Analysis
-
max time kernel
152s -
max time network
160s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29-11-2022 08:34
Static task
static1
Behavioral task
behavioral1
Sample
formbook4.exe
Resource
win7-20220812-en
General
-
Target
formbook4.exe
-
Size
1.0MB
-
MD5
e434c99075bb1cc365706ac25bc1c53a
-
SHA1
4cbc665703ef6c5eb46608aa5b8fef42c6afe6f5
-
SHA256
f50fd444e689593c2b29b62961986f31fe2b61f28850d23680aab7671add1365
-
SHA512
a6de56271d64f1ec3c4049faaeb99b7822f22b0acb6716a5ac52f7726d6278724d3110361cf13b63d441af01c3668dcde727a3ba322af17e00b33b0b0abb4610
-
SSDEEP
24576:bpxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxNuss8gPkS3k:23cj+/ZEFdj
Malware Config
Extracted
formbook
5pdf
cnoOEQHsI9ejYIEif1HquIlIogYo8Ow=
+pAzTzDtpZpp
djD/KBrcDAYQyOGt+Us+fA==
EJM2X0tTvNKodx36
86lMWj8hSQvtqtamtDE6kbKCy3c=
/ywYVB9fxjhRAg==
0OZ0eaYoArZ0
Kl0MifS5n1TXmIQBZLE=
2eN+GpZbBAJDAg==
E8OdZbo7E5cuJgSu2JNUfg==
wXQeNSUaXiXts3xLPw==
PzLRe+HePPeJJB8PJw==
BPaaT7LANzqtcROc+Us+fA==
/vB5AHAzcWtvN1TtGCkZ2L47OjGmU8RrWQ==
gwSl0rcfM/O7hCE=
NrtIzTsH96xB8a3HBhbfMkCs
bxu1vLuDaipA5w0OVuBc8Mw=
2IRJAE05bSVR4Oj7UeBc8Mw=
kQuq4sSpB/7gs3xLPw==
iqhd2Ea725sBlSE=
2W4CFPu+nVNYIETeChLfMkCs
rchrkJdbPvJ4EIUofdOKHa4KvWXqPA==
cRK3t7O9JxGll9Ko+Us+fA==
OkbfYMd4YBtPEzH16G9hXeakjg==
FymwvK0aKOSRQ+vtHyHfMkCs
cYxU+28lAbwIu2UPXuBc8Mw=
jItanwa+2WniqbzU/pNGnYnemQ==
zm4bsAj8JuIjvpT8Vqg=
6n4ZpyUVq2BrXz0VJg==
ex3L9jb8WVNQ8h8YLg==
tWQRGxXQvngitC0LC9yIPx6/WgdW
lxyUmnd+9u2EaOft
PsRikYc3s2cLtC8=
kxi8zbh5hvQTmDE=
UuWMqXsubU4j1w6Yy0k3dA==
Jyy/YKmfAfWEaOft
zI46RDD+8KCgcz0YLA==
zdJyp52lRwLhjhs4lqolYOSp
T1LG48dgPrWNP+vw
IbVegHBx09TjgZOPwfO/fk6hdBzJMNSR
VOK6i3smSUDWZX35R9e/EqyZvWXqPA==
4+iFjng5Ic3Daeu6Plli
s+zGZ8aScRmaQj9JebdXkbKCy3c=
ZYEk0E48oQ81vFYBV+Bc8Mw=
4BTRTLpor6B3DRerztfIcxMsqH8=
+jL4etO66KHhjoQBZLE=
gwq16dufhAZ8Fho3mTS8eYVyyXc=
8W4HH/2jgjDPiC4bLyHfMkCs
V4FT/FYWV0KJRmNCVNjSVvUCS/jOMeQ=
iZsSIQXsRkQa439geM6SkOek
WviYppWH3dm+WmG6Plli
nB6xNZdIdXcSvoQBZLE=
dSPsEf/H//vvttt8y4M6oYBToAYo8Ow=
XnI72zskWw1B+ic+l+WkNgrkaQYo8Ow=
eRhBIwPE/O/Laeu6Plli
z3wr6HTtc7mEaOft
t8ZlmJVRP/6EaOft
96JPVkTwx3AHuKyf+Us+fA==
AiT4mvfkUUmiboQeauL0tcQ=
IdN+DnYkXl5UGDfaxURKXeakjg==
9X8UkPez5txE/KhZ7Rw4aw==
0VRBjjas6ew=
iC34jAC/nQm9eCk=
i7xrp8SFJ++wnJgBYa8=
realtechtalks.com
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
formbook4.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\International\Geo\Nation formbook4.exe -
Loads dropped DLL 1 IoCs
Processes:
systray.exepid process 616 systray.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
formbook4.exeformbook4.exesystray.exedescription pid process target process PID 1992 set thread context of 1096 1992 formbook4.exe formbook4.exe PID 1096 set thread context of 1192 1096 formbook4.exe Explorer.EXE PID 616 set thread context of 1192 616 systray.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Processes:
systray.exedescription ioc process Key created \Registry\User\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 systray.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
formbook4.exeformbook4.exepowershell.exesystray.exepid process 1992 formbook4.exe 1992 formbook4.exe 1096 formbook4.exe 1096 formbook4.exe 1096 formbook4.exe 1096 formbook4.exe 1148 powershell.exe 616 systray.exe 616 systray.exe 616 systray.exe 616 systray.exe 616 systray.exe 616 systray.exe 616 systray.exe 616 systray.exe 616 systray.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
formbook4.exesystray.exepid process 1096 formbook4.exe 1096 formbook4.exe 1096 formbook4.exe 616 systray.exe 616 systray.exe 616 systray.exe 616 systray.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
formbook4.exeformbook4.exepowershell.exesystray.exedescription pid process Token: SeDebugPrivilege 1992 formbook4.exe Token: SeDebugPrivilege 1096 formbook4.exe Token: SeDebugPrivilege 1148 powershell.exe Token: SeDebugPrivilege 616 systray.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1192 Explorer.EXE 1192 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1192 Explorer.EXE 1192 Explorer.EXE -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
formbook4.exeExplorer.EXEsystray.exedescription pid process target process PID 1992 wrote to memory of 1148 1992 formbook4.exe powershell.exe PID 1992 wrote to memory of 1148 1992 formbook4.exe powershell.exe PID 1992 wrote to memory of 1148 1992 formbook4.exe powershell.exe PID 1992 wrote to memory of 1148 1992 formbook4.exe powershell.exe PID 1992 wrote to memory of 832 1992 formbook4.exe schtasks.exe PID 1992 wrote to memory of 832 1992 formbook4.exe schtasks.exe PID 1992 wrote to memory of 832 1992 formbook4.exe schtasks.exe PID 1992 wrote to memory of 832 1992 formbook4.exe schtasks.exe PID 1992 wrote to memory of 1096 1992 formbook4.exe formbook4.exe PID 1992 wrote to memory of 1096 1992 formbook4.exe formbook4.exe PID 1992 wrote to memory of 1096 1992 formbook4.exe formbook4.exe PID 1992 wrote to memory of 1096 1992 formbook4.exe formbook4.exe PID 1992 wrote to memory of 1096 1992 formbook4.exe formbook4.exe PID 1992 wrote to memory of 1096 1992 formbook4.exe formbook4.exe PID 1992 wrote to memory of 1096 1992 formbook4.exe formbook4.exe PID 1192 wrote to memory of 616 1192 Explorer.EXE systray.exe PID 1192 wrote to memory of 616 1192 Explorer.EXE systray.exe PID 1192 wrote to memory of 616 1192 Explorer.EXE systray.exe PID 1192 wrote to memory of 616 1192 Explorer.EXE systray.exe PID 616 wrote to memory of 956 616 systray.exe Firefox.exe PID 616 wrote to memory of 956 616 systray.exe Firefox.exe PID 616 wrote to memory of 956 616 systray.exe Firefox.exe PID 616 wrote to memory of 956 616 systray.exe Firefox.exe PID 616 wrote to memory of 956 616 systray.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\formbook4.exe"C:\Users\Admin\AppData\Local\Temp\formbook4.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vwzBruALhhNkob.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1148 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vwzBruALhhNkob" /XML "C:\Users\Admin\AppData\Local\Temp\tmp781D.tmp"3⤵
- Creates scheduled task(s)
PID:832 -
C:\Users\Admin\AppData\Local\Temp\formbook4.exe"C:\Users\Admin\AppData\Local\Temp\formbook4.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1096 -
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:956
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp781D.tmpFilesize
1KB
MD59ef8657bffb7ce178a2cf56b1e9f6476
SHA1230062c9bd3c52080a32e478d24cbe564e4d3182
SHA25696c98ef52c6b803d566fadbc6ea30143995bc5649a85114fd566e7a47d65a9df
SHA512185260c7a962a28b4ae313309b99f23a4be37f231baf3f881dcf08e33e493a63c452012225d933fadfead1e3c8b2289568c769fce8014b085b692a1879620412
-
\Users\Admin\AppData\Local\Temp\sqlite3.dllFilesize
849KB
MD587f9e5a6318ac1ec5ee05aa94a919d7a
SHA17a9956e8de89603dba99772da29493d3fd0fe37d
SHA2567705b87603e0d772e1753441001fcf1ac2643ee41bf14a8177de2c056628665c
SHA512c45c03176142918e34f746711e83384572bd6a8ed0a005600aa4a18cf22eade06c76eda190b37db49ec1971c4649e086affd19eee108c5f405df27c0c8cb23d2
-
memory/616-77-0x0000000000000000-mapping.dmp
-
memory/616-87-0x0000000000080000-0x00000000000AD000-memory.dmpFilesize
180KB
-
memory/616-84-0x0000000001E30000-0x0000000001EBF000-memory.dmpFilesize
572KB
-
memory/616-82-0x0000000000080000-0x00000000000AD000-memory.dmpFilesize
180KB
-
memory/616-81-0x0000000001FC0000-0x00000000022C3000-memory.dmpFilesize
3.0MB
-
memory/616-80-0x00000000002E0000-0x00000000002E5000-memory.dmpFilesize
20KB
-
memory/832-60-0x0000000000000000-mapping.dmp
-
memory/1096-74-0x00000000000E0000-0x00000000000F0000-memory.dmpFilesize
64KB
-
memory/1096-78-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1096-68-0x00000000004012B0-mapping.dmp
-
memory/1096-67-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1096-70-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1096-71-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/1096-73-0x0000000000B10000-0x0000000000E13000-memory.dmpFilesize
3.0MB
-
memory/1096-79-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/1096-65-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1096-64-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1148-88-0x0000000074840000-0x0000000074DEB000-memory.dmpFilesize
5.7MB
-
memory/1148-59-0x0000000000000000-mapping.dmp
-
memory/1148-86-0x0000000074840000-0x0000000074DEB000-memory.dmpFilesize
5.7MB
-
memory/1148-76-0x0000000074840000-0x0000000074DEB000-memory.dmpFilesize
5.7MB
-
memory/1192-85-0x00000000062C0000-0x00000000063F6000-memory.dmpFilesize
1.2MB
-
memory/1192-75-0x0000000004E50000-0x0000000004F22000-memory.dmpFilesize
840KB
-
memory/1192-89-0x00000000062C0000-0x00000000063F6000-memory.dmpFilesize
1.2MB
-
memory/1992-57-0x0000000000420000-0x000000000042C000-memory.dmpFilesize
48KB
-
memory/1992-58-0x00000000041C0000-0x000000000424E000-memory.dmpFilesize
568KB
-
memory/1992-56-0x0000000000380000-0x0000000000398000-memory.dmpFilesize
96KB
-
memory/1992-63-0x0000000005170000-0x00000000051A4000-memory.dmpFilesize
208KB
-
memory/1992-54-0x0000000000A00000-0x0000000000B0C000-memory.dmpFilesize
1.0MB
-
memory/1992-55-0x0000000076141000-0x0000000076143000-memory.dmpFilesize
8KB