Analysis

  • max time kernel
    148s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    09-05-2024 05:07

General

  • Target

    1aa76ce00f01882d5cd3d712b8052bc2.rtf

  • Size

    81KB

  • MD5

    1aa76ce00f01882d5cd3d712b8052bc2

  • SHA1

    b0cb1b9a8ada2812a013469ff5cf736b0f8da933

  • SHA256

    9ae7ad0d29ba6a855eec28c8dca1b7b43063677139463dc54640d4232489d029

  • SHA512

    ac7d9b0319aeab38a8bdea8c6094a4a73266d83ea4ee4974619bdc641197e58f1402089a9ab67a679df9920884214cfd5b69a4dcc9d8c3aa0d62165a67dcbdcb

  • SSDEEP

    1536:77VscWY5jbOYcra/iDM+nRXsSH2lDG5ODlQfg4NaQ7rXwkpez4p7sRc1HudD:qxY5jyTra/iDM+nZsSHxODEgyt7jwkpi

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ht3d

Decoy

derlon.net

46gem.vip

bridal-heart-boutique.com

porarquitectura.com

durkal.online

9916k.vip

nativegarden.net

hoodjac.com

coachwunder.com

jutuowangluo.com

frankmontagna.com

jalenx.com

yhxg.net

brasserie-bro.com

whitecoatprivilege.com

sigmadriving.com

inhkipcmacau.com

freediveexperience.com

52iwin.com

aaditt.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 2 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 33 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1212
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\1aa76ce00f01882d5cd3d712b8052bc2.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1888
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:2752
      • C:\Windows\SysWOW64\autoconv.exe
        "C:\Windows\SysWOW64\autoconv.exe"
        2⤵
          PID:1604
        • C:\Windows\SysWOW64\cmstp.exe
          "C:\Windows\SysWOW64\cmstp.exe"
          2⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1560
          • C:\Windows\SysWOW64\cmd.exe
            /c del "C:\Users\Admin\AppData\Roaming\html.exe"
            3⤵
              PID:1852
        • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
          "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
          1⤵
          • Blocklisted process makes network request
          • Loads dropped DLL
          • Launches Equation Editor
          • Suspicious use of WriteProcessMemory
          PID:2604
          • C:\Users\Admin\AppData\Roaming\html.exe
            "C:\Users\Admin\AppData\Roaming\html.exe"
            2⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2508
            • C:\Users\Admin\AppData\Roaming\html.exe
              "C:\Users\Admin\AppData\Roaming\html.exe"
              3⤵
              • Executes dropped EXE
              PID:2900
            • C:\Users\Admin\AppData\Roaming\html.exe
              "C:\Users\Admin\AppData\Roaming\html.exe"
              3⤵
              • Executes dropped EXE
              PID:2920
            • C:\Users\Admin\AppData\Roaming\html.exe
              "C:\Users\Admin\AppData\Roaming\html.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of AdjustPrivilegeToken
              PID:2960

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

          Filesize

          20KB

          MD5

          bcf103ff2239ac0b99573cb11a6fd6b8

          SHA1

          a742828c23600864364c9b2648e6d71f4726e89e

          SHA256

          86242c6901f704e60e989be33f063f36363361b2df8e64eb97d7b4b24f61ae07

          SHA512

          7f3ac09c69cd2a1dd72919e15b8ac896013bbeb7bc04b13747fbd86d7fa033797d8ce1d4b8642bf2007c82743fecab996a60c98170eca78e07fff8697bd927d6

        • C:\Users\Admin\AppData\Roaming\html.exe

          Filesize

          658KB

          MD5

          cef1565654989742eaffa2cbc59947eb

          SHA1

          afef46a08dc6a2e1b3c8a9c6b58627677403f7b5

          SHA256

          f23b020b5a3aab42525b80bef3474df287cc7fa80dc3c13229c571e32fb99fe9

          SHA512

          53b9b0cf0d8d1c815c269e1f152ee26cda3fe18e277341f753c2d98a134e32a1c4bc6691d99cee68942e497014785087a20b2563005fd7ce4aaac9511ccfcf97

        • memory/1212-36-0x0000000000200000-0x0000000000300000-memory.dmp

          Filesize

          1024KB

        • memory/1212-43-0x0000000006B60000-0x0000000006CD1000-memory.dmp

          Filesize

          1.4MB

        • memory/1560-38-0x00000000000D0000-0x00000000000FF000-memory.dmp

          Filesize

          188KB

        • memory/1560-37-0x0000000000A40000-0x0000000000A58000-memory.dmp

          Filesize

          96KB

        • memory/1888-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

          Filesize

          64KB

        • memory/1888-2-0x000000007109D000-0x00000000710A8000-memory.dmp

          Filesize

          44KB

        • memory/1888-67-0x000000005FFF0000-0x0000000060000000-memory.dmp

          Filesize

          64KB

        • memory/1888-0-0x000000002F1A1000-0x000000002F1A2000-memory.dmp

          Filesize

          4KB

        • memory/1888-41-0x000000007109D000-0x00000000710A8000-memory.dmp

          Filesize

          44KB

        • memory/2508-21-0x0000000000610000-0x000000000062C000-memory.dmp

          Filesize

          112KB

        • memory/2508-25-0x0000000004350000-0x00000000043C6000-memory.dmp

          Filesize

          472KB

        • memory/2508-24-0x00000000007F0000-0x0000000000806000-memory.dmp

          Filesize

          88KB

        • memory/2508-23-0x0000000000640000-0x000000000064E000-memory.dmp

          Filesize

          56KB

        • memory/2508-16-0x0000000000050000-0x00000000000FA000-memory.dmp

          Filesize

          680KB

        • memory/2960-28-0x0000000000400000-0x000000000042F000-memory.dmp

          Filesize

          188KB

        • memory/2960-32-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

        • memory/2960-33-0x0000000000400000-0x000000000042F000-memory.dmp

          Filesize

          188KB

        • memory/2960-30-0x0000000000400000-0x000000000042F000-memory.dmp

          Filesize

          188KB