Analysis

  • max time kernel
    158s
  • max time network
    187s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    23-11-2022 14:40

General

  • Target

    jetss46635.exe

  • Size

    261KB

  • MD5

    62cc148705cfa7c981bdb823de72bb93

  • SHA1

    1b47fd2f7535f55d44abaea0ce85d685841c6ef4

  • SHA256

    f79c3a8f98d47aab53d03bce09d51bc17c25b9cb051a69f040b0ada6fc6abb88

  • SHA512

    0c86c17dcbd338db984b3765e489510e90b71cae33746da75c2310c4722f35e878d01e94834d444e3a28e3012a2631dacfed55e69561edba44212711622475c3

  • SSDEEP

    6144:MEa0NXK2m0R1Ic0wsf08mIm2+vARvuR5UKMUgfkmoLv24T:XXXRL0Pf0TIm2+IliGcLvV

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

je14

Decoy

innervisionbuildings.com

theenergysocialite.com

565548.com

panghr.com

onlyonesolutions.com

stjohnzone6.com

cnotes.rest

helfeb.online

xixi-s-inc.club

easilyentered.com

theshopx.store

mrclean-ac.com

miamibeachwateradventures.com

jpearce.co.uk

seseragi-bunkou.com

minimaddie.com

commbank-help-849c3.com

segohandelsonderneming.com

namthanhreal.com

fototerapi.online

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 4 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1288
    • C:\Users\Admin\AppData\Local\Temp\jetss46635.exe
      "C:\Users\Admin\AppData\Local\Temp\jetss46635.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:868
      • C:\Users\Admin\AppData\Local\Temp\pnowxpr.exe
        "C:\Users\Admin\AppData\Local\Temp\pnowxpr.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:1656
        • C:\Users\Admin\AppData\Local\Temp\pnowxpr.exe
          "C:\Users\Admin\AppData\Local\Temp\pnowxpr.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:676
    • C:\Windows\SysWOW64\cmstp.exe
      "C:\Windows\SysWOW64\cmstp.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:584
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\pnowxpr.exe"
        3⤵
          PID:1296

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Discovery

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\aewdt.d
      Filesize

      5KB

      MD5

      dd27f576cb0ceb724998aa7f63897fbc

      SHA1

      be3e2c774e6b75520fb413cefa01e4bde2dde92d

      SHA256

      8a42cacf9193740b218a9855c72cf3a3c12daee3410958ef934d09ee3b49df7a

      SHA512

      8035fedd42beca60c010fa69eaec2ae1c6691f1a1fa90cd07fbdfb05ebc7ce648e80c1cff11e6dd1c006f971d782054974718eabac3369584005d1fe84292006

    • C:\Users\Admin\AppData\Local\Temp\pnowxpr.exe
      Filesize

      73KB

      MD5

      c3d1520595c08a392fe0df9a14a9e611

      SHA1

      b0f8176f6b68a572b5b4f9212ab51597afb17cfd

      SHA256

      400c153d2ce5ec6408769a9b12b87a1f138d0fe69166d080913d865d605608ab

      SHA512

      5d473a9a473ea61c67b1d9b1e00509168ff2b7245df8679323ffd6f9032e726e5963afbc523da663ed5d39c8d49e841211a0c49534c70afbb589023f34ac10dd

    • C:\Users\Admin\AppData\Local\Temp\pnowxpr.exe
      Filesize

      73KB

      MD5

      c3d1520595c08a392fe0df9a14a9e611

      SHA1

      b0f8176f6b68a572b5b4f9212ab51597afb17cfd

      SHA256

      400c153d2ce5ec6408769a9b12b87a1f138d0fe69166d080913d865d605608ab

      SHA512

      5d473a9a473ea61c67b1d9b1e00509168ff2b7245df8679323ffd6f9032e726e5963afbc523da663ed5d39c8d49e841211a0c49534c70afbb589023f34ac10dd

    • C:\Users\Admin\AppData\Local\Temp\pnowxpr.exe
      Filesize

      73KB

      MD5

      c3d1520595c08a392fe0df9a14a9e611

      SHA1

      b0f8176f6b68a572b5b4f9212ab51597afb17cfd

      SHA256

      400c153d2ce5ec6408769a9b12b87a1f138d0fe69166d080913d865d605608ab

      SHA512

      5d473a9a473ea61c67b1d9b1e00509168ff2b7245df8679323ffd6f9032e726e5963afbc523da663ed5d39c8d49e841211a0c49534c70afbb589023f34ac10dd

    • C:\Users\Admin\AppData\Local\Temp\zxykqdfeho.kl
      Filesize

      185KB

      MD5

      ad084fb23e4d42b35a182e01abcbc654

      SHA1

      e06b7ec6a5cc037a6aec7c22351fb1752c6e5477

      SHA256

      3350c35339de981bf8eae8bd39e0ea907976042b342bd76cbef5e8f6eb74af21

      SHA512

      de3600c48a73c28bfdb581fc30e2d3e35ab321fba5067ffceb7f1c60f48e790a3958ba228e2d61942e50acd7c93f4a5b4c815c02881753c7b7a9a5e0d4b92ee8

    • \Users\Admin\AppData\Local\Temp\pnowxpr.exe
      Filesize

      73KB

      MD5

      c3d1520595c08a392fe0df9a14a9e611

      SHA1

      b0f8176f6b68a572b5b4f9212ab51597afb17cfd

      SHA256

      400c153d2ce5ec6408769a9b12b87a1f138d0fe69166d080913d865d605608ab

      SHA512

      5d473a9a473ea61c67b1d9b1e00509168ff2b7245df8679323ffd6f9032e726e5963afbc523da663ed5d39c8d49e841211a0c49534c70afbb589023f34ac10dd

    • \Users\Admin\AppData\Local\Temp\pnowxpr.exe
      Filesize

      73KB

      MD5

      c3d1520595c08a392fe0df9a14a9e611

      SHA1

      b0f8176f6b68a572b5b4f9212ab51597afb17cfd

      SHA256

      400c153d2ce5ec6408769a9b12b87a1f138d0fe69166d080913d865d605608ab

      SHA512

      5d473a9a473ea61c67b1d9b1e00509168ff2b7245df8679323ffd6f9032e726e5963afbc523da663ed5d39c8d49e841211a0c49534c70afbb589023f34ac10dd

    • memory/584-80-0x0000000000090000-0x00000000000BF000-memory.dmp
      Filesize

      188KB

    • memory/584-70-0x0000000000000000-mapping.dmp
    • memory/584-77-0x0000000000410000-0x00000000004A3000-memory.dmp
      Filesize

      588KB

    • memory/584-76-0x0000000002160000-0x0000000002463000-memory.dmp
      Filesize

      3.0MB

    • memory/584-74-0x0000000000BB0000-0x0000000000BC8000-memory.dmp
      Filesize

      96KB

    • memory/584-75-0x0000000000090000-0x00000000000BF000-memory.dmp
      Filesize

      188KB

    • memory/676-66-0x0000000000280000-0x0000000000294000-memory.dmp
      Filesize

      80KB

    • memory/676-65-0x00000000009E0000-0x0000000000CE3000-memory.dmp
      Filesize

      3.0MB

    • memory/676-62-0x000000000041F120-mapping.dmp
    • memory/676-64-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/676-71-0x0000000000400000-0x000000000042F000-memory.dmp
      Filesize

      188KB

    • memory/676-68-0x00000000002F0000-0x0000000000304000-memory.dmp
      Filesize

      80KB

    • memory/868-54-0x00000000753D1000-0x00000000753D3000-memory.dmp
      Filesize

      8KB

    • memory/1288-67-0x00000000065C0000-0x00000000066B5000-memory.dmp
      Filesize

      980KB

    • memory/1288-69-0x00000000068B0000-0x000000000699D000-memory.dmp
      Filesize

      948KB

    • memory/1288-78-0x00000000049E0000-0x0000000004A89000-memory.dmp
      Filesize

      676KB

    • memory/1288-79-0x00000000068B0000-0x000000000699D000-memory.dmp
      Filesize

      948KB

    • memory/1288-81-0x00000000049E0000-0x0000000004A89000-memory.dmp
      Filesize

      676KB

    • memory/1296-73-0x0000000000000000-mapping.dmp
    • memory/1656-56-0x0000000000000000-mapping.dmp