Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    22/09/2022, 11:59

General

  • Target

    Bill_for_September.js

  • Size

    117KB

  • MD5

    0d4ce6bd62a6939871782dbf6dc33905

  • SHA1

    c59f4f36d9b46b8e4c131401fa4054f50450e245

  • SHA256

    4fcdcb3039331525724bfeb0cbc97bd0893de48d4aa4ca95e282f0a8f2a1a5ab

  • SHA512

    07b7f3d7cb81a48c90f21bfdf22b0f6cb3941631ab14d05004b813f031d0c5b41538818e4b8c15b83081f48f522adce9b3e01d9f43cf3d202d142f0ea806aff1

  • SSDEEP

    1536:LfgQ2U241TiKP3/qopoIo8kQjZs1BGMLOivlSPPQh7l1GCVbabMOijrkJpQt:BVxiufpoTnBzK7cvhaoNr1t

Malware Config

Extracted

Family

formbook

Campaign

te2r

Decoy

Fd9/7zupFcFsmNMDWQ==

7VlRReDWtbu4LUTd5fNe/zPDyw==

jQgurOY8oCSzrjSP+2/F1jU=

xTMzpNwUaiHAy4+Anaz1

RcLapxVS9iOZhw==

lfLSnVItJp+5ImXLvcrLFTUXRmDxTnik

vj9fMOxFLjrOtdhP1GZo0KXIQ388

/91mgBbtxFIxtQk=

4FZ0aRyH/rEdFibAy+VjQyWIUIZaHBQ=

ScHdt3/t4FIxtQk=

/M9svqdL9iOZhw==

iFX1abANxkj893bVWA==

KzjvVANMpiTBmg==

aEKKEue7E9JtmNMDWQ==

+Mdhw6992svnUbzeo5y0zSn+B2co

albc98wrE0xtKjOoOOQ=

DV6CgU6omcjeZ6bJEG/F1jU=

NH981rm1JdyUNRd1

yi0xIqrxV83bmNMDWQ==

v8l52aXp4VIxtQk=

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

  • Blocklisted process makes network request 15 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Drops startup file 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\Bill_for_September.js
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2020
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\OKbZTSiYGW.js"
      2⤵
      • Blocklisted process makes network request
      • Drops startup file
      PID:1252
    • C:\Program Files\Java\jre7\bin\javaw.exe
      "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\ykmjni.txt"
      2⤵
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1108
      • C:\Users\Admin\AppData\Local\Temp\dl-11941615582555800775452413394.exe
        C:\Users\Admin\AppData\Local\Temp\dl-11941615582555800775452413394.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1196
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQAwAA==
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:852
        • C:\Users\Admin\AppData\Local\Temp\dl-11941615582555800775452413394.exe
          C:\Users\Admin\AppData\Local\Temp\dl-11941615582555800775452413394.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:1352

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\dl-11941615582555800775452413394.exe

          Filesize

          6KB

          MD5

          ca997af70e0e7ba134bd85015d945684

          SHA1

          0d2972cf028063d8086fc6207537d8d1796993b7

          SHA256

          74cb4ffa84249a18ca95cd781bd121a166e2902161a8918d645fa3d6b59032ec

          SHA512

          836c667aba467655a52a1c13f6d8a4eff844af3aedb115dea2a77244d9294cf605d7030ffc9d30e200c5010251aa78cbe8e5265daebee8c4a0cd107ff3253fc9

        • C:\Users\Admin\AppData\Local\Temp\dl-11941615582555800775452413394.exe

          Filesize

          6KB

          MD5

          ca997af70e0e7ba134bd85015d945684

          SHA1

          0d2972cf028063d8086fc6207537d8d1796993b7

          SHA256

          74cb4ffa84249a18ca95cd781bd121a166e2902161a8918d645fa3d6b59032ec

          SHA512

          836c667aba467655a52a1c13f6d8a4eff844af3aedb115dea2a77244d9294cf605d7030ffc9d30e200c5010251aa78cbe8e5265daebee8c4a0cd107ff3253fc9

        • C:\Users\Admin\AppData\Local\Temp\dl-11941615582555800775452413394.exe

          Filesize

          6KB

          MD5

          ca997af70e0e7ba134bd85015d945684

          SHA1

          0d2972cf028063d8086fc6207537d8d1796993b7

          SHA256

          74cb4ffa84249a18ca95cd781bd121a166e2902161a8918d645fa3d6b59032ec

          SHA512

          836c667aba467655a52a1c13f6d8a4eff844af3aedb115dea2a77244d9294cf605d7030ffc9d30e200c5010251aa78cbe8e5265daebee8c4a0cd107ff3253fc9

        • C:\Users\Admin\AppData\Roaming\OKbZTSiYGW.js

          Filesize

          6KB

          MD5

          cd1e26090eca7148fb0bf3d0a9070791

          SHA1

          745715f115adbc17ee4f903908cedbf5f33fe305

          SHA256

          5ccd5f609f1f1c47e835968018ad8efc7dc25c6ab5c6b8212a279ddd494b7196

          SHA512

          12b6a39cd7e3495c562e8c5a73aeba37e7055d5c4049a1a976a9945609ae7452d0ceb70e9c95432151104cd39991dadc36978ac87c1b09cb09cb53d17f014bdc

        • C:\Users\Admin\AppData\Roaming\ykmjni.txt

          Filesize

          51KB

          MD5

          f3fec1cda20623152eadff01fa271dd9

          SHA1

          24b5b9e16d17fa7828b0f2edeaa5aab8ac8bacfb

          SHA256

          eb5605cc851a689a83c9555f48465ea5d13af94ea8db927e6f8ba32640462efc

          SHA512

          5895e77dedd7756e98f4484b0ea0bdba348211349eb6483ca002d60d293e58f253028a4b07f6deab2d902cbbcc502cf75ac812ec38c30fd05d7e74d1cc5a8a2f

        • \Users\Admin\AppData\Local\Temp\dl-11941615582555800775452413394.exe

          Filesize

          6KB

          MD5

          ca997af70e0e7ba134bd85015d945684

          SHA1

          0d2972cf028063d8086fc6207537d8d1796993b7

          SHA256

          74cb4ffa84249a18ca95cd781bd121a166e2902161a8918d645fa3d6b59032ec

          SHA512

          836c667aba467655a52a1c13f6d8a4eff844af3aedb115dea2a77244d9294cf605d7030ffc9d30e200c5010251aa78cbe8e5265daebee8c4a0cd107ff3253fc9

        • memory/852-89-0x000000006EFF0000-0x000000006F59B000-memory.dmp

          Filesize

          5.7MB

        • memory/852-88-0x000000006EFF0000-0x000000006F59B000-memory.dmp

          Filesize

          5.7MB

        • memory/852-85-0x000000006EFF0000-0x000000006F59B000-memory.dmp

          Filesize

          5.7MB

        • memory/1108-75-0x0000000000370000-0x000000000037A000-memory.dmp

          Filesize

          40KB

        • memory/1108-86-0x0000000002230000-0x0000000005230000-memory.dmp

          Filesize

          48.0MB

        • memory/1108-71-0x0000000002230000-0x0000000005230000-memory.dmp

          Filesize

          48.0MB

        • memory/1108-74-0x0000000000370000-0x000000000037A000-memory.dmp

          Filesize

          40KB

        • memory/1108-87-0x0000000000370000-0x000000000037A000-memory.dmp

          Filesize

          40KB

        • memory/1196-80-0x00000000756B1000-0x00000000756B3000-memory.dmp

          Filesize

          8KB

        • memory/1196-79-0x00000000009C0000-0x00000000009C8000-memory.dmp

          Filesize

          32KB

        • memory/1196-82-0x0000000005420000-0x00000000054B2000-memory.dmp

          Filesize

          584KB

        • memory/1196-81-0x00000000097F0000-0x00000000098C4000-memory.dmp

          Filesize

          848KB

        • memory/1352-91-0x0000000000400000-0x000000000042F000-memory.dmp

          Filesize

          188KB

        • memory/1352-92-0x0000000000400000-0x000000000042F000-memory.dmp

          Filesize

          188KB

        • memory/1352-94-0x0000000000400000-0x000000000042F000-memory.dmp

          Filesize

          188KB

        • memory/1352-99-0x0000000000401000-0x000000000042F000-memory.dmp

          Filesize

          184KB

        • memory/1352-98-0x0000000000400000-0x000000000042F000-memory.dmp

          Filesize

          188KB

        • memory/1352-100-0x00000000009D0000-0x0000000000CD3000-memory.dmp

          Filesize

          3.0MB

        • memory/2020-54-0x000007FEFC2C1000-0x000007FEFC2C3000-memory.dmp

          Filesize

          8KB