Analysis
-
max time kernel
153s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2022 08:08
Static task
static1
Behavioral task
behavioral1
Sample
formbook4.exe
Resource
win7-20220901-en
General
-
Target
formbook4.exe
-
Size
1.0MB
-
MD5
e434c99075bb1cc365706ac25bc1c53a
-
SHA1
4cbc665703ef6c5eb46608aa5b8fef42c6afe6f5
-
SHA256
f50fd444e689593c2b29b62961986f31fe2b61f28850d23680aab7671add1365
-
SHA512
a6de56271d64f1ec3c4049faaeb99b7822f22b0acb6716a5ac52f7726d6278724d3110361cf13b63d441af01c3668dcde727a3ba322af17e00b33b0b0abb4610
-
SSDEEP
24576:bpxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxNuss8gPkS3k:23cj+/ZEFdj
Malware Config
Extracted
formbook
5pdf
cnoOEQHsI9ejYIEif1HquIlIogYo8Ow=
+pAzTzDtpZpp
djD/KBrcDAYQyOGt+Us+fA==
EJM2X0tTvNKodx36
86lMWj8hSQvtqtamtDE6kbKCy3c=
/ywYVB9fxjhRAg==
0OZ0eaYoArZ0
Kl0MifS5n1TXmIQBZLE=
2eN+GpZbBAJDAg==
E8OdZbo7E5cuJgSu2JNUfg==
wXQeNSUaXiXts3xLPw==
PzLRe+HePPeJJB8PJw==
BPaaT7LANzqtcROc+Us+fA==
/vB5AHAzcWtvN1TtGCkZ2L47OjGmU8RrWQ==
gwSl0rcfM/O7hCE=
NrtIzTsH96xB8a3HBhbfMkCs
bxu1vLuDaipA5w0OVuBc8Mw=
2IRJAE05bSVR4Oj7UeBc8Mw=
kQuq4sSpB/7gs3xLPw==
iqhd2Ea725sBlSE=
2W4CFPu+nVNYIETeChLfMkCs
rchrkJdbPvJ4EIUofdOKHa4KvWXqPA==
cRK3t7O9JxGll9Ko+Us+fA==
OkbfYMd4YBtPEzH16G9hXeakjg==
FymwvK0aKOSRQ+vtHyHfMkCs
cYxU+28lAbwIu2UPXuBc8Mw=
jItanwa+2WniqbzU/pNGnYnemQ==
zm4bsAj8JuIjvpT8Vqg=
6n4ZpyUVq2BrXz0VJg==
ex3L9jb8WVNQ8h8YLg==
tWQRGxXQvngitC0LC9yIPx6/WgdW
lxyUmnd+9u2EaOft
PsRikYc3s2cLtC8=
kxi8zbh5hvQTmDE=
UuWMqXsubU4j1w6Yy0k3dA==
Jyy/YKmfAfWEaOft
zI46RDD+8KCgcz0YLA==
zdJyp52lRwLhjhs4lqolYOSp
T1LG48dgPrWNP+vw
IbVegHBx09TjgZOPwfO/fk6hdBzJMNSR
VOK6i3smSUDWZX35R9e/EqyZvWXqPA==
4+iFjng5Ic3Daeu6Plli
s+zGZ8aScRmaQj9JebdXkbKCy3c=
ZYEk0E48oQ81vFYBV+Bc8Mw=
4BTRTLpor6B3DRerztfIcxMsqH8=
+jL4etO66KHhjoQBZLE=
gwq16dufhAZ8Fho3mTS8eYVyyXc=
8W4HH/2jgjDPiC4bLyHfMkCs
V4FT/FYWV0KJRmNCVNjSVvUCS/jOMeQ=
iZsSIQXsRkQa439geM6SkOek
WviYppWH3dm+WmG6Plli
nB6xNZdIdXcSvoQBZLE=
dSPsEf/H//vvttt8y4M6oYBToAYo8Ow=
XnI72zskWw1B+ic+l+WkNgrkaQYo8Ow=
eRhBIwPE/O/Laeu6Plli
z3wr6HTtc7mEaOft
t8ZlmJVRP/6EaOft
96JPVkTwx3AHuKyf+Us+fA==
AiT4mvfkUUmiboQeauL0tcQ=
IdN+DnYkXl5UGDfaxURKXeakjg==
9X8UkPez5txE/KhZ7Rw4aw==
0VRBjjas6ew=
iC34jAC/nQm9eCk=
i7xrp8SFJ++wnJgBYa8=
realtechtalks.com
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
formbook4.exeformbook4.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation formbook4.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation formbook4.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
formbook4.exeformbook4.exemstsc.exedescription pid process target process PID 3440 set thread context of 4664 3440 formbook4.exe formbook4.exe PID 4664 set thread context of 3052 4664 formbook4.exe Explorer.EXE PID 4200 set thread context of 3052 4200 mstsc.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Processes:
mstsc.exedescription ioc process Key created \Registry\User\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 mstsc.exe -
Suspicious behavior: EnumeratesProcesses 39 IoCs
Processes:
formbook4.exepowershell.exeformbook4.exemstsc.exepid process 3440 formbook4.exe 3440 formbook4.exe 3440 formbook4.exe 1124 powershell.exe 4664 formbook4.exe 4664 formbook4.exe 4664 formbook4.exe 4664 formbook4.exe 4664 formbook4.exe 4664 formbook4.exe 4664 formbook4.exe 4664 formbook4.exe 1124 powershell.exe 4200 mstsc.exe 4200 mstsc.exe 4200 mstsc.exe 4200 mstsc.exe 4200 mstsc.exe 4200 mstsc.exe 4200 mstsc.exe 4200 mstsc.exe 4200 mstsc.exe 4200 mstsc.exe 4200 mstsc.exe 4200 mstsc.exe 4200 mstsc.exe 4200 mstsc.exe 4200 mstsc.exe 4200 mstsc.exe 4200 mstsc.exe 4200 mstsc.exe 4200 mstsc.exe 4200 mstsc.exe 4200 mstsc.exe 4200 mstsc.exe 4200 mstsc.exe 4200 mstsc.exe 4200 mstsc.exe 4200 mstsc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3052 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
formbook4.exemstsc.exepid process 4664 formbook4.exe 4664 formbook4.exe 4664 formbook4.exe 4200 mstsc.exe 4200 mstsc.exe 4200 mstsc.exe 4200 mstsc.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
formbook4.exepowershell.exeformbook4.exemstsc.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 3440 formbook4.exe Token: SeDebugPrivilege 1124 powershell.exe Token: SeDebugPrivilege 4664 formbook4.exe Token: SeDebugPrivilege 4200 mstsc.exe Token: SeShutdownPrivilege 3052 Explorer.EXE Token: SeCreatePagefilePrivilege 3052 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
formbook4.exeExplorer.EXEmstsc.exedescription pid process target process PID 3440 wrote to memory of 1124 3440 formbook4.exe powershell.exe PID 3440 wrote to memory of 1124 3440 formbook4.exe powershell.exe PID 3440 wrote to memory of 1124 3440 formbook4.exe powershell.exe PID 3440 wrote to memory of 3876 3440 formbook4.exe schtasks.exe PID 3440 wrote to memory of 3876 3440 formbook4.exe schtasks.exe PID 3440 wrote to memory of 3876 3440 formbook4.exe schtasks.exe PID 3440 wrote to memory of 4664 3440 formbook4.exe formbook4.exe PID 3440 wrote to memory of 4664 3440 formbook4.exe formbook4.exe PID 3440 wrote to memory of 4664 3440 formbook4.exe formbook4.exe PID 3440 wrote to memory of 4664 3440 formbook4.exe formbook4.exe PID 3440 wrote to memory of 4664 3440 formbook4.exe formbook4.exe PID 3440 wrote to memory of 4664 3440 formbook4.exe formbook4.exe PID 3052 wrote to memory of 4200 3052 Explorer.EXE mstsc.exe PID 3052 wrote to memory of 4200 3052 Explorer.EXE mstsc.exe PID 3052 wrote to memory of 4200 3052 Explorer.EXE mstsc.exe PID 4200 wrote to memory of 1660 4200 mstsc.exe Firefox.exe PID 4200 wrote to memory of 1660 4200 mstsc.exe Firefox.exe PID 4200 wrote to memory of 1660 4200 mstsc.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\formbook4.exe"C:\Users\Admin\AppData\Local\Temp\formbook4.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vwzBruALhhNkob.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1124 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vwzBruALhhNkob" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6C13.tmp"3⤵
- Creates scheduled task(s)
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\formbook4.exe"C:\Users\Admin\AppData\Local\Temp\formbook4.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4664 -
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:1660
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp6C13.tmpFilesize
1KB
MD5ff8df213c9c7f3d6b075bee099ca15ff
SHA12840f03c5be07ba2073d45dfe2d209d448f94fa1
SHA2566281978fe2ab50b7b3187c242c31064c3b5f1622215736072e9ea4195a44676d
SHA512b989a823c74261f27c2bf42da060cdc90ecebfbba8a40dcd744f73c05af195138b357072ecafe10253c6e5e7adb2d8ab3eb6b106a6476d0a2c11b47c803034c3
-
memory/1124-173-0x0000000007600000-0x000000000761A000-memory.dmpFilesize
104KB
-
memory/1124-142-0x00000000050E0000-0x0000000005708000-memory.dmpFilesize
6.2MB
-
memory/1124-148-0x0000000004EF0000-0x0000000004F12000-memory.dmpFilesize
136KB
-
memory/1124-169-0x00000000072C0000-0x00000000072CA000-memory.dmpFilesize
40KB
-
memory/1124-172-0x00000000074F0000-0x00000000074FE000-memory.dmpFilesize
56KB
-
memory/1124-138-0x0000000000000000-mapping.dmp
-
memory/1124-163-0x00000000064E0000-0x00000000064FE000-memory.dmpFilesize
120KB
-
memory/1124-140-0x0000000002580000-0x00000000025B6000-memory.dmpFilesize
216KB
-
memory/1124-166-0x00000000078D0000-0x0000000007F4A000-memory.dmpFilesize
6.5MB
-
memory/1124-170-0x0000000007540000-0x00000000075D6000-memory.dmpFilesize
600KB
-
memory/1124-174-0x00000000075E0000-0x00000000075E8000-memory.dmpFilesize
32KB
-
memory/1124-161-0x0000000006500000-0x0000000006532000-memory.dmpFilesize
200KB
-
memory/1124-162-0x0000000070690000-0x00000000706DC000-memory.dmpFilesize
304KB
-
memory/1124-157-0x0000000005F30000-0x0000000005F4E000-memory.dmpFilesize
120KB
-
memory/1124-167-0x0000000007250000-0x000000000726A000-memory.dmpFilesize
104KB
-
memory/1124-150-0x0000000005810000-0x0000000005876000-memory.dmpFilesize
408KB
-
memory/3052-168-0x0000000008520000-0x000000000866C000-memory.dmpFilesize
1.3MB
-
memory/3052-171-0x0000000008520000-0x000000000866C000-memory.dmpFilesize
1.3MB
-
memory/3052-153-0x00000000082C0000-0x0000000008412000-memory.dmpFilesize
1.3MB
-
memory/3440-135-0x0000000004C10000-0x0000000004C1A000-memory.dmpFilesize
40KB
-
memory/3440-132-0x0000000000170000-0x000000000027C000-memory.dmpFilesize
1.0MB
-
memory/3440-136-0x0000000008F90000-0x000000000902C000-memory.dmpFilesize
624KB
-
memory/3440-134-0x0000000004CA0000-0x0000000004D32000-memory.dmpFilesize
584KB
-
memory/3440-133-0x0000000005310000-0x00000000058B4000-memory.dmpFilesize
5.6MB
-
memory/3440-137-0x0000000009030000-0x0000000009096000-memory.dmpFilesize
408KB
-
memory/3876-139-0x0000000000000000-mapping.dmp
-
memory/4200-154-0x0000000000000000-mapping.dmp
-
memory/4200-160-0x0000000002F60000-0x00000000032AA000-memory.dmpFilesize
3.3MB
-
memory/4200-158-0x0000000000AC0000-0x0000000000BFA000-memory.dmpFilesize
1.2MB
-
memory/4200-164-0x0000000001050000-0x000000000107D000-memory.dmpFilesize
180KB
-
memory/4200-165-0x00000000032B0000-0x000000000333F000-memory.dmpFilesize
572KB
-
memory/4200-159-0x0000000001050000-0x000000000107D000-memory.dmpFilesize
180KB
-
memory/4664-155-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4664-156-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/4664-152-0x0000000000FF0000-0x0000000001000000-memory.dmpFilesize
64KB
-
memory/4664-151-0x0000000001A30000-0x0000000001D7A000-memory.dmpFilesize
3.3MB
-
memory/4664-147-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/4664-146-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4664-144-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4664-143-0x0000000000000000-mapping.dmp