Analysis
-
max time kernel
153s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 19:17
Static task
static1
Behavioral task
behavioral1
Sample
formbook1.exe
Resource
win7-20221111-en
General
-
Target
formbook1.exe
-
Size
433KB
-
MD5
9672b2beca3027b6f008dfc291d21777
-
SHA1
9dfa2b2cc3d1f04fd715068e9eee238d6b1ca5a7
-
SHA256
ba10a45e13a79398a5802c91636684e54e53f26409feed99e7c89bbbe0c720d3
-
SHA512
6396c39d4b9da16e541bb29659737d9841c5841c808c58a7d88accb35715d673820d63679ea0e0ff7642cd952158e11029b5fd689b0588cff8987816df3ccb2e
-
SSDEEP
6144:6bE/HUrUAGxkcrTRkHqqZMWq1cD8YGMOsPEF75noWa4zbzDp/TkLNlkDfkDSDr0x:6bkxJkKqx4rB75HpALLkD0SMx
Malware Config
Extracted
formbook
nrln
IG7zJSm49UqTTuu/N/oTCIg=
CVLdAPgw0CRSMuZnRRU=
PiA5Z3umP2NyX81VGQhjWyS59nFYhXiG
5i6p4GeQqtBgNRfGNQ==
5984keYswxh8mGZHz4ipAHtQ
VNJaK4Gh0CrOvHpW/p353A==
71rEtrL2icToyKGhcWrTxjsFU5T98zeO
r3q1sy1iZaL+2XIUAob7yw==
9+83Qkrk/vV/jVXsDvoTCIg=
aMFAgYF1prov8/UErH/Y1A==
Alqtx/0rxwEbCLdudftl
ImCbnglBSUHF0mv2tTSP40bPeYao
s4DFNvAJ4GIJ+g==
phOa6mtS8QQICuZnRRU=
7TSu5vqRtB45EZtf4WDSTBHPeYao
ImPWqwUUIVWMQLyMbUab7tmspvNCcT8=
HF7jKjbGox2SAffTPw==
yAM3mOQot5l+cD0ikR5MGp8=
UYzW0/8z70JcQenVLidu1kLPeYao
OoCznp5UWz+hT9OBFXbfVhXPeYao
RZAWUeouUqpRAffTPw==
qQZsaG6uSqBRXS0J4PoTCIg=
idE3YO0X4GIJ+g==
NZQvYOWIBkHd4Z7AmQwAslxY
1KTdRR1OPJb88A==
8iap4OQKp/C3gQludftl
9Tyi5kaIC/Dk7JRTK/5lx1LLzRi53w==
3Lbm4soAuhRHLuZnRRU=
F4rw7+2RqgQp3urIPPoTCIg=
WcAxntfwcZZxHdfbgtoL1FbLzRi53w==
Cb4Mn+LGQzI=
v6zC+zJc9ggtoRfSUKT5VgjPeYao
8SNotqm7G3gx
zkfYBpVE7kZy6Z1eRBc=
fGC3taUlU5/grJFa/p353A==
guxOQaxAp/H3/7hudftl
1ySVyYygrPSWgzsz5voTCIg=
kgzOYyfN4GIJ+g==
uI3MyBlFYb9zLp9O/p353A==
LiJEdPqeLRv/dUMZph0=
P44MT+MPGVCfAffTPw==
92zQztuUoOD397dudftl
KAIeV2q7G3gx
16rd9Lv/EDB9NuZnRRU=
Zq8rUUtzFDYhDLdudftl
0TzN9nwSt9Ld5oQMz8oX7KcwExI=
8C4/Zed9GAoGCuZnRRU=
0R6HvJ+vT2pZMuZnRRU=
PXCroG2LPYhB92PmoRh6SNSmrvNCcT8=
jcoShE+OVbsoB4Vm
XKDr2FEDkRYoA6F7B3bfVhXPeYao
lxlqoFqiNTE=
gth+8scYHF4q9oJM/p353A==
kV6UlVdWZM+9b/WfNw==
mMkJeLvrdq91ULk=
Nxw5ckJtib7+oGdQ/p353A==
K4vu5D5UecNAxJtKPxM=
abYdRE3u8iYkqH9x
KnPrFJC5zSp1V9mCQbIDbiMamCw7zg==
DXEGJOvxscsrAcaZBs0qfqcwExI=
JxA3dYsfQKRsEMqqNrMQekNL0+MJaAkWNg==
Q4dtrcgmnb1BThr40YjqkyMQ3A==
7l7NPgxGZMGfhgludftl
MYT9Mshe6ejKfvG1lYXezH0WmCo61w==
sincewordsmatter.com
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
nbeggsncal.exepid process 3604 nbeggsncal.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
nbeggsncal.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation nbeggsncal.exe -
Loads dropped DLL 1 IoCs
Processes:
nbeggsncal.exepid process 4216 nbeggsncal.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
nbeggsncal.exenbeggsncal.exehelp.exedescription pid process target process PID 3604 set thread context of 4216 3604 nbeggsncal.exe nbeggsncal.exe PID 4216 set thread context of 2832 4216 nbeggsncal.exe Explorer.EXE PID 1520 set thread context of 2832 1520 help.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4824 3604 WerFault.exe nbeggsncal.exe -
Processes:
help.exedescription ioc process Key created \Registry\User\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 help.exe -
Suspicious behavior: EnumeratesProcesses 48 IoCs
Processes:
nbeggsncal.exehelp.exepid process 4216 nbeggsncal.exe 4216 nbeggsncal.exe 4216 nbeggsncal.exe 4216 nbeggsncal.exe 4216 nbeggsncal.exe 4216 nbeggsncal.exe 4216 nbeggsncal.exe 4216 nbeggsncal.exe 1520 help.exe 1520 help.exe 1520 help.exe 1520 help.exe 1520 help.exe 1520 help.exe 1520 help.exe 1520 help.exe 1520 help.exe 1520 help.exe 1520 help.exe 1520 help.exe 1520 help.exe 1520 help.exe 1520 help.exe 1520 help.exe 1520 help.exe 1520 help.exe 1520 help.exe 1520 help.exe 1520 help.exe 1520 help.exe 1520 help.exe 1520 help.exe 1520 help.exe 1520 help.exe 1520 help.exe 1520 help.exe 1520 help.exe 1520 help.exe 1520 help.exe 1520 help.exe 1520 help.exe 1520 help.exe 1520 help.exe 1520 help.exe 1520 help.exe 1520 help.exe 1520 help.exe 1520 help.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2832 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
nbeggsncal.exehelp.exepid process 4216 nbeggsncal.exe 4216 nbeggsncal.exe 4216 nbeggsncal.exe 1520 help.exe 1520 help.exe 1520 help.exe 1520 help.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
nbeggsncal.exeExplorer.EXEhelp.exedescription pid process Token: SeDebugPrivilege 4216 nbeggsncal.exe Token: SeShutdownPrivilege 2832 Explorer.EXE Token: SeCreatePagefilePrivilege 2832 Explorer.EXE Token: SeShutdownPrivilege 2832 Explorer.EXE Token: SeCreatePagefilePrivilege 2832 Explorer.EXE Token: SeShutdownPrivilege 2832 Explorer.EXE Token: SeCreatePagefilePrivilege 2832 Explorer.EXE Token: SeDebugPrivilege 1520 help.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
formbook1.exenbeggsncal.exeExplorer.EXEhelp.exedescription pid process target process PID 4648 wrote to memory of 3604 4648 formbook1.exe nbeggsncal.exe PID 4648 wrote to memory of 3604 4648 formbook1.exe nbeggsncal.exe PID 4648 wrote to memory of 3604 4648 formbook1.exe nbeggsncal.exe PID 3604 wrote to memory of 4216 3604 nbeggsncal.exe nbeggsncal.exe PID 3604 wrote to memory of 4216 3604 nbeggsncal.exe nbeggsncal.exe PID 3604 wrote to memory of 4216 3604 nbeggsncal.exe nbeggsncal.exe PID 3604 wrote to memory of 4216 3604 nbeggsncal.exe nbeggsncal.exe PID 2832 wrote to memory of 1520 2832 Explorer.EXE help.exe PID 2832 wrote to memory of 1520 2832 Explorer.EXE help.exe PID 2832 wrote to memory of 1520 2832 Explorer.EXE help.exe PID 1520 wrote to memory of 4760 1520 help.exe Firefox.exe PID 1520 wrote to memory of 4760 1520 help.exe Firefox.exe PID 1520 wrote to memory of 4760 1520 help.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\formbook1.exe"C:\Users\Admin\AppData\Local\Temp\formbook1.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\nbeggsncal.exe"C:\Users\Admin\AppData\Local\Temp\nbeggsncal.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\nbeggsncal.exe"C:\Users\Admin\AppData\Local\Temp\nbeggsncal.exe"4⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3604 -s 5204⤵
- Program crash
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3604 -ip 36041⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\cimrcc.gFilesize
185KB
MD5874dc59d7571e9ffa32c16740763a222
SHA1cf2e6e6c8e7e3a2f4e1a348a289983a730b676fc
SHA256da67c1628cfe982e5aa0995fd4c4f92a434e2e8a577941d7d9d0d8d1373a9183
SHA512d4a8d8c5107cd029fd638f49efabee51d4a4167de260b998497f715fc80f205c03458bbf433c326b46b0fd647ba383df557015428b62457207bb335ce75cb41e
-
C:\Users\Admin\AppData\Local\Temp\nbeggsncal.exeFilesize
131KB
MD5669c2269eea6c11fd71038f0918193fb
SHA1b2da793470b99bd215fbd9b3c7396ac402b068e9
SHA256ba605ae9b548c05ffa985ddad9217cbdd99c1aecc83ce6e7cf36a162cb69938e
SHA5120759ebe446901ab0974ff7cdac1b5517a7a739890a20858da93aaec94bd06bc4e6cb697b706864d78df044c41211990185b4bd9c00a24c616ce6004f371bc91c
-
C:\Users\Admin\AppData\Local\Temp\nbeggsncal.exeFilesize
131KB
MD5669c2269eea6c11fd71038f0918193fb
SHA1b2da793470b99bd215fbd9b3c7396ac402b068e9
SHA256ba605ae9b548c05ffa985ddad9217cbdd99c1aecc83ce6e7cf36a162cb69938e
SHA5120759ebe446901ab0974ff7cdac1b5517a7a739890a20858da93aaec94bd06bc4e6cb697b706864d78df044c41211990185b4bd9c00a24c616ce6004f371bc91c
-
C:\Users\Admin\AppData\Local\Temp\nbeggsncal.exeFilesize
131KB
MD5669c2269eea6c11fd71038f0918193fb
SHA1b2da793470b99bd215fbd9b3c7396ac402b068e9
SHA256ba605ae9b548c05ffa985ddad9217cbdd99c1aecc83ce6e7cf36a162cb69938e
SHA5120759ebe446901ab0974ff7cdac1b5517a7a739890a20858da93aaec94bd06bc4e6cb697b706864d78df044c41211990185b4bd9c00a24c616ce6004f371bc91c
-
C:\Users\Admin\AppData\Local\Temp\qzhglh.zoFilesize
4KB
MD50bd04364eecd4445c14e6f6a52045245
SHA129cd354bba1a83d8e8342d2f7e13a90c87af59a4
SHA25662cb82f57397ea5a5622f990d4729bc6838f5db0e17161080acf4fd46d0b751f
SHA512efda83747836c79a852c0261c0843a3a55991c16fc16b6fd58e7cef3a3b0a4efe561c40b8701c9bb05b74792d273bbd75fd2818b7380a3aacb81a94729d7f6c7
-
memory/1520-146-0x0000000000D20000-0x0000000000D27000-memory.dmpFilesize
28KB
-
memory/1520-144-0x0000000000000000-mapping.dmp
-
memory/1520-152-0x00000000007A0000-0x00000000007CD000-memory.dmpFilesize
180KB
-
memory/1520-149-0x0000000000F30000-0x0000000000FBF000-memory.dmpFilesize
572KB
-
memory/1520-148-0x0000000001190000-0x00000000014DA000-memory.dmpFilesize
3.3MB
-
memory/1520-147-0x00000000007A0000-0x00000000007CD000-memory.dmpFilesize
180KB
-
memory/2832-150-0x00000000082B0000-0x00000000083FB000-memory.dmpFilesize
1.3MB
-
memory/2832-143-0x00000000081A0000-0x00000000082A6000-memory.dmpFilesize
1.0MB
-
memory/2832-151-0x00000000081A0000-0x00000000082A6000-memory.dmpFilesize
1.0MB
-
memory/2832-153-0x00000000082B0000-0x00000000083FB000-memory.dmpFilesize
1.3MB
-
memory/3604-132-0x0000000000000000-mapping.dmp
-
memory/4216-145-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4216-142-0x0000000000E70000-0x0000000000E80000-memory.dmpFilesize
64KB
-
memory/4216-141-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/4216-140-0x00000000013C0000-0x000000000170A000-memory.dmpFilesize
3.3MB
-
memory/4216-137-0x0000000000000000-mapping.dmp
-
memory/4216-139-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB