Analysis

  • max time kernel
    148s
  • max time network
    139s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    15/08/2023, 08:53

General

  • Target

    order #393405.xls

  • Size

    1.3MB

  • MD5

    a913096f787c53f96a34dfff28a68ac1

  • SHA1

    43ea14976d150ca3146c0fde2f44947df9e2f4af

  • SHA256

    da1f2444a6a87363c210ff73a4111ccea458b1d35b2cbe7c1c54fa471c8f752f

  • SHA512

    ec32f7db5917cfb7162d32386c3dd38cc1373a6635668c3ffe158130e8d4d1eeadb69ca0a6ee6fb9d09168b83e24f1b9ee923d96a7f668b2a9d09f0e3a32d81f

  • SSDEEP

    24576:UaZy0w6VgjKaWlEzp7aUZydw6VzjKaWlEzp7azzd6f/b7QAUQp5E/zwwx:UE86VgjKjOzRJ6VzjKjOzEdU7/UX/zf

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

sy22

Decoy

vinteligencia.com

displayfridges.fun

completetip.com

giallozafferrano.com

jizihao1.com

mysticheightstrail.com

fourseasonslb.com

kjnala.shop

mosiacwall.com

vandistreet.com

gracefullytouchedartistry.com

hbiwhwr.shop

mfmz.net

hrmbrillianz.com

funwarsztat.com

polewithcandy.com

ourrajasthan.com

wilhouettteamerica.com

johnnystintshop.com

asgnelwin.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 4 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1368
    • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\order #393405.xls"
      2⤵
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:2676
    • C:\Windows\SysWOW64\wuapp.exe
      "C:\Windows\SysWOW64\wuapp.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2684
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\dasHost.exe"
        3⤵
          PID:1920
    • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
      "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
      1⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Launches Equation Editor
      • Suspicious use of WriteProcessMemory
      PID:1440
      • C:\Users\Admin\AppData\Local\Temp\dasHost.exe
        "C:\Users\Admin\AppData\Local\Temp\dasHost.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:2068
        • C:\Users\Admin\AppData\Local\Temp\dasHost.exe
          "C:\Users\Admin\AppData\Local\Temp\dasHost.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:2448

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\E7779D06.emf

      Filesize

      1.4MB

      MD5

      a01b9617553432807b9b58025b338d97

      SHA1

      439bdcc450408b9735b2428c2d53d2e6977fa58c

      SHA256

      7a0426ed2e2349916969ff7087c0f76089fb8ce7f4627f3d11ccbc1aaefcedce

      SHA512

      312cc2563fa865d6a939fea85a520627c73ed9a95bafc98c89495f21d535dc658825be74b64f0f5c5815d1d234fc6e77a71779247e4973e39ba8dccec2f09bee

    • C:\Users\Admin\AppData\Local\Temp\dasHost.exe

      Filesize

      537KB

      MD5

      d145e45a54f7ad9c25620e97fb545734

      SHA1

      4a6a4de62f44c29f3008de7436f7fa4f44814dd3

      SHA256

      edb6d1a583895269b9b3d58b7acdb1a8590a2289529f9c9e937a33fed180add6

      SHA512

      a00d9dbff3cd5a6c3e4efdf349b3ae65d948a3b2a651e75325bce9aa5896959bb93b9f90a27b44e1e2d24ac17b4164bb2a7e8812086540d7b2a862c3e9fe4b9f

    • C:\Users\Admin\AppData\Local\Temp\dasHost.exe

      Filesize

      537KB

      MD5

      d145e45a54f7ad9c25620e97fb545734

      SHA1

      4a6a4de62f44c29f3008de7436f7fa4f44814dd3

      SHA256

      edb6d1a583895269b9b3d58b7acdb1a8590a2289529f9c9e937a33fed180add6

      SHA512

      a00d9dbff3cd5a6c3e4efdf349b3ae65d948a3b2a651e75325bce9aa5896959bb93b9f90a27b44e1e2d24ac17b4164bb2a7e8812086540d7b2a862c3e9fe4b9f

    • C:\Users\Admin\AppData\Local\Temp\dasHost.exe

      Filesize

      537KB

      MD5

      d145e45a54f7ad9c25620e97fb545734

      SHA1

      4a6a4de62f44c29f3008de7436f7fa4f44814dd3

      SHA256

      edb6d1a583895269b9b3d58b7acdb1a8590a2289529f9c9e937a33fed180add6

      SHA512

      a00d9dbff3cd5a6c3e4efdf349b3ae65d948a3b2a651e75325bce9aa5896959bb93b9f90a27b44e1e2d24ac17b4164bb2a7e8812086540d7b2a862c3e9fe4b9f

    • C:\Users\Admin\AppData\Local\Temp\dasHost.exe

      Filesize

      537KB

      MD5

      d145e45a54f7ad9c25620e97fb545734

      SHA1

      4a6a4de62f44c29f3008de7436f7fa4f44814dd3

      SHA256

      edb6d1a583895269b9b3d58b7acdb1a8590a2289529f9c9e937a33fed180add6

      SHA512

      a00d9dbff3cd5a6c3e4efdf349b3ae65d948a3b2a651e75325bce9aa5896959bb93b9f90a27b44e1e2d24ac17b4164bb2a7e8812086540d7b2a862c3e9fe4b9f

    • \Users\Admin\AppData\Local\Temp\dasHost.exe

      Filesize

      537KB

      MD5

      d145e45a54f7ad9c25620e97fb545734

      SHA1

      4a6a4de62f44c29f3008de7436f7fa4f44814dd3

      SHA256

      edb6d1a583895269b9b3d58b7acdb1a8590a2289529f9c9e937a33fed180add6

      SHA512

      a00d9dbff3cd5a6c3e4efdf349b3ae65d948a3b2a651e75325bce9aa5896959bb93b9f90a27b44e1e2d24ac17b4164bb2a7e8812086540d7b2a862c3e9fe4b9f

    • \Users\Admin\AppData\Local\Temp\dasHost.exe

      Filesize

      537KB

      MD5

      d145e45a54f7ad9c25620e97fb545734

      SHA1

      4a6a4de62f44c29f3008de7436f7fa4f44814dd3

      SHA256

      edb6d1a583895269b9b3d58b7acdb1a8590a2289529f9c9e937a33fed180add6

      SHA512

      a00d9dbff3cd5a6c3e4efdf349b3ae65d948a3b2a651e75325bce9aa5896959bb93b9f90a27b44e1e2d24ac17b4164bb2a7e8812086540d7b2a862c3e9fe4b9f

    • \Users\Admin\AppData\Local\Temp\dasHost.exe

      Filesize

      537KB

      MD5

      d145e45a54f7ad9c25620e97fb545734

      SHA1

      4a6a4de62f44c29f3008de7436f7fa4f44814dd3

      SHA256

      edb6d1a583895269b9b3d58b7acdb1a8590a2289529f9c9e937a33fed180add6

      SHA512

      a00d9dbff3cd5a6c3e4efdf349b3ae65d948a3b2a651e75325bce9aa5896959bb93b9f90a27b44e1e2d24ac17b4164bb2a7e8812086540d7b2a862c3e9fe4b9f

    • memory/1368-110-0x0000000004EF0000-0x0000000004FA3000-memory.dmp

      Filesize

      716KB

    • memory/1368-95-0x0000000000200000-0x0000000000300000-memory.dmp

      Filesize

      1024KB

    • memory/1368-96-0x0000000006FF0000-0x0000000007191000-memory.dmp

      Filesize

      1.6MB

    • memory/1368-102-0x0000000006FF0000-0x0000000007191000-memory.dmp

      Filesize

      1.6MB

    • memory/1368-135-0x000007FEE4990000-0x000007FEE499A000-memory.dmp

      Filesize

      40KB

    • memory/1368-134-0x000007FEF5C50000-0x000007FEF5D93000-memory.dmp

      Filesize

      1.3MB

    • memory/1368-107-0x0000000004EF0000-0x0000000004FA3000-memory.dmp

      Filesize

      716KB

    • memory/1368-108-0x0000000004EF0000-0x0000000004FA3000-memory.dmp

      Filesize

      716KB

    • memory/2068-80-0x0000000004A70000-0x0000000004AB0000-memory.dmp

      Filesize

      256KB

    • memory/2068-74-0x000000006BEC0000-0x000000006C5AE000-memory.dmp

      Filesize

      6.9MB

    • memory/2068-75-0x0000000000FE0000-0x000000000106C000-memory.dmp

      Filesize

      560KB

    • memory/2068-82-0x0000000004FE0000-0x000000000504E000-memory.dmp

      Filesize

      440KB

    • memory/2068-81-0x0000000000240000-0x000000000024E000-memory.dmp

      Filesize

      56KB

    • memory/2068-79-0x000000006BEC0000-0x000000006C5AE000-memory.dmp

      Filesize

      6.9MB

    • memory/2068-90-0x000000006BEC0000-0x000000006C5AE000-memory.dmp

      Filesize

      6.9MB

    • memory/2068-78-0x0000000000210000-0x0000000000220000-memory.dmp

      Filesize

      64KB

    • memory/2068-77-0x0000000004A70000-0x0000000004AB0000-memory.dmp

      Filesize

      256KB

    • memory/2448-88-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/2448-85-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/2448-93-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/2448-94-0x0000000000170000-0x0000000000184000-memory.dmp

      Filesize

      80KB

    • memory/2448-91-0x0000000000A40000-0x0000000000D43000-memory.dmp

      Filesize

      3.0MB

    • memory/2448-84-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/2448-86-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2676-54-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2676-76-0x000000007387D000-0x0000000073888000-memory.dmp

      Filesize

      44KB

    • memory/2676-129-0x000000007387D000-0x0000000073888000-memory.dmp

      Filesize

      44KB

    • memory/2676-118-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2676-55-0x000000007387D000-0x0000000073888000-memory.dmp

      Filesize

      44KB

    • memory/2684-99-0x0000000000090000-0x00000000000BF000-memory.dmp

      Filesize

      188KB

    • memory/2684-104-0x0000000001D60000-0x0000000001DF3000-memory.dmp

      Filesize

      588KB

    • memory/2684-101-0x0000000000090000-0x00000000000BF000-memory.dmp

      Filesize

      188KB

    • memory/2684-100-0x0000000001E60000-0x0000000002163000-memory.dmp

      Filesize

      3.0MB

    • memory/2684-98-0x00000000008C0000-0x00000000008CB000-memory.dmp

      Filesize

      44KB

    • memory/2684-97-0x00000000008C0000-0x00000000008CB000-memory.dmp

      Filesize

      44KB