Analysis

  • max time kernel
    148s
  • max time network
    136s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    16-11-2022 20:30

General

  • Target

    jetsoff887453.exe

  • Size

    226KB

  • MD5

    1eea2dfdae7eb894956ca1c1640f68c5

  • SHA1

    d84785baefe3f1fce5bbd9cf93c03bb09d8a20e8

  • SHA256

    45b23c325946154b6990adf193926f99019ccc14f815a9768c208494197d3208

  • SHA512

    64efce3783fd512b03cff3e3c3b93bda7ddf793f199e64809a13c64b948e91deb68dddb1394e5a24353ab42012df88e4a7f0a213b29e9ae3f006bff19755572d

  • SSDEEP

    6144:MEa0NOhe6ib7DKeu/cIJyJJnJCDTRn5lAAfh:XONibPeOJnJY9Dh

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

je14

Decoy

innervisionbuildings.com

theenergysocialite.com

565548.com

panghr.com

onlyonesolutions.com

stjohnzone6.com

cnotes.rest

helfeb.online

xixi-s-inc.club

easilyentered.com

theshopx.store

mrclean-ac.com

miamibeachwateradventures.com

jpearce.co.uk

seseragi-bunkou.com

minimaddie.com

commbank-help-849c3.com

segohandelsonderneming.com

namthanhreal.com

fototerapi.online

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 4 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 27 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1360
    • C:\Users\Admin\AppData\Local\Temp\jetsoff887453.exe
      "C:\Users\Admin\AppData\Local\Temp\jetsoff887453.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:784
      • C:\Users\Admin\AppData\Local\Temp\krwcwm.exe
        "C:\Users\Admin\AppData\Local\Temp\krwcwm.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:1984
        • C:\Users\Admin\AppData\Local\Temp\krwcwm.exe
          "C:\Users\Admin\AppData\Local\Temp\krwcwm.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:900
    • C:\Windows\SysWOW64\systray.exe
      "C:\Windows\SysWOW64\systray.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:936
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\krwcwm.exe"
        3⤵
          PID:1724

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Discovery

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\cmxapzchjh.mfg
      Filesize

      185KB

      MD5

      e0393404e1db74cc34660a5a4cdf44b9

      SHA1

      88c7398ff382baee47b03705c8fe9cae33b5c66d

      SHA256

      da3381d0f783bf287a0a7e4cf558732b4f3f6b952599463eb91e05a0993b78ad

      SHA512

      bb74b2ccfaf07ca73325b324af0beb344ac2244d2d09f3e4673efc9e7becc5b219ead7870be10332f82061d2e1c5bb793660837b9f8a9aedd1c1d34724377936

    • C:\Users\Admin\AppData\Local\Temp\hwwsjbg.e
      Filesize

      5KB

      MD5

      fd5f4d91c7778d694137a815bbb14292

      SHA1

      6b3f4a6b14ccd69b3ff959376106876aaa5141df

      SHA256

      c6633251a0126effcad26a968b952b49d041105192fb212506162d95ec114722

      SHA512

      98d2ad43b1857894103702c8379dd672221d898c660bd4659cc46aaa5a8a3da321c85123464ab0cf626754973bc0b9e5f3a1941f80266bff91fe40aae9fb87d7

    • C:\Users\Admin\AppData\Local\Temp\krwcwm.exe
      Filesize

      13KB

      MD5

      89cb047bc134ce369ad1005598404480

      SHA1

      e662924b6095d90662fb01c22fc0546c72630feb

      SHA256

      ee792f2d3d5c85a9474eaf46db3f087594d427e2bd30bdfb0f6ff97d6ee734cd

      SHA512

      03648b80279202d5a6ba83244758e9be7e16b581c2eb0fc43bec886e59570d4db8cdbc942273b02c21184dd37a6b7c04636d459a3a8515b49e707c6530586f23

    • C:\Users\Admin\AppData\Local\Temp\krwcwm.exe
      Filesize

      13KB

      MD5

      89cb047bc134ce369ad1005598404480

      SHA1

      e662924b6095d90662fb01c22fc0546c72630feb

      SHA256

      ee792f2d3d5c85a9474eaf46db3f087594d427e2bd30bdfb0f6ff97d6ee734cd

      SHA512

      03648b80279202d5a6ba83244758e9be7e16b581c2eb0fc43bec886e59570d4db8cdbc942273b02c21184dd37a6b7c04636d459a3a8515b49e707c6530586f23

    • C:\Users\Admin\AppData\Local\Temp\krwcwm.exe
      Filesize

      13KB

      MD5

      89cb047bc134ce369ad1005598404480

      SHA1

      e662924b6095d90662fb01c22fc0546c72630feb

      SHA256

      ee792f2d3d5c85a9474eaf46db3f087594d427e2bd30bdfb0f6ff97d6ee734cd

      SHA512

      03648b80279202d5a6ba83244758e9be7e16b581c2eb0fc43bec886e59570d4db8cdbc942273b02c21184dd37a6b7c04636d459a3a8515b49e707c6530586f23

    • \Users\Admin\AppData\Local\Temp\krwcwm.exe
      Filesize

      13KB

      MD5

      89cb047bc134ce369ad1005598404480

      SHA1

      e662924b6095d90662fb01c22fc0546c72630feb

      SHA256

      ee792f2d3d5c85a9474eaf46db3f087594d427e2bd30bdfb0f6ff97d6ee734cd

      SHA512

      03648b80279202d5a6ba83244758e9be7e16b581c2eb0fc43bec886e59570d4db8cdbc942273b02c21184dd37a6b7c04636d459a3a8515b49e707c6530586f23

    • \Users\Admin\AppData\Local\Temp\krwcwm.exe
      Filesize

      13KB

      MD5

      89cb047bc134ce369ad1005598404480

      SHA1

      e662924b6095d90662fb01c22fc0546c72630feb

      SHA256

      ee792f2d3d5c85a9474eaf46db3f087594d427e2bd30bdfb0f6ff97d6ee734cd

      SHA512

      03648b80279202d5a6ba83244758e9be7e16b581c2eb0fc43bec886e59570d4db8cdbc942273b02c21184dd37a6b7c04636d459a3a8515b49e707c6530586f23

    • memory/784-54-0x0000000075FC1000-0x0000000075FC3000-memory.dmp
      Filesize

      8KB

    • memory/900-66-0x0000000000140000-0x0000000000154000-memory.dmp
      Filesize

      80KB

    • memory/900-69-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/900-64-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/900-65-0x0000000000AC0000-0x0000000000DC3000-memory.dmp
      Filesize

      3.0MB

    • memory/900-62-0x000000000041F120-mapping.dmp
    • memory/936-72-0x0000000001E90000-0x0000000002193000-memory.dmp
      Filesize

      3.0MB

    • memory/936-68-0x0000000000000000-mapping.dmp
    • memory/936-71-0x0000000000A80000-0x0000000000A85000-memory.dmp
      Filesize

      20KB

    • memory/936-73-0x00000000000C0000-0x00000000000EF000-memory.dmp
      Filesize

      188KB

    • memory/936-74-0x0000000000760000-0x00000000007F3000-memory.dmp
      Filesize

      588KB

    • memory/936-76-0x00000000000C0000-0x00000000000EF000-memory.dmp
      Filesize

      188KB

    • memory/1360-67-0x0000000004900000-0x00000000049FF000-memory.dmp
      Filesize

      1020KB

    • memory/1360-75-0x0000000007300000-0x0000000007489000-memory.dmp
      Filesize

      1.5MB

    • memory/1360-77-0x0000000007300000-0x0000000007489000-memory.dmp
      Filesize

      1.5MB

    • memory/1724-70-0x0000000000000000-mapping.dmp
    • memory/1984-56-0x0000000000000000-mapping.dmp