Analysis
- max time kernel
143s - max time network
128s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
18/05/2024, 09:15
General
- Target 80bc491f53143f0586753066eff8912b356258afe443f5d0f74ef9b36703225c.xlsm
- Size 57KB
- Sample240518-k8bacada96
- SHA256 80bc491f53143f0586753066eff8912b356258afe443f5d0f74ef9b36703225c
Malware Config
Extracted
-
formbook
-
4.1
-
dn03
-
almouranipainting.com
-
cataloguia.shop
-
zaparielectric.com
-
whcqsc.com
-
ioco.in
-
aduredmond.com
-
vavada611a.fun
-
humtivers.com
-
jewellerytml.com
-
mcapitalparticipacoes.com
-
inhlcq.shop
-
solanamall.xyz
-
moviepropgroup.com
-
thegenesis.ltd
-
cyberxdefend.com
-
skinbykoco.com
-
entermintlead.com
-
honestaireviews.com
-
wyclhj7gqfustzp.buzz
-
w937xb.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Downloads MZ/PE file
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 37 IoCs
- Suspicious use of SetWindowsHookEx 12 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\80bc491f53143f0586753066eff8912b356258afe443f5d0f74ef9b36703225c.xlsm"2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\pp.exeC:\Users\Admin\AppData\Local\Temp\pp.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\pp.exe"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\pp.exe"C:\Users\Admin\AppData\Local\Temp\pp.exe"4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\pp.exe"C:\Users\Admin\AppData\Local\Temp\pp.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4048,i,15140928051103392835,1612840580898364401,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_ew05xgll.bjx.ps1
pp.exe
memory/2404-67-0x0000000005C50000-0x0000000005C5C000-memory.dmp
memory/2404-74-0x000000000A900000-0x000000000A99C000-memory.dmp
memory/2404-73-0x0000000006F30000-0x0000000006FA6000-memory.dmp
memory/2404-72-0x0000000003260000-0x0000000003270000-memory.dmp
memory/2404-79-0x00007FFCCC0D0000-0x00007FFCCC2C5000-memory.dmp
memory/2404-66-0x0000000006A70000-0x0000000006A92000-memory.dmp
memory/2404-65-0x00000000059C0000-0x00000000059CA000-memory.dmp
memory/2404-64-0x00007FFCCC0D0000-0x00007FFCCC2C5000-memory.dmp
memory/2404-63-0x00000000059D0000-0x0000000005A62000-memory.dmp
memory/2404-62-0x0000000005EE0000-0x0000000006484000-memory.dmp
memory/2404-61-0x0000000000F00000-0x0000000000FA6000-memory.dmp
memory/2404-60-0x00007FFCCC0D0000-0x00007FFCCC2C5000-memory.dmp
memory/3516-103-0x0000000070FC0000-0x000000007100C000-memory.dmp
memory/3516-118-0x0000000007450000-0x00000000074E6000-memory.dmp
memory/3516-123-0x00000000074F0000-0x00000000074F8000-memory.dmp
memory/3516-122-0x0000000007510000-0x000000000752A000-memory.dmp
memory/3516-121-0x0000000007410000-0x0000000007424000-memory.dmp
memory/3516-120-0x0000000007400000-0x000000000740E000-memory.dmp
memory/3516-119-0x00000000073D0000-0x00000000073E1000-memory.dmp
memory/3516-117-0x0000000007240000-0x000000000724A000-memory.dmp
memory/3516-116-0x00000000071D0000-0x00000000071EA000-memory.dmp
memory/3516-115-0x0000000007820000-0x0000000007E9A000-memory.dmp
memory/3516-114-0x00000000070A0000-0x0000000007143000-memory.dmp
memory/3516-113-0x0000000006480000-0x000000000649E000-memory.dmp
memory/3516-102-0x0000000007060000-0x0000000007092000-memory.dmp
memory/3516-97-0x0000000005ED0000-0x0000000005F1C000-memory.dmp
memory/3516-96-0x0000000005EA0000-0x0000000005EBE000-memory.dmp
memory/3516-95-0x0000000005A50000-0x0000000005DA4000-memory.dmp
memory/3516-85-0x00000000051F0000-0x0000000005256000-memory.dmp
memory/3516-84-0x0000000005180000-0x00000000051E6000-memory.dmp
memory/3516-83-0x00000000050E0000-0x0000000005102000-memory.dmp
memory/3516-82-0x0000000005420000-0x0000000005A48000-memory.dmp
memory/3516-80-0x00000000025B0000-0x00000000025E6000-memory.dmp
memory/4576-76-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4576-127-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4624-18-0x00007FFCCC0D0000-0x00007FFCCC2C5000-memory.dmp
memory/4624-56-0x00007FFCCC0D0000-0x00007FFCCC2C5000-memory.dmp
memory/4624-2-0x00007FFC8C150000-0x00007FFC8C160000-memory.dmp
memory/4624-71-0x00007FFCCC0D0000-0x00007FFCCC2C5000-memory.dmp
memory/4624-10-0x00007FFCCC0D0000-0x00007FFCCC2C5000-memory.dmp
memory/4624-11-0x00007FFCCC0D0000-0x00007FFCCC2C5000-memory.dmp
memory/4624-9-0x00007FFCCC0D0000-0x00007FFCCC2C5000-memory.dmp
memory/4624-0-0x00007FFC8C150000-0x00007FFC8C160000-memory.dmp
memory/4624-12-0x00007FFC899F0000-0x00007FFC89A00000-memory.dmp
memory/4624-8-0x00007FFCCC0D0000-0x00007FFCCC2C5000-memory.dmp
memory/4624-40-0x00007FFCCC0D0000-0x00007FFCCC2C5000-memory.dmp
memory/4624-99-0x00007FFCCC0D0000-0x00007FFCCC2C5000-memory.dmp
memory/4624-98-0x00007FFCCC16D000-0x00007FFCCC16E000-memory.dmp
memory/4624-15-0x00007FFCCC0D0000-0x00007FFCCC2C5000-memory.dmp
memory/4624-1-0x00007FFCCC16D000-0x00007FFCCC16E000-memory.dmp
memory/4624-16-0x00007FFC899F0000-0x00007FFC89A00000-memory.dmp
memory/4624-3-0x00007FFC8C150000-0x00007FFC8C160000-memory.dmp
memory/4624-5-0x00007FFCCC0D0000-0x00007FFCCC2C5000-memory.dmp
memory/4624-7-0x00007FFCCC0D0000-0x00007FFCCC2C5000-memory.dmp
memory/4624-41-0x00007FFCCC0D0000-0x00007FFCCC2C5000-memory.dmp
memory/4624-19-0x00007FFCCC0D0000-0x00007FFCCC2C5000-memory.dmp
memory/4624-6-0x00007FFC8C150000-0x00007FFC8C160000-memory.dmp
memory/4624-13-0x00007FFCCC0D0000-0x00007FFCCC2C5000-memory.dmp
memory/4624-14-0x00007FFCCC0D0000-0x00007FFCCC2C5000-memory.dmp
memory/4624-17-0x00007FFCCC0D0000-0x00007FFCCC2C5000-memory.dmp
memory/4624-20-0x00007FFCCC0D0000-0x00007FFCCC2C5000-memory.dmp
memory/4624-126-0x00007FFCCC0D0000-0x00007FFCCC2C5000-memory.dmp
memory/4624-4-0x00007FFC8C150000-0x00007FFC8C160000-memory.dmp
memory/4624-128-0x00007FFCCC0D0000-0x00007FFCCC2C5000-memory.dmp
memory/4624-144-0x00007FFC8C150000-0x00007FFC8C160000-memory.dmp
memory/4624-145-0x00007FFC8C150000-0x00007FFC8C160000-memory.dmp
memory/4624-147-0x00007FFC8C150000-0x00007FFC8C160000-memory.dmp
memory/4624-146-0x00007FFC8C150000-0x00007FFC8C160000-memory.dmp
memory/4624-148-0x00007FFCCC0D0000-0x00007FFCCC2C5000-memory.dmp