Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/09/2022, 08:20

General

  • Target

    Payments Pending July2022.js

  • Size

    117KB

  • MD5

    0689e4e89cc239978a0fd64e6d7562c2

  • SHA1

    c4d44aa767b00e4df3e167e663d53efbb38e65cd

  • SHA256

    b9b4fc0d7e86072d0bccd0a50fbe65fb407f3f713dc6841fe708f5675e10f3fd

  • SHA512

    87ca1e8ca3b345d448d7531c15a222d7603d8fd2a6c86b97596a07612f5a280c6b3006623b93797dc1d1f988547f8f5c6ce31a5da7d010af1ec5ea3cb23cbf09

  • SSDEEP

    1536:xutYJwehB1pUB+x6sgo7XQ526va9X9zqhnG+QMkOucOLv1lWm7ezwhcPQO:weTvUULw2VtOosux1I6ePQO

Malware Config

Extracted

Family

formbook

Campaign

te2r

Decoy

Fd9/7zupFcFsmNMDWQ==

7VlRReDWtbu4LUTd5fNe/zPDyw==

jQgurOY8oCSzrjSP+2/F1jU=

xTMzpNwUaiHAy4+Anaz1

RcLapxVS9iOZhw==

lfLSnVItJp+5ImXLvcrLFTUXRmDxTnik

vj9fMOxFLjrOtdhP1GZo0KXIQ388

/91mgBbtxFIxtQk=

4FZ0aRyH/rEdFibAy+VjQyWIUIZaHBQ=

ScHdt3/t4FIxtQk=

/M9svqdL9iOZhw==

iFX1abANxkj893bVWA==

KzjvVANMpiTBmg==

aEKKEue7E9JtmNMDWQ==

+Mdhw6992svnUbzeo5y0zSn+B2co

albc98wrE0xtKjOoOOQ=

DV6CgU6omcjeZ6bJEG/F1jU=

NH981rm1JdyUNRd1

yi0xIqrxV83bmNMDWQ==

v8l52aXp4VIxtQk=

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

  • Blocklisted process makes network request 6 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe "C:\Users\Admin\AppData\Local\Temp\Payments Pending July2022.js"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2672
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\XFQJBzLSvS.js"
      2⤵
      • Blocklisted process makes network request
      • Drops startup file
      PID:2128
    • C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
      "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\dqvpmqlbj.txt"
      2⤵
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4700
      • C:\Users\Admin\AppData\Local\Temp\dl-17096158396911694833019677680.exe
        C:\Users\Admin\AppData\Local\Temp\dl-17096158396911694833019677680.exe
        3⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4772
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQAwAA==
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1176
        • C:\Users\Admin\AppData\Local\Temp\dl-17096158396911694833019677680.exe
          C:\Users\Admin\AppData\Local\Temp\dl-17096158396911694833019677680.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:2304

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\dl-17096158396911694833019677680.exe

          Filesize

          7KB

          MD5

          7ef3ca7c2d9d16855398bc4a40ffbf18

          SHA1

          b3f197e1f447a582a527d209fa0e1b5a7fc7d5d8

          SHA256

          6ffada93e4930ec9519c825c43f876015e0b9065e19a4b6356a8f575d62b6e54

          SHA512

          8d4dc7503026819c92b19f2208e88ce63afc8cdf413adaa8c29c0a6c9d721a0d0424f86377c3ebfcd4023c8be730da74ea849b574b7c653f5150ac7592fcbfdf

        • C:\Users\Admin\AppData\Local\Temp\dl-17096158396911694833019677680.exe

          Filesize

          7KB

          MD5

          7ef3ca7c2d9d16855398bc4a40ffbf18

          SHA1

          b3f197e1f447a582a527d209fa0e1b5a7fc7d5d8

          SHA256

          6ffada93e4930ec9519c825c43f876015e0b9065e19a4b6356a8f575d62b6e54

          SHA512

          8d4dc7503026819c92b19f2208e88ce63afc8cdf413adaa8c29c0a6c9d721a0d0424f86377c3ebfcd4023c8be730da74ea849b574b7c653f5150ac7592fcbfdf

        • C:\Users\Admin\AppData\Local\Temp\dl-17096158396911694833019677680.exe

          Filesize

          7KB

          MD5

          7ef3ca7c2d9d16855398bc4a40ffbf18

          SHA1

          b3f197e1f447a582a527d209fa0e1b5a7fc7d5d8

          SHA256

          6ffada93e4930ec9519c825c43f876015e0b9065e19a4b6356a8f575d62b6e54

          SHA512

          8d4dc7503026819c92b19f2208e88ce63afc8cdf413adaa8c29c0a6c9d721a0d0424f86377c3ebfcd4023c8be730da74ea849b574b7c653f5150ac7592fcbfdf

        • C:\Users\Admin\AppData\Roaming\XFQJBzLSvS.js

          Filesize

          6KB

          MD5

          1c3b0b42763f83a240f6b119d3b15c2f

          SHA1

          4d70ed8dba182021d7392822e9adfec9559d6a10

          SHA256

          477266506c73225a2e83e2bbe231b98d21a1bff91ca05f7f1c531d8e82f75cd7

          SHA512

          61073136d0082ed4341200ceb4ee6bbb6a0fe237626576ba298db17ca1fc8c2ab3fb58d0a84387fdaef2126fc98d2d424f4600093c378720892acaa182418779

        • C:\Users\Admin\AppData\Roaming\dqvpmqlbj.txt

          Filesize

          51KB

          MD5

          195f235d676a9e8c3195d5e5e99487e4

          SHA1

          829cde6ad78db81138dc93f31ca2e7c94b5d6f64

          SHA256

          f68ca9305c322ff38d1043d48311ad49f9ae1ad2d7d12c88bf84d1187078448c

          SHA512

          48e681a9d15ca3867db4805412ba3f5916d1c5cbe8f6325285055aa65f6573130028308913f7be68e8ca51a205d2702f522bf0b6fc8bc03aa7014ce677aa8270

        • memory/1176-157-0x0000000005430000-0x0000000005A58000-memory.dmp

          Filesize

          6.2MB

        • memory/1176-162-0x0000000006680000-0x000000000669A000-memory.dmp

          Filesize

          104KB

        • memory/1176-161-0x00000000077D0000-0x0000000007E4A000-memory.dmp

          Filesize

          6.5MB

        • memory/1176-160-0x0000000006190000-0x00000000061AE000-memory.dmp

          Filesize

          120KB

        • memory/1176-159-0x0000000005B80000-0x0000000005BE6000-memory.dmp

          Filesize

          408KB

        • memory/1176-158-0x0000000005360000-0x00000000053C6000-memory.dmp

          Filesize

          408KB

        • memory/1176-156-0x0000000002850000-0x0000000002886000-memory.dmp

          Filesize

          216KB

        • memory/2304-170-0x00000000011F0000-0x000000000153A000-memory.dmp

          Filesize

          3.3MB

        • memory/2304-165-0x0000000000400000-0x000000000042F000-memory.dmp

          Filesize

          188KB

        • memory/2304-168-0x0000000000400000-0x000000000042F000-memory.dmp

          Filesize

          188KB

        • memory/2304-169-0x0000000000401000-0x000000000042F000-memory.dmp

          Filesize

          184KB

        • memory/4700-153-0x0000000002750000-0x0000000003750000-memory.dmp

          Filesize

          16.0MB

        • memory/4700-152-0x0000000002750000-0x0000000003750000-memory.dmp

          Filesize

          16.0MB

        • memory/4700-173-0x0000000002750000-0x0000000003750000-memory.dmp

          Filesize

          16.0MB

        • memory/4700-140-0x0000000002750000-0x0000000003750000-memory.dmp

          Filesize

          16.0MB

        • memory/4700-163-0x0000000002750000-0x0000000003750000-memory.dmp

          Filesize

          16.0MB

        • memory/4700-172-0x0000000002750000-0x0000000003750000-memory.dmp

          Filesize

          16.0MB

        • memory/4772-151-0x00000000002B0000-0x00000000002B8000-memory.dmp

          Filesize

          32KB

        • memory/4772-154-0x0000000009AC0000-0x0000000009AE2000-memory.dmp

          Filesize

          136KB