:31

General

  • Target

    ION LABZ Statement.js

  • Size

    117KB

  • MD5

    911a689ab23a99b27ec0a41df25dc1b2

  • SHA1

    f78334182a6c6af188f996c215ea7b48bb4043ea

  • SHA256

    6dde0bc3fc8d0b186be04fd2ca3b284aa7f922f28cd04830adc1e2e03d95e34b

  • SHA512

    b0ef082316a219063c26aa92f2adb914fd0ec3648531d9fa0d3082ad13762f3cdedec91b85e936ed6da7bebf227de6f63e8bc10949b059961d1db7beb7517a6d

  • SSDEEP

    1536:Exy5MbAav/s5Aj6hQDvY1lnpFjPdTtiS7b2Piz4KBVmNBs3lt66hS5LmFf3:9s/ujSvaJPDjYiXVDloI0I3

Malware Config

Extracted

Family

formbook

Campaign

te2r

Decoy

Fd9/7zupFcFsmNMDWQ==

7VlRReDWtbu4LUTd5fNe/zPDyw==

jQgurOY8oCSzrjSP+2/F1jU=

xTMzpNwUaiHAy4+Anaz1

RcLapxVS9iOZhw==

lfLSnVItJp+5ImXLvcrLFTUXRmDxTnik

vj9fMOxFLjrOtdhP1GZo0KXIQ388

/91mgBbtxFIxtQk=

4FZ0aRyH/rEdFibAy+VjQyWIUIZaHBQ=

ScHdt3/t4FIxtQk=

/M9svqdL9iOZhw==

iFX1abANxkj893bVWA==

KzjvVANMpiTBmg==

aEKKEue7E9JtmNMDWQ==

+Mdhw6992svnUbzeo5y0zSn+B2co

albc98wrE0xtKjOoOOQ=

DV6CgU6omcjeZ6bJEG/F1jU=

NH981rm1JdyUNRd1

yi0xIqrxV83bmNMDWQ==

v8l52aXp4VIxtQk=

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

  • Blocklisted process makes network request 15 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 3 IoCs
  • Drops startup file 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe "C:\Users\Admin\AppData\Local\Temp\ION LABZ Statement.js"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2012
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\vZrohjawOK.js"
      2⤵
      • Blocklisted process makes network request
      • Drops startup file
      PID:1340
    • C:\Program Files\Java\jre7\bin\javaw.exe
      "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\kpakazlev.txt"
      2⤵
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1200
      • C:\Users\Admin\AppData\Local\Temp\dl8146395848399798364075715024.exe
        C:\Users\Admin\AppData\Local\Temp\dl8146395848399798364075715024.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1624
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQAwAA==
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1804
        • C:\Users\Admin\AppData\Local\Temp\dl8146395848399798364075715024.exe
          C:\Users\Admin\AppData\Local\Temp\dl8146395848399798364075715024.exe
          4⤵
          • Executes dropped EXE
          PID:1528
        • C:\Users\Admin\AppData\Local\Temp\dl8146395848399798364075715024.exe
          C:\Users\Admin\AppData\Local\Temp\dl8146395848399798364075715024.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:1628

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\dl8146395848399798364075715024.exe

          Filesize

          6KB

          MD5

          ca997af70e0e7ba134bd85015d945684

          SHA1

          0d2972cf028063d8086fc6207537d8d1796993b7

          SHA256

          74cb4ffa84249a18ca95cd781bd121a166e2902161a8918d645fa3d6b59032ec

          SHA512

          836c667aba467655a52a1c13f6d8a4eff844af3aedb115dea2a77244d9294cf605d7030ffc9d30e200c5010251aa78cbe8e5265daebee8c4a0cd107ff3253fc9

        • C:\Users\Admin\AppData\Local\Temp\dl8146395848399798364075715024.exe

          Filesize

          6KB

          MD5

          ca997af70e0e7ba134bd85015d945684

          SHA1

          0d2972cf028063d8086fc6207537d8d1796993b7

          SHA256

          74cb4ffa84249a18ca95cd781bd121a166e2902161a8918d645fa3d6b59032ec

          SHA512

          836c667aba467655a52a1c13f6d8a4eff844af3aedb115dea2a77244d9294cf605d7030ffc9d30e200c5010251aa78cbe8e5265daebee8c4a0cd107ff3253fc9

        • C:\Users\Admin\AppData\Local\Temp\dl8146395848399798364075715024.exe

          Filesize

          6KB

          MD5

          ca997af70e0e7ba134bd85015d945684

          SHA1

          0d2972cf028063d8086fc6207537d8d1796993b7

          SHA256

          74cb4ffa84249a18ca95cd781bd121a166e2902161a8918d645fa3d6b59032ec

          SHA512

          836c667aba467655a52a1c13f6d8a4eff844af3aedb115dea2a77244d9294cf605d7030ffc9d30e200c5010251aa78cbe8e5265daebee8c4a0cd107ff3253fc9

        • C:\Users\Admin\AppData\Local\Temp\dl8146395848399798364075715024.exe

          Filesize

          6KB

          MD5

          ca997af70e0e7ba134bd85015d945684

          SHA1

          0d2972cf028063d8086fc6207537d8d1796993b7

          SHA256

          74cb4ffa84249a18ca95cd781bd121a166e2902161a8918d645fa3d6b59032ec

          SHA512

          836c667aba467655a52a1c13f6d8a4eff844af3aedb115dea2a77244d9294cf605d7030ffc9d30e200c5010251aa78cbe8e5265daebee8c4a0cd107ff3253fc9

        • C:\Users\Admin\AppData\Roaming\kpakazlev.txt

          Filesize

          51KB

          MD5

          1d6cb5a374117999329351e6f28268e3

          SHA1

          a08e5a413f3febe7def2dff25717cbfe16b315b5

          SHA256

          cbf7cbc7305bed6abb433ff9b8277c63a2d79dc845d2995adf8cc1c6dd5463dd

          SHA512

          0ce83690f1806a002bd68e6fd1caad2852146e8c03d78aefd5309868e184954793ed0546978dcc86d226c4a5a33437f6feb350cc7ef1a57615dbe80e22042c51

        • C:\Users\Admin\AppData\Roaming\vZrohjawOK.js

          Filesize

          6KB

          MD5

          aeea41deb4363e0a23003555ffc0ada1

          SHA1

          c1fc845800ef733bfd2886bceba15ed4ec19bbdb

          SHA256

          e4b86c3adb3c82dcbf9e87518210b8f23e813174e93fa8b90f3b0ee0f024da1e

          SHA512

          bcbe6e10d4a6f5166adc864274b534be36b5b238abe7d83c2d26c60cc25a7ff9b2d887c10c132c439108dbdae793d0ad061890a431f1e2b7df659dd67f5cd823

        • \Users\Admin\AppData\Local\Temp\dl8146395848399798364075715024.exe

          Filesize

          6KB

          MD5

          ca997af70e0e7ba134bd85015d945684

          SHA1

          0d2972cf028063d8086fc6207537d8d1796993b7

          SHA256

          74cb4ffa84249a18ca95cd781bd121a166e2902161a8918d645fa3d6b59032ec

          SHA512

          836c667aba467655a52a1c13f6d8a4eff844af3aedb115dea2a77244d9294cf605d7030ffc9d30e200c5010251aa78cbe8e5265daebee8c4a0cd107ff3253fc9

        • \Users\Admin\AppData\Local\Temp\dl8146395848399798364075715024.exe

          Filesize

          6KB

          MD5

          ca997af70e0e7ba134bd85015d945684

          SHA1

          0d2972cf028063d8086fc6207537d8d1796993b7

          SHA256

          74cb4ffa84249a18ca95cd781bd121a166e2902161a8918d645fa3d6b59032ec

          SHA512

          836c667aba467655a52a1c13f6d8a4eff844af3aedb115dea2a77244d9294cf605d7030ffc9d30e200c5010251aa78cbe8e5265daebee8c4a0cd107ff3253fc9

        • memory/1200-74-0x0000000000180000-0x000000000018A000-memory.dmp

          Filesize

          40KB

        • memory/1200-70-0x0000000002150000-0x0000000005150000-memory.dmp

          Filesize

          48.0MB

        • memory/1200-85-0x0000000002150000-0x0000000005150000-memory.dmp

          Filesize

          48.0MB

        • memory/1200-86-0x0000000000180000-0x000000000018A000-memory.dmp

          Filesize

          40KB

        • memory/1624-81-0x0000000005010000-0x00000000050A2000-memory.dmp

          Filesize

          584KB

        • memory/1624-80-0x0000000004F40000-0x0000000005014000-memory.dmp

          Filesize

          848KB

        • memory/1624-79-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

          Filesize

          8KB

        • memory/1624-78-0x0000000000C30000-0x0000000000C38000-memory.dmp

          Filesize

          32KB

        • memory/1628-101-0x0000000000C40000-0x0000000000F43000-memory.dmp

          Filesize

          3.0MB

        • memory/1628-100-0x0000000000401000-0x000000000042F000-memory.dmp

          Filesize

          184KB

        • memory/1628-99-0x0000000000400000-0x000000000042F000-memory.dmp

          Filesize

          188KB

        • memory/1628-92-0x0000000000400000-0x000000000042F000-memory.dmp

          Filesize

          188KB

        • memory/1628-93-0x0000000000400000-0x000000000042F000-memory.dmp

          Filesize

          188KB

        • memory/1628-95-0x0000000000400000-0x000000000042F000-memory.dmp

          Filesize

          188KB

        • memory/1804-88-0x000000006EC60000-0x000000006F20B000-memory.dmp

          Filesize

          5.7MB

        • memory/1804-84-0x000000006EC60000-0x000000006F20B000-memory.dmp

          Filesize

          5.7MB

        • memory/1804-87-0x000000006EC60000-0x000000006F20B000-memory.dmp

          Filesize

          5.7MB

        • memory/2012-54-0x000007FEFBF21000-0x000007FEFBF23000-memory.dmp

          Filesize

          8KB