formbook | 151bfa7336a9c96e65bf8a0eeb54a3d34665e612c8c5b3a7886f16a6f58277c4

Modify Registry

Processes:

help.exe

description	ioc	process
Key created	\Registry\User\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	help.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

help.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ZHG4EXWXCN = "C:\\Program Files (x86)\\Windows Mail\\wab.exe"	help.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

Цитата.exewab.exehelp.exe

description	pid	process	target process
PID 4992 set thread context of 4728	4992	Цитата.exe	wab.exe
PID 4728 set thread context of 3536	4728	wab.exe	Explorer.EXE
PID 4728 set thread context of 3536	4728	wab.exe	Explorer.EXE
PID 3152 set thread context of 3536	3152	help.exe	Explorer.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

Processes:

help.exe

description	ioc	process
Key created	\Registry\User\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	help.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

Processes:

wab.exehelp.exe

pid	process
4728	wab.exe
4728	wab.exe
4728	wab.exe
4728	wab.exe
4728	wab.exe
4728	wab.exe
3152	help.exe
3152	help.exe
3152	help.exe
3152	help.exe
3152	help.exe
3152	help.exe
3152	help.exe
3152	help.exe
3152	help.exe
3152	help.exe
3152	help.exe
3152	help.exe
3152	help.exe
3152	help.exe
3152	help.exe
3152	help.exe
3152	help.exe
3152	help.exe
3152	help.exe
3152	help.exe
3152	help.exe
3152	help.exe
3152	help.exe
3152	help.exe
3152	help.exe
3152	help.exe
3152	help.exe
3152	help.exe
3152	help.exe
3152	help.exe
3152	help.exe
3152	help.exe
3152	help.exe
3152	help.exe
3152	help.exe
3152	help.exe
3152	help.exe
3152	help.exe
3152	help.exe
3152	help.exe
3152	help.exe
3152	help.exe
3152	help.exe
3152	help.exe
3152	help.exe
3152	help.exe
3152	help.exe
3152	help.exe
3152	help.exe
3152	help.exe
3152	help.exe
3152	help.exe

Suspicious behavior: MapViewOfSection 8 IoCs

Processes:

wab.exehelp.exe

pid process

4728 wab.exe
4728 wab.exe
4728 wab.exe
4728 wab.exe
3152 help.exe
3152 help.exe
3152 help.exe
3152 help.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

wab.exeExplorer.EXEhelp.exe

description	pid	process
Token: SeDebugPrivilege	4728	wab.exe
Token: SeShutdownPrivilege	3536	Explorer.EXE
Token: SeCreatePagefilePrivilege	3536	Explorer.EXE
Token: SeDebugPrivilege	3152	help.exe
Token: SeShutdownPrivilege	3536	Explorer.EXE
Token: SeCreatePagefilePrivilege	3536	Explorer.EXE
Token: SeShutdownPrivilege	3536	Explorer.EXE
Token: SeCreatePagefilePrivilege	3536	Explorer.EXE

Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

3536 Explorer.EXE

pid	process
3536	Explorer.EXE

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

Цитата.exeExplorer.EXEhelp.exe

description	pid	process	target process
PID 4992 wrote to memory of 4728	4992	Цитата.exe	wab.exe
PID 4992 wrote to memory of 4728	4992	Цитата.exe	wab.exe
PID 4992 wrote to memory of 4728	4992	Цитата.exe	wab.exe
PID 4992 wrote to memory of 4728	4992	Цитата.exe	wab.exe
PID 4992 wrote to memory of 4728	4992	Цитата.exe	wab.exe
PID 4992 wrote to memory of 4728	4992	Цитата.exe	wab.exe
PID 4992 wrote to memory of 4984	4992	Цитата.exe	wab.exe
PID 4992 wrote to memory of 4984	4992	Цитата.exe	wab.exe
PID 4992 wrote to memory of 4984	4992	Цитата.exe	wab.exe
PID 3536 wrote to memory of 3152	3536	Explorer.EXE	help.exe
PID 3536 wrote to memory of 3152	3536	Explorer.EXE	help.exe
PID 3536 wrote to memory of 3152	3536	Explorer.EXE	help.exe
PID 3152 wrote to memory of 3972	3152	help.exe	cmd.exe
PID 3152 wrote to memory of 3972	3152	help.exe	cmd.exe
PID 3152 wrote to memory of 3972	3152	help.exe	cmd.exe
PID 3152 wrote to memory of 4152	3152	help.exe	Firefox.exe
PID 3152 wrote to memory of 4152	3152	help.exe	Firefox.exe
PID 3152 wrote to memory of 4152	3152	help.exe	Firefox.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3536

C:\Users\Admin\AppData\Local\Temp\Цитата.exe
"C:\Users\Admin\AppData\Local\Temp\Цитата.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4992

C:\Program Files (x86)\Windows Mail\wab.exe
"C:\Program Files (x86)\Windows Mail\wab.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4728

C:\Program Files (x86)\Windows Mail\wab.exe
"C:\Program Files (x86)\Windows Mail\wab.exe"
3⤵
PID:4984

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:4720

C:\Windows\SysWOW64\help.exe
"C:\Windows\SysWOW64\help.exe"
2⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3152

C:\Windows\SysWOW64\cmd.exe
/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
3⤵
PID:3972

C:\Program Files\Mozilla Firefox\Firefox.exe
"C:\Program Files\Mozilla Firefox\Firefox.exe"
3⤵
PID:4152

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

3