502751e0b4a8acff074def25e8bf46495cc258100652ae11194aea84b5278fcf

General

Target

formbook4.exe
Size

1.0MB
MD5

e434c99075bb1cc365706ac25bc1c53a
SHA1

4cbc665703ef6c5eb46608aa5b8fef42c6afe6f5
SHA256

f50fd444e689593c2b29b62961986f31fe2b61f28850d23680aab7671add1365
SHA512

a6de56271d64f1ec3c4049faaeb99b7822f22b0acb6716a5ac52f7726d6278724d3110361cf13b63d441af01c3668dcde727a3ba322af17e00b33b0b0abb4610
SSDEEP

24576:bpxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxNuss8gPkS3k:23cj+/ZEFdj

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1332 schtasks.exe
Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

formbook4.exepowershell.exe

pid process

852 formbook4.exe
852 formbook4.exe
852 formbook4.exe
852 formbook4.exe
852 formbook4.exe
852 formbook4.exe
624 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

formbook4.exepowershell.exe

description pid process

Token: SeDebugPrivilege 852 formbook4.exe
Token: SeDebugPrivilege 624 powershell.exe

pid	process
1332	schtasks.exe

pid	process
852	formbook4.exe
852	formbook4.exe
852	formbook4.exe
852	formbook4.exe
852	formbook4.exe
852	formbook4.exe
624	powershell.exe

description	pid	process
Token: SeDebugPrivilege	852	formbook4.exe
Token: SeDebugPrivilege	624	powershell.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

formbook4.exe

description	pid	process	target process
PID 852 wrote to memory of 624	852	formbook4.exe	powershell.exe
PID 852 wrote to memory of 624	852	formbook4.exe	powershell.exe
PID 852 wrote to memory of 624	852	formbook4.exe	powershell.exe
PID 852 wrote to memory of 624	852	formbook4.exe	powershell.exe
PID 852 wrote to memory of 1332	852	formbook4.exe	schtasks.exe
PID 852 wrote to memory of 1332	852	formbook4.exe	schtasks.exe
PID 852 wrote to memory of 1332	852	formbook4.exe	schtasks.exe
PID 852 wrote to memory of 1332	852	formbook4.exe	schtasks.exe
PID 852 wrote to memory of 304	852	formbook4.exe	formbook4.exe
PID 852 wrote to memory of 304	852	formbook4.exe	formbook4.exe
PID 852 wrote to memory of 304	852	formbook4.exe	formbook4.exe
PID 852 wrote to memory of 304	852	formbook4.exe	formbook4.exe
PID 852 wrote to memory of 1916	852	formbook4.exe	formbook4.exe
PID 852 wrote to memory of 1916	852	formbook4.exe	formbook4.exe
PID 852 wrote to memory of 1916	852	formbook4.exe	formbook4.exe
PID 852 wrote to memory of 1916	852	formbook4.exe	formbook4.exe
PID 852 wrote to memory of 1792	852	formbook4.exe	formbook4.exe
PID 852 wrote to memory of 1792	852	formbook4.exe	formbook4.exe
PID 852 wrote to memory of 1792	852	formbook4.exe	formbook4.exe
PID 852 wrote to memory of 1792	852	formbook4.exe	formbook4.exe
PID 852 wrote to memory of 332	852	formbook4.exe	formbook4.exe
PID 852 wrote to memory of 332	852	formbook4.exe	formbook4.exe
PID 852 wrote to memory of 332	852	formbook4.exe	formbook4.exe
PID 852 wrote to memory of 332	852	formbook4.exe	formbook4.exe
PID 852 wrote to memory of 1744	852	formbook4.exe	formbook4.exe
PID 852 wrote to memory of 1744	852	formbook4.exe	formbook4.exe
PID 852 wrote to memory of 1744	852	formbook4.exe	formbook4.exe
PID 852 wrote to memory of 1744	852	formbook4.exe	formbook4.exe

C:\Users\Admin\AppData\Local\Temp\formbook4.exe
"C:\Users\Admin\AppData\Local\Temp\formbook4.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:852

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vwzBruALhhNkob.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:624

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vwzBruALhhNkob" /XML "C:\Users\Admin\AppData\Local\Temp\tmpED5C.tmp"
2⤵
- Creates scheduled task(s)
PID:1332

C:\Users\Admin\AppData\Local\Temp\formbook4.exe
"C:\Users\Admin\AppData\Local\Temp\formbook4.exe"
2⤵
PID:304

C:\Users\Admin\AppData\Local\Temp\formbook4.exe
"C:\Users\Admin\AppData\Local\Temp\formbook4.exe"
2⤵
PID:1916

C:\Users\Admin\AppData\Local\Temp\formbook4.exe
"C:\Users\Admin\AppData\Local\Temp\formbook4.exe"
2⤵
PID:1792

C:\Users\Admin\AppData\Local\Temp\formbook4.exe
"C:\Users\Admin\AppData\Local\Temp\formbook4.exe"
2⤵
PID:332

C:\Users\Admin\AppData\Local\Temp\formbook4.exe
"C:\Users\Admin\AppData\Local\Temp\formbook4.exe"
2⤵
PID:1744

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpED5C.tmp
Filesize
1KB

MD5
af3b9437dbc76045d80c6baea7178fb9

SHA1
9ec400c8408ca57400fed85ab78324cc4efed95f

SHA256
780fd62a98ea8f77c50ff687290f90c9ee7a81fd5737455941a37ae56d3ee396

SHA512
12d21ca92026fb6cf5a62419858248a0ceb92ab0185a43585d4de1559b911299edf38f8b34dbc9ea0af0fae24354e6e08b8756291ab4e8bacc4636fa1756c7c8

Download Submit
memory/624-59-0x0000000000000000-mapping.dmp

Download
memory/624-64-0x000000006E280000-0x000000006E82B000-memory.dmp

Filesize
5.7MB

Download
memory/624-65-0x000000006E280000-0x000000006E82B000-memory.dmp

Filesize
5.7MB

Download
memory/852-54-0x0000000000320000-0x000000000042C000-memory.dmp

Filesize
1.0MB

Download
memory/852-55-0x0000000074E41000-0x0000000074E43000-memory.dmp

Filesize
8KB

Download
memory/852-56-0x00000000004A0000-0x00000000004B8000-memory.dmp

Filesize
96KB

Download
memory/852-57-0x0000000000540000-0x000000000054C000-memory.dmp

Filesize
48KB

Download
memory/852-58-0x00000000006D0000-0x000000000075E000-memory.dmp

Filesize
568KB

Download
memory/852-63-0x0000000005EC0000-0x0000000005EF4000-memory.dmp

Filesize
208KB

Download
memory/1332-60-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads