Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
- submitted
15/11/2022, 12:23
General
- Target SHIPPING DOC.exe
- Size 863KB
- Sample221115-pkg57sdh42
- SHA256 7cc325dd19e4ceb61b666da2a847b3f4f65e945ea1b71d7616cbc8d2dbea30d4
Malware Config
Extracted
-
formbook
-
cfvc
-
qFcyI8OAPHKap6ubfQ==
-
NuOCNnr/zOqy1xM5AN4=
-
CnHfypZMLKQKgKaaVw4J1g==
-
9WpDFnsiwEyoFko7+GYiyo55
-
zUKhZPi3f21+ux+L
-
vqqeiTTPlz+cnQaD
-
GLGZh9zop+UvsCtBEm9x
-
eCUGyUEAe9hmj8KgaA==
-
EvXUn0s63zJyoxQfCGQmMZRu
-
kVy6iO/FuRGD/A==
-
+tg0M82KQk7fX4XXoYIluHMEFhbrzMk=
-
hP/nqutI9DR+0mBnYA==
-
cwrq1kLJd9QzqtQq9QCc7hHV9FjjKSvU
-
eE6vlcLHxAHZ7g==
-
vpKQL84+30y4SZpU/Ox5
-
vbfnlWZmAj1aVbCdbA==
-
UNQwEfT8tzbiL3J2Wrjm3g==
-
02LLqYRY9SeDIHwK5pFjYrg=
-
PhkLzj8IuT6R7v3lxlBYwqO69HReqnrF
-
mkYwC5lsF6cDS6RU/Ox5
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 50 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 7 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SHIPPING DOC.exe"C:\Users\Admin\AppData\Local\Temp\SHIPPING DOC.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\dcvYWn.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dcvYWn" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2962.tmp"3⤵
- Creates scheduled task(s)
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
tmp2962.tmp
memory/1664-165-0x0000000000120000-0x000000000014D000-memory.dmp
memory/1664-164-0x0000000000430000-0x000000000043C000-memory.dmp
memory/1664-170-0x0000000002050000-0x00000000020DF000-memory.dmp
memory/1664-166-0x0000000002460000-0x00000000027AA000-memory.dmp
memory/1664-172-0x0000000000120000-0x000000000014D000-memory.dmp
memory/2752-171-0x0000000002E70000-0x0000000002F54000-memory.dmp
memory/2752-173-0x0000000002E70000-0x0000000002F54000-memory.dmp
memory/2752-154-0x00000000029B0000-0x0000000002B0F000-memory.dmp
memory/4580-139-0x0000000002D30000-0x0000000002D66000-memory.dmp
memory/4580-160-0x0000000007970000-0x000000000798A000-memory.dmp
memory/4580-146-0x0000000005FD0000-0x0000000006036000-memory.dmp
memory/4580-147-0x0000000006040000-0x00000000060A6000-memory.dmp
memory/4580-141-0x0000000005930000-0x0000000005F58000-memory.dmp
memory/4580-162-0x0000000007BF0000-0x0000000007C86000-memory.dmp
memory/4580-169-0x0000000007C90000-0x0000000007C98000-memory.dmp
memory/4580-168-0x0000000007CB0000-0x0000000007CCA000-memory.dmp
memory/4580-156-0x0000000007620000-0x0000000007652000-memory.dmp
memory/4580-145-0x00000000056A0000-0x00000000056C2000-memory.dmp
memory/4580-155-0x0000000006660000-0x000000000667E000-memory.dmp
memory/4580-167-0x0000000007BA0000-0x0000000007BAE000-memory.dmp
memory/4580-157-0x0000000070DB0000-0x0000000070DFC000-memory.dmp
memory/4580-158-0x0000000006C10000-0x0000000006C2E000-memory.dmp
memory/4580-159-0x0000000007FB0000-0x000000000862A000-memory.dmp
memory/4580-161-0x00000000079E0000-0x00000000079EA000-memory.dmp
memory/4776-132-0x00000000006C0000-0x000000000079E000-memory.dmp
memory/4776-136-0x0000000008FE0000-0x000000000907C000-memory.dmp
memory/4776-135-0x0000000005170000-0x000000000517A000-memory.dmp
memory/4776-134-0x0000000005180000-0x0000000005212000-memory.dmp
memory/4776-133-0x0000000005690000-0x0000000005C34000-memory.dmp
memory/4796-153-0x0000000000AE0000-0x0000000000AF0000-memory.dmp
memory/4796-152-0x0000000000422000-0x0000000000424000-memory.dmp
memory/4796-151-0x0000000000F60000-0x00000000012AA000-memory.dmp
memory/4796-150-0x0000000000401000-0x000000000042F000-memory.dmp
memory/4796-149-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4796-148-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4796-143-0x0000000000400000-0x000000000042F000-memory.dmp