Analysis

  • max time kernel
    146s
  • max time network
    134s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    15-11-2022 21:36

General

  • Target

    jetsoff887453.exe

  • Size

    226KB

  • MD5

    1eea2dfdae7eb894956ca1c1640f68c5

  • SHA1

    d84785baefe3f1fce5bbd9cf93c03bb09d8a20e8

  • SHA256

    45b23c325946154b6990adf193926f99019ccc14f815a9768c208494197d3208

  • SHA512

    64efce3783fd512b03cff3e3c3b93bda7ddf793f199e64809a13c64b948e91deb68dddb1394e5a24353ab42012df88e4a7f0a213b29e9ae3f006bff19755572d

  • SSDEEP

    6144:MEa0NOhe6ib7DKeu/cIJyJJnJCDTRn5lAAfh:XONibPeOJnJY9Dh

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

je14

Decoy

innervisionbuildings.com

theenergysocialite.com

565548.com

panghr.com

onlyonesolutions.com

stjohnzone6.com

cnotes.rest

helfeb.online

xixi-s-inc.club

easilyentered.com

theshopx.store

mrclean-ac.com

miamibeachwateradventures.com

jpearce.co.uk

seseragi-bunkou.com

minimaddie.com

commbank-help-849c3.com

segohandelsonderneming.com

namthanhreal.com

fototerapi.online

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 3 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 27 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1268
    • C:\Users\Admin\AppData\Local\Temp\jetsoff887453.exe
      "C:\Users\Admin\AppData\Local\Temp\jetsoff887453.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1044
      • C:\Users\Admin\AppData\Local\Temp\krwcwm.exe
        "C:\Users\Admin\AppData\Local\Temp\krwcwm.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:684
        • C:\Users\Admin\AppData\Local\Temp\krwcwm.exe
          "C:\Users\Admin\AppData\Local\Temp\krwcwm.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:1348
    • C:\Windows\SysWOW64\autoconv.exe
      "C:\Windows\SysWOW64\autoconv.exe"
      2⤵
        PID:1108
      • C:\Windows\SysWOW64\msiexec.exe
        "C:\Windows\SysWOW64\msiexec.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:952
        • C:\Windows\SysWOW64\cmd.exe
          /c del "C:\Users\Admin\AppData\Local\Temp\krwcwm.exe"
          3⤵
            PID:1240

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Discovery

      System Information Discovery

      1
      T1082

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\cmxapzchjh.mfg
        Filesize

        185KB

        MD5

        e0393404e1db74cc34660a5a4cdf44b9

        SHA1

        88c7398ff382baee47b03705c8fe9cae33b5c66d

        SHA256

        da3381d0f783bf287a0a7e4cf558732b4f3f6b952599463eb91e05a0993b78ad

        SHA512

        bb74b2ccfaf07ca73325b324af0beb344ac2244d2d09f3e4673efc9e7becc5b219ead7870be10332f82061d2e1c5bb793660837b9f8a9aedd1c1d34724377936

      • C:\Users\Admin\AppData\Local\Temp\hwwsjbg.e
        Filesize

        5KB

        MD5

        fd5f4d91c7778d694137a815bbb14292

        SHA1

        6b3f4a6b14ccd69b3ff959376106876aaa5141df

        SHA256

        c6633251a0126effcad26a968b952b49d041105192fb212506162d95ec114722

        SHA512

        98d2ad43b1857894103702c8379dd672221d898c660bd4659cc46aaa5a8a3da321c85123464ab0cf626754973bc0b9e5f3a1941f80266bff91fe40aae9fb87d7

      • C:\Users\Admin\AppData\Local\Temp\krwcwm.exe
        Filesize

        13KB

        MD5

        89cb047bc134ce369ad1005598404480

        SHA1

        e662924b6095d90662fb01c22fc0546c72630feb

        SHA256

        ee792f2d3d5c85a9474eaf46db3f087594d427e2bd30bdfb0f6ff97d6ee734cd

        SHA512

        03648b80279202d5a6ba83244758e9be7e16b581c2eb0fc43bec886e59570d4db8cdbc942273b02c21184dd37a6b7c04636d459a3a8515b49e707c6530586f23

      • C:\Users\Admin\AppData\Local\Temp\krwcwm.exe
        Filesize

        13KB

        MD5

        89cb047bc134ce369ad1005598404480

        SHA1

        e662924b6095d90662fb01c22fc0546c72630feb

        SHA256

        ee792f2d3d5c85a9474eaf46db3f087594d427e2bd30bdfb0f6ff97d6ee734cd

        SHA512

        03648b80279202d5a6ba83244758e9be7e16b581c2eb0fc43bec886e59570d4db8cdbc942273b02c21184dd37a6b7c04636d459a3a8515b49e707c6530586f23

      • C:\Users\Admin\AppData\Local\Temp\krwcwm.exe
        Filesize

        13KB

        MD5

        89cb047bc134ce369ad1005598404480

        SHA1

        e662924b6095d90662fb01c22fc0546c72630feb

        SHA256

        ee792f2d3d5c85a9474eaf46db3f087594d427e2bd30bdfb0f6ff97d6ee734cd

        SHA512

        03648b80279202d5a6ba83244758e9be7e16b581c2eb0fc43bec886e59570d4db8cdbc942273b02c21184dd37a6b7c04636d459a3a8515b49e707c6530586f23

      • \Users\Admin\AppData\Local\Temp\krwcwm.exe
        Filesize

        13KB

        MD5

        89cb047bc134ce369ad1005598404480

        SHA1

        e662924b6095d90662fb01c22fc0546c72630feb

        SHA256

        ee792f2d3d5c85a9474eaf46db3f087594d427e2bd30bdfb0f6ff97d6ee734cd

        SHA512

        03648b80279202d5a6ba83244758e9be7e16b581c2eb0fc43bec886e59570d4db8cdbc942273b02c21184dd37a6b7c04636d459a3a8515b49e707c6530586f23

      • \Users\Admin\AppData\Local\Temp\krwcwm.exe
        Filesize

        13KB

        MD5

        89cb047bc134ce369ad1005598404480

        SHA1

        e662924b6095d90662fb01c22fc0546c72630feb

        SHA256

        ee792f2d3d5c85a9474eaf46db3f087594d427e2bd30bdfb0f6ff97d6ee734cd

        SHA512

        03648b80279202d5a6ba83244758e9be7e16b581c2eb0fc43bec886e59570d4db8cdbc942273b02c21184dd37a6b7c04636d459a3a8515b49e707c6530586f23

      • memory/684-56-0x0000000000000000-mapping.dmp
      • memory/952-76-0x0000000000090000-0x00000000000BF000-memory.dmp
        Filesize

        188KB

      • memory/952-74-0x0000000000580000-0x0000000000613000-memory.dmp
        Filesize

        588KB

      • memory/952-73-0x0000000002390000-0x0000000002693000-memory.dmp
        Filesize

        3.0MB

      • memory/952-72-0x0000000000090000-0x00000000000BF000-memory.dmp
        Filesize

        188KB

      • memory/952-71-0x0000000000CA0000-0x0000000000CB4000-memory.dmp
        Filesize

        80KB

      • memory/952-68-0x0000000000000000-mapping.dmp
      • memory/1044-54-0x0000000075071000-0x0000000075073000-memory.dmp
        Filesize

        8KB

      • memory/1240-70-0x0000000000000000-mapping.dmp
      • memory/1268-67-0x0000000004FB0000-0x00000000050A6000-memory.dmp
        Filesize

        984KB

      • memory/1268-75-0x0000000006460000-0x0000000006548000-memory.dmp
        Filesize

        928KB

      • memory/1268-77-0x0000000006460000-0x0000000006548000-memory.dmp
        Filesize

        928KB

      • memory/1348-66-0x00000000001D0000-0x00000000001E4000-memory.dmp
        Filesize

        80KB

      • memory/1348-65-0x0000000000800000-0x0000000000B03000-memory.dmp
        Filesize

        3.0MB

      • memory/1348-64-0x0000000000400000-0x000000000042F000-memory.dmp
        Filesize

        188KB

      • memory/1348-62-0x000000000041F120-mapping.dmp