| File name: | malicious-email-1814-UTC.eml |
| Full analysis: | https://app.any.run/tasks/f871a84e-e809-4a8b-9c76-bc11a0d3aba8 |
| Verdict: | Malicious activity |
| Threats: | FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus. |
| Analysis date: | April 29, 2025, 14:50:23 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | message/rfc822 |
| File info: | RFC 822 mail, Non-ISO extended-ASCII text, with CRLF line terminators |
| MD5: | AB0161DCE4B3DA647CE46269BAB3405C |
| SHA1: | A1ECA086CDCEB47DB3F75FBE9621C7C075118649 |
| SHA256: | 1680370D9EE294BA8A3BEBCFFC3995FCEE6906D3201281BF85EF39537C7B3B92 |
| SSDEEP: | 6144:uvhxWOuktmi+44iFfCOmc6++wg+wSo0uE0kbF3/IoqNqdmib+GC:BEJVhL6KwSbuE0QF3/Iocqnc |
MALICIOUS
Connects to the CnC server
- explorer.exe (PID: 5492)
FORMBOOK has been detected (SURICATA)
- explorer.exe (PID: 5492)
FORMBOOK has been detected (YARA)
- chkdsk.exe (PID: 4188)
SUSPICIOUS
Reads Microsoft Outlook installation path
- explorer.exe (PID: 5492)
Contacting a server suspected of hosting an CnC
- explorer.exe (PID: 5492)
Application launched itself
- ohmxwpep8pedo0q8.exe (PID: 2644)
- Proforma Invoice P101092292891 TT slip pdf.rar.exe (PID: 2420)
Executable content was dropped or overwritten
- explorer.exe (PID: 5492)
- dllhost.exe (PID: 8172)
Starts CMD.EXE for commands execution
- chkdsk.exe (PID: 4188)
INFO
The sample compiled with chinese language support
- OUTLOOK.EXE (PID: 2564)
- explorer.exe (PID: 5492)
- dllhost.exe (PID: 8172)
- WinRAR.exe (PID: 8080)
- WinRAR.exe (PID: 668)
Reads security settings of Internet Explorer
- explorer.exe (PID: 5492)
Reads Microsoft Office registry keys
- explorer.exe (PID: 5492)
Executable content was dropped or overwritten
- WinRAR.exe (PID: 668)
- WinRAR.exe (PID: 8080)
Manual execution by a user
- WinRAR.exe (PID: 668)
- Proforma Invoice P101092292891 TT slip pdf.rar.exe (PID: 2420)
- chkdsk.exe (PID: 4188)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Formbook
(PID) Process(4188) chkdsk.exe
C2www.ellentscm.info/ob/
Strings (79)USERNAME
LOCALAPPDATA
USERPROFILE
APPDATA
TEMP
ProgramFiles
CommonProgramFiles
ALLUSERSPROFILE
/c copy "
/c del "
\Run
\Policies
\Explorer
\Registry\User
\Registry\Machine
\SOFTWARE\Microsoft\Windows\CurrentVersion
Office\15.0\Outlook\Profiles\Outlook\
NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\
\SOFTWARE\Mozilla\Mozilla
\Mozilla
Username:
Password:
formSubmitURL
usernameField
encryptedUsername
encryptedPassword
\logins.json
\signons.sqlite
\Microsoft\Vault\
SELECT encryptedUsername, encryptedPassword, formSubmitURL FROM moz_logins
\Google\Chrome\User Data\Default\Login Data
SELECT origin_url, username_value, password_value FROM logins
.exe
.com
.scr
.pif
.cmd
.bat
ms
win
gdi
mfc
vga
igfx
user
help
config
update
regsvc
chkdsk
systray
audiodg
certmgr
autochk
taskhost
colorcpl
services
IconCache
ThumbCache
Cookies
SeDebugPrivilege
SeShutdownPrivilege
\BaseNamedObjects
config.php
POST
HTTP/1.1
Host:
Connection: close
Content-Length:
Cache-Control: no-cache
Origin: http://
User-Agent: Mozilla Firefox/4.0
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://
Accept-Language: en-US
Accept-Encoding: gzip, deflate
dat=
f-start
f-end
Decoy C2 (64)maneresidenties.com
daylighttheatre.foundation
xn--jjq193ajmav75c.com
gatinhas.net
cerebrumfriend.info
gikyokudan.net
sosssou.com
texowipu14.win
askserene.com
lookbooks.net
salomst.reisen
hotsexchatwithmilfs.com
marcelaeerico.com
school79.info
zhongguowuzixu.com
b106879210.win
bishermarket.com
coincaucus.com
incomecan.net
alldayexchange.com
107hamiltonroad.com
claireaumatcha.com
xn--fiqs8spwb006g.com
jufa123.com
kowollik.email
sparkyoursukha.com
www8458v.com
jvfilmmakers.com
yifch.info
yunshangcms.com
seorowipe.com
gotrkx.com
xiangxiangbi.com
youxinyidai.com
turizmbelgesi.online
nolahmattresscoupon.com
goaskincancerhelpok.live
amiratu.com
dapsic.men
b2bcopybyjane.com
prozactruth.net
06mm9dj84r.com
heapto.com
xn--trivioonline-ehb.com
weddingpetattendant.com
4legs1heart.com
privacyguide.net
theitblogs.com
lukshan.com
juhanzaitu.com
100placesbandb.com
studioa93.com
canamultimedia.com
preprod.football
behrimen.com
hylexus.com
iangng.com
harrisrobertslimited.com
b3s669u-fzy.com
templatediprova.info
incoalth.com
adcecija.com
pleredberseka.com
refuright.com
Total processes
157
Monitored processes
22
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 516 | C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding | C:\Windows\System32\rundll32.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 632 | C:\WINDOWS\System32\slui.exe -Embedding | C:\Windows\System32\slui.exe | svchost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Activation Client Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 668 | "C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Downloads\Proforma Invoice P101092292891 TT slip pdf.rar.zip" "?\" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 Modules
| |||||||||||||||
| 1040 | "C:\Users\admin\Downloads\Proforma Invoice P101092292891 TT slip pdf.rar\Proforma Invoice P101092292891 TT slip pdf.rar.exe" | C:\Users\admin\Downloads\Proforma Invoice P101092292891 TT slip pdf.rar\Proforma Invoice P101092292891 TT slip pdf.rar.exe | — | Proforma Invoice P101092292891 TT slip pdf.rar.exe | |||||||||||
User: admin Company: lexus Integrity Level: MEDIUM Description: lexus Exit code: 0 Version: 8.05 Modules
| |||||||||||||||
| 2196 | C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2420 | "C:\Users\admin\Downloads\Proforma Invoice P101092292891 TT slip pdf.rar\Proforma Invoice P101092292891 TT slip pdf.rar.exe" | C:\Users\admin\Downloads\Proforma Invoice P101092292891 TT slip pdf.rar\Proforma Invoice P101092292891 TT slip pdf.rar.exe | — | explorer.exe | |||||||||||
User: admin Company: lexus Integrity Level: MEDIUM Description: lexus Exit code: 0 Version: 8.05 Modules
| |||||||||||||||
| 2564 | "C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml C:\Users\admin\AppData\Local\Temp\malicious-email-1814-UTC.eml | C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Outlook Version: 16.0.16026.20146 Modules
| |||||||||||||||
| 2644 | "C:\Program Files (x86)\Zgzndsznp\ohmxwpep8pedo0q8.exe" | C:\Program Files (x86)\Zgzndsznp\ohmxwpep8pedo0q8.exe | — | explorer.exe | |||||||||||
User: admin Company: lexus Integrity Level: MEDIUM Description: lexus Exit code: 0 Version: 8.05 Modules
| |||||||||||||||
| 4152 | "C:\Windows\SysWOW64\WWAHost.exe" | C:\Windows\SysWOW64\WWAHost.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft WWA Host Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4188 | "C:\Windows\SysWOW64\chkdsk.exe" | C:\Windows\SysWOW64\chkdsk.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Check Disk Utility Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
Formbook(PID) Process(4188) chkdsk.exe C2www.ellentscm.info/ob/ Strings (79)USERNAME LOCALAPPDATA USERPROFILE APPDATA TEMP ProgramFiles CommonProgramFiles ALLUSERSPROFILE /c copy " /c del " \Run \Policies \Explorer \Registry\User \Registry\Machine \SOFTWARE\Microsoft\Windows\CurrentVersion Office\15.0\Outlook\Profiles\Outlook\ NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ \SOFTWARE\Mozilla\Mozilla \Mozilla Username: Password: formSubmitURL usernameField encryptedUsername encryptedPassword \logins.json \signons.sqlite \Microsoft\Vault\ SELECT encryptedUsername, encryptedPassword, formSubmitURL FROM moz_logins \Google\Chrome\User Data\Default\Login Data SELECT origin_url, username_value, password_value FROM logins .exe .com .scr .pif .cmd .bat ms win gdi mfc vga igfx user help config update regsvc chkdsk systray audiodg certmgr autochk taskhost colorcpl services IconCache ThumbCache Cookies SeDebugPrivilege SeShutdownPrivilege \BaseNamedObjects config.php POST HTTP/1.1 Host: Connection: close Content-Length: Cache-Control: no-cache Origin: http:// User-Agent: Mozilla Firefox/4.0 Content-Type: application/x-www-form-urlencoded Accept: */* Referer: http:// Accept-Language: en-US Accept-Encoding: gzip, deflate
dat= f-start f-end Decoy C2 (64)maneresidenties.com daylighttheatre.foundation xn--jjq193ajmav75c.com gatinhas.net cerebrumfriend.info gikyokudan.net sosssou.com texowipu14.win askserene.com lookbooks.net salomst.reisen hotsexchatwithmilfs.com marcelaeerico.com school79.info zhongguowuzixu.com b106879210.win bishermarket.com coincaucus.com incomecan.net alldayexchange.com 107hamiltonroad.com claireaumatcha.com xn--fiqs8spwb006g.com jufa123.com kowollik.email sparkyoursukha.com www8458v.com jvfilmmakers.com yifch.info yunshangcms.com seorowipe.com gotrkx.com xiangxiangbi.com youxinyidai.com turizmbelgesi.online nolahmattresscoupon.com goaskincancerhelpok.live amiratu.com dapsic.men b2bcopybyjane.com prozactruth.net 06mm9dj84r.com heapto.com xn--trivioonline-ehb.com weddingpetattendant.com 4legs1heart.com privacyguide.net theitblogs.com lukshan.com juhanzaitu.com 100placesbandb.com studioa93.com canamultimedia.com preprod.football behrimen.com hylexus.com iangng.com harrisrobertslimited.com b3s669u-fzy.com templatediprova.info incoalth.com adcecija.com pleredberseka.com refuright.com | |||||||||||||||
Total events
57 525
Read events
55 904
Write events
1 420
Delete events
201
Modification events
| (PID) Process: | (2564) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\ClientTelemetry\Sampling |
| Operation: | write | Name: | 6 |
Value: 01941A000000001000B24E9A3E06000000000000000600000000000000 | |||
| (PID) Process: | (2564) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\OUTLOOK\2564 |
| Operation: | write | Name: | 0 |
Value: 0B0E10C2F3A318E331AF49A52AD1E77D1F7F4D230046A0A4BFF8E0A2EEED016A04102400449A7D64B29D01008500A907556E6B6E6F776EC906022222CA0DC2190000C91003783634C5118414D2120B6F00750074006C006F006F006B002E00650078006500C51620C517808004C91808323231322D44656300 | |||
| (PID) Process: | (2564) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics |
| Operation: | delete value | Name: | BootCommand |
Value: | |||
| (PID) Process: | (2564) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics |
| Operation: | delete value | Name: | BootFailureCount |
Value: | |||
| (PID) Process: | (2564) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsDataPreviousSession |
| Operation: | delete key | Name: | (default) |
Value: | |||
| (PID) Process: | (2564) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsDataPreviousSession |
| Operation: | write | Name: | CantBootResolution |
Value: BootSuccess | |||
| (PID) Process: | (2564) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsDataPreviousSession |
| Operation: | write | Name: | ProfileBeingOpened |
Value: Outlook | |||
| (PID) Process: | (2564) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsDataPreviousSession |
| Operation: | write | Name: | SessionId |
Value: C3D8E96E-C1AF-4750-8D52-F4E28119C131 | |||
| (PID) Process: | (2564) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsDataPreviousSession |
| Operation: | write | Name: | BootDiagnosticsLogFile |
Value: C:\Users\admin\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16026_20146-20240718T1116060318-1644.etl | |||
| (PID) Process: | (2564) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics |
| Operation: | delete value | Name: | ProfileBeingOpened |
Value: | |||
Executable files
4
Suspicious files
17
Text files
8
Unknown types
2
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2564 | OUTLOOK.EXE | C:\Users\admin\Documents\Outlook Files\Outlook1.pst | — | |
MD5:— | SHA256:— | |||
| 2564 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres | binary | |
MD5:96EF448D1200F435C6D33BB7EF0E9656 | SHA256:52CD56B2B1B009E1D18666BDF0C1D0794759976C09F246C76BD210DD307F2BDE | |||
| 2564 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\238036B3-B800-4134-A245-7F406FA7B6A3 | xml | |
MD5:CEA84E17F1295A6856B64BD564F25126 | SHA256:3980BC0AF7B5B8B32A714F70B17F4D3DAC4E92FF3F8B328B6D726899A1FDC2EC | |||
| 2564 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\olkDEAA.tmp | compressed | |
MD5:8B87386E5610F7C1746357387B1E12CD | SHA256:6D3DDF69633082A3DD352A5ACFE9013ADB4F71126E846854DA57CC5C574114F7 | |||
| 5492 | explorer.exe | C:\Users\admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat | binary | |
MD5:E49C56350AEDF784BFE00E444B879672 | SHA256:A8BD235303668981563DFB5AAE338CB802817C4060E2C199B7C84901D57B7E1E | |||
| 2564 | OUTLOOK.EXE | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9 | der | |
MD5:FB60FF789C58BC6CDCCF1F388665810F | SHA256:6789861E71306F8693FC978CF96CB95DF934765C8891B7AFE7D5297D76ABB527 | |||
| 2564 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin | text | |
MD5:0FB5E58DE57234A9B4ECAEB58EDB8725 | SHA256:55DE85F69AC46107801B0434B692B5C5C20B13FA6AFA89B59DE1A3B6ED17CD32 | |||
| 2564 | OUTLOOK.EXE | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04 | binary | |
MD5:4A616C03A38A5455B78DC20677E1CC1F | SHA256:F477B85F8F0A1706D61679013F6037991CE9991B4C744317B49DA68E4621CD3A | |||
| 2564 | OUTLOOK.EXE | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04 | binary | |
MD5:5EB5DEF34748487EED3D8E6DCA5EB602 | SHA256:70402B8E2197B909B4303051400C6940685715CD2A74BA3578EB144124E927F6 | |||
| 2564 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Office\16.0\outlook.exe_Rules.xml | xml | |
MD5:6717E5764CF1DFD429511F96259F7BFC | SHA256:D4C88959519231CD296F4C2E83A627E0C570E66D8C735D82DA302AB0D017C9D9 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
41
DNS requests
34
Threats
4
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 2.19.11.105:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
2564 | OUTLOOK.EXE | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
2564 | OUTLOOK.EXE | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D | unknown | — | — | whitelisted |
3300 | SIHClient.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
3300 | SIHClient.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
5492 | explorer.exe | GET | 404 | 200.58.119.215:80 | http://www.amiratu.com/ob/?id=/XOX991UuoWKQeOUzg6tQXIzS2Hh6cF7p30NYiLVEhdrnUZRBcNonon9zY/jI/Elh5Y3&uvpXQL=r4w4yPRh7bV0aJi | unknown | — | — | malicious |
5492 | explorer.exe | POST | 404 | 81.169.145.86:80 | http://www.kowollik.email/ob/ | unknown | — | — | malicious |
5492 | explorer.exe | POST | 404 | 81.169.145.86:80 | http://www.kowollik.email/ob/ | unknown | — | — | malicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 40.127.240.158:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
— | — | 2.19.11.105:80 | crl.microsoft.com | Elisa Oyj | NL | whitelisted |
— | — | 23.35.229.160:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
2104 | svchost.exe | 40.127.240.158:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
3216 | svchost.exe | 172.211.123.248:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
2564 | OUTLOOK.EXE | 52.109.76.240:443 | officeclient.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
2564 | OUTLOOK.EXE | 52.123.128.14:443 | ecs.office.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
6544 | svchost.exe | 20.190.160.22:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 2.23.77.188:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
officeclient.microsoft.com |
| whitelisted |
ecs.office.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
roaming.officeapps.live.com |
| whitelisted |
omex.cdn.office.net |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
— | — | Malware Command and Control Activity Detected | ET MALWARE FormBook CnC Checkin (GET) |
— | — | Malware Command and Control Activity Detected | ET MALWARE Formbook 0.3 Checkin |
— | — | Malware Command and Control Activity Detected | ET MALWARE Formbook 0.3 Checkin |
— | — | Malware Command and Control Activity Detected | ET MALWARE FormBook CnC Checkin (GET) |