Overview

overview

10

Static

static

NEWorder20...76.exe

windows7-x64

7

NEWorder20...76.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    186s
  • max time network
    197s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-12-2022 14:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    NEWorder2022FILE8876.exe

  • Size

    829KB

  • MD5

    443188c8e6b449066d99f49d1b715e92

  • SHA1

    7ebde06ed2558ad169e7b779ac2f7bc8bc758ef0

  • SHA256

    15046684df239f63119e30eadc6a71abbfece9080bb3a6a1d4f7b0899ee47409

  • SHA512

    1c063339b87ebe67daf14c58f20cbe917885d12ff3d1161e8e7180752710819c5b1aea92b104130d3a42beaa5906691938656c0f394591d2e2ba3beb5de31fee

  • SSDEEP

    12288:D3YNF3wX+sJMgCEdhJlxnFrQ9dI640gfHtY/h8uSW7rbLxPkgUUj5TX:j8GlJMkdhVnaHI6ufNkUEpaE

Score
10/10
formbook4u5apersistenceratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Campaign

4u5a

Decoy

Y9HWoINcPu0r7SSSKt4FCmk7

G/E64auYdhRQM4wZW2bcOaY=

bL57APty/StRpW49a+EdxA==

TppryJ0SoslHe8gJFVc=

HXxDShYIEcUJDahdv2nvl5Hlbp4=

EKaq5c6w0nV3WWlEqM4Www==

VM+YjE8XS1OLcH1roYF4zA==

OwK0wxmBGnq2Fg==

B1zy4bulyfY9tj9DK2eIkeYArpTt

Avj5JeA8m9girqfQ4+cZxA==

AOY4dmDFkCdX8HUJMw==

5cQUw3pPMYr07V8=

P7ZsN4/zt63AEw==

FYyVCOpB8Vl//kSkDLPo91Yy

jxwZTBp+5gcsccPxDF+K4bDG2Rpp0A==

iGx9AO58DRhZbXX9

prwVyLkAtlhSU6irmansg8wArpTt

uqa8ZPl+FFObOkdFNg==

tL4OhF22EDaEOkdFNg==

6exH76Z9o7eu/n86vgPE

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Uses the VBS compiler for execution 1 TTPs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 4 IoCs
  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 36 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 48 IoCs
  • Suspicious behavior: MapViewOfSection 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 16 IoCs
  • Suspicious use of FindShellTrayWindow 17 IoCs
  • Suspicious use of SendNotifyMessage 11 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:968
    • C:\Users\Admin\AppData\Local\Temp\NEWorder2022FILE8876.exe
      "C:\Users\Admin\AppData\Local\Temp\NEWorder2022FILE8876.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1576
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:2224
    • C:\Windows\SysWOW64\cmmon32.exe
      "C:\Windows\SysWOW64\cmmon32.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      PID:1244
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 968 -s 1964
      2⤵
      • Program crash
      PID:3776
  • C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -pss -s 456 -p 968 -ip 968
    1⤵
      PID:3668
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3760
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -u -p 3760 -s 5748
        2⤵
        • Program crash
        PID:656
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -pss -s 452 -p 3760 -ip 3760
      1⤵
        PID:1152
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
          PID:1444

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/968-152-0x0000000007180000-0x00000000072DD000-memory.dmp
          Filesize

          1.4MB

          Download
        • memory/968-151-0x0000000007180000-0x00000000072DD000-memory.dmp
          Filesize

          1.4MB

          Download
        • memory/968-143-0x0000000002830000-0x000000000292A000-memory.dmp
          Filesize

          1000KB

          Download
        • memory/1244-146-0x0000000000000000-mapping.dmp
          Download
        • memory/1244-150-0x0000000003540000-0x00000000035CF000-memory.dmp
          Filesize

          572KB

          Download
        • memory/1244-149-0x00000000031F0000-0x000000000353A000-memory.dmp
          Filesize

          3.3MB

          Download
        • memory/1244-148-0x0000000001230000-0x000000000125D000-memory.dmp
          Filesize

          180KB

          Download
        • memory/1244-147-0x0000000000D70000-0x0000000000D7C000-memory.dmp
          Filesize

          48KB

          Download
        • memory/1576-133-0x00007FFE99A90000-0x00007FFE9A551000-memory.dmp
          Filesize

          10.8MB

          Download
        • memory/1576-137-0x00007FFE99A90000-0x00007FFE9A551000-memory.dmp
          Filesize

          10.8MB

          Download
        • memory/1576-132-0x00000293CB240000-0x00000293CB316000-memory.dmp
          Filesize

          856KB

          Download
        • memory/2224-139-0x0000000000400000-0x000000000042E000-memory.dmp
          Filesize

          184KB

          Download
        • memory/2224-145-0x0000000000401000-0x000000000042E000-memory.dmp
          Filesize

          180KB

          Download
        • memory/2224-144-0x0000000000400000-0x000000000042E000-memory.dmp
          Filesize

          184KB

          Download
        • memory/2224-142-0x0000000000FF0000-0x0000000001000000-memory.dmp
          Filesize

          64KB

          Download
        • memory/2224-138-0x00000000018C0000-0x0000000001C0A000-memory.dmp
          Filesize

          3.3MB

          Download
        • memory/2224-140-0x0000000000401000-0x000000000042E000-memory.dmp
          Filesize

          180KB

          Download
        • memory/2224-135-0x00000000004012B0-mapping.dmp
          Download
        • memory/2224-134-0x0000000000400000-0x000000000042E000-memory.dmp
          Filesize

          184KB

          Download
        • memory/3760-153-0x000000000CF50000-0x000000000D0BF000-memory.dmp
          Filesize

          1.4MB

          Download
        • memory/3760-154-0x000000000CF50000-0x000000000D0BF000-memory.dmp
          Filesize

          1.4MB

          Download