Analysis

  • max time kernel
    147s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    27/01/2023, 09:15

General

  • Target

    Doc_230127.xlsx

  • Size

    751KB

  • MD5

    223722998eedb55be29303871403d229

  • SHA1

    c77a66ba6b49f19471eed470c7ab13c9574ec5e5

  • SHA256

    c59569a4dcfea9baca6013c1abdc304577907e8cc1659fc8df93d6bb48129845

  • SHA512

    b22c9c6f5ecfa2dbfa896eccc139c50a0424931b51db3a53088cd0c405a0c8f12f07240781a268bdb34adbfac43f07dfb5922efd3523c4fad714677e39687691

  • SSDEEP

    12288:seQslI5UMktTW6VV7PINexvXJzEiGGZb7s8pr7E8+qlPqX46lp6d+kWlM/:qY0k48IkNkGZbtZovqlPqJlp6QPM/

Malware Config

Extracted

Family

formbook

Campaign

poub

Decoy

WY0eksfISzRg4O6c+opnGL6gaw==

moRjn9ExtYi8UmUo+Tya

2vME+GedoxzFnuLXesUoVj4=

EvW4JWJ1NQ8nN3tA3SM=

2mK9efMZMgN1VOs=

8d0jua5b0J6AQEW7

/2cyThOd37DSTYMASDye4Q0t/Vs=

ral+tbIh2KKAQEW7

YLY9jsPtYB/FRmMo+Tya

R1WcElWAMtFxFrVqtZT2ZpIS9xRZNho=

KFXGg/T1pCC9GjrxUPTcjw==

8mMlK5nDwjjPFTP5jMtAtQ0t/Vs=

c7am8nhhlCo=

UW91trZj6dENxuRdpxOvW1Cf

sjOMUcvq6lYJCZEfV4euFzY=

62nBgPjdmWQkmWElww==

64E8JqA1aruSUvw=

NqI1reXpcR+REye0

8+y1oOsbjgSyEhjXUPTcjw==

Rx9by8gNBwN1VOs=

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader payload 3 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 3 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 3 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1352
    • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\Doc_230127.xlsx
      2⤵
      • Enumerates system info in registry
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:1160
    • C:\Windows\SysWOW64\control.exe
      "C:\Windows\SysWOW64\control.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1968
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\ozggicxy.exe"
        3⤵
          PID:1796
    • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
      "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
      1⤵
      • Blocklisted process makes network request
      • Launches Equation Editor
      • Suspicious use of WriteProcessMemory
      PID:944
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Users\Public\name.exe
        2⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1840
        • C:\Users\Public\name.exe
          C:\Users\Public\name.exe
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:1980
          • C:\Users\Admin\AppData\Local\Temp\ozggicxy.exe
            "C:\Users\Admin\AppData\Local\Temp\ozggicxy.exe" C:\Users\Admin\AppData\Local\Temp\rznlc.m
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of WriteProcessMemory
            PID:1820
            • C:\Users\Admin\AppData\Local\Temp\ozggicxy.exe
              "C:\Users\Admin\AppData\Local\Temp\ozggicxy.exe"
              5⤵
              • Executes dropped EXE
              • Checks computer location settings
              • Suspicious use of SetThreadContext
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of AdjustPrivilegeToken
              PID:1188

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\nfekeauyiy.uih

            Filesize

            196KB

            MD5

            62db7e07dd4481e9b594a97c4b97281a

            SHA1

            0996af042cee334be6c8d71b689e1c3405dba59e

            SHA256

            e0ab3c275ba03990a2f28abd8f37f8ff078fb8dce7fb939c6029631a5b4018a6

            SHA512

            90823ffa0232b7c18bb927dfbd87f4e5220bcf8e23f55d6638ac6ca26c29341c2ed80b2039f3893323a315071f64c572cbee70f33dd9fa2c723465a6b476e23a

          • C:\Users\Admin\AppData\Local\Temp\ozggicxy.exe

            Filesize

            50KB

            MD5

            f73f9940d91bb012db1ea328b3897c82

            SHA1

            a2168931605a10f3604dc2c24504d82a51ab6e99

            SHA256

            2cd78183a6fca82b8e05a38466051f56529a1f5843cfd6bf7274ffe30e9abf57

            SHA512

            e74c2ac031aab4ede16a0b2525a22545b555c3e659fed10079a9921e3620e42b22f2052ec5f930519881a3b7e2dd1afbd0931d1696d99e516466314b90aa217a

          • C:\Users\Admin\AppData\Local\Temp\ozggicxy.exe

            Filesize

            50KB

            MD5

            f73f9940d91bb012db1ea328b3897c82

            SHA1

            a2168931605a10f3604dc2c24504d82a51ab6e99

            SHA256

            2cd78183a6fca82b8e05a38466051f56529a1f5843cfd6bf7274ffe30e9abf57

            SHA512

            e74c2ac031aab4ede16a0b2525a22545b555c3e659fed10079a9921e3620e42b22f2052ec5f930519881a3b7e2dd1afbd0931d1696d99e516466314b90aa217a

          • C:\Users\Admin\AppData\Local\Temp\ozggicxy.exe

            Filesize

            50KB

            MD5

            f73f9940d91bb012db1ea328b3897c82

            SHA1

            a2168931605a10f3604dc2c24504d82a51ab6e99

            SHA256

            2cd78183a6fca82b8e05a38466051f56529a1f5843cfd6bf7274ffe30e9abf57

            SHA512

            e74c2ac031aab4ede16a0b2525a22545b555c3e659fed10079a9921e3620e42b22f2052ec5f930519881a3b7e2dd1afbd0931d1696d99e516466314b90aa217a

          • C:\Users\Admin\AppData\Local\Temp\rznlc.m

            Filesize

            5KB

            MD5

            56075b8221603dd51f2e7cc79097c954

            SHA1

            0df59bf418b3398bb248b63ff834e7dea05596f0

            SHA256

            0775d03420d1805c24855734fdcbe12f7dc1d1bd150b345274495054b41576dc

            SHA512

            47bb8745800a315fb7f8b6717a70fa6b5c648309c02954bb41faccd29c42be7d8e6a1d1de1cae946e2893cb0660be93fd6487891364941279656723db004086c

          • C:\Users\Public\name.exe

            Filesize

            249KB

            MD5

            f020e4ab9dacdc83e6b1a4537b5338bc

            SHA1

            2006686a3a91ed7892cffc9b1bc68c57d59118b3

            SHA256

            3290889312a146f7ed60102439cb580f84057c98c530c31cae7461b2764f5ad4

            SHA512

            b959b9b3cebd08a09dddad4933be828a3ce4d45269d64121cb2009898e2cc0508fd36ee7b3bb1dc00ed32ca7071d59a0173b3d17ac88184b8a083ef64820585a

          • C:\Users\Public\name.exe

            Filesize

            249KB

            MD5

            f020e4ab9dacdc83e6b1a4537b5338bc

            SHA1

            2006686a3a91ed7892cffc9b1bc68c57d59118b3

            SHA256

            3290889312a146f7ed60102439cb580f84057c98c530c31cae7461b2764f5ad4

            SHA512

            b959b9b3cebd08a09dddad4933be828a3ce4d45269d64121cb2009898e2cc0508fd36ee7b3bb1dc00ed32ca7071d59a0173b3d17ac88184b8a083ef64820585a

          • \Users\Admin\AppData\Local\Temp\ozggicxy.exe

            Filesize

            50KB

            MD5

            f73f9940d91bb012db1ea328b3897c82

            SHA1

            a2168931605a10f3604dc2c24504d82a51ab6e99

            SHA256

            2cd78183a6fca82b8e05a38466051f56529a1f5843cfd6bf7274ffe30e9abf57

            SHA512

            e74c2ac031aab4ede16a0b2525a22545b555c3e659fed10079a9921e3620e42b22f2052ec5f930519881a3b7e2dd1afbd0931d1696d99e516466314b90aa217a

          • \Users\Admin\AppData\Local\Temp\ozggicxy.exe

            Filesize

            50KB

            MD5

            f73f9940d91bb012db1ea328b3897c82

            SHA1

            a2168931605a10f3604dc2c24504d82a51ab6e99

            SHA256

            2cd78183a6fca82b8e05a38466051f56529a1f5843cfd6bf7274ffe30e9abf57

            SHA512

            e74c2ac031aab4ede16a0b2525a22545b555c3e659fed10079a9921e3620e42b22f2052ec5f930519881a3b7e2dd1afbd0931d1696d99e516466314b90aa217a

          • \Users\Public\name.exe

            Filesize

            249KB

            MD5

            f020e4ab9dacdc83e6b1a4537b5338bc

            SHA1

            2006686a3a91ed7892cffc9b1bc68c57d59118b3

            SHA256

            3290889312a146f7ed60102439cb580f84057c98c530c31cae7461b2764f5ad4

            SHA512

            b959b9b3cebd08a09dddad4933be828a3ce4d45269d64121cb2009898e2cc0508fd36ee7b3bb1dc00ed32ca7071d59a0173b3d17ac88184b8a083ef64820585a

          • memory/1160-92-0x000000005FFF0000-0x0000000060000000-memory.dmp

            Filesize

            64KB

          • memory/1160-76-0x000000006C8E1000-0x000000006C8E3000-memory.dmp

            Filesize

            8KB

          • memory/1160-81-0x000000007215D000-0x0000000072168000-memory.dmp

            Filesize

            44KB

          • memory/1160-93-0x000000007215D000-0x0000000072168000-memory.dmp

            Filesize

            44KB

          • memory/1160-69-0x000000006C521000-0x000000006C523000-memory.dmp

            Filesize

            8KB

          • memory/1160-58-0x0000000075A91000-0x0000000075A93000-memory.dmp

            Filesize

            8KB

          • memory/1160-57-0x000000007215D000-0x0000000072168000-memory.dmp

            Filesize

            44KB

          • memory/1160-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

            Filesize

            64KB

          • memory/1160-54-0x000000002F4E1000-0x000000002F4E4000-memory.dmp

            Filesize

            12KB

          • memory/1160-55-0x0000000071171000-0x0000000071173000-memory.dmp

            Filesize

            8KB

          • memory/1188-78-0x0000000000890000-0x0000000000B93000-memory.dmp

            Filesize

            3.0MB

          • memory/1188-79-0x0000000000340000-0x0000000000351000-memory.dmp

            Filesize

            68KB

          • memory/1188-77-0x0000000000400000-0x000000000042C000-memory.dmp

            Filesize

            176KB

          • memory/1352-90-0x0000000003F80000-0x000000000405D000-memory.dmp

            Filesize

            884KB

          • memory/1352-80-0x0000000006820000-0x000000000696A000-memory.dmp

            Filesize

            1.3MB

          • memory/1352-91-0x0000000003F80000-0x000000000405D000-memory.dmp

            Filesize

            884KB

          • memory/1968-87-0x0000000001F00000-0x0000000002203000-memory.dmp

            Filesize

            3.0MB

          • memory/1968-86-0x0000000000080000-0x00000000000AC000-memory.dmp

            Filesize

            176KB

          • memory/1968-88-0x0000000001D70000-0x0000000001E00000-memory.dmp

            Filesize

            576KB

          • memory/1968-89-0x0000000000080000-0x00000000000AC000-memory.dmp

            Filesize

            176KB

          • memory/1968-85-0x0000000000950000-0x000000000096F000-memory.dmp

            Filesize

            124KB