Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-07-2024 06:40

General

  • Target

    DHL Shipping DOC_987796013270.exe

  • Size

    645KB

  • MD5

    51d304a31d64e8975c2cdfad3367f686

  • SHA1

    8cc59a68e3f6f6ada93abfbaeae2b6dc698cd085

  • SHA256

    a4de39a318f8fb37cf0ac7f320a6cf7f8b68a403ea26d3c5f8b82630f6693b70

  • SHA512

    e6158154334f211333430791dce7d90622b0cd90672607a2e3e1ac075b64c89c9313a0bc82196d6bbc80f036022b670fa35e6d7952d87b3e4566eeda2c0f9d59

  • SSDEEP

    12288:b51eKYx6+DaBbWTYoFnXFqdXKr87wgI7gY10ZAYbmOLPbIQdRlF6v/kR:jUo+uBsFBFMXU87QgYWaYbmOLhRv6va

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dk07

Decoy

reclam.xyz

parchmentmediaadd.com

gaolibai.site

menage-exclusif.com

ceremoniesbyjade.com

5663876.com

take3.xyz

environmentaladvocacygroup.com

fp38z.rest

elektro-vlasic.com

bollybytestv.com

udfunsd.cloud

studiomiraiarq.com

e-commercebrasil.shop

sansiddhiedu.com

draaronroughan.net

24angel.com

rjh-equestrian.com

22db3rgdg6a73pea7.vip

mintygreen-wellnessportal.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 17 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3512
    • C:\Users\Admin\AppData\Local\Temp\DHL Shipping DOC_987796013270.exe
      "C:\Users\Admin\AppData\Local\Temp\DHL Shipping DOC_987796013270.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:544
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\DHL Shipping DOC_987796013270.exe"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:512
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\YNTqAcPAvosK.exe"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1444
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YNTqAcPAvosK" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE00F.tmp"
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:700
      • C:\Users\Admin\AppData\Local\Temp\DHL Shipping DOC_987796013270.exe
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipping DOC_987796013270.exe"
        3⤵
          PID:1304
        • C:\Users\Admin\AppData\Local\Temp\DHL Shipping DOC_987796013270.exe
          "C:\Users\Admin\AppData\Local\Temp\DHL Shipping DOC_987796013270.exe"
          3⤵
            PID:3588
          • C:\Users\Admin\AppData\Local\Temp\DHL Shipping DOC_987796013270.exe
            "C:\Users\Admin\AppData\Local\Temp\DHL Shipping DOC_987796013270.exe"
            3⤵
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of AdjustPrivilegeToken
            PID:2940
        • C:\Windows\SysWOW64\cmmon32.exe
          "C:\Windows\SysWOW64\cmmon32.exe"
          2⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2736
          • C:\Windows\SysWOW64\cmd.exe
            /c del "C:\Users\Admin\AppData\Local\Temp\DHL Shipping DOC_987796013270.exe"
            3⤵
              PID:4388

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

          Filesize

          2KB

          MD5

          968cb9309758126772781b83adb8a28f

          SHA1

          8da30e71accf186b2ba11da1797cf67f8f78b47c

          SHA256

          92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

          SHA512

          4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          18KB

          MD5

          6504f47b0f640112363e029c5e4ae4a5

          SHA1

          c09ce76d76f308974111f30b4b73b2fd06e58f54

          SHA256

          8d0421965ee588cf7c94239516e1f9c603296aa7214658ab0962a58a58f08f96

          SHA512

          b1ae20be42d491357e5540f8342eeabf896e03e8af84a8aa91ed15c85224751f03eba60fce1a8eab85eac71d77da6c28a0cd863c9ae0fe05f25a1cba15bbc9cc

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qjpb1y3o.mtu.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • C:\Users\Admin\AppData\Local\Temp\tmpE00F.tmp

          Filesize

          1KB

          MD5

          b179bb95d0eecac696e6e5df8996daa5

          SHA1

          cbedf4b6e46e79a18a9a3fc4ca675580df9b5874

          SHA256

          329531979452148e44e5955b829b97f4464b5f18c8851468d37197b88a4c6fca

          SHA512

          c6b1b48eca7fda0c6f5cefafbfa497e9e64b4865912f7f54e5bb99281dd5f96a6279ac20f10af687c94596c841124d69ce3dd47acc4c276486d5aa0602e8761b

        • memory/512-62-0x0000000006310000-0x000000000632E000-memory.dmp

          Filesize

          120KB

        • memory/512-15-0x0000000074D50000-0x0000000075500000-memory.dmp

          Filesize

          7.7MB

        • memory/512-72-0x0000000006CD0000-0x0000000006D73000-memory.dmp

          Filesize

          652KB

        • memory/512-51-0x00000000755E0000-0x000000007562C000-memory.dmp

          Filesize

          304KB

        • memory/512-76-0x0000000007080000-0x000000000708A000-memory.dmp

          Filesize

          40KB

        • memory/512-49-0x0000000005D90000-0x0000000005DDC000-memory.dmp

          Filesize

          304KB

        • memory/512-14-0x00000000023D0000-0x0000000002406000-memory.dmp

          Filesize

          216KB

        • memory/512-88-0x0000000074D50000-0x0000000075500000-memory.dmp

          Filesize

          7.7MB

        • memory/512-79-0x0000000007240000-0x000000000724E000-memory.dmp

          Filesize

          56KB

        • memory/512-80-0x0000000007250000-0x0000000007264000-memory.dmp

          Filesize

          80KB

        • memory/512-18-0x0000000074D50000-0x0000000075500000-memory.dmp

          Filesize

          7.7MB

        • memory/512-50-0x00000000062D0000-0x0000000006302000-memory.dmp

          Filesize

          200KB

        • memory/512-78-0x0000000007210000-0x0000000007221000-memory.dmp

          Filesize

          68KB

        • memory/512-21-0x0000000074D50000-0x0000000075500000-memory.dmp

          Filesize

          7.7MB

        • memory/512-82-0x0000000007330000-0x0000000007338000-memory.dmp

          Filesize

          32KB

        • memory/512-74-0x0000000007010000-0x000000000702A000-memory.dmp

          Filesize

          104KB

        • memory/512-34-0x00000000057A0000-0x0000000005AF4000-memory.dmp

          Filesize

          3.3MB

        • memory/512-81-0x0000000007350000-0x000000000736A000-memory.dmp

          Filesize

          104KB

        • memory/512-48-0x0000000005CE0000-0x0000000005CFE000-memory.dmp

          Filesize

          120KB

        • memory/544-8-0x0000000006240000-0x00000000062B6000-memory.dmp

          Filesize

          472KB

        • memory/544-0-0x0000000074D5E000-0x0000000074D5F000-memory.dmp

          Filesize

          4KB

        • memory/544-46-0x0000000074D50000-0x0000000075500000-memory.dmp

          Filesize

          7.7MB

        • memory/544-9-0x0000000008C00000-0x0000000008C9C000-memory.dmp

          Filesize

          624KB

        • memory/544-7-0x00000000061D0000-0x00000000061DE000-memory.dmp

          Filesize

          56KB

        • memory/544-6-0x00000000061A0000-0x00000000061BA000-memory.dmp

          Filesize

          104KB

        • memory/544-5-0x0000000074D50000-0x0000000075500000-memory.dmp

          Filesize

          7.7MB

        • memory/544-4-0x0000000004F70000-0x0000000004F7A000-memory.dmp

          Filesize

          40KB

        • memory/544-3-0x0000000004EB0000-0x0000000004F42000-memory.dmp

          Filesize

          584KB

        • memory/544-2-0x0000000005560000-0x0000000005B04000-memory.dmp

          Filesize

          5.6MB

        • memory/544-1-0x0000000000430000-0x00000000004D2000-memory.dmp

          Filesize

          648KB

        • memory/1444-22-0x0000000004DC0000-0x0000000004DE2000-memory.dmp

          Filesize

          136KB

        • memory/1444-23-0x0000000004E60000-0x0000000004EC6000-memory.dmp

          Filesize

          408KB

        • memory/1444-77-0x0000000007220000-0x00000000072B6000-memory.dmp

          Filesize

          600KB

        • memory/1444-73-0x00000000075F0000-0x0000000007C6A000-memory.dmp

          Filesize

          6.5MB

        • memory/1444-61-0x00000000755E0000-0x000000007562C000-memory.dmp

          Filesize

          304KB

        • memory/1444-24-0x0000000005550000-0x00000000055B6000-memory.dmp

          Filesize

          408KB

        • memory/1444-17-0x0000000074D50000-0x0000000075500000-memory.dmp

          Filesize

          7.7MB

        • memory/1444-89-0x0000000074D50000-0x0000000075500000-memory.dmp

          Filesize

          7.7MB

        • memory/1444-19-0x0000000074D50000-0x0000000075500000-memory.dmp

          Filesize

          7.7MB

        • memory/1444-16-0x0000000004F20000-0x0000000005548000-memory.dmp

          Filesize

          6.2MB

        • memory/2736-75-0x00000000000A0000-0x00000000000AC000-memory.dmp

          Filesize

          48KB

        • memory/2736-90-0x0000000000AD0000-0x0000000000AFF000-memory.dmp

          Filesize

          188KB

        • memory/2940-35-0x0000000000400000-0x000000000042F000-memory.dmp

          Filesize

          188KB

        • memory/3512-93-0x0000000008020000-0x000000000819B000-memory.dmp

          Filesize

          1.5MB