Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-07-2024 06:24

General

  • Target

    SecuriteInfo.com.Win32.PWSX-gen.13937.11977.exe

  • Size

    691KB

  • MD5

    c2ae4fdb661a151be4876289ed7f8261

  • SHA1

    f8fbb8b8ddb55aacc20449ff2bd5d671e4cbb9fa

  • SHA256

    d58780d1d574bfe77c6f9cfad1cf4b51522231b2699081befd5bbd15f7309aa0

  • SHA512

    2642eac12e6a42fbd503621871802da278e0c68a4678675ddbe71f66d7a2b7d0ed8a22640c13d153ea63bcb33f7f13ae32eaa3e444fc451c64a1839d8cc91c89

  • SSDEEP

    12288:luCDWx2PQfnESfZ0nl+xD4u1JW31MlxwXY5oMY3tQMmVHMe3+L4Ull0l8fkR:/awMnESR0nl+Z9OSXwXuoaVse3+sCie6

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

45er

Decoy

depotpulsa.com

k2bilbao.online

bb4uoficial.com

rwc666.club

us-pservice.cyou

tricegottreats.com

zsystems.pro

qudouyin6.com

sfumaturedamore.net

pcetyy.icu

notbokin.online

beqprod.tech

flipbuilding.com

errormitigationzoo.com

zj5u603.xyz

jezzatravel.com

zmdniavysyi.shop

quinnsteele.com

522334.com

outdoorshopping.net

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 4 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3580
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.13937.11977.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.13937.11977.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2324
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\sXqUfHySpG.exe"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3736
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sXqUfHySpG" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEFCE.tmp"
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:4928
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:2928
    • C:\Windows\SysWOW64\wscript.exe
      "C:\Windows\SysWOW64\wscript.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1444
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        3⤵
          PID:2736

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mac5qqur.d3v.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\tmpEFCE.tmp

      Filesize

      1KB

      MD5

      eefd745ec5c7e436a1ff72bb47f57c2e

      SHA1

      7d55b1eb3e7d71739a42f32918caab02a03ba5f3

      SHA256

      93fa759dbab96935d333be853627e71d3535d90b6ceca21527b6af4e55d50bbd

      SHA512

      4948c6b1347e9b918043eb7c0e7e58685515ab93b58d20f3caaa0c59e2312ef8172147837992b4fed7ed164b5f0dd1d83538d5332f45c26000ffa824337ed5ae

    • memory/1444-74-0x0000000000240000-0x0000000000267000-memory.dmp

      Filesize

      156KB

    • memory/1444-76-0x0000000000F40000-0x0000000000F6F000-memory.dmp

      Filesize

      188KB

    • memory/2324-6-0x0000000005EA0000-0x00000000061F4000-memory.dmp

      Filesize

      3.3MB

    • memory/2324-5-0x0000000074A10000-0x00000000751C0000-memory.dmp

      Filesize

      7.7MB

    • memory/2324-40-0x0000000074A10000-0x00000000751C0000-memory.dmp

      Filesize

      7.7MB

    • memory/2324-7-0x0000000005700000-0x0000000005712000-memory.dmp

      Filesize

      72KB

    • memory/2324-8-0x0000000007030000-0x0000000007052000-memory.dmp

      Filesize

      136KB

    • memory/2324-9-0x0000000007010000-0x000000000702A000-memory.dmp

      Filesize

      104KB

    • memory/2324-10-0x0000000006A00000-0x0000000006A0E000-memory.dmp

      Filesize

      56KB

    • memory/2324-11-0x0000000006A20000-0x0000000006A96000-memory.dmp

      Filesize

      472KB

    • memory/2324-12-0x0000000006CE0000-0x0000000006D7C000-memory.dmp

      Filesize

      624KB

    • memory/2324-0-0x0000000074A1E000-0x0000000074A1F000-memory.dmp

      Filesize

      4KB

    • memory/2324-26-0x0000000074A1E000-0x0000000074A1F000-memory.dmp

      Filesize

      4KB

    • memory/2324-4-0x00000000054A0000-0x00000000054AA000-memory.dmp

      Filesize

      40KB

    • memory/2324-3-0x00000000053E0000-0x0000000005472000-memory.dmp

      Filesize

      584KB

    • memory/2324-27-0x0000000074A10000-0x00000000751C0000-memory.dmp

      Filesize

      7.7MB

    • memory/2324-2-0x00000000058F0000-0x0000000005E94000-memory.dmp

      Filesize

      5.6MB

    • memory/2324-1-0x0000000000AD0000-0x0000000000B7E000-memory.dmp

      Filesize

      696KB

    • memory/2928-24-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/2928-75-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/2928-38-0x0000000001650000-0x000000000199A000-memory.dmp

      Filesize

      3.3MB

    • memory/2928-41-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/2928-42-0x00000000011A0000-0x00000000011B4000-memory.dmp

      Filesize

      80KB

    • memory/3580-45-0x00000000091D0000-0x0000000009353000-memory.dmp

      Filesize

      1.5MB

    • memory/3580-79-0x0000000007C00000-0x0000000007CDD000-memory.dmp

      Filesize

      884KB

    • memory/3736-17-0x00000000022B0000-0x00000000022E6000-memory.dmp

      Filesize

      216KB

    • memory/3736-25-0x0000000074A10000-0x00000000751C0000-memory.dmp

      Filesize

      7.7MB

    • memory/3736-43-0x0000000005BC0000-0x0000000005BDE000-memory.dmp

      Filesize

      120KB

    • memory/3736-44-0x0000000005C60000-0x0000000005CAC000-memory.dmp

      Filesize

      304KB

    • memory/3736-21-0x0000000004BB0000-0x0000000004C16000-memory.dmp

      Filesize

      408KB

    • memory/3736-46-0x000000007FC80000-0x000000007FC90000-memory.dmp

      Filesize

      64KB

    • memory/3736-47-0x00000000061D0000-0x0000000006202000-memory.dmp

      Filesize

      200KB

    • memory/3736-48-0x00000000752A0000-0x00000000752EC000-memory.dmp

      Filesize

      304KB

    • memory/3736-58-0x0000000006190000-0x00000000061AE000-memory.dmp

      Filesize

      120KB

    • memory/3736-59-0x0000000002370000-0x0000000002380000-memory.dmp

      Filesize

      64KB

    • memory/3736-60-0x0000000006BD0000-0x0000000006C73000-memory.dmp

      Filesize

      652KB

    • memory/3736-61-0x0000000007530000-0x0000000007BAA000-memory.dmp

      Filesize

      6.5MB

    • memory/3736-62-0x0000000006EE0000-0x0000000006EFA000-memory.dmp

      Filesize

      104KB

    • memory/3736-63-0x0000000006F60000-0x0000000006F6A000-memory.dmp

      Filesize

      40KB

    • memory/3736-64-0x0000000007160000-0x00000000071F6000-memory.dmp

      Filesize

      600KB

    • memory/3736-65-0x00000000070E0000-0x00000000070F1000-memory.dmp

      Filesize

      68KB

    • memory/3736-66-0x0000000007110000-0x000000000711E000-memory.dmp

      Filesize

      56KB

    • memory/3736-67-0x0000000007120000-0x0000000007134000-memory.dmp

      Filesize

      80KB

    • memory/3736-68-0x0000000007220000-0x000000000723A000-memory.dmp

      Filesize

      104KB

    • memory/3736-69-0x0000000007200000-0x0000000007208000-memory.dmp

      Filesize

      32KB

    • memory/3736-72-0x0000000074A10000-0x00000000751C0000-memory.dmp

      Filesize

      7.7MB

    • memory/3736-22-0x0000000004C20000-0x0000000004C86000-memory.dmp

      Filesize

      408KB

    • memory/3736-23-0x0000000074A10000-0x00000000751C0000-memory.dmp

      Filesize

      7.7MB

    • memory/3736-18-0x0000000004F20000-0x0000000005548000-memory.dmp

      Filesize

      6.2MB

    • memory/3736-19-0x0000000074A10000-0x00000000751C0000-memory.dmp

      Filesize

      7.7MB