formbook | b1a7f40f3e1a87d3db5daa508219e315d1d6ce77d772a7256eaa16d880359a90

General

Target

output(1)(1).js
Size

9KB
MD5

457ddfc8f22d62496b18842824d69fe1
SHA1

7dbcf4a549128f0a108a40057c1b4a1c34a1023d
SHA256

b1a7f40f3e1a87d3db5daa508219e315d1d6ce77d772a7256eaa16d880359a90
SHA512

ae5c5176e164d5610c37a2950310b13735de175d0976809f4fa4fe4bf1bd19d87d4f5aa0ca453afe57512848cea80fe6432274c68da39a559e451a66d1d036ee
SSDEEP

192:ZblVH3Ye8iGlyi5K3hAwhB7VBOHwI+0eM1gr2JhEKyhOhr7kGLgIY9NhAAbmx:ZbciGlygwhBDOQI+EWwSLhOhX7gIY9N8

Score

10^/10

formbook tu7g rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

tu7g

Decoy

fbbktzFKN8MB1h8=

FPidEXGfkl0WqgXoVhHehw==

iHEjIL7XwJdpN6Er4Evhu03o

fHQTMsjqD3cPpQ==

VDXmCsr22oYhshz/Fg305nF21Q==

j4ZHfk5rRf6tVtwbMRU=

AORqAXKWy4R+//VwFdB6VVk=

9PW0Yw9RkIfer5+/bum7nlxwy1QfDQ==

ZU8mUjRgSOn3d0eFD3puQgVpnaAj

nlHgT2aJaMMB1h8=

+qc6XcgwdjVsEgKQ2zT+

/gCHJbBZrWjx1OZN40Hhu03o

48dX+WeLWAjFZMR2lItP8bJ87X4=

+N6H9VVzix7uogI=

Jf/NAPQe+8we7uftVhHehw==

YmANk8T+ix7uogI=

GTKxpLAYsJTl

pT8FM/QacYAV/+VInxn0

8JAnF9PnyZA29xH3Iw==

8ZdFPhCvGxYBxRCTqtB6VVk=

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Blocklisted process makes network request 9 IoCs

Processes:

wscript.exe

flow	pid	process
13	2560	wscript.exe
15	2560	wscript.exe
26	2560	wscript.exe
40	2560	wscript.exe
42	2560	wscript.exe
47	2560	wscript.exe
52	2560	wscript.exe
53	2560	wscript.exe
59	2560	wscript.exe

Downloads MZ/PE file
Executes dropped EXE 1 IoCs

Processes:

zz.exe

pid process

648 zz.exe

pid	process
648	zz.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wscript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	wscript.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

zz.exeRegsvcs.exehelp.exe

description	pid	process	target process
PID 648 set thread context of 308	648	zz.exe	Regsvcs.exe
PID 308 set thread context of 3092	308	Regsvcs.exe	Explorer.EXE
PID 4344 set thread context of 3092	4344	help.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

help.exe

description	ioc	process
Key created	\Registry\User\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	help.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

Processes:

Regsvcs.exehelp.exe

pid	process
308	Regsvcs.exe
308	Regsvcs.exe
308	Regsvcs.exe
308	Regsvcs.exe
308	Regsvcs.exe
308	Regsvcs.exe
308	Regsvcs.exe
308	Regsvcs.exe
4344	help.exe
4344	help.exe
4344	help.exe
4344	help.exe
4344	help.exe
4344	help.exe
4344	help.exe
4344	help.exe
4344	help.exe
4344	help.exe
4344	help.exe
4344	help.exe
4344	help.exe
4344	help.exe
4344	help.exe
4344	help.exe
4344	help.exe
4344	help.exe
4344	help.exe
4344	help.exe
4344	help.exe
4344	help.exe
4344	help.exe
4344	help.exe
4344	help.exe
4344	help.exe
4344	help.exe
4344	help.exe
4344	help.exe
4344	help.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

3092 Explorer.EXE
Suspicious behavior: MapViewOfSection 7 IoCs

Processes:

Regsvcs.exehelp.exe

pid process

308 Regsvcs.exe
308 Regsvcs.exe
308 Regsvcs.exe
4344 help.exe
4344 help.exe
4344 help.exe
4344 help.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Regsvcs.exehelp.exe

description pid process

Token: SeDebugPrivilege 308 Regsvcs.exe
Token: SeDebugPrivilege 4344 help.exe

pid	process
3092	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	308	Regsvcs.exe
Token: SeDebugPrivilege	4344	help.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

wscript.exezz.exeExplorer.EXEhelp.exe

description	pid	process	target process
PID 2560 wrote to memory of 648	2560	wscript.exe	zz.exe
PID 2560 wrote to memory of 648	2560	wscript.exe	zz.exe
PID 648 wrote to memory of 308	648	zz.exe	Regsvcs.exe
PID 648 wrote to memory of 308	648	zz.exe	Regsvcs.exe
PID 648 wrote to memory of 308	648	zz.exe	Regsvcs.exe
PID 648 wrote to memory of 308	648	zz.exe	Regsvcs.exe
PID 648 wrote to memory of 308	648	zz.exe	Regsvcs.exe
PID 648 wrote to memory of 308	648	zz.exe	Regsvcs.exe
PID 3092 wrote to memory of 4344	3092	Explorer.EXE	help.exe
PID 3092 wrote to memory of 4344	3092	Explorer.EXE	help.exe
PID 3092 wrote to memory of 4344	3092	Explorer.EXE	help.exe
PID 4344 wrote to memory of 4180	4344	help.exe	Firefox.exe
PID 4344 wrote to memory of 4180	4344	help.exe	Firefox.exe
PID 4344 wrote to memory of 4180	4344	help.exe	Firefox.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3092

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\output(1)(1).js
2⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2560

C:\Users\Admin\AppData\Local\Temp\zz.exe
"C:\Users\Admin\AppData\Local\Temp\zz.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:648

C:\Windows\Microsoft.NET\Framework\v4.0.30319\Regsvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Regsvcs.exe"
4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:308

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:3952

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:312

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:3256

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:3004

C:\Windows\SysWOW64\help.exe
"C:\Windows\SysWOW64\help.exe"
2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4344

C:\Program Files\Mozilla Firefox\Firefox.exe
"C:\Program Files\Mozilla Firefox\Firefox.exe"
3⤵
PID:4180

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\zz.exe
Filesize
260KB

MD5
31319144a917439aa8e961cce95f82ee

SHA1
eaea6b758bdba74243099d60e8dd65dcbb524351

SHA256
b4455821387f7c5571cf3aa28abde41c188593a4cb5f59d0f1e9c368db49348b

SHA512
0d28854203e99f9d35fbbb920a23d9829cfad3a2583d42c77515709963c347282737b7ac545673a3b7951c4e44e4c4c37209780ef9a498eeca1ac81948dccf62

Download Submit
C:\Users\Admin\AppData\Local\Temp\zz.exe
Filesize
260KB

MD5
31319144a917439aa8e961cce95f82ee

SHA1
eaea6b758bdba74243099d60e8dd65dcbb524351

SHA256
b4455821387f7c5571cf3aa28abde41c188593a4cb5f59d0f1e9c368db49348b

SHA512
0d28854203e99f9d35fbbb920a23d9829cfad3a2583d42c77515709963c347282737b7ac545673a3b7951c4e44e4c4c37209780ef9a498eeca1ac81948dccf62

Download Submit
memory/308-143-0x00000000017E0000-0x0000000001B2A000-memory.dmp

Filesize
3.3MB

Download
memory/308-142-0x0000000000401000-0x000000000042F000-memory.dmp

Filesize
184KB

Download
memory/308-148-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/308-137-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/308-138-0x00000000004012B0-mapping.dmp

Download
memory/308-149-0x0000000000401000-0x000000000042F000-memory.dmp

Filesize
184KB

Download
memory/308-141-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/308-145-0x0000000000DF0000-0x0000000000E00000-memory.dmp

Filesize
64KB

Download
memory/648-132-0x0000000000000000-mapping.dmp

Download
memory/648-135-0x00000168B8FA0000-0x00000168B8FE4000-memory.dmp

Filesize
272KB

Download
memory/648-139-0x00007FFC9A730000-0x00007FFC9B1F1000-memory.dmp

Filesize
10.8MB

Download
memory/648-136-0x00007FFC9A730000-0x00007FFC9B1F1000-memory.dmp

Filesize
10.8MB

Download
memory/3092-154-0x0000000007CD0000-0x0000000007DB7000-memory.dmp

Filesize
924KB

Download
memory/3092-146-0x0000000008260000-0x00000000083DF000-memory.dmp

Filesize
1.5MB

Download
memory/3092-156-0x0000000007CD0000-0x0000000007DB7000-memory.dmp

Filesize
924KB

Download
memory/4344-147-0x0000000000000000-mapping.dmp

Download
memory/4344-152-0x0000000001550000-0x000000000189A000-memory.dmp

Filesize
3.3MB

Download
memory/4344-153-0x0000000001280000-0x000000000130F000-memory.dmp

Filesize
572KB

Download
memory/4344-151-0x0000000000B20000-0x0000000000B4D000-memory.dmp

Filesize
180KB

Download
memory/4344-155-0x0000000000B20000-0x0000000000B4D000-memory.dmp

Filesize
180KB

Download
memory/4344-150-0x0000000000F90000-0x0000000000F97000-memory.dmp

Filesize
28KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads