Analysis

  • max time kernel
    147s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    07-05-2024 07:40

General

  • Target

    Order4500318042.xls

  • Size

    229KB

  • MD5

    ef04a12bc8c36b451d4b9da3cd9d36d6

  • SHA1

    cf13b2aedb7a44209a7d8bbe4694150834fc50e0

  • SHA256

    c4266d2a1d05270a41a4959ab0143f13655790c4c9fc189088b46302a367567a

  • SHA512

    cc9901d0ef11be9a8e7d79fd7b5c744637afa376a50990259d303f2c0448f5fd18e8c8691daadc92a8c1203d820eaa86db45ca165f572be01ffd2df37dbb25fa

  • SSDEEP

    6144:6d4UcLe0JOqPQZR8MDdATCR3tSv0W83l0MUl73/aLKMml:9UP/qPQZR8MxAm/S8W83lObaLK

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ht3d

Decoy

derlon.net

46gem.vip

bridal-heart-boutique.com

porarquitectura.com

durkal.online

9916k.vip

nativegarden.net

hoodjac.com

coachwunder.com

jutuowangluo.com

frankmontagna.com

jalenx.com

yhxg.net

brasserie-bro.com

whitecoatprivilege.com

sigmadriving.com

inhkipcmacau.com

freediveexperience.com

52iwin.com

aaditt.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 2 IoCs
  • Blocklisted process makes network request 2 IoCs
  • Downloads MZ/PE file
  • Abuses OpenXML format to download file from external location
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 27 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1196
    • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\Order4500318042.xls
      2⤵
      • Enumerates system info in registry
      • Modifies Internet Explorer settings
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:2864
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\SysWOW64\rundll32.exe"
      2⤵
      • Blocklisted process makes network request
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1716
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Roaming\html.exe"
        3⤵
          PID:2656
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2812
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        2⤵
          PID:1044
      • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
        "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
        1⤵
        • Blocklisted process makes network request
        • Loads dropped DLL
        • Launches Equation Editor
        • Suspicious use of WriteProcessMemory
        PID:2160
        • C:\Users\Admin\AppData\Roaming\html.exe
          "C:\Users\Admin\AppData\Roaming\html.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:944
          • C:\Users\Admin\AppData\Roaming\html.exe
            "C:\Users\Admin\AppData\Roaming\html.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of AdjustPrivilegeToken
            PID:1524

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

        Filesize

        717B

        MD5

        822467b728b7a66b081c91795373789a

        SHA1

        d8f2f02e1eef62485a9feffd59ce837511749865

        SHA256

        af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9

        SHA512

        bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1B1495DD322A24490E2BF2FAABAE1C61

        Filesize

        299B

        MD5

        5ae8478af8dd6eec7ad4edf162dd3df1

        SHA1

        55670b9fd39da59a9d7d0bb0aecb52324cbacc5a

        SHA256

        fe42ac92eae3b2850370b73c3691ccf394c23ab6133de39f1697a6ebac4bedca

        SHA512

        a5ed33ecec5eecf5437c14eba7c65c84b6f8b08a42df7f18c8123ee37f6743b0cf8116f4359efa82338b244b28938a6e0c8895fcd7f7563bf5777b7d8ee86296

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

        Filesize

        68KB

        MD5

        29f65ba8e88c063813cc50a4ea544e93

        SHA1

        05a7040d5c127e68c25d81cc51271ffb8bef3568

        SHA256

        1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

        SHA512

        e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

        Filesize

        192B

        MD5

        a3173ddf041b713016fcd9efc178876b

        SHA1

        ca043b28b195289942e9c036a2029876ad15ab79

        SHA256

        d14ff92d13b448ecead5bf20e8ac806a35b7098598b5749f749e00857a4af83f

        SHA512

        b36029fb8340e9cfd82102aace1592a94f0fecd24d68bbb26452f3e612fd2ac3004a61535a40600bd8abb74ea3ed3ebb4f28b3e8c7b81b414d5257a0493c962e

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1B1495DD322A24490E2BF2FAABAE1C61

        Filesize

        192B

        MD5

        fe1116f40dfb4a3cd9169be4ff621a56

        SHA1

        0c0c684d7fd30a2bad523f0dd0614f9ecccf2be0

        SHA256

        d6b934ce8356cf42abf807466108483706c3d97e6c8757642c01319ddd30934a

        SHA512

        ef84732e3a6525daa5b83746b2baf9c387276420dcd64e336af0741d0dc2fa68c056aaab974485ee28495f5bb1d6cea54c5d84afe4d5f280f6848204b8b9cba6

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

        Filesize

        344B

        MD5

        768892d87fec5e5fe7806f4434fc031b

        SHA1

        c062cf87c2f5756a46ae1f3777ddea25c5d73d32

        SHA256

        2b864ab0d6f0e0122acea6e3f961dd24fbecb5c1fe9e69471859190967a1b434

        SHA512

        e9288d3445876b264130267cd22c486b466cc493c9c692c87cba01a90408ee153cdab54f84d0e646cd7ba8b999393bc370a2012b28c6d7f07d9c170e54e6b418

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

        Filesize

        344B

        MD5

        220b5ca0adb2a5546ec64f3f515bdbf8

        SHA1

        ee5c34e099434e861a6282d98a0d4dd58ab36b3d

        SHA256

        626f0ff6a81dae7846c67a84648587f515be89b73110c97d7bda44ff7b9ff904

        SHA512

        db6cb9d7a98808c8455a2ee0a8fb33a4196de4679127d994375a9e54d9db2b1d224a5dfd65b5a0abcb8c6bb44009edcde3d9786513e85d98367b917440193688

      • C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD

        Filesize

        128KB

        MD5

        ab75c7d8500f61672afed932b46a33b8

        SHA1

        28b479885fa8b2aaf8baea17f615d0df8ea397e3

        SHA256

        968e0f51b568a8910ae9fdcb27cb717b5bbc42eef524f458653816815584368c

        SHA512

        d35ff05e18946489fc1c183bf65cc3243c580192e32d60eb7b51c61e9642dd58982e5ab28d852bd4c4f0f5755d5ddbf7242f7d832104dacecd53134087afa7fa

      • C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-{50BEF63D-99F3-4C58-A462-25EFD33F821D}.FSD

        Filesize

        128KB

        MD5

        c1d657bebd10fb4e1b89fe834f396f10

        SHA1

        32fa97c12a3e9dd911e3fa70bea6eb18d1857b80

        SHA256

        c8c731d97193218d2612cd8bb816435c5be3e05b3a08d380722fb7604e964d89

        SHA512

        7344d829ccf87dafcba9f2872a7952a5fc7069b88f44be5acb0a1bf7ee266168977bfac97f0b4aaa2c180499bf5955479f83abfb4ce41bc7bdb2bad640ed7bef

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OORQXHVT\dayisagooddaytoheargoodnewfromthegodwholovegodtrulyfromthehearttheyhearinggoodnews__godisgreatforentier[1].doc

        Filesize

        81KB

        MD5

        1aa76ce00f01882d5cd3d712b8052bc2

        SHA1

        b0cb1b9a8ada2812a013469ff5cf736b0f8da933

        SHA256

        9ae7ad0d29ba6a855eec28c8dca1b7b43063677139463dc54640d4232489d029

        SHA512

        ac7d9b0319aeab38a8bdea8c6094a4a73266d83ea4ee4974619bdc641197e58f1402089a9ab67a679df9920884214cfd5b69a4dcc9d8c3aa0d62165a67dcbdcb

      • C:\Users\Admin\AppData\Local\Temp\Cab2677.tmp

        Filesize

        65KB

        MD5

        ac05d27423a85adc1622c714f2cb6184

        SHA1

        b0fe2b1abddb97837ea0195be70ab2ff14d43198

        SHA256

        c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

        SHA512

        6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

      • C:\Users\Admin\AppData\Local\Temp\Tar27B6.tmp

        Filesize

        177KB

        MD5

        435a9ac180383f9fa094131b173a2f7b

        SHA1

        76944ea657a9db94f9a4bef38f88c46ed4166983

        SHA256

        67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

        SHA512

        1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

      • C:\Users\Admin\AppData\Local\Temp\{5AB59EA4-31A7-4486-B6EE-8D7FF139C338}

        Filesize

        128KB

        MD5

        0527946dac350378658d3324264a5bb9

        SHA1

        d09275cf5ccd91ef63844d837254df9c9e79c143

        SHA256

        d9c62972e61a8dd095286dbd1a26c1db391c511f04d12e6f5d10f0caf6814399

        SHA512

        4224ecbbff5b42472c946739989fbc4ed7cc75ec59064e35b204ed9d45381f9e137602a72f2ded6aa8c9d0ada87bc6b831800fb24a181114988360069c69943a

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\A6CNFVGP.txt

        Filesize

        69B

        MD5

        35f96955cc8f2557790cdb4e27850650

        SHA1

        46fe84f7601646d04406b989a093e608bfb3fe17

        SHA256

        c0e1f7124831c590a381e2b73db4f8c872e117adfc2b72e52229b1bbd9d2f684

        SHA512

        e9e4719db94980af63c235e62a1a4d9bfc8538de368c9eab9e7c63845983687122cf57c8fddfb050408fb78e148539e1ca6239a0d197cd1cc1a4c8da1c52f3e1

      • \Users\Admin\AppData\Roaming\html.exe

        Filesize

        658KB

        MD5

        cef1565654989742eaffa2cbc59947eb

        SHA1

        afef46a08dc6a2e1b3c8a9c6b58627677403f7b5

        SHA256

        f23b020b5a3aab42525b80bef3474df287cc7fa80dc3c13229c571e32fb99fe9

        SHA512

        53b9b0cf0d8d1c815c269e1f152ee26cda3fe18e277341f753c2d98a134e32a1c4bc6691d99cee68942e497014785087a20b2563005fd7ce4aaac9511ccfcf97

      • memory/944-236-0x00000000004D0000-0x00000000004DE000-memory.dmp

        Filesize

        56KB

      • memory/944-237-0x00000000004E0000-0x00000000004F6000-memory.dmp

        Filesize

        88KB

      • memory/944-238-0x0000000000C30000-0x0000000000CA6000-memory.dmp

        Filesize

        472KB

      • memory/944-234-0x0000000000390000-0x00000000003AC000-memory.dmp

        Filesize

        112KB

      • memory/944-233-0x0000000001290000-0x000000000133A000-memory.dmp

        Filesize

        680KB

      • memory/1196-247-0x0000000000260000-0x0000000000360000-memory.dmp

        Filesize

        1024KB

      • memory/1196-255-0x0000000006F10000-0x0000000007068000-memory.dmp

        Filesize

        1.3MB

      • memory/1524-240-0x0000000000400000-0x000000000042F000-memory.dmp

        Filesize

        188KB

      • memory/1524-241-0x0000000000400000-0x000000000042F000-memory.dmp

        Filesize

        188KB

      • memory/1524-243-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

      • memory/1524-244-0x0000000000400000-0x000000000042F000-memory.dmp

        Filesize

        188KB

      • memory/1716-248-0x0000000000C90000-0x0000000000C9E000-memory.dmp

        Filesize

        56KB

      • memory/1716-250-0x0000000000C90000-0x0000000000C9E000-memory.dmp

        Filesize

        56KB

      • memory/1716-251-0x0000000000090000-0x00000000000BF000-memory.dmp

        Filesize

        188KB

      • memory/2812-90-0x000000007267D000-0x0000000072688000-memory.dmp

        Filesize

        44KB

      • memory/2812-92-0x0000000003CB0000-0x0000000003CB2000-memory.dmp

        Filesize

        8KB

      • memory/2812-88-0x000000002FBF1000-0x000000002FBF2000-memory.dmp

        Filesize

        4KB

      • memory/2812-252-0x000000007267D000-0x0000000072688000-memory.dmp

        Filesize

        44KB

      • memory/2864-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

        Filesize

        64KB

      • memory/2864-93-0x00000000024B0000-0x00000000024B2000-memory.dmp

        Filesize

        8KB

      • memory/2864-235-0x000000007267D000-0x0000000072688000-memory.dmp

        Filesize

        44KB

      • memory/2864-1-0x000000007267D000-0x0000000072688000-memory.dmp

        Filesize

        44KB