Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    19-12-2022 08:12

General

  • Target

    ORDER.exe

  • Size

    275KB

  • MD5

    40c08389f9b3ac964f7a1188f51dfb7b

  • SHA1

    05b6fb387f69441d4107227d361d3b8ffef821dd

  • SHA256

    426072e14b14fa10a6bf93d53c6bc17ab8d6c0871411dfece93bc765fd7d55ef

  • SHA512

    e42e4cee19cfd90c0fee5ca6ee9425cc257524a1c4de02f94a2b01bbb99679c8794c981eec61f743afa0e8afe5bb744299033695f71fede7b6e753f97e17cbf6

  • SSDEEP

    6144:Lkwtd2QvDC3Wol85o0Fv7UbxoNdyY5A0UHpMV1s3CvPqPY551P:bAQvGWouCaUbU+pMQSncY5b

Malware Config

Extracted

Family

formbook

Campaign

scse

Decoy

SKpYFyVNT2zunKf0uuM=

FlEHUseI7I5XbrO8fR/XBcS9ZA==

FPuxoUOxkLiATugw

VKdxsDSk0jdT5Kw=

FpqHf9iI/1tl97E=

YGI6sIl3UIxfZvlD+JiUuuLR

oBAEO0suBEAD5aK00A==

RKJqTzg4gQ/Q6DYSuTjDGkwuyl0ik5Kb8w==

VFg9s3W0/Ype8A3cZb+D7g==

hwD+VNd6014nrsaTWm4FBcS9ZA==

zkAdUq1soKYUfZaTqLmL

XVQ9WbRivUIQ477a/hKv+g==

QireF2geizAwmp674AGc5g==

PSTUQxs6j8OATugw

LHJhyy2VbX8NEqf0uuM=

MiY1vg6T3HqATugw

wqkUjaVXnGgBqA==

jUr/eUtSIT01Wegt

PjQidcqKzAbSZICUZb+D7g==

OkAmcv12sUEAIHwFHakzdIo2FPHw

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 27 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1244
    • C:\Users\Admin\AppData\Local\Temp\ORDER.exe
      "C:\Users\Admin\AppData\Local\Temp\ORDER.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1752
      • C:\Users\Admin\AppData\Local\Temp\sschk.exe
        "C:\Users\Admin\AppData\Local\Temp\sschk.exe" C:\Users\Admin\AppData\Local\Temp\uqmpszrescr.mh
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:1260
        • C:\Users\Admin\AppData\Local\Temp\sschk.exe
          "C:\Users\Admin\AppData\Local\Temp\sschk.exe"
          4⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:2020
    • C:\Windows\SysWOW64\wlanext.exe
      "C:\Windows\SysWOW64\wlanext.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:572
      • C:\Program Files\Mozilla Firefox\Firefox.exe
        "C:\Program Files\Mozilla Firefox\Firefox.exe"
        3⤵
          PID:2000

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Defense Evasion

    Modify Registry

    2
    T1112

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    2
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\sschk.exe
      Filesize

      128KB

      MD5

      d5711c7dd676247b08e5d6bcfa3163e4

      SHA1

      3b6255b87b2067a2022fa3049faf52609e884797

      SHA256

      e736927372d65401306e5deda3e516c24a1f52641862034847218d3923993ed3

      SHA512

      eef729152468f88a969f5c752d8ba0b20f3881d3d99696488463e54aa27f6351a55f956bccb7f5555ca2d5da1a8037d23e8c144d5280cee8f4d39b4b72cea4d4

    • C:\Users\Admin\AppData\Local\Temp\sschk.exe
      Filesize

      128KB

      MD5

      d5711c7dd676247b08e5d6bcfa3163e4

      SHA1

      3b6255b87b2067a2022fa3049faf52609e884797

      SHA256

      e736927372d65401306e5deda3e516c24a1f52641862034847218d3923993ed3

      SHA512

      eef729152468f88a969f5c752d8ba0b20f3881d3d99696488463e54aa27f6351a55f956bccb7f5555ca2d5da1a8037d23e8c144d5280cee8f4d39b4b72cea4d4

    • C:\Users\Admin\AppData\Local\Temp\sschk.exe
      Filesize

      128KB

      MD5

      d5711c7dd676247b08e5d6bcfa3163e4

      SHA1

      3b6255b87b2067a2022fa3049faf52609e884797

      SHA256

      e736927372d65401306e5deda3e516c24a1f52641862034847218d3923993ed3

      SHA512

      eef729152468f88a969f5c752d8ba0b20f3881d3d99696488463e54aa27f6351a55f956bccb7f5555ca2d5da1a8037d23e8c144d5280cee8f4d39b4b72cea4d4

    • C:\Users\Admin\AppData\Local\Temp\tllavf.j
      Filesize

      184KB

      MD5

      64e026b55299735b9db1af520d95c567

      SHA1

      7eee907d5dbd2200ecddcc83082344780a06cebb

      SHA256

      68a579dd70b4f44a3f974c22473798f9781bc1d2761e53d9c4f98580d6e6763d

      SHA512

      a5a4eb133ae8548d1c66bec32993df5ee90c650dd653c817b028a00212e3ac1801cd925831273baeb0e72371361bf8dad91dd1379acfe2b3f924b4b4d58cd2a9

    • C:\Users\Admin\AppData\Local\Temp\uqmpszrescr.mh
      Filesize

      7KB

      MD5

      792469c8fa02e0eea0ba2bb71fd99ea8

      SHA1

      dfea8de272b9e88a5a4135cb5e4cc6fc1dd95c47

      SHA256

      b56c9f242715c82598af57710034a20d51991b265269a4e73826d1c37e3bf66f

      SHA512

      338d582d394bfbe76fa8c5cb5050892eff81c8869fc4a5d272ebc8f8ce9405bd9f7b930d73d73a2dc5a8652021db1a67e339b71ad6f167a5b60f7a59ac5b58d2

    • \Users\Admin\AppData\Local\Temp\sqlite3.dll
      Filesize

      910KB

      MD5

      d79258c5189103d69502eac786addb04

      SHA1

      f34b33681cfe8ce649218173a7f58b237821c1ef

      SHA256

      57d89a52061d70d87e40281f1196d53273f87860c4d707d667a8c7d9573da675

      SHA512

      da797f4dd1ad628aa4e8004b2e00b7c278facbc57a313f56b70dc8fcfbdb0050ea8b025b3475098223cce96ea53537d678273656d46c2d33d81b496d90da34b2

    • \Users\Admin\AppData\Local\Temp\sschk.exe
      Filesize

      128KB

      MD5

      d5711c7dd676247b08e5d6bcfa3163e4

      SHA1

      3b6255b87b2067a2022fa3049faf52609e884797

      SHA256

      e736927372d65401306e5deda3e516c24a1f52641862034847218d3923993ed3

      SHA512

      eef729152468f88a969f5c752d8ba0b20f3881d3d99696488463e54aa27f6351a55f956bccb7f5555ca2d5da1a8037d23e8c144d5280cee8f4d39b4b72cea4d4

    • \Users\Admin\AppData\Local\Temp\sschk.exe
      Filesize

      128KB

      MD5

      d5711c7dd676247b08e5d6bcfa3163e4

      SHA1

      3b6255b87b2067a2022fa3049faf52609e884797

      SHA256

      e736927372d65401306e5deda3e516c24a1f52641862034847218d3923993ed3

      SHA512

      eef729152468f88a969f5c752d8ba0b20f3881d3d99696488463e54aa27f6351a55f956bccb7f5555ca2d5da1a8037d23e8c144d5280cee8f4d39b4b72cea4d4

    • \Users\Admin\AppData\Local\Temp\sschk.exe
      Filesize

      128KB

      MD5

      d5711c7dd676247b08e5d6bcfa3163e4

      SHA1

      3b6255b87b2067a2022fa3049faf52609e884797

      SHA256

      e736927372d65401306e5deda3e516c24a1f52641862034847218d3923993ed3

      SHA512

      eef729152468f88a969f5c752d8ba0b20f3881d3d99696488463e54aa27f6351a55f956bccb7f5555ca2d5da1a8037d23e8c144d5280cee8f4d39b4b72cea4d4

    • memory/572-80-0x0000000001EB0000-0x00000000021B3000-memory.dmp
      Filesize

      3.0MB

    • memory/572-83-0x00000000000A0000-0x00000000000CD000-memory.dmp
      Filesize

      180KB

    • memory/572-81-0x0000000001D80000-0x0000000001E0F000-memory.dmp
      Filesize

      572KB

    • memory/572-78-0x0000000000030000-0x0000000000046000-memory.dmp
      Filesize

      88KB

    • memory/572-79-0x00000000000A0000-0x00000000000CD000-memory.dmp
      Filesize

      180KB

    • memory/572-75-0x0000000000000000-mapping.dmp
    • memory/1244-85-0x0000000006040000-0x0000000006189000-memory.dmp
      Filesize

      1.3MB

    • memory/1244-82-0x0000000006040000-0x0000000006189000-memory.dmp
      Filesize

      1.3MB

    • memory/1244-71-0x0000000003B00000-0x0000000003BDE000-memory.dmp
      Filesize

      888KB

    • memory/1244-74-0x0000000005E60000-0x0000000005F2C000-memory.dmp
      Filesize

      816KB

    • memory/1260-57-0x0000000000000000-mapping.dmp
    • memory/1752-54-0x0000000075C41000-0x0000000075C43000-memory.dmp
      Filesize

      8KB

    • memory/2020-70-0x0000000000070000-0x0000000000080000-memory.dmp
      Filesize

      64KB

    • memory/2020-77-0x0000000000401000-0x000000000042E000-memory.dmp
      Filesize

      180KB

    • memory/2020-76-0x0000000000400000-0x000000000042E000-memory.dmp
      Filesize

      184KB

    • memory/2020-72-0x0000000000422000-0x0000000000424000-memory.dmp
      Filesize

      8KB

    • memory/2020-73-0x00000000002A0000-0x00000000002B0000-memory.dmp
      Filesize

      64KB

    • memory/2020-69-0x0000000000422000-0x0000000000424000-memory.dmp
      Filesize

      8KB

    • memory/2020-68-0x0000000000770000-0x0000000000A73000-memory.dmp
      Filesize

      3.0MB

    • memory/2020-67-0x0000000000401000-0x000000000042E000-memory.dmp
      Filesize

      180KB

    • memory/2020-66-0x0000000000400000-0x000000000042E000-memory.dmp
      Filesize

      184KB

    • memory/2020-64-0x00000000004012B0-mapping.dmp