Analysis

  • max time kernel
    146s
  • max time network
    136s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    09-05-2024 04:19

General

  • Target

    87930142ba02cbbfe0b77ab3beb3d1bc.rtf

  • Size

    80KB

  • MD5

    87930142ba02cbbfe0b77ab3beb3d1bc

  • SHA1

    4eae75c6e3d552ec1ff34d3ee00a7ee0d6f92bd0

  • SHA256

    3445d16ad6e5de9939611d9bc5f3169581c3bd1166ad228506d6be70ac1eacbd

  • SHA512

    7f69dc7584da9c2da36ef26eb2b1ee167800d27433383ea881b739121d706cc4330d6fe174409ce8a0518713f92a58710b0c4cac0c5b231596298962fe244a99

  • SSDEEP

    1536:LAXgS04nWQuhEWhCBt2KET+qMPsAvBgdPwVI6PbxULWI4qtqi/wEXvgaew6iAzab:IggWQuhBCB8KET+qMPsAvBgWVI6POLW8

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ht3d

Decoy

derlon.net

46gem.vip

bridal-heart-boutique.com

porarquitectura.com

durkal.online

9916k.vip

nativegarden.net

hoodjac.com

coachwunder.com

jutuowangluo.com

frankmontagna.com

jalenx.com

yhxg.net

brasserie-bro.com

whitecoatprivilege.com

sigmadriving.com

inhkipcmacau.com

freediveexperience.com

52iwin.com

aaditt.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 3 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 31 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1224
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\87930142ba02cbbfe0b77ab3beb3d1bc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1688
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:1936
      • C:\Windows\SysWOW64\NAPSTAT.EXE
        "C:\Windows\SysWOW64\NAPSTAT.EXE"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:772
        • C:\Windows\SysWOW64\cmd.exe
          /c del "C:\Users\Admin\AppData\Roaming\hjcl.exe"
          3⤵
            PID:1080
      • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
        "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
        1⤵
        • Blocklisted process makes network request
        • Loads dropped DLL
        • Launches Equation Editor
        • Suspicious use of WriteProcessMemory
        PID:2168
        • C:\Users\Admin\AppData\Roaming\hjcl.exe
          "C:\Users\Admin\AppData\Roaming\hjcl.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2824
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\zNukUlepyAI.exe"
            3⤵
            • Command and Scripting Interpreter: PowerShell
            • Drops file in System32 directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1364
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\zNukUlepyAI" /XML "C:\Users\Admin\AppData\Local\Temp\tmp670D.tmp"
            3⤵
            • Creates scheduled task(s)
            PID:308
          • C:\Users\Admin\AppData\Roaming\hjcl.exe
            "C:\Users\Admin\AppData\Roaming\hjcl.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of AdjustPrivilegeToken
            PID:1808

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\tmp670D.tmp

        Filesize

        1KB

        MD5

        16ace24a938a4575f4c608361972d70f

        SHA1

        3de37ee295f3b699411649720c9ce1f1e5c759d7

        SHA256

        199476fe9149b9f6ecd7ba21dcecc41dc1d3178884404c834a7a1359450343f1

        SHA512

        395e6b6238a0d82ab8c49f524ff37c98487a833a174b59bbf6023e6fbbc2be1b1e24b7ad093bd6481a6e8b85548533434314e564d5bd68a491070997c8d13185

      • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

        Filesize

        20KB

        MD5

        6bf82377d75055da5a563f3738a9de19

        SHA1

        36b2b543d2cdad611963150cf27c05ab9b825931

        SHA256

        d6b3ce7bd5f2902f4dc41e4b116f1b2668b5142729af59b5a732b9d70ee99fdb

        SHA512

        219229de0f9470c413f37d4455786a6049ed3c5e8f6b12559cab699e58b65f0b46f77bcb6a6a1b06a4d08d0acfe34a6de31f57803609508f0e102f98e8ebe2ef

      • C:\Users\Admin\AppData\Roaming\hjcl.exe

        Filesize

        718KB

        MD5

        f49a18388f070afc8f7a17f6053666ba

        SHA1

        d1062e2c38badf9aac1a2c2d0bf4ea7f3e07341b

        SHA256

        3b746894d0a71f6162d96d2af36bea8d794d7e23af44c5536fcf97d416510a6e

        SHA512

        6557e22c3e5542262cb8d9ae6c1a79a17f8ce2b9666dfab3ea2df5acd8c23bda607358569b75454cb49a3d36448c08a1a671923f27c13b2473d5925842a7cd34

      • memory/772-48-0x0000000000130000-0x000000000015F000-memory.dmp

        Filesize

        188KB

      • memory/772-46-0x00000000000A0000-0x00000000000E6000-memory.dmp

        Filesize

        280KB

      • memory/1224-44-0x0000000000340000-0x0000000000440000-memory.dmp

        Filesize

        1024KB

      • memory/1224-51-0x0000000004C70000-0x0000000004D69000-memory.dmp

        Filesize

        996KB

      • memory/1688-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

        Filesize

        64KB

      • memory/1688-2-0x00000000712DD000-0x00000000712E8000-memory.dmp

        Filesize

        44KB

      • memory/1688-75-0x000000005FFF0000-0x0000000060000000-memory.dmp

        Filesize

        64KB

      • memory/1688-47-0x00000000712DD000-0x00000000712E8000-memory.dmp

        Filesize

        44KB

      • memory/1688-0-0x000000002F9D1000-0x000000002F9D2000-memory.dmp

        Filesize

        4KB

      • memory/1808-45-0x0000000000400000-0x000000000042F000-memory.dmp

        Filesize

        188KB

      • memory/1808-36-0x0000000000400000-0x000000000042F000-memory.dmp

        Filesize

        188KB

      • memory/1808-38-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

      • memory/1808-39-0x0000000000400000-0x000000000042F000-memory.dmp

        Filesize

        188KB

      • memory/1808-34-0x0000000000400000-0x000000000042F000-memory.dmp

        Filesize

        188KB

      • memory/2824-28-0x0000000007410000-0x0000000007486000-memory.dmp

        Filesize

        472KB

      • memory/2824-27-0x00000000009E0000-0x00000000009F6000-memory.dmp

        Filesize

        88KB

      • memory/2824-26-0x0000000000980000-0x0000000000990000-memory.dmp

        Filesize

        64KB

      • memory/2824-24-0x00000000008C0000-0x00000000008DE000-memory.dmp

        Filesize

        120KB

      • memory/2824-19-0x0000000000C20000-0x0000000000CDA000-memory.dmp

        Filesize

        744KB