File name: | 47837_PO 3434555.xlsx |
Full analysis: | https://app.any.run/tasks/38c136f0-a4a5-4b34-9878-0598c343e5cf |
Verdict: | Malicious activity |
Threats: | FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus. |
Analysis date: | March 31, 2020, 08:14:21 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.openxmlformats-officedocument.spreadsheetml.sheet |
File info: | Microsoft Excel 2007+ |
MD5: | 4783735BEDBB544C9CB47F837DFD2B99 |
SHA1: | 2657D7030E0C5E7B9A516AA66EB20DE658472D3F |
SHA256: | 29A75735E418508D7898026A11207F16DC8077BE25215366E97F38B5D487171E |
SSDEEP: | 3072:86g7NHJFu2+IjGUMRPUEBvSQkjsPhqgFh/rZMmu0Ht4:FUHJI2+fUMRPUS3ZqgFbMmuet4 |
.xlsx | | | Excel Microsoft Office Open XML Format document (61.2) |
---|---|---|
.zip | | | Open Packaging Conventions container (31.5) |
.zip | | | ZIP compressed archive (7.2) |
ZipRequiredVersion: | 20 |
---|---|
ZipBitFlag: | 0x0002 |
ZipCompression: | Deflated |
ZipModifyDate: | 2020:03:30 10:02:18 |
ZipCRC: | 0x52547938 |
ZipCompressedSize: | 402 |
ZipUncompressedSize: | 1777 |
ZipFileName: | [Content_Types].xml |
Creator: | Modexcomm |
---|
LastModifiedBy: | Modexcomm |
---|---|
CreateDate: | 2019:11:27 09:20:57Z |
ModifyDate: | 2019:11:27 09:22:47Z |
Application: | Microsoft Excel |
DocSecurity: | None |
ScaleCrop: | No |
HeadingPairs: |
|
TitlesOfParts: |
|
LinksUpToDate: | No |
SharedDoc: | No |
HyperlinksChanged: | No |
AppVersion: | 12 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2544 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Version: 14.0.6024.1000 | ||||
1852 | "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE | svchost.exe | |
User: admin Company: Design Science, Inc. Integrity Level: MEDIUM Description: Microsoft Equation Editor Exit code: 0 Version: 00110900 | ||||
1828 | "C:\Users\admin\AppData\Roaming\uzmod035865.exe" | C:\Users\admin\AppData\Roaming\uzmod035865.exe | — | EQNEDT32.EXE |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
2952 | "C:\Users\admin\AppData\Roaming\uzmod035865.exe" | C:\Users\admin\AppData\Roaming\uzmod035865.exe | — | uzmod035865.exe |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
3212 | "C:\Windows\System32\audiodg.exe" | C:\Windows\System32\audiodg.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Audio Device Graph Isolation Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
1688 | /c del "C:\Users\admin\AppData\Roaming\uzmod035865.exe" | C:\Windows\System32\cmd.exe | — | audiodg.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
372 | C:\Windows\Explorer.EXE | C:\Windows\explorer.exe | — | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2392 | "C:\Program Files\Mozilla Firefox\Firefox.exe" | C:\Program Files\Mozilla Firefox\Firefox.exe | audiodg.exe | |
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 68.0.1 | ||||
3076 | C:\Windows\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09} | C:\Windows\system32\DllHost.exe | svchost.exe | |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: COM Surrogate Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
1092 | "C:\Program Files\Btz28\9rxd8fdj8-.exe" | C:\Program Files\Btz28\9rxd8fdj8-.exe | — | explorer.exe |
User: admin Integrity Level: MEDIUM Exit code: 0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2544 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVR6B26.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3212 | audiodg.exe | C:\Users\admin\AppData\Roaming\NP218825\NP2logrc.ini | binary | |
MD5:2855A82ECDD565B4D957EC2EE05AED26 | SHA256:88E38DA5B12DD96AFD9DC90C79929EC31D8604B1AFDEBDD5A02B19249C08C939 | |||
1852 | EQNEDT32.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\uzmod03[1].exe | executable | |
MD5:D07B37062294EAC9E937ED2A56F3A7CA | SHA256:25332C42E2C0F04CD54BC45CAFECDEA965580892CDFDDECD3BA430BD376486FB | |||
1852 | EQNEDT32.EXE | C:\Users\admin\AppData\Roaming\uzmod035865.exe | executable | |
MD5:D07B37062294EAC9E937ED2A56F3A7CA | SHA256:25332C42E2C0F04CD54BC45CAFECDEA965580892CDFDDECD3BA430BD376486FB | |||
3212 | audiodg.exe | C:\Users\admin\AppData\Roaming\NP218825\NP2logim.jpeg | image | |
MD5:21E5C9AE630B36E680B09F2B0B3E7FDA | SHA256:BEDF155F9757FC77A316A8CB1755DC3D146952950CDC9A305CD31DAC884A8AEC | |||
3212 | audiodg.exe | C:\Users\admin\AppData\Roaming\NP218825\NP2logri.ini | binary | |
MD5:D63A82E5D81E02E399090AF26DB0B9CB | SHA256:EAECE2EBA6310253249603033C744DD5914089B0BB26BDE6685EC9813611BAAE | |||
2392 | Firefox.exe | C:\Users\admin\AppData\Roaming\NP218825\NP2logrf.ini | binary | |
MD5:53028481B5B5795F1501241CCC7ABFF6 | SHA256:75B5F3045E20C80F264568707E2D444DC7498DB119D9661AE51A91575960FC5A | |||
3076 | DllHost.exe | C:\Program Files\Btz28\9rxd8fdj8-.exe | executable | |
MD5:D07B37062294EAC9E937ED2A56F3A7CA | SHA256:25332C42E2C0F04CD54BC45CAFECDEA965580892CDFDDECD3BA430BD376486FB | |||
372 | explorer.exe | C:\Users\admin\AppData\Local\Temp\Btz28\9rxd8fdj8-.exe | executable | |
MD5:D07B37062294EAC9E937ED2A56F3A7CA | SHA256:25332C42E2C0F04CD54BC45CAFECDEA965580892CDFDDECD3BA430BD376486FB | |||
3212 | audiodg.exe | C:\Users\admin\AppData\Roaming\NP218825\NP2logrv.ini | binary | |
MD5:BA3B6BC807D4F76794C4B81B09BB9BA5 | SHA256:6EEBF968962745B2E9DE2CA969AF7C424916D4E3FE3CC0BB9B3D414ABFCE9507 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
372 | explorer.exe | GET | — | 50.63.202.35:80 | http://www.providencetowing.com/d003/?jdGtQt20=FgBT/q131xChL6IhbsfR+Zedo2diRKmnyhR4STL/rDvqPn+nOxguib+Vs3hmrptKTo2PfQ==&TT=Ehd07BMX&sql=1 | US | — | — | malicious |
372 | explorer.exe | POST | — | 50.63.202.35:80 | http://www.providencetowing.com/d003/ | US | — | — | malicious |
372 | explorer.exe | POST | — | 50.63.202.35:80 | http://www.providencetowing.com/d003/ | US | — | — | malicious |
1852 | EQNEDT32.EXE | GET | 200 | 162.214.75.129:80 | http://sylvaclouds.eu/uzmod03/uzmod03.exe | US | executable | 712 Kb | whitelisted |
372 | explorer.exe | GET | — | 208.91.197.27:80 | http://www.meanfarmer.net/d003/?jdGtQt20=D6+ZTEX+THh+q6BQmfoR7t2E6lQU+QMiuSDHfYK9KlWfI+hFAmTpPmbHf4V0xdB3/GJ6pg==&TT=Ehd07BMX&sql=1 | US | — | — | malicious |
372 | explorer.exe | POST | — | 208.91.197.27:80 | http://www.meanfarmer.net/d003/ | US | — | — | malicious |
372 | explorer.exe | POST | — | 208.91.197.27:80 | http://www.meanfarmer.net/d003/ | US | — | — | malicious |
372 | explorer.exe | POST | — | 50.63.202.35:80 | http://www.providencetowing.com/d003/ | US | — | — | malicious |
372 | explorer.exe | GET | 302 | 92.43.218.161:80 | http://www.jedomproperties.com/d003/?jdGtQt20=wYhDetPX7POnKzew87KBVBhk7oTtvQey6rdLjv75d2qpvJo+a6z/s4PRqnxUwGL5GIPiDA==&TT=Ehd07BMX&sql=1 | CH | html | 268 b | malicious |
372 | explorer.exe | GET | 301 | 199.34.228.146:80 | http://www.tommymccarthycomedy.com/d003/?jdGtQt20=JV5/MuI8KmZ75SINUT/7cRHcp4IVO7APo/NXOJzXneO1J4VaZRz5IhRB5ubnck1oZhmTAw==&TT=Ehd07BMX&sql=1 | US | html | 880 b | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
372 | explorer.exe | 209.99.40.222:80 | www.usinamontealegre.com | Confluence Networks Inc | US | malicious |
372 | explorer.exe | 162.213.250.169:80 | www.allixanes.com | Namecheap, Inc. | US | malicious |
1852 | EQNEDT32.EXE | 162.214.75.129:80 | sylvaclouds.eu | Unified Layer | US | malicious |
372 | explorer.exe | 50.63.202.35:80 | www.providencetowing.com | GoDaddy.com, LLC | US | malicious |
372 | explorer.exe | 208.91.197.27:80 | www.meanfarmer.net | Confluence Networks Inc | US | malicious |
372 | explorer.exe | 92.43.218.161:80 | www.jedomproperties.com | Webland AG | CH | malicious |
372 | explorer.exe | 199.34.228.146:80 | www.tommymccarthycomedy.com | Weebly, Inc. | US | malicious |
Domain | IP | Reputation |
---|---|---|
sylvaclouds.eu |
| whitelisted |
www.usinamontealegre.com |
| malicious |
dns.msftncsi.com |
| shared |
www.0310100.com |
| unknown |
www.allixanes.com |
| malicious |
www.providencetowing.com |
| malicious |
www.meanfarmer.net |
| malicious |
www.fengxingyizhan.com |
| unknown |
www.tommymccarthycomedy.com |
| malicious |
www.ippuku.style |
| unknown |
PID | Process | Class | Message |
---|---|---|---|
1852 | EQNEDT32.EXE | A Network Trojan was detected | ET TROJAN Possible Malicious Macro DL EXE Feb 2016 |
1852 | EQNEDT32.EXE | A Network Trojan was detected | ET TROJAN Possible Malicious Macro EXE DL AlphaNumL |
1852 | EQNEDT32.EXE | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
372 | explorer.exe | A Network Trojan was detected | SPYWARE [PTsecurity] FormBook |
372 | explorer.exe | A Network Trojan was detected | SPYWARE [PTsecurity] FormBook |
372 | explorer.exe | A Network Trojan was detected | SPYWARE [PTsecurity] FormBook |
372 | explorer.exe | A Network Trojan was detected | SPYWARE [PTsecurity] FormBook |
372 | explorer.exe | A Network Trojan was detected | SPYWARE [PTsecurity] FormBook |
372 | explorer.exe | A Network Trojan was detected | SPYWARE [PTsecurity] FormBook |
372 | explorer.exe | A Network Trojan was detected | SPYWARE [PTsecurity] FormBook |