Resubmissions

16-07-2024 22:15

240716-16kzrswapd 10

16-07-2024 12:42

240716-pxbtyswbqa 10

Analysis

  • max time kernel
    299s
  • max time network
    272s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240709-en
  • resource tags

    arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    16-07-2024 22:15

General

  • Target

    DHL_TOC2_2407081728458457.pdf.exe

  • Size

    1.0MB

  • MD5

    f6ed869b733b1f2aa3bdd06040f3372a

  • SHA1

    7075acf1c62e44653f5c834a14b56cd342f0ae5a

  • SHA256

    05b3ae9c167cf06edf52dc99127dfd516e24ead51e9da7d3fbf230124e7063e1

  • SHA512

    cba7753022eaa43f2d1bc77c73c7276824545e3083eee5e321f8be5b729bad3b01fe84108cbc5bdbe5fca7df1e802a55b36ef19292b1874a1cb514af5c16c582

  • SSDEEP

    24576:PAHnh+eWsN3skA4RV1Hom2KXMmHasscwkKNvvD5:yh+ZkldoPK8Yassht

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

rn94

Decoy

st68v.xyz

conciergenotary.net

qwechaotk.top

rtpdonatoto29.xyz

8ad.xyz

powermove.top

cameras-30514.bond

vanguardcoffee.shop

umoe53fxc1bsujv.buzz

consultoriamax.net

hplxx.com

ndu.wtf

yzh478c.xyz

bigbrown999.site

xiake07.asia

resdai.xyz

the35678.shop

ba6rf.rest

ceo688.com

phimxhot.xyz

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 4 IoCs
  • Blocklisted process makes network request 2 IoCs
  • Drops startup file 4 IoCs
  • Executes dropped EXE 2 IoCs
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 7 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 7 IoCs
  • Modifies registry class 64 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 3 IoCs
  • Suspicious behavior: MapViewOfSection 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 54 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3280
    • C:\Users\Admin\AppData\Local\Temp\DHL_TOC2_2407081728458457.pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\DHL_TOC2_2407081728458457.pdf.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4120
      • C:\Users\Admin\AppData\Local\directory\name.exe
        "C:\Users\Admin\AppData\Local\Temp\DHL_TOC2_2407081728458457.pdf.exe"
        3⤵
        • Drops startup file
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:2380
        • C:\Windows\SysWOW64\svchost.exe
          "C:\Users\Admin\AppData\Local\Temp\DHL_TOC2_2407081728458457.pdf.exe"
          4⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:4984
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /0
      2⤵
      • Drops startup file
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1364
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\SysWOW64\rundll32.exe"
      2⤵
      • Blocklisted process makes network request
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1452
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Windows\SysWOW64\svchost.exe"
        3⤵
          PID:4284
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\test.txt
        2⤵
        • Opens file in notepad (likely ransom note)
        PID:2200
      • C:\Users\Admin\AppData\Local\directory\name.exe
        "C:\Users\Admin\AppData\Local\directory\name.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:4204
        • C:\Windows\SysWOW64\svchost.exe
          "C:\Users\Admin\AppData\Local\directory\name.exe"
          3⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: MapViewOfSection
          PID:2692
      • C:\Windows\SysWOW64\explorer.exe
        "C:\Windows\SysWOW64\explorer.exe"
        2⤵
          PID:464
      • C:\Windows\System32\rundll32.exe
        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
        1⤵
          PID:3576
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k SDRSVC
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4964
        • C:\Windows\system32\OpenWith.exe
          C:\Windows\system32\OpenWith.exe -Embedding
          1⤵
          • Modifies registry class
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:560
          • C:\Program Files\Microsoft Office\root\Office16\Winword.exe
            "C:\Program Files\Microsoft Office\root\Office16\Winword.exe" /n "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs"
            2⤵
            • Drops startup file
            • Checks processor information in registry
            • Enumerates system info in registry
            • Suspicious behavior: AddClipboardFormatListener
            • Suspicious use of SetWindowsHookEx
            PID:3352
        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
          1⤵
          • Suspicious use of SetWindowsHookEx
          PID:3676

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\Mazatl

          Filesize

          28KB

          MD5

          e0a5cf114d58f8ee0ff4291a867fd137

          SHA1

          1b158ff65388347954508f5b7f199371e19223e3

          SHA256

          eafeb8c80d4ad126dadef3f52db44f656a8aeef68287af04a50e6fa881b9140e

          SHA512

          8546fef189b766616f1d99e98dba8b46809e2f5097c7ab931096ff3838439a2e18b4a2a61cbd0d318c0aa0ff014e883711210f5cdeaa6a021aaa57f628fb7ac4

        • C:\Users\Admin\AppData\Local\Temp\TCD57F0.tmp\gb.xsl

          Filesize

          262KB

          MD5

          51d32ee5bc7ab811041f799652d26e04

          SHA1

          412193006aa3ef19e0a57e16acf86b830993024a

          SHA256

          6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97

          SHA512

          5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

        • C:\Users\Admin\AppData\Local\Temp\autA218.tmp

          Filesize

          179KB

          MD5

          8f00c6312ecadd84097fa759d4df7fc2

          SHA1

          bff90ea1e4bf123c54eeffe5337c7f43067e9828

          SHA256

          7cc40b0a90a7248a40b11eadd9a1c059758dfb69731749a103cc4cf21985f8d0

          SHA512

          1f63f9ec423c24c4012ab5464ebea81d4b251a00a6cc38e2fd021ddf84ad51306363fa96bb544c3b83a4d8cc28524c0b1a082b80ec22f2cb4db775fd71025b6c

        • C:\Users\Admin\AppData\Local\Temp\autA229.tmp

          Filesize

          9KB

          MD5

          6f11e5dd4b19acaef0d6e1f3f6e5cfb4

          SHA1

          0ded7178b036bfa3b7fba86ecb88000a372791ab

          SHA256

          ff110fbcc707afdc95d485e379ffeefa6db7b9eef3535e22a2f73c6998c04963

          SHA512

          a6a2b7103178ef4932a62574b94197cacfd7711c58f4b1c05d78d58ad0c8e9d18856ecc7e3fe1f3411c9e81b0666675b0f512e609b8808867ffe6396d96b23f2

        • C:\Users\Admin\AppData\Local\Temp\niellists

          Filesize

          185KB

          MD5

          58078733b08c9abd4a1d6945eedd33f7

          SHA1

          9d3b0fa2d1d78bc91875e656c82ac9c0a78ab5e2

          SHA256

          b9934664b8c472743c1170afd0acfbbc1d6a299ade5451e4dfd7dee18d1a60c7

          SHA512

          87b2f00bb55166bfc1d3da8a3f65648fb9cc0690ccd47ec70f589be1808351c13904fc9ab8e2b253e59ff1e8d90e4e75d22f106627312ca26d2ff098166a2f40

        • C:\Users\Admin\AppData\Local\directory\name.exe

          Filesize

          1.0MB

          MD5

          f6ed869b733b1f2aa3bdd06040f3372a

          SHA1

          7075acf1c62e44653f5c834a14b56cd342f0ae5a

          SHA256

          05b3ae9c167cf06edf52dc99127dfd516e24ead51e9da7d3fbf230124e7063e1

          SHA512

          cba7753022eaa43f2d1bc77c73c7276824545e3083eee5e321f8be5b729bad3b01fe84108cbc5bdbe5fca7df1e802a55b36ef19292b1874a1cb514af5c16c582

        • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

          Filesize

          305B

          MD5

          76eea5cac5570de6a36d8f8c509b6088

          SHA1

          5f4ca779b3ad7a44864465026888dd239b2333db

          SHA256

          602c714add305bdd48f3bb39fae2ab896cd8d0321a2d721104574b92d7ba9793

          SHA512

          6e011e89d7fdd94d0bcb7f9e48ce3d06fa6222b0ddbeb7288e26c2218975bd1a6562d9785f54df23601595cb524e49b87ba1752b198560f1c2287d49e91366a4

        • C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

          Filesize

          2B

          MD5

          f3b25701fe362ec84616a93a45ce9998

          SHA1

          d62636d8caec13f04e28442a0a6fa1afeb024bbb

          SHA256

          b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

          SHA512

          98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms

          Filesize

          7KB

          MD5

          2595c393965508c2d12ac0706fe0bbcf

          SHA1

          49b338c5bb213c1842e768e06cfc1ba47e9076bd

          SHA256

          a6db86172e953f361280ed45258cdd5225ae27b1abefc82d57e3d9a51a4672f9

          SHA512

          8b3489b14893051315cac3d95987470624b25132d86e981f34e66ad51597de642d2c2bee931e49d4434cc8346fcf4909ef3a01e64db1077daaa4f5ffc19b20b4

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms

          Filesize

          7KB

          MD5

          f7fc3d261a9c0dcbe4441b15020e9b2b

          SHA1

          f99757accb8c3fc17bc48dbefec21507c0e6c30f

          SHA256

          6d282a872743f8ff55b19478f7d9348a60df949ebc86aceb599f78425993be3b

          SHA512

          8f77e608c0ea249d8f45d7beb5115488d6e36b6c58d7942e1039e4126bc702843a006db1d6753f97e5413a0059d64b91efbe70cb8ab35038c04c798d3d217032

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs

          Filesize

          268B

          MD5

          cabb1f8d30a7147e4fb96b9be21a18ed

          SHA1

          e8d7d546f002126219644f2d21426f4a5ed0131c

          SHA256

          460491914d4528305288989dbd120da00ceb14a9ff8436c30485876e9a27bad2

          SHA512

          f36ed295204e99d9f3e5107617fdba641b2cb06325508d1dac4b337366b04c8937582ad4609a7f8e8e7d1900e4b75596ccad4d717687d9d3f45ccc72099031de

        • memory/1364-37-0x000001A992CF0000-0x000001A992CF1000-memory.dmp

          Filesize

          4KB

        • memory/1364-41-0x000001A992CF0000-0x000001A992CF1000-memory.dmp

          Filesize

          4KB

        • memory/1364-47-0x000001A992CF0000-0x000001A992CF1000-memory.dmp

          Filesize

          4KB

        • memory/1364-46-0x000001A992CF0000-0x000001A992CF1000-memory.dmp

          Filesize

          4KB

        • memory/1364-45-0x000001A992CF0000-0x000001A992CF1000-memory.dmp

          Filesize

          4KB

        • memory/1364-44-0x000001A992CF0000-0x000001A992CF1000-memory.dmp

          Filesize

          4KB

        • memory/1364-43-0x000001A992CF0000-0x000001A992CF1000-memory.dmp

          Filesize

          4KB

        • memory/1364-42-0x000001A992CF0000-0x000001A992CF1000-memory.dmp

          Filesize

          4KB

        • memory/1364-36-0x000001A992CF0000-0x000001A992CF1000-memory.dmp

          Filesize

          4KB

        • memory/1364-35-0x000001A992CF0000-0x000001A992CF1000-memory.dmp

          Filesize

          4KB

        • memory/1452-50-0x0000000000830000-0x000000000083E000-memory.dmp

          Filesize

          56KB

        • memory/1452-52-0x0000000000830000-0x000000000083E000-memory.dmp

          Filesize

          56KB

        • memory/1452-53-0x0000000000C50000-0x0000000000C7F000-memory.dmp

          Filesize

          188KB

        • memory/3280-55-0x0000000003BD0000-0x0000000003C96000-memory.dmp

          Filesize

          792KB

        • memory/3280-58-0x0000000006A60000-0x0000000006B70000-memory.dmp

          Filesize

          1.1MB

        • memory/3280-61-0x0000000015B00000-0x0000000015B10000-memory.dmp

          Filesize

          64KB

        • memory/3280-69-0x0000000015C00000-0x0000000015C10000-memory.dmp

          Filesize

          64KB

        • memory/3280-33-0x0000000003BD0000-0x0000000003C96000-memory.dmp

          Filesize

          792KB

        • memory/3352-90-0x00007FFE3E2B0000-0x00007FFE3E2C0000-memory.dmp

          Filesize

          64KB

        • memory/3352-435-0x00007FFE405F0000-0x00007FFE40600000-memory.dmp

          Filesize

          64KB

        • memory/3352-87-0x00007FFE405F0000-0x00007FFE40600000-memory.dmp

          Filesize

          64KB

        • memory/3352-88-0x00007FFE405F0000-0x00007FFE40600000-memory.dmp

          Filesize

          64KB

        • memory/3352-89-0x00007FFE3E2B0000-0x00007FFE3E2C0000-memory.dmp

          Filesize

          64KB

        • memory/3352-83-0x00007FFE405F0000-0x00007FFE40600000-memory.dmp

          Filesize

          64KB

        • memory/3352-85-0x00007FFE405F0000-0x00007FFE40600000-memory.dmp

          Filesize

          64KB

        • memory/3352-84-0x00007FFE405F0000-0x00007FFE40600000-memory.dmp

          Filesize

          64KB

        • memory/3352-434-0x00007FFE405F0000-0x00007FFE40600000-memory.dmp

          Filesize

          64KB

        • memory/3352-433-0x00007FFE405F0000-0x00007FFE40600000-memory.dmp

          Filesize

          64KB

        • memory/3352-436-0x00007FFE405F0000-0x00007FFE40600000-memory.dmp

          Filesize

          64KB

        • memory/4120-10-0x00000000005F0000-0x00000000005F4000-memory.dmp

          Filesize

          16KB

        • memory/4984-31-0x0000000000400000-0x000000000042F000-memory.dmp

          Filesize

          188KB

        • memory/4984-32-0x0000000001880000-0x0000000001895000-memory.dmp

          Filesize

          84KB

        • memory/4984-51-0x0000000000400000-0x000000000042F000-memory.dmp

          Filesize

          188KB

        • memory/4984-29-0x0000000001900000-0x0000000001C56000-memory.dmp

          Filesize

          3.3MB

        • memory/4984-28-0x0000000000400000-0x000000000042F000-memory.dmp

          Filesize

          188KB