Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
25-12-2024 19:11
General
-
Target
Remittance Scan DOC-2029293#PI207-048.pptx.exe
-
Size
602KB
-
MD5
7619630836e31219892819641fc56773
-
SHA1
23ca70fb00964a3059a6838bc906a511741a3d38
-
SHA256
4bbda63f732b2341b67208a1f237db39488fed540f55ee994a641a0a133ec0ac
-
SHA512
c7703054434c9c3c2a7074e470f89d61c8455fb466e14a34b436460c1bd17299a5976d87b504a695c52f04d4f6ca9dc4f697a18bc9f8e17baade5bda175467a4
-
SSDEEP
12288:6+ZRT7+v5UH3Tyzgj3pIXMRg9A1GKZHNYPzodG5hIE8Tv:6e+OH32EDSX0oA1GUKzodG3
Malware Config
Extracted
formbook
4.1
svh9
jejupassive.com
schoolrepetit.site
ganfraud.com
kuoretkauppa.com
bgdocs.online
climatechampionsfund.info
lamaletadeagustin.com
jessicaolear.com
oncologyacademe.com
aurum.academy
thaliasoap.com
tempeindo.online
alnajem-law.com
eracab.com
ozerk.site
3drinkmin.com
synergygroup.fitness
foundyourlabel.info
bonniebagay.com
wcncusa.com
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook family
-
Formbook payload 4 IoCs
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
-
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext 4 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 40 IoCs
-
Suspicious behavior: MapViewOfSection 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Remittance Scan DOC-2029293#PI207-048.pptx.exe"C:\Users\Admin\AppData\Local\Temp\Remittance Scan DOC-2029293#PI207-048.pptx.exe"2⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Remittance Scan DOC-2029293#PI207-048.pptx.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Remittance Scan DOC-2029293#PI207-048.pptx.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
392KB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
4KB
-
Filesize
40KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
120KB
-
Filesize
408KB
-
Filesize
7.7MB
-
Filesize
184KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
3.3MB
-
Filesize
184KB
-
Filesize
80KB
-
Filesize
184KB
-
Filesize
80KB
-
Filesize
184KB
-
Filesize
964KB
-
Filesize
728KB
-
Filesize
964KB
-
Filesize
728KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB