Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-12-2022 08:55

General

  • Target

    Order.exe

  • Size

    275KB

  • MD5

    40c08389f9b3ac964f7a1188f51dfb7b

  • SHA1

    05b6fb387f69441d4107227d361d3b8ffef821dd

  • SHA256

    426072e14b14fa10a6bf93d53c6bc17ab8d6c0871411dfece93bc765fd7d55ef

  • SHA512

    e42e4cee19cfd90c0fee5ca6ee9425cc257524a1c4de02f94a2b01bbb99679c8794c981eec61f743afa0e8afe5bb744299033695f71fede7b6e753f97e17cbf6

  • SSDEEP

    6144:Lkwtd2QvDC3Wol85o0Fv7UbxoNdyY5A0UHpMV1s3CvPqPY551P:bAQvGWouCaUbU+pMQSncY5b

Malware Config

Extracted

Family

formbook

Campaign

scse

Decoy

SKpYFyVNT2zunKf0uuM=

FlEHUseI7I5XbrO8fR/XBcS9ZA==

FPuxoUOxkLiATugw

VKdxsDSk0jdT5Kw=

FpqHf9iI/1tl97E=

YGI6sIl3UIxfZvlD+JiUuuLR

oBAEO0suBEAD5aK00A==

RKJqTzg4gQ/Q6DYSuTjDGkwuyl0ik5Kb8w==

VFg9s3W0/Ype8A3cZb+D7g==

hwD+VNd6014nrsaTWm4FBcS9ZA==

zkAdUq1soKYUfZaTqLmL

XVQ9WbRivUIQ477a/hKv+g==

QireF2geizAwmp674AGc5g==

PSTUQxs6j8OATugw

LHJhyy2VbX8NEqf0uuM=

MiY1vg6T3HqATugw

wqkUjaVXnGgBqA==

jUr/eUtSIT01Wegt

PjQidcqKzAbSZICUZb+D7g==

OkAmcv12sUEAIHwFHakzdIo2FPHw

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 16 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3080
    • C:\Users\Admin\AppData\Local\Temp\Order.exe
      "C:\Users\Admin\AppData\Local\Temp\Order.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3208
      • C:\Users\Admin\AppData\Local\Temp\sschk.exe
        "C:\Users\Admin\AppData\Local\Temp\sschk.exe" C:\Users\Admin\AppData\Local\Temp\uqmpszrescr.mh
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:2544
        • C:\Users\Admin\AppData\Local\Temp\sschk.exe
          "C:\Users\Admin\AppData\Local\Temp\sschk.exe"
          4⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:1980
    • C:\Windows\SysWOW64\wscript.exe
      "C:\Windows\SysWOW64\wscript.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4032
      • C:\Program Files\Mozilla Firefox\Firefox.exe
        "C:\Program Files\Mozilla Firefox\Firefox.exe"
        3⤵
          PID:2624

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Defense Evasion

    Modify Registry

    2
    T1112

    Credential Access

    Credentials in Files

    1
    T1081

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    2
    T1082

    Collection

    Data from Local System

    1
    T1005

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\sschk.exe
      Filesize

      128KB

      MD5

      d5711c7dd676247b08e5d6bcfa3163e4

      SHA1

      3b6255b87b2067a2022fa3049faf52609e884797

      SHA256

      e736927372d65401306e5deda3e516c24a1f52641862034847218d3923993ed3

      SHA512

      eef729152468f88a969f5c752d8ba0b20f3881d3d99696488463e54aa27f6351a55f956bccb7f5555ca2d5da1a8037d23e8c144d5280cee8f4d39b4b72cea4d4

    • C:\Users\Admin\AppData\Local\Temp\sschk.exe
      Filesize

      128KB

      MD5

      d5711c7dd676247b08e5d6bcfa3163e4

      SHA1

      3b6255b87b2067a2022fa3049faf52609e884797

      SHA256

      e736927372d65401306e5deda3e516c24a1f52641862034847218d3923993ed3

      SHA512

      eef729152468f88a969f5c752d8ba0b20f3881d3d99696488463e54aa27f6351a55f956bccb7f5555ca2d5da1a8037d23e8c144d5280cee8f4d39b4b72cea4d4

    • C:\Users\Admin\AppData\Local\Temp\sschk.exe
      Filesize

      128KB

      MD5

      d5711c7dd676247b08e5d6bcfa3163e4

      SHA1

      3b6255b87b2067a2022fa3049faf52609e884797

      SHA256

      e736927372d65401306e5deda3e516c24a1f52641862034847218d3923993ed3

      SHA512

      eef729152468f88a969f5c752d8ba0b20f3881d3d99696488463e54aa27f6351a55f956bccb7f5555ca2d5da1a8037d23e8c144d5280cee8f4d39b4b72cea4d4

    • C:\Users\Admin\AppData\Local\Temp\tllavf.j
      Filesize

      184KB

      MD5

      64e026b55299735b9db1af520d95c567

      SHA1

      7eee907d5dbd2200ecddcc83082344780a06cebb

      SHA256

      68a579dd70b4f44a3f974c22473798f9781bc1d2761e53d9c4f98580d6e6763d

      SHA512

      a5a4eb133ae8548d1c66bec32993df5ee90c650dd653c817b028a00212e3ac1801cd925831273baeb0e72371361bf8dad91dd1379acfe2b3f924b4b4d58cd2a9

    • C:\Users\Admin\AppData\Local\Temp\uqmpszrescr.mh
      Filesize

      7KB

      MD5

      792469c8fa02e0eea0ba2bb71fd99ea8

      SHA1

      dfea8de272b9e88a5a4135cb5e4cc6fc1dd95c47

      SHA256

      b56c9f242715c82598af57710034a20d51991b265269a4e73826d1c37e3bf66f

      SHA512

      338d582d394bfbe76fa8c5cb5050892eff81c8869fc4a5d272ebc8f8ce9405bd9f7b930d73d73a2dc5a8652021db1a67e339b71ad6f167a5b60f7a59ac5b58d2

    • memory/1980-143-0x0000000001470000-0x0000000001480000-memory.dmp
      Filesize

      64KB

    • memory/1980-137-0x0000000000000000-mapping.dmp
    • memory/1980-139-0x0000000000400000-0x000000000042E000-memory.dmp
      Filesize

      184KB

    • memory/1980-140-0x0000000000401000-0x000000000042E000-memory.dmp
      Filesize

      180KB

    • memory/1980-141-0x0000000001A10000-0x0000000001D5A000-memory.dmp
      Filesize

      3.3MB

    • memory/1980-142-0x0000000000422000-0x0000000000424000-memory.dmp
      Filesize

      8KB

    • memory/2544-132-0x0000000000000000-mapping.dmp
    • memory/3080-144-0x0000000002900000-0x0000000002A9A000-memory.dmp
      Filesize

      1.6MB

    • memory/3080-150-0x0000000007C10000-0x0000000007D4C000-memory.dmp
      Filesize

      1.2MB

    • memory/3080-152-0x0000000007C10000-0x0000000007D4C000-memory.dmp
      Filesize

      1.2MB

    • memory/4032-145-0x0000000000000000-mapping.dmp
    • memory/4032-147-0x0000000001230000-0x000000000125D000-memory.dmp
      Filesize

      180KB

    • memory/4032-146-0x0000000000910000-0x0000000000937000-memory.dmp
      Filesize

      156KB

    • memory/4032-148-0x0000000003330000-0x000000000367A000-memory.dmp
      Filesize

      3.3MB

    • memory/4032-149-0x00000000030D0000-0x000000000315F000-memory.dmp
      Filesize

      572KB

    • memory/4032-151-0x0000000001230000-0x000000000125D000-memory.dmp
      Filesize

      180KB