Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    12/10/2022, 13:21

General

  • Target

    Swift_049949_pdf.js

  • Size

    356KB

  • MD5

    f01befe67328d6895946ab4c8763f006

  • SHA1

    b302694c2c69da517b88eec771d8fc2c13ad5a66

  • SHA256

    4a9a8778e84343f5992bddbfdec6e7d45ca399d1f20a44bcb8eaccd05372f193

  • SHA512

    012fd72d8a70023772345213fdefb6382e4658e97bfd27cd4610312e4aa7fd113bde436f159451b77688ca876401cd05b2a207d194a3e562b265fbcdfb0a17a4

  • SSDEEP

    6144:BWCdn1qRUAtmWXwXXJ528/RpFH81oTrmYW1XEMnGWrUvfhZN8gkU9uQyp:BbqZmWXsXzLH981omYHMGWuZZOrU+p

Malware Config

Extracted

Family

formbook

Campaign

xrob

Decoy

dV8FCtdWdnfMJ9thh8l/

IJG6Bh4iMeHVBHNp2MrpTA==

NhPKKtmQxnHYF/80

f4M2RhGEf3Ot13+qLrKqxb9f3dXj9Q==

A/689/MibSRBgkPkx07m+H+g

e8OOkUu9y/uYCMsdrR3s0mODmGw3d8t9Og==

gLN5bn+Zq1VQXmOOvw==

NFcQGvViY5sxmkty83Fde4GQhg==

XWMfFSM3f7GT9w==

Ih6vvqf9R8gDObM=

FGAlLASHlpLaUUKUJIwm9ABQ2Js=

v8R615LDC8iWchwv

m+u3rLUxScgDObM=

jc3eahERf7GT9w==

TYNBVDadkpTF76HeNl/rbwWtLSbyPzM=

j6NQmhWeOi2B

aqJocUfM3v97ryScY6EiSMbVyBak

V7nYOyEZKa2J/KKh5RMhJrbyK/eC/Q==

8zPsAt3ejcgDObM=

Rpe+BrGBzpGa9q8FHKpi

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

  • Blocklisted process makes network request 5 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 27 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1344
    • C:\Windows\system32\wscript.exe
      wscript.exe C:\Users\Admin\AppData\Local\Temp\Swift_049949_pdf.js
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1444
      • C:\Windows\System32\wscript.exe
        "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\WvtFvwPcPZ.js"
        3⤵
        • Blocklisted process makes network request
        • Drops startup file
        PID:460
      • C:\Users\Admin\AppData\Local\Temp\bin.exe
        "C:\Users\Admin\AppData\Local\Temp\bin.exe"
        3⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:584
    • C:\Windows\SysWOW64\NAPSTAT.EXE
      "C:\Windows\SysWOW64\NAPSTAT.EXE"
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:996
      • C:\Program Files\Mozilla Firefox\Firefox.exe
        "C:\Program Files\Mozilla Firefox\Firefox.exe"
        3⤵
          PID:972

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\bin.exe

      Filesize

      185KB

      MD5

      26db0806c0871f293a77e5d5676e2fd8

      SHA1

      7c17ccce454d81bb999c04d45e9e4913969a73ee

      SHA256

      2c623f8e02e0aef43501e320fd20a3b407dcf35676e6620574bf7e8ce4844e66

      SHA512

      0dac19dab4827a036a4e42371807639a4c378b440c3edc9ae30171cfb62a894243dc55ad5145434fac384aa37dd32381d148757e35c08300bbfe45c4cb85c09f

    • C:\Users\Admin\AppData\Local\Temp\bin.exe

      Filesize

      185KB

      MD5

      26db0806c0871f293a77e5d5676e2fd8

      SHA1

      7c17ccce454d81bb999c04d45e9e4913969a73ee

      SHA256

      2c623f8e02e0aef43501e320fd20a3b407dcf35676e6620574bf7e8ce4844e66

      SHA512

      0dac19dab4827a036a4e42371807639a4c378b440c3edc9ae30171cfb62a894243dc55ad5145434fac384aa37dd32381d148757e35c08300bbfe45c4cb85c09f

    • C:\Users\Admin\AppData\Roaming\WvtFvwPcPZ.js

      Filesize

      10KB

      MD5

      3589411aa8a0eb5b2130b6f012c5e15e

      SHA1

      17f11b37cea60cbad8a275b67cbdf4c87fc8f4b9

      SHA256

      0a9e55b1f39f811950237ab0022fd1540a3d6ce359d1d6305b73d8995b59243b

      SHA512

      a7a40aee84ef42b35b1f1a8e0e3a7441a8a6779eb1f2e02eb5c43cdae9f168b8829b783f08f8c5be0ebb091437e532cc52bf64dd16b6e67d6e6acb9f7c959395

    • \Users\Admin\AppData\Local\Temp\sqlite3.dll

      Filesize

      849KB

      MD5

      87f9e5a6318ac1ec5ee05aa94a919d7a

      SHA1

      7a9956e8de89603dba99772da29493d3fd0fe37d

      SHA256

      7705b87603e0d772e1753441001fcf1ac2643ee41bf14a8177de2c056628665c

      SHA512

      c45c03176142918e34f746711e83384572bd6a8ed0a005600aa4a18cf22eade06c76eda190b37db49ec1971c4649e086affd19eee108c5f405df27c0c8cb23d2

    • memory/584-60-0x0000000001160000-0x000000000118F000-memory.dmp

      Filesize

      188KB

    • memory/584-61-0x00000000008A0000-0x0000000000BA3000-memory.dmp

      Filesize

      3.0MB

    • memory/584-62-0x0000000000070000-0x0000000000080000-memory.dmp

      Filesize

      64KB

    • memory/996-65-0x00000000008B0000-0x00000000008F6000-memory.dmp

      Filesize

      280KB

    • memory/996-66-0x0000000000080000-0x00000000000AD000-memory.dmp

      Filesize

      180KB

    • memory/996-68-0x0000000001FD0000-0x00000000022D3000-memory.dmp

      Filesize

      3.0MB

    • memory/996-69-0x0000000001D90000-0x0000000001E1F000-memory.dmp

      Filesize

      572KB

    • memory/996-71-0x0000000000080000-0x00000000000AD000-memory.dmp

      Filesize

      180KB

    • memory/996-72-0x0000000075D71000-0x0000000075D73000-memory.dmp

      Filesize

      8KB

    • memory/1344-70-0x00000000071F0000-0x0000000007353000-memory.dmp

      Filesize

      1.4MB

    • memory/1344-63-0x0000000004BE0000-0x0000000004CA1000-memory.dmp

      Filesize

      772KB

    • memory/1344-74-0x00000000071F0000-0x0000000007353000-memory.dmp

      Filesize

      1.4MB

    • memory/1444-54-0x000007FEFBEE1000-0x000007FEFBEE3000-memory.dmp

      Filesize

      8KB