Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/10/2022, 13:21

General

  • Target

    Swift_049949_pdf.js

  • Size

    356KB

  • MD5

    f01befe67328d6895946ab4c8763f006

  • SHA1

    b302694c2c69da517b88eec771d8fc2c13ad5a66

  • SHA256

    4a9a8778e84343f5992bddbfdec6e7d45ca399d1f20a44bcb8eaccd05372f193

  • SHA512

    012fd72d8a70023772345213fdefb6382e4658e97bfd27cd4610312e4aa7fd113bde436f159451b77688ca876401cd05b2a207d194a3e562b265fbcdfb0a17a4

  • SSDEEP

    6144:BWCdn1qRUAtmWXwXXJ528/RpFH81oTrmYW1XEMnGWrUvfhZN8gkU9uQyp:BbqZmWXsXzLH981omYHMGWuZZOrU+p

Malware Config

Extracted

Family

formbook

Campaign

xrob

Decoy

dV8FCtdWdnfMJ9thh8l/

IJG6Bh4iMeHVBHNp2MrpTA==

NhPKKtmQxnHYF/80

f4M2RhGEf3Ot13+qLrKqxb9f3dXj9Q==

A/689/MibSRBgkPkx07m+H+g

e8OOkUu9y/uYCMsdrR3s0mODmGw3d8t9Og==

gLN5bn+Zq1VQXmOOvw==

NFcQGvViY5sxmkty83Fde4GQhg==

XWMfFSM3f7GT9w==

Ih6vvqf9R8gDObM=

FGAlLASHlpLaUUKUJIwm9ABQ2Js=

v8R615LDC8iWchwv

m+u3rLUxScgDObM=

jc3eahERf7GT9w==

TYNBVDadkpTF76HeNl/rbwWtLSbyPzM=

j6NQmhWeOi2B

aqJocUfM3v97ryScY6EiSMbVyBak

V7nYOyEZKa2J/KKh5RMhJrbyK/eC/Q==

8zPsAt3ejcgDObM=

Rpe+BrGBzpGa9q8FHKpi

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

  • Blocklisted process makes network request 6 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:3092
    • C:\Windows\system32\wscript.exe
      wscript.exe C:\Users\Admin\AppData\Local\Temp\Swift_049949_pdf.js
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:676
      • C:\Windows\System32\wscript.exe
        "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\WvtFvwPcPZ.js"
        3⤵
        • Blocklisted process makes network request
        • Drops startup file
        PID:2256
      • C:\Users\Admin\AppData\Local\Temp\bin.exe
        "C:\Users\Admin\AppData\Local\Temp\bin.exe"
        3⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:856
    • C:\Windows\SysWOW64\wlanext.exe
      "C:\Windows\SysWOW64\wlanext.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1288
      • C:\Program Files\Mozilla Firefox\Firefox.exe
        "C:\Program Files\Mozilla Firefox\Firefox.exe"
        3⤵
          PID:2188

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\bin.exe

      Filesize

      185KB

      MD5

      26db0806c0871f293a77e5d5676e2fd8

      SHA1

      7c17ccce454d81bb999c04d45e9e4913969a73ee

      SHA256

      2c623f8e02e0aef43501e320fd20a3b407dcf35676e6620574bf7e8ce4844e66

      SHA512

      0dac19dab4827a036a4e42371807639a4c378b440c3edc9ae30171cfb62a894243dc55ad5145434fac384aa37dd32381d148757e35c08300bbfe45c4cb85c09f

    • C:\Users\Admin\AppData\Local\Temp\bin.exe

      Filesize

      185KB

      MD5

      26db0806c0871f293a77e5d5676e2fd8

      SHA1

      7c17ccce454d81bb999c04d45e9e4913969a73ee

      SHA256

      2c623f8e02e0aef43501e320fd20a3b407dcf35676e6620574bf7e8ce4844e66

      SHA512

      0dac19dab4827a036a4e42371807639a4c378b440c3edc9ae30171cfb62a894243dc55ad5145434fac384aa37dd32381d148757e35c08300bbfe45c4cb85c09f

    • C:\Users\Admin\AppData\Roaming\WvtFvwPcPZ.js

      Filesize

      10KB

      MD5

      3589411aa8a0eb5b2130b6f012c5e15e

      SHA1

      17f11b37cea60cbad8a275b67cbdf4c87fc8f4b9

      SHA256

      0a9e55b1f39f811950237ab0022fd1540a3d6ce359d1d6305b73d8995b59243b

      SHA512

      a7a40aee84ef42b35b1f1a8e0e3a7441a8a6779eb1f2e02eb5c43cdae9f168b8829b783f08f8c5be0ebb091437e532cc52bf64dd16b6e67d6e6acb9f7c959395

    • memory/856-139-0x0000000000BD0000-0x0000000000BE0000-memory.dmp

      Filesize

      64KB

    • memory/856-137-0x00000000006B0000-0x00000000006DF000-memory.dmp

      Filesize

      188KB

    • memory/856-138-0x00000000014B0000-0x00000000017FA000-memory.dmp

      Filesize

      3.3MB

    • memory/1288-144-0x0000000001130000-0x000000000147A000-memory.dmp

      Filesize

      3.3MB

    • memory/1288-142-0x0000000000250000-0x0000000000267000-memory.dmp

      Filesize

      92KB

    • memory/1288-143-0x0000000000730000-0x000000000075D000-memory.dmp

      Filesize

      180KB

    • memory/1288-145-0x0000000000E60000-0x0000000000EEF000-memory.dmp

      Filesize

      572KB

    • memory/1288-147-0x0000000000730000-0x000000000075D000-memory.dmp

      Filesize

      180KB

    • memory/3092-140-0x0000000008260000-0x000000000836C000-memory.dmp

      Filesize

      1.0MB

    • memory/3092-146-0x0000000008370000-0x00000000084FE000-memory.dmp

      Filesize

      1.6MB

    • memory/3092-148-0x0000000008370000-0x00000000084FE000-memory.dmp

      Filesize

      1.6MB