Analysis

  • max time kernel
    139s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    26/09/2022, 08:20

General

  • Target

    Payments Pending July2022.js

  • Size

    117KB

  • MD5

    0689e4e89cc239978a0fd64e6d7562c2

  • SHA1

    c4d44aa767b00e4df3e167e663d53efbb38e65cd

  • SHA256

    b9b4fc0d7e86072d0bccd0a50fbe65fb407f3f713dc6841fe708f5675e10f3fd

  • SHA512

    87ca1e8ca3b345d448d7531c15a222d7603d8fd2a6c86b97596a07612f5a280c6b3006623b93797dc1d1f988547f8f5c6ce31a5da7d010af1ec5ea3cb23cbf09

  • SSDEEP

    1536:xutYJwehB1pUB+x6sgo7XQ526va9X9zqhnG+QMkOucOLv1lWm7ezwhcPQO:weTvUULw2VtOosux1I6ePQO

Malware Config

Extracted

Family

formbook

Campaign

te2r

Decoy

Fd9/7zupFcFsmNMDWQ==

7VlRReDWtbu4LUTd5fNe/zPDyw==

jQgurOY8oCSzrjSP+2/F1jU=

xTMzpNwUaiHAy4+Anaz1

RcLapxVS9iOZhw==

lfLSnVItJp+5ImXLvcrLFTUXRmDxTnik

vj9fMOxFLjrOtdhP1GZo0KXIQ388

/91mgBbtxFIxtQk=

4FZ0aRyH/rEdFibAy+VjQyWIUIZaHBQ=

ScHdt3/t4FIxtQk=

/M9svqdL9iOZhw==

iFX1abANxkj893bVWA==

KzjvVANMpiTBmg==

aEKKEue7E9JtmNMDWQ==

+Mdhw6992svnUbzeo5y0zSn+B2co

albc98wrE0xtKjOoOOQ=

DV6CgU6omcjeZ6bJEG/F1jU=

NH981rm1JdyUNRd1

yi0xIqrxV83bmNMDWQ==

v8l52aXp4VIxtQk=

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

  • Blocklisted process makes network request 5 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Drops startup file 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe "C:\Users\Admin\AppData\Local\Temp\Payments Pending July2022.js"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1340
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\XFQJBzLSvS.js"
      2⤵
      • Blocklisted process makes network request
      • Drops startup file
      PID:960
    • C:\Program Files\Java\jre7\bin\javaw.exe
      "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\mljrbnp.txt"
      2⤵
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:600
      • C:\Users\Admin\AppData\Local\Temp\dl-15151331247720787836844007150.exe
        C:\Users\Admin\AppData\Local\Temp\dl-15151331247720787836844007150.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1656
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQAwAA==
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1528
        • C:\Users\Admin\AppData\Local\Temp\dl-15151331247720787836844007150.exe
          C:\Users\Admin\AppData\Local\Temp\dl-15151331247720787836844007150.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:1480

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\dl-15151331247720787836844007150.exe

          Filesize

          7KB

          MD5

          7ef3ca7c2d9d16855398bc4a40ffbf18

          SHA1

          b3f197e1f447a582a527d209fa0e1b5a7fc7d5d8

          SHA256

          6ffada93e4930ec9519c825c43f876015e0b9065e19a4b6356a8f575d62b6e54

          SHA512

          8d4dc7503026819c92b19f2208e88ce63afc8cdf413adaa8c29c0a6c9d721a0d0424f86377c3ebfcd4023c8be730da74ea849b574b7c653f5150ac7592fcbfdf

        • C:\Users\Admin\AppData\Local\Temp\dl-15151331247720787836844007150.exe

          Filesize

          7KB

          MD5

          7ef3ca7c2d9d16855398bc4a40ffbf18

          SHA1

          b3f197e1f447a582a527d209fa0e1b5a7fc7d5d8

          SHA256

          6ffada93e4930ec9519c825c43f876015e0b9065e19a4b6356a8f575d62b6e54

          SHA512

          8d4dc7503026819c92b19f2208e88ce63afc8cdf413adaa8c29c0a6c9d721a0d0424f86377c3ebfcd4023c8be730da74ea849b574b7c653f5150ac7592fcbfdf

        • C:\Users\Admin\AppData\Local\Temp\dl-15151331247720787836844007150.exe

          Filesize

          7KB

          MD5

          7ef3ca7c2d9d16855398bc4a40ffbf18

          SHA1

          b3f197e1f447a582a527d209fa0e1b5a7fc7d5d8

          SHA256

          6ffada93e4930ec9519c825c43f876015e0b9065e19a4b6356a8f575d62b6e54

          SHA512

          8d4dc7503026819c92b19f2208e88ce63afc8cdf413adaa8c29c0a6c9d721a0d0424f86377c3ebfcd4023c8be730da74ea849b574b7c653f5150ac7592fcbfdf

        • C:\Users\Admin\AppData\Roaming\XFQJBzLSvS.js

          Filesize

          6KB

          MD5

          1c3b0b42763f83a240f6b119d3b15c2f

          SHA1

          4d70ed8dba182021d7392822e9adfec9559d6a10

          SHA256

          477266506c73225a2e83e2bbe231b98d21a1bff91ca05f7f1c531d8e82f75cd7

          SHA512

          61073136d0082ed4341200ceb4ee6bbb6a0fe237626576ba298db17ca1fc8c2ab3fb58d0a84387fdaef2126fc98d2d424f4600093c378720892acaa182418779

        • C:\Users\Admin\AppData\Roaming\mljrbnp.txt

          Filesize

          51KB

          MD5

          195f235d676a9e8c3195d5e5e99487e4

          SHA1

          829cde6ad78db81138dc93f31ca2e7c94b5d6f64

          SHA256

          f68ca9305c322ff38d1043d48311ad49f9ae1ad2d7d12c88bf84d1187078448c

          SHA512

          48e681a9d15ca3867db4805412ba3f5916d1c5cbe8f6325285055aa65f6573130028308913f7be68e8ca51a205d2702f522bf0b6fc8bc03aa7014ce677aa8270

        • \Users\Admin\AppData\Local\Temp\dl-15151331247720787836844007150.exe

          Filesize

          7KB

          MD5

          7ef3ca7c2d9d16855398bc4a40ffbf18

          SHA1

          b3f197e1f447a582a527d209fa0e1b5a7fc7d5d8

          SHA256

          6ffada93e4930ec9519c825c43f876015e0b9065e19a4b6356a8f575d62b6e54

          SHA512

          8d4dc7503026819c92b19f2208e88ce63afc8cdf413adaa8c29c0a6c9d721a0d0424f86377c3ebfcd4023c8be730da74ea849b574b7c653f5150ac7592fcbfdf

        • memory/600-71-0x00000000020C0000-0x00000000050C0000-memory.dmp

          Filesize

          48.0MB

        • memory/600-75-0x0000000001DB0000-0x0000000001DBA000-memory.dmp

          Filesize

          40KB

        • memory/600-87-0x0000000001DB0000-0x0000000001DBA000-memory.dmp

          Filesize

          40KB

        • memory/600-74-0x0000000001DB0000-0x0000000001DBA000-memory.dmp

          Filesize

          40KB

        • memory/600-88-0x0000000001DB0000-0x0000000001DBA000-memory.dmp

          Filesize

          40KB

        • memory/600-86-0x00000000020C0000-0x00000000050C0000-memory.dmp

          Filesize

          48.0MB

        • memory/1340-54-0x000007FEFB9E1000-0x000007FEFB9E3000-memory.dmp

          Filesize

          8KB

        • memory/1480-95-0x0000000000400000-0x000000000042F000-memory.dmp

          Filesize

          188KB

        • memory/1480-93-0x0000000000400000-0x000000000042F000-memory.dmp

          Filesize

          188KB

        • memory/1480-99-0x0000000000400000-0x000000000042F000-memory.dmp

          Filesize

          188KB

        • memory/1480-100-0x0000000000401000-0x000000000042F000-memory.dmp

          Filesize

          184KB

        • memory/1480-101-0x0000000000770000-0x0000000000A73000-memory.dmp

          Filesize

          3.0MB

        • memory/1480-92-0x0000000000400000-0x000000000042F000-memory.dmp

          Filesize

          188KB

        • memory/1528-90-0x000000006E750000-0x000000006ECFB000-memory.dmp

          Filesize

          5.7MB

        • memory/1528-89-0x000000006E750000-0x000000006ECFB000-memory.dmp

          Filesize

          5.7MB

        • memory/1528-85-0x000000006E750000-0x000000006ECFB000-memory.dmp

          Filesize

          5.7MB

        • memory/1656-82-0x0000000005440000-0x00000000054D2000-memory.dmp

          Filesize

          584KB

        • memory/1656-81-0x0000000005110000-0x00000000051DC000-memory.dmp

          Filesize

          816KB

        • memory/1656-80-0x00000000758B1000-0x00000000758B3000-memory.dmp

          Filesize

          8KB

        • memory/1656-79-0x0000000000EF0000-0x0000000000EF8000-memory.dmp

          Filesize

          32KB