Managed XDR

c-users-user-desktop-1...tom_clearance.xls-copy (FormBookFormgrabber) — отчёт о динамическом анализе вредоносного файла

Информация о файле

Имя файла
c-users-user-desktop-144__dhl_awb_custom_clearance.xls-copy
Тип файла
Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 00:00:00 2006, Last Saved Time/Date: Tue Jan 14 17:08:36 2025, Security: 1
Размер файла
871 KB
Первое обнаружение
Последнее обнаружение

Окружение

w10/x86 en

Хеши

SHA1
f056191e00973bac1dc2b6ae2305014c55313cc9
SHA256
6568855704f3f5bec7bf349ce3b5a184642bb84a8d6e672a423862aa94e71e10
MD5
591b0e16266e2df90a8ca5e0665effcc

Вредоносное ПО

  • FormBookFormgrabber

Сигнатуры

Execution

T1059.001 suspicious_powershell: Suspicious document behaviour (creates powershell process)
T1203 office_exploit_creates_process: The document exhibits suspicious behaviour (spawns a process)
T1203 office_exploit_http: The document exhibits suspicious behaviour (performs HTTP requests)
T1059 autoit: AutoIt script execution detected
T1059.001 suspicious_process: Spawns a suspicious process
T1059.003 suspicious_process: Spawns a suspicious process
T1064 office_macros: The document contains macro
T1204.002 office_com_load: Microsoft Office loads COM DLL files (indicator of COM usage in macros)

Privilege Escalation

T1055.012 injection_runpe: Injects code into another process
T1055 sets_debug_registers: Sets debug registers for a thread in a different process
T1134 sets_privilegies_via_adjusttokenprivileges: Sets process privilege via AdjustTokenPrivileges
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1055.012 injection_runpe: Injects code into another process
T1027.002 unnamed_memory_regions_contains_pe: One or several unnamed memory regions are PE files
T1027.002 unnamed_memory_regions: Code was executed in unnamed regions
T1055 sets_debug_registers: Sets debug registers for a thread in a different process
T1497 antidbg_query_system: Checks for kernel debugger (SystemKernelDebuggerInformation)
T1497 antidbg_query_process: Checks if the process is being debugged (ProcessDebugPort)
T1497.003 antisandbox_idletime: Detects Windows Idle Time to determine the uptime
T1027.004 compiles_code: Compiles C# code
T1070 stealth_window: A process created a hidden window
T1497 evasion_trustrecords: Attempts to detect Sandbox exploring trusted documents
T1134 sets_privilegies_via_adjusttokenprivileges: Sets process privilege via AdjustTokenPrivileges
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process
T1064 office_macros: The document contains macro

Discovery

T1497 antidbg_query_system: Checks for kernel debugger (SystemKernelDebuggerInformation)
T1497 antidbg_query_process: Checks if the process is being debugged (ProcessDebugPort)
T1497.003 antisandbox_idletime: Detects Windows Idle Time to determine the uptime
T1082 uses_windows_utilities: Uses Windows utilities for basic Windows functionality
T1518 locates_browser: Attempts to identify where browsers are installed
T1497 evasion_trustrecords: Attempts to detect Sandbox exploring trusted documents
T1082 recon_systeminfo: Collects system information (ipconfig, netstat, systeminfo, net)
T1083 checks_recent_files: Attempt to check recently opened files through registry

Command and Control

T1071.001 office_exploit_http: The document exhibits suspicious behaviour (performs HTTP requests)
T1071.004 office_exploit_dns: The document exhibits suspicious behaviour (performs DNS requests)
T1071.001 network_http: Performs HTTP requests
T1071.001 wininet_https: Performs HTTP/HTTPS requests using WinInet

Other

yara_rules: Static rules
suricata_alert: Malicious traffic detected
executes_dropped_exe: Executes dropped exe files
ce_info: Formbook Configuration Data found
formbook: FormBook stealer found
creates_exe: Creates executable files in the file system
unpacker_wrong_base: Possibly, an error occured in the file unpacker
suspicious_process_network: Unusual process network activity detected
network_powershell: Powershell process network connection detected
office_summary: The document contains suspicious metadata
create_rpc_bindings: Creates RPC connection
creates_suspended_process: Creates suspended process
break_limit_exceeded: Warning: function calls limit has been exceeded
message_box: Displays a message
test_check_service: Starts services
checktokenmembership: Checks user token with CheckTokenMembership call

Похожие отчёты