Analysis

  • max time kernel
    150s
  • max time network
    139s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    12/10/2023, 10:37

General

  • Target

    SecuriteInfo.com.Exploit.CVE-2018-0798.4.9100.16087.rtf

  • Size

    62KB

  • MD5

    bb973c3280643cb3da16e508325158ba

  • SHA1

    76632193c1757813bd396f6c93ab597ce8ab357b

  • SHA256

    576aeff7f1272f505d250f9ffa5e0a470a83aa42daa88533aa1cb0f9447145cf

  • SHA512

    a962a8c34d0ea8125bb77b09b26ebacd86df489246d9e613d0bc284fe44976997b494d500c3ae0b91bcfb3e4bc46b04e75ab12391ab56e0e0ba74c0914697869

  • SSDEEP

    768:EXwAbZSibMX9gRWjQ1LEEZLpPosZrw72fy:uwAlRPpEErPoCw7Cy

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

o5gu

Decoy

jonathanvuportfolio.website

moneyboost.net

imikecutyou.com

toollessassembling.com

keoinfra.com

mackenziejamesphoto.com

zenovaa.com

ngmnetwork.com

odropoficial.com

huyangli.company

ganjajuice.info

promptmechanic.xyz

crispyjoy.com

dinevintageshirts.com

heyxop.online

hopefinancialmarketingph.com

weeklyvolcano.app

consultoriopmn.com

seetheratequote.com

ftds77.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 4 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1424
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Exploit.CVE-2018-0798.4.9100.16087.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2020
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:2580
      • C:\Windows\SysWOW64\NAPSTAT.EXE
        "C:\Windows\SysWOW64\NAPSTAT.EXE"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2176
        • C:\Windows\SysWOW64\cmd.exe
          /c del "C:\Users\Admin\AppData\Roaming\owenenfj578956.exe"
          3⤵
            PID:1704
      • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
        "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
        1⤵
        • Blocklisted process makes network request
        • Loads dropped DLL
        • Launches Equation Editor
        • Suspicious use of WriteProcessMemory
        PID:2940
        • C:\Users\Admin\AppData\Roaming\owenenfj578956.exe
          "C:\Users\Admin\AppData\Roaming\owenenfj578956.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:2704
          • C:\Users\Admin\AppData\Roaming\owenenfj578956.exe
            "C:\Users\Admin\AppData\Roaming\owenenfj578956.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of AdjustPrivilegeToken
            PID:1356

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

              Filesize

              20KB

              MD5

              f4f552e95269fbdbc1f8f345261f9101

              SHA1

              e1e09291f3601432fbb4637810a34cc76d41c523

              SHA256

              87cff73ac084acf5e7822bb02868e5f553fdb752f67c669c370f0dbfa97404fe

              SHA512

              d84d25748e4e623a6ba7eb8abdcba43a63455469894a5bf6275920bae8fc39ce1a26d2d2f5c0cfabfd9858bd6a4f441bf1b703aa5ff8032fadb21dd4e585647f

            • C:\Users\Admin\AppData\Roaming\owenenfj578956.exe

              Filesize

              588KB

              MD5

              47ea784b5aa582da550a12add7ccd74d

              SHA1

              5b6ae1d9193def3a895b102bc8340120bd5b8ea5

              SHA256

              e3adb8e74cd21839185ef70b6430c229a34636536412afc08bfbf1b8a610b359

              SHA512

              b4be253005f12497d76c320d14e3a9efc8632fe381baf6e1ff7aef6de5d4dc963fbfc83a944ce1f99939d3e7626ee0fb47d6b0687041d54b0b4e2e1ebd86306e

            • C:\Users\Admin\AppData\Roaming\owenenfj578956.exe

              Filesize

              588KB

              MD5

              47ea784b5aa582da550a12add7ccd74d

              SHA1

              5b6ae1d9193def3a895b102bc8340120bd5b8ea5

              SHA256

              e3adb8e74cd21839185ef70b6430c229a34636536412afc08bfbf1b8a610b359

              SHA512

              b4be253005f12497d76c320d14e3a9efc8632fe381baf6e1ff7aef6de5d4dc963fbfc83a944ce1f99939d3e7626ee0fb47d6b0687041d54b0b4e2e1ebd86306e

            • C:\Users\Admin\AppData\Roaming\owenenfj578956.exe

              Filesize

              588KB

              MD5

              47ea784b5aa582da550a12add7ccd74d

              SHA1

              5b6ae1d9193def3a895b102bc8340120bd5b8ea5

              SHA256

              e3adb8e74cd21839185ef70b6430c229a34636536412afc08bfbf1b8a610b359

              SHA512

              b4be253005f12497d76c320d14e3a9efc8632fe381baf6e1ff7aef6de5d4dc963fbfc83a944ce1f99939d3e7626ee0fb47d6b0687041d54b0b4e2e1ebd86306e

            • C:\Users\Admin\AppData\Roaming\owenenfj578956.exe

              Filesize

              588KB

              MD5

              47ea784b5aa582da550a12add7ccd74d

              SHA1

              5b6ae1d9193def3a895b102bc8340120bd5b8ea5

              SHA256

              e3adb8e74cd21839185ef70b6430c229a34636536412afc08bfbf1b8a610b359

              SHA512

              b4be253005f12497d76c320d14e3a9efc8632fe381baf6e1ff7aef6de5d4dc963fbfc83a944ce1f99939d3e7626ee0fb47d6b0687041d54b0b4e2e1ebd86306e

            • \Users\Admin\AppData\Roaming\owenenfj578956.exe

              Filesize

              588KB

              MD5

              47ea784b5aa582da550a12add7ccd74d

              SHA1

              5b6ae1d9193def3a895b102bc8340120bd5b8ea5

              SHA256

              e3adb8e74cd21839185ef70b6430c229a34636536412afc08bfbf1b8a610b359

              SHA512

              b4be253005f12497d76c320d14e3a9efc8632fe381baf6e1ff7aef6de5d4dc963fbfc83a944ce1f99939d3e7626ee0fb47d6b0687041d54b0b4e2e1ebd86306e

            • memory/1356-33-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

              Filesize

              4KB

            • memory/1356-40-0x0000000000400000-0x000000000042F000-memory.dmp

              Filesize

              188KB

            • memory/1356-38-0x0000000000810000-0x0000000000B13000-memory.dmp

              Filesize

              3.0MB

            • memory/1356-29-0x0000000000400000-0x000000000042F000-memory.dmp

              Filesize

              188KB

            • memory/1356-31-0x0000000000400000-0x000000000042F000-memory.dmp

              Filesize

              188KB

            • memory/1356-41-0x0000000000380000-0x0000000000394000-memory.dmp

              Filesize

              80KB

            • memory/1356-35-0x0000000000400000-0x000000000042F000-memory.dmp

              Filesize

              188KB

            • memory/1424-42-0x0000000008770000-0x00000000088D9000-memory.dmp

              Filesize

              1.4MB

            • memory/1424-56-0x00000000072B0000-0x00000000073FD000-memory.dmp

              Filesize

              1.3MB

            • memory/1424-54-0x00000000072B0000-0x00000000073FD000-memory.dmp

              Filesize

              1.3MB

            • memory/1424-53-0x00000000072B0000-0x00000000073FD000-memory.dmp

              Filesize

              1.3MB

            • memory/1424-48-0x0000000008770000-0x00000000088D9000-memory.dmp

              Filesize

              1.4MB

            • memory/2020-23-0x00000000710AD000-0x00000000710B8000-memory.dmp

              Filesize

              44KB

            • memory/2020-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

              Filesize

              64KB

            • memory/2020-0-0x000000002F4B1000-0x000000002F4B2000-memory.dmp

              Filesize

              4KB

            • memory/2020-77-0x00000000710AD000-0x00000000710B8000-memory.dmp

              Filesize

              44KB

            • memory/2020-2-0x00000000710AD000-0x00000000710B8000-memory.dmp

              Filesize

              44KB

            • memory/2020-76-0x000000005FFF0000-0x0000000060000000-memory.dmp

              Filesize

              64KB

            • memory/2176-44-0x0000000000750000-0x0000000000796000-memory.dmp

              Filesize

              280KB

            • memory/2176-47-0x0000000000080000-0x00000000000AF000-memory.dmp

              Filesize

              188KB

            • memory/2176-43-0x0000000000750000-0x0000000000796000-memory.dmp

              Filesize

              280KB

            • memory/2176-50-0x0000000001DF0000-0x0000000001E83000-memory.dmp

              Filesize

              588KB

            • memory/2176-45-0x0000000000080000-0x00000000000AF000-memory.dmp

              Filesize

              188KB

            • memory/2176-46-0x0000000001EE0000-0x00000000021E3000-memory.dmp

              Filesize

              3.0MB

            • memory/2704-27-0x00000000004E0000-0x00000000004EC000-memory.dmp

              Filesize

              48KB

            • memory/2704-37-0x000000006B260000-0x000000006B94E000-memory.dmp

              Filesize

              6.9MB

            • memory/2704-28-0x0000000004EA0000-0x0000000004F0E000-memory.dmp

              Filesize

              440KB

            • memory/2704-25-0x0000000004C90000-0x0000000004CD0000-memory.dmp

              Filesize

              256KB

            • memory/2704-24-0x000000006B260000-0x000000006B94E000-memory.dmp

              Filesize

              6.9MB

            • memory/2704-18-0x00000000005B0000-0x00000000005CA000-memory.dmp

              Filesize

              104KB

            • memory/2704-17-0x0000000004C90000-0x0000000004CD0000-memory.dmp

              Filesize

              256KB

            • memory/2704-16-0x000000006B260000-0x000000006B94E000-memory.dmp

              Filesize

              6.9MB

            • memory/2704-15-0x0000000000C70000-0x0000000000D0A000-memory.dmp

              Filesize

              616KB