formbook | 5b8369fd8e0ee96e8a54151a110628c79df21ab82ef65910e92feb40afe1757b

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 15:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2598ebf1b561402e5a4c9042514ac04d_JaffaCakes118.exe
Size 1.3MB
Sample240508-tcga6aef29
SHA256 5b8369fd8e0ee96e8a54151a110628c79df21ab82ef65910e92feb40afe1757b
MD5 2598ebf1b561402e5a4c9042514ac04d
SHA1 a888bbd8d3c26c99e3eb49b3121d669c340687ec
SHA512 5cc1ce18ef0242d6519055cf4cf1fa3300682a6a8ed77232135e178eeba457402dcafc747a26898e0d525a0b5ba57890b5472e62236fb4d5ef888020d3b644f0
SSDEEP 24576:7gHEvJo0mfNy/JCGaje+vwc3U5DZhMoP8iQQLCb9Slqk:EEa04y/JC3vx3U5v1GQI9r
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook hx48 persistence rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

hx48

Decoy

click-list.info

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Executes dropped EXE 3 IoCs

pid	Process
4160	Quote.exe
4860	Quote.exe
3160	Quote.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\colorcplS = "C:\\Program Files (x86)\\audiodghz74.cmd"	cscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Quote = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Quote.txt \| cmd"	reg.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4160 set thread context of 3160	4160	Quote.exe	89
PID 3160 set thread context of 3448	3160	Quote.exe	56
PID 3432 set thread context of 3448	3432	cscript.exe	56

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\audiodghz74.cmd	cmd.exe
File opened for modification	C:\Program Files (x86)\audiodghz74.cmd	cmd.exe
File opened for modification	C:\Program Files (x86)\audiodghz74.cmd	cscript.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	cscript.exe

Suspicious behavior: EnumeratesProcesses 62 IoCs

pid	Process
404	2598ebf1b561402e5a4c9042514ac04d_JaffaCakes118.exe
404	2598ebf1b561402e5a4c9042514ac04d_JaffaCakes118.exe
4160	Quote.exe
4160	Quote.exe
3160	Quote.exe
3160	Quote.exe
3160	Quote.exe
3160	Quote.exe
3432	cscript.exe
3432	cscript.exe
3432	cscript.exe
3432	cscript.exe
3432	cscript.exe
3432	cscript.exe
3432	cscript.exe
3432	cscript.exe
3432	cscript.exe
3432	cscript.exe
3432	cscript.exe
3432	cscript.exe
3432	cscript.exe
3432	cscript.exe
3432	cscript.exe
3432	cscript.exe
3432	cscript.exe
3432	cscript.exe
3432	cscript.exe
3432	cscript.exe
3432	cscript.exe
3432	cscript.exe
3432	cscript.exe
3432	cscript.exe
3432	cscript.exe
3432	cscript.exe
3432	cscript.exe
3432	cscript.exe
3432	cscript.exe
3432	cscript.exe
3432	cscript.exe
3432	cscript.exe
3432	cscript.exe
3432	cscript.exe
3432	cscript.exe
3432	cscript.exe
3432	cscript.exe
3432	cscript.exe
3432	cscript.exe
3432	cscript.exe
3432	cscript.exe
3432	cscript.exe
3432	cscript.exe
3432	cscript.exe
3432	cscript.exe
3432	cscript.exe
3432	cscript.exe
3432	cscript.exe
3432	cscript.exe
3432	cscript.exe
3432	cscript.exe
3432	cscript.exe
3432	cscript.exe
3432	cscript.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
3160	Quote.exe
3160	Quote.exe
3160	Quote.exe
3432	cscript.exe
3432	cscript.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	404	2598ebf1b561402e5a4c9042514ac04d_JaffaCakes118.exe
Token: SeDebugPrivilege	4160	Quote.exe
Token: SeDebugPrivilege	3160	Quote.exe
Token: SeDebugPrivilege	3432	cscript.exe
Token: SeShutdownPrivilege	3448	Explorer.EXE
Token: SeCreatePagefilePrivilege	3448	Explorer.EXE
Token: SeShutdownPrivilege	3448	Explorer.EXE
Token: SeCreatePagefilePrivilege	3448	Explorer.EXE

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 404 wrote to memory of 3760	404	2598ebf1b561402e5a4c9042514ac04d_JaffaCakes118.exe	81
PID 404 wrote to memory of 3760	404	2598ebf1b561402e5a4c9042514ac04d_JaffaCakes118.exe	81
PID 404 wrote to memory of 3760	404	2598ebf1b561402e5a4c9042514ac04d_JaffaCakes118.exe	81
PID 3760 wrote to memory of 4160	3760	cmd.exe	83
PID 3760 wrote to memory of 4160	3760	cmd.exe	83
PID 3760 wrote to memory of 4160	3760	cmd.exe	83
PID 4160 wrote to memory of 904	4160	Quote.exe	85
PID 4160 wrote to memory of 904	4160	Quote.exe	85
PID 4160 wrote to memory of 904	4160	Quote.exe	85
PID 904 wrote to memory of 2656	904	cmd.exe	87
PID 904 wrote to memory of 2656	904	cmd.exe	87
PID 904 wrote to memory of 2656	904	cmd.exe	87
PID 4160 wrote to memory of 4860	4160	Quote.exe	88
PID 4160 wrote to memory of 4860	4160	Quote.exe	88
PID 4160 wrote to memory of 4860	4160	Quote.exe	88
PID 4160 wrote to memory of 3160	4160	Quote.exe	89
PID 4160 wrote to memory of 3160	4160	Quote.exe	89
PID 4160 wrote to memory of 3160	4160	Quote.exe	89
PID 4160 wrote to memory of 3160	4160	Quote.exe	89
PID 4160 wrote to memory of 3160	4160	Quote.exe	89
PID 4160 wrote to memory of 3160	4160	Quote.exe	89
PID 3448 wrote to memory of 3432	3448	Explorer.EXE	91
PID 3448 wrote to memory of 3432	3448	Explorer.EXE	91
PID 3448 wrote to memory of 3432	3448	Explorer.EXE	91
PID 3432 wrote to memory of 2160	3432	cscript.exe	92
PID 3432 wrote to memory of 2160	3432	cscript.exe	92
PID 3432 wrote to memory of 2160	3432	cscript.exe	92
PID 3432 wrote to memory of 4916	3432	cscript.exe	94
PID 3432 wrote to memory of 4916	3432	cscript.exe	94
PID 3432 wrote to memory of 4916	3432	cscript.exe	94
PID 3432 wrote to memory of 2932	3432	cscript.exe	96
PID 3432 wrote to memory of 2932	3432	cscript.exe	96
PID 3432 wrote to memory of 2932	3432	cscript.exe	96

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Users\Admin\AppData\Local\Temp\2598ebf1b561402e5a4c9042514ac04d_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\2598ebf1b561402e5a4c9042514ac04d_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:404
- - C:\Windows\SysWOW64\cmd.exe
    "cmd"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3760
  - - C:\Users\Admin\Desktop\Quote.exe
      "C:\Users\Admin\Desktop\Quote.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4160
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:904
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Quote" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Quote.txt" | cmd"
        6⤵
        Adds Run key to start application
        
        PID:2656
    - - C:\Users\Admin\Desktop\Quote.exe
        
        "C:\Users\Admin\Desktop\Quote.exe"
        5⤵
        Executes dropped EXE
        
        PID:4860
    - - C:\Users\Admin\Desktop\Quote.exe
        
        "C:\Users\Admin\Desktop\Quote.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        
        PID:3160
- C:\Windows\SysWOW64\cscript.exe
  "C:\Windows\SysWOW64\cscript.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3432
- - C:\Windows\SysWOW64\cmd.exe
    /c copy "C:\Users\Admin\Desktop\Quote.exe" "C:\Program Files (x86)\audiodghz74.cmd" /V
    3⤵
    - Drops file in Program Files directory
    PID:2160
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\Desktop\Quote.exe"
    3⤵
    PID:4916
- - C:\Windows\SysWOW64\cmd.exe
    /c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
    3⤵
    PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DB1

Path C:\Users\Admin\AppData\Local\Temp\DB1
Size 46KB
SHA256 776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea
MD5 8f5942354d3809f865f9767eddf51314
SHA1 20be11c0d42fc0cef53931ea9152b55082d1a11e
SHA512 fde8dfae8a862cf106b0cb55e02d73e4e4c0527c744c20886681245c8160287f722612a6de9d0046ed1156b1771229c8950b9ac036b39c988d75aa20b7bac218
SSDEEP 96:FSXNKLyeymwHCn8MouOFlRGiZqYtFTCG:FSfHG7qqifTCG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Quote.exe

Path C:\Users\Admin\Desktop\Quote.exe
Size 1.3MB
SHA256 5b8369fd8e0ee96e8a54151a110628c79df21ab82ef65910e92feb40afe1757b
MD5 2598ebf1b561402e5a4c9042514ac04d
SHA1 a888bbd8d3c26c99e3eb49b3121d669c340687ec
SHA512 5cc1ce18ef0242d6519055cf4cf1fa3300682a6a8ed77232135e178eeba457402dcafc747a26898e0d525a0b5ba57890b5472e62236fb4d5ef888020d3b644f0
SSDEEP 24576:7gHEvJo0mfNy/JCGaje+vwc3U5DZhMoP8iQQLCb9Slqk:EEa04y/JC3vx3U5v1GQI9r
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/404-2-0x0000000074830000-0x0000000074DE1000-memory.dmp

Download

memory/404-0-0x0000000074832000-0x0000000074833000-memory.dmp

Download

memory/404-8-0x0000000074830000-0x0000000074DE1000-memory.dmp

Download

memory/404-1-0x0000000074830000-0x0000000074DE1000-memory.dmp

Download

memory/3160-14-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/3160-18-0x0000000001840000-0x0000000001B8A000-memory.dmp

Download

memory/3160-20-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/3160-21-0x00000000012B0000-0x00000000012C0000-memory.dmp

Download

memory/3432-23-0x00000000009A0000-0x00000000009C7000-memory.dmp

Download

memory/3432-24-0x00000000009A0000-0x00000000009C7000-memory.dmp

Download

memory/3448-22-0x0000000002D90000-0x0000000002E1A000-memory.dmp

Download

memory/4160-9-0x0000000074830000-0x0000000074DE1000-memory.dmp

Download

memory/4160-17-0x0000000074830000-0x0000000074DE1000-memory.dmp

Download

memory/4160-10-0x0000000074830000-0x0000000074DE1000-memory.dmp

Download

memory/4160-11-0x0000000074830000-0x0000000074DE1000-memory.dmp

Download