Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
29-11-2022 10:06
Static task
static1
Behavioral task
behavioral1
Sample
formbook1.exe
Resource
win7-20220901-en
General
-
Target
formbook1.exe
-
Size
433KB
-
MD5
9672b2beca3027b6f008dfc291d21777
-
SHA1
9dfa2b2cc3d1f04fd715068e9eee238d6b1ca5a7
-
SHA256
ba10a45e13a79398a5802c91636684e54e53f26409feed99e7c89bbbe0c720d3
-
SHA512
6396c39d4b9da16e541bb29659737d9841c5841c808c58a7d88accb35715d673820d63679ea0e0ff7642cd952158e11029b5fd689b0588cff8987816df3ccb2e
-
SSDEEP
6144:6bE/HUrUAGxkcrTRkHqqZMWq1cD8YGMOsPEF75noWa4zbzDp/TkLNlkDfkDSDr0x:6bkxJkKqx4rB75HpALLkD0SMx
Malware Config
Extracted
formbook
nrln
IG7zJSm49UqTTuu/N/oTCIg=
CVLdAPgw0CRSMuZnRRU=
PiA5Z3umP2NyX81VGQhjWyS59nFYhXiG
5i6p4GeQqtBgNRfGNQ==
5984keYswxh8mGZHz4ipAHtQ
VNJaK4Gh0CrOvHpW/p353A==
71rEtrL2icToyKGhcWrTxjsFU5T98zeO
r3q1sy1iZaL+2XIUAob7yw==
9+83Qkrk/vV/jVXsDvoTCIg=
aMFAgYF1prov8/UErH/Y1A==
Alqtx/0rxwEbCLdudftl
ImCbnglBSUHF0mv2tTSP40bPeYao
s4DFNvAJ4GIJ+g==
phOa6mtS8QQICuZnRRU=
7TSu5vqRtB45EZtf4WDSTBHPeYao
ImPWqwUUIVWMQLyMbUab7tmspvNCcT8=
HF7jKjbGox2SAffTPw==
yAM3mOQot5l+cD0ikR5MGp8=
UYzW0/8z70JcQenVLidu1kLPeYao
OoCznp5UWz+hT9OBFXbfVhXPeYao
RZAWUeouUqpRAffTPw==
qQZsaG6uSqBRXS0J4PoTCIg=
idE3YO0X4GIJ+g==
NZQvYOWIBkHd4Z7AmQwAslxY
1KTdRR1OPJb88A==
8iap4OQKp/C3gQludftl
9Tyi5kaIC/Dk7JRTK/5lx1LLzRi53w==
3Lbm4soAuhRHLuZnRRU=
F4rw7+2RqgQp3urIPPoTCIg=
WcAxntfwcZZxHdfbgtoL1FbLzRi53w==
Cb4Mn+LGQzI=
v6zC+zJc9ggtoRfSUKT5VgjPeYao
8SNotqm7G3gx
zkfYBpVE7kZy6Z1eRBc=
fGC3taUlU5/grJFa/p353A==
guxOQaxAp/H3/7hudftl
1ySVyYygrPSWgzsz5voTCIg=
kgzOYyfN4GIJ+g==
uI3MyBlFYb9zLp9O/p353A==
LiJEdPqeLRv/dUMZph0=
P44MT+MPGVCfAffTPw==
92zQztuUoOD397dudftl
KAIeV2q7G3gx
16rd9Lv/EDB9NuZnRRU=
Zq8rUUtzFDYhDLdudftl
0TzN9nwSt9Ld5oQMz8oX7KcwExI=
8C4/Zed9GAoGCuZnRRU=
0R6HvJ+vT2pZMuZnRRU=
PXCroG2LPYhB92PmoRh6SNSmrvNCcT8=
jcoShE+OVbsoB4Vm
XKDr2FEDkRYoA6F7B3bfVhXPeYao
lxlqoFqiNTE=
gth+8scYHF4q9oJM/p353A==
kV6UlVdWZM+9b/WfNw==
mMkJeLvrdq91ULk=
Nxw5ckJtib7+oGdQ/p353A==
K4vu5D5UecNAxJtKPxM=
abYdRE3u8iYkqH9x
KnPrFJC5zSp1V9mCQbIDbiMamCw7zg==
DXEGJOvxscsrAcaZBs0qfqcwExI=
JxA3dYsfQKRsEMqqNrMQekNL0+MJaAkWNg==
Q4dtrcgmnb1BThr40YjqkyMQ3A==
7l7NPgxGZMGfhgludftl
MYT9Mshe6ejKfvG1lYXezH0WmCo61w==
sincewordsmatter.com
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
nbeggsncal.exepid process 932 nbeggsncal.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
nbeggsncal.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\Geo\Nation nbeggsncal.exe -
Loads dropped DLL 4 IoCs
Processes:
formbook1.exenbeggsncal.exenbeggsncal.exeipconfig.exepid process 828 formbook1.exe 932 nbeggsncal.exe 1648 nbeggsncal.exe 268 ipconfig.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
nbeggsncal.exenbeggsncal.exeipconfig.exedescription pid process target process PID 932 set thread context of 1648 932 nbeggsncal.exe nbeggsncal.exe PID 1648 set thread context of 1360 1648 nbeggsncal.exe Explorer.EXE PID 268 set thread context of 1360 268 ipconfig.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid process 268 ipconfig.exe -
Processes:
ipconfig.exedescription ioc process Key created \Registry\User\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 27 IoCs
Processes:
nbeggsncal.exeipconfig.exepid process 1648 nbeggsncal.exe 1648 nbeggsncal.exe 1648 nbeggsncal.exe 1648 nbeggsncal.exe 268 ipconfig.exe 268 ipconfig.exe 268 ipconfig.exe 268 ipconfig.exe 268 ipconfig.exe 268 ipconfig.exe 268 ipconfig.exe 268 ipconfig.exe 268 ipconfig.exe 268 ipconfig.exe 268 ipconfig.exe 268 ipconfig.exe 268 ipconfig.exe 268 ipconfig.exe 268 ipconfig.exe 268 ipconfig.exe 268 ipconfig.exe 268 ipconfig.exe 268 ipconfig.exe 268 ipconfig.exe 268 ipconfig.exe 268 ipconfig.exe 268 ipconfig.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1360 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
nbeggsncal.exeipconfig.exepid process 1648 nbeggsncal.exe 1648 nbeggsncal.exe 1648 nbeggsncal.exe 268 ipconfig.exe 268 ipconfig.exe 268 ipconfig.exe 268 ipconfig.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
nbeggsncal.exeipconfig.exedescription pid process Token: SeDebugPrivilege 1648 nbeggsncal.exe Token: SeDebugPrivilege 268 ipconfig.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1360 Explorer.EXE 1360 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1360 Explorer.EXE 1360 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
formbook1.exenbeggsncal.exeExplorer.EXEipconfig.exedescription pid process target process PID 828 wrote to memory of 932 828 formbook1.exe nbeggsncal.exe PID 828 wrote to memory of 932 828 formbook1.exe nbeggsncal.exe PID 828 wrote to memory of 932 828 formbook1.exe nbeggsncal.exe PID 828 wrote to memory of 932 828 formbook1.exe nbeggsncal.exe PID 932 wrote to memory of 1648 932 nbeggsncal.exe nbeggsncal.exe PID 932 wrote to memory of 1648 932 nbeggsncal.exe nbeggsncal.exe PID 932 wrote to memory of 1648 932 nbeggsncal.exe nbeggsncal.exe PID 932 wrote to memory of 1648 932 nbeggsncal.exe nbeggsncal.exe PID 932 wrote to memory of 1648 932 nbeggsncal.exe nbeggsncal.exe PID 1360 wrote to memory of 268 1360 Explorer.EXE ipconfig.exe PID 1360 wrote to memory of 268 1360 Explorer.EXE ipconfig.exe PID 1360 wrote to memory of 268 1360 Explorer.EXE ipconfig.exe PID 1360 wrote to memory of 268 1360 Explorer.EXE ipconfig.exe PID 268 wrote to memory of 1700 268 ipconfig.exe Firefox.exe PID 268 wrote to memory of 1700 268 ipconfig.exe Firefox.exe PID 268 wrote to memory of 1700 268 ipconfig.exe Firefox.exe PID 268 wrote to memory of 1700 268 ipconfig.exe Firefox.exe PID 268 wrote to memory of 1700 268 ipconfig.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\formbook1.exe"C:\Users\Admin\AppData\Local\Temp\formbook1.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\nbeggsncal.exe"C:\Users\Admin\AppData\Local\Temp\nbeggsncal.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\nbeggsncal.exe"C:\Users\Admin\AppData\Local\Temp\nbeggsncal.exe"4⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Gathers network information
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\cimrcc.gFilesize
185KB
MD5874dc59d7571e9ffa32c16740763a222
SHA1cf2e6e6c8e7e3a2f4e1a348a289983a730b676fc
SHA256da67c1628cfe982e5aa0995fd4c4f92a434e2e8a577941d7d9d0d8d1373a9183
SHA512d4a8d8c5107cd029fd638f49efabee51d4a4167de260b998497f715fc80f205c03458bbf433c326b46b0fd647ba383df557015428b62457207bb335ce75cb41e
-
C:\Users\Admin\AppData\Local\Temp\nbeggsncal.exeFilesize
131KB
MD5669c2269eea6c11fd71038f0918193fb
SHA1b2da793470b99bd215fbd9b3c7396ac402b068e9
SHA256ba605ae9b548c05ffa985ddad9217cbdd99c1aecc83ce6e7cf36a162cb69938e
SHA5120759ebe446901ab0974ff7cdac1b5517a7a739890a20858da93aaec94bd06bc4e6cb697b706864d78df044c41211990185b4bd9c00a24c616ce6004f371bc91c
-
C:\Users\Admin\AppData\Local\Temp\nbeggsncal.exeFilesize
131KB
MD5669c2269eea6c11fd71038f0918193fb
SHA1b2da793470b99bd215fbd9b3c7396ac402b068e9
SHA256ba605ae9b548c05ffa985ddad9217cbdd99c1aecc83ce6e7cf36a162cb69938e
SHA5120759ebe446901ab0974ff7cdac1b5517a7a739890a20858da93aaec94bd06bc4e6cb697b706864d78df044c41211990185b4bd9c00a24c616ce6004f371bc91c
-
C:\Users\Admin\AppData\Local\Temp\nbeggsncal.exeFilesize
131KB
MD5669c2269eea6c11fd71038f0918193fb
SHA1b2da793470b99bd215fbd9b3c7396ac402b068e9
SHA256ba605ae9b548c05ffa985ddad9217cbdd99c1aecc83ce6e7cf36a162cb69938e
SHA5120759ebe446901ab0974ff7cdac1b5517a7a739890a20858da93aaec94bd06bc4e6cb697b706864d78df044c41211990185b4bd9c00a24c616ce6004f371bc91c
-
C:\Users\Admin\AppData\Local\Temp\qzhglh.zoFilesize
4KB
MD50bd04364eecd4445c14e6f6a52045245
SHA129cd354bba1a83d8e8342d2f7e13a90c87af59a4
SHA25662cb82f57397ea5a5622f990d4729bc6838f5db0e17161080acf4fd46d0b751f
SHA512efda83747836c79a852c0261c0843a3a55991c16fc16b6fd58e7cef3a3b0a4efe561c40b8701c9bb05b74792d273bbd75fd2818b7380a3aacb81a94729d7f6c7
-
\Users\Admin\AppData\Local\Temp\nbeggsncal.exeFilesize
131KB
MD5669c2269eea6c11fd71038f0918193fb
SHA1b2da793470b99bd215fbd9b3c7396ac402b068e9
SHA256ba605ae9b548c05ffa985ddad9217cbdd99c1aecc83ce6e7cf36a162cb69938e
SHA5120759ebe446901ab0974ff7cdac1b5517a7a739890a20858da93aaec94bd06bc4e6cb697b706864d78df044c41211990185b4bd9c00a24c616ce6004f371bc91c
-
\Users\Admin\AppData\Local\Temp\nbeggsncal.exeFilesize
131KB
MD5669c2269eea6c11fd71038f0918193fb
SHA1b2da793470b99bd215fbd9b3c7396ac402b068e9
SHA256ba605ae9b548c05ffa985ddad9217cbdd99c1aecc83ce6e7cf36a162cb69938e
SHA5120759ebe446901ab0974ff7cdac1b5517a7a739890a20858da93aaec94bd06bc4e6cb697b706864d78df044c41211990185b4bd9c00a24c616ce6004f371bc91c
-
\Users\Admin\AppData\Local\Temp\sqlite3.dllFilesize
932KB
MD5661fd92d4eaeea3740649af5a484d7c8
SHA1c93f868890fee1475f8ec9e7607e26f5dce67d54
SHA25658a478f0560ea22c1bc194263f07cf6f3ecfe47d0c8b534a7bba185f28a1141f
SHA5121fac03c20139fde41d121e0adbd02d127261ce061509996087fc1c80baf2fe0d0f70fed6b83d38a85cfa2e07d038ff809161c7ecce31ec44ac8b89740d3db15d
-
memory/268-68-0x0000000000000000-mapping.dmp
-
memory/268-73-0x0000000002270000-0x0000000002573000-memory.dmpFilesize
3.0MB
-
memory/268-74-0x0000000000430000-0x00000000004BF000-memory.dmpFilesize
572KB
-
memory/268-72-0x0000000000080000-0x00000000000AD000-memory.dmpFilesize
180KB
-
memory/268-71-0x0000000000E60000-0x0000000000E6A000-memory.dmpFilesize
40KB
-
memory/828-54-0x0000000075BB1000-0x0000000075BB3000-memory.dmpFilesize
8KB
-
memory/932-56-0x0000000000000000-mapping.dmp
-
memory/1360-76-0x0000000006680000-0x000000000674C000-memory.dmpFilesize
816KB
-
memory/1360-75-0x0000000006680000-0x000000000674C000-memory.dmpFilesize
816KB
-
memory/1360-67-0x0000000004A10000-0x0000000004B40000-memory.dmpFilesize
1.2MB
-
memory/1648-62-0x00000000004012B0-mapping.dmp
-
memory/1648-69-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1648-66-0x00000000000F0000-0x0000000000100000-memory.dmpFilesize
64KB
-
memory/1648-65-0x0000000000890000-0x0000000000B93000-memory.dmpFilesize
3.0MB
-
memory/1648-64-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB