File name: | MALWARE SAMPLE.zip |
Full analysis: | https://app.any.run/tasks/7c51a64c-6b3b-4c2e-94dd-46215719d915 |
Verdict: | Malicious activity |
Threats: | FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus. |
Analysis date: | April 25, 2019, 17:30:36 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | B75E3AAD31257B4263B6BF2ADB095A8E |
SHA1: | DB20E63287E96F7D3ED70E3556F5228C62338D81 |
SHA256: | 30E15E51DC2280445DCAFE7D7E0F0D09322287D67FF52822148A42932D604AC7 |
SSDEEP: | 24576:TIBcmaClDlS/mIHSFQ/jWLtTYRaupaJgiLHjHGS5+/C:kBD7lS/1S+/OTDZKifNM/C |
.zip | | | ZIP compressed archive (100) |
---|
ZipFileName: | dc7a1e2dc56c6917a5d7f21e21e6a2aba0f7004421f27a6552c77eff109a6192.bin |
---|---|
ZipUncompressedSize: | 1512448 |
ZipCompressedSize: | 818721 |
ZipCRC: | 0x3b03b969 |
ZipModifyDate: | 2019:04:25 17:30:10 |
ZipCompression: | Deflated |
ZipBitFlag: | 0x0001 |
ZipRequiredVersion: | 788 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2596 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\MALWARE SAMPLE.zip" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
2692 | "C:\Users\admin\Desktop\osd.exe" | C:\Users\admin\Desktop\osd.exe | — | explorer.exe |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
476 | "C:\Users\admin\Desktop\osd.exe" | C:\Users\admin\Desktop\osd.exe | — | osd.exe |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
3832 | "C:\Windows\System32\wuauclt.exe" | C:\Windows\System32\wuauclt.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Update Version: 7.5.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2760 | /c del "C:\Users\admin\Desktop\osd.exe" | C:\Windows\System32\cmd.exe | — | wuauclt.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2036 | C:\Windows\Explorer.EXE | C:\Windows\explorer.exe | — | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2296 | "C:\Program Files\Mozilla Firefox\Firefox.exe" | C:\Program Files\Mozilla Firefox\Firefox.exe | wuauclt.exe | |
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 65.0.2 |
(PID) Process: | (2596) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtBMP |
Value: | |||
(PID) Process: | (2596) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtIcon |
Value: | |||
(PID) Process: | (2596) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (2596) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\MALWARE SAMPLE.zip | |||
(PID) Process: | (2596) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | name |
Value: 120 | |||
(PID) Process: | (2596) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | size |
Value: 80 | |||
(PID) Process: | (2036) explorer.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.zip\OpenWithList |
Operation: | write | Name: | a |
Value: WinRAR.exe | |||
(PID) Process: | (2036) explorer.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.zip\OpenWithList |
Operation: | write | Name: | MRUList |
Value: a | |||
(PID) Process: | (2596) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | type |
Value: 120 | |||
(PID) Process: | (2596) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | mtime |
Value: 100 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3832 | wuauclt.exe | C:\Users\admin\AppData\Roaming\-407OO0R\-40logrc.ini | binary | |
MD5:2855A82ECDD565B4D957EC2EE05AED26 | SHA256:88E38DA5B12DD96AFD9DC90C79929EC31D8604B1AFDEBDD5A02B19249C08C939 | |||
2036 | explorer.exe | C:\Users\admin\Desktop\osd.exe | executable | |
MD5:2C3E6A51033E2FA02C62A2D26325E295 | SHA256:DC7A1E2DC56C6917A5D7F21E21E6A2ABA0F7004421F27A6552C77EFF109A6192 | |||
2596 | WinRAR.exe | C:\Users\admin\Desktop\dc7a1e2dc56c6917a5d7f21e21e6a2aba0f7004421f27a6552c77eff109a6192.bin | executable | |
MD5:2C3E6A51033E2FA02C62A2D26325E295 | SHA256:DC7A1E2DC56C6917A5D7F21E21E6A2ABA0F7004421F27A6552C77EFF109A6192 | |||
3832 | wuauclt.exe | C:\Users\admin\AppData\Roaming\-407OO0R\-40logim.jpeg | image | |
MD5:4D657890C02D7D45848587E0474A3C3D | SHA256:77C1A079D6364CD9972990D333F45866F30D2CBFC8DE66ABBD3E851452471D5A | |||
2296 | Firefox.exe | C:\Users\admin\AppData\Roaming\-407OO0R\-40logrf.ini | binary | |
MD5:53028481B5B5795F1501241CCC7ABFF6 | SHA256:75B5F3045E20C80F264568707E2D444DC7498DB119D9661AE51A91575960FC5A | |||
3832 | wuauclt.exe | C:\Users\admin\AppData\Roaming\-407OO0R\-40logri.ini | binary | |
MD5:D63A82E5D81E02E399090AF26DB0B9CB | SHA256:EAECE2EBA6310253249603033C744DD5914089B0BB26BDE6685EC9813611BAAE | |||
3832 | wuauclt.exe | C:\Users\admin\AppData\Roaming\-407OO0R\-40logrv.ini | binary | |
MD5:BA3B6BC807D4F76794C4B81B09BB9BA5 | SHA256:6EEBF968962745B2E9DE2CA969AF7C424916D4E3FE3CC0BB9B3D414ABFCE9507 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2036 | explorer.exe | GET | 301 | 197.221.14.4:80 | http://www.thereviewalight.com/ke40/?lnBXn=T2zeiDF6hTCCo1zvIGUNpQO0CnRfbZtNZJHTHbsD9wZ7RQZ3gMf0tjkOuuXAQZybDhUFSA==&2d=2d6HZl8xMrT8UJ4&sql=1 | ZA | — | — | malicious |
2036 | explorer.exe | GET | 403 | 23.227.38.64:80 | http://www.technovabyac.com/ke40/?lnBXn=eu3Wvw/YblKP99qD6+bmC+1hfflhoOK9v6piqtP0V4o6rwb38bICJ4OZ1gS1M51LxoIUBg==&2d=2d6HZl8xMrT8UJ4&sql=1 | CA | html | 1.74 Kb | malicious |
2036 | explorer.exe | POST | — | 197.221.14.4:80 | http://www.thereviewalight.com/ke40/ | ZA | — | — | malicious |
2036 | explorer.exe | POST | — | 23.227.38.64:80 | http://www.technovabyac.com/ke40/ | CA | — | — | malicious |
2036 | explorer.exe | POST | — | 23.227.38.64:80 | http://www.technovabyac.com/ke40/ | CA | — | — | malicious |
2036 | explorer.exe | POST | — | 23.227.38.64:80 | http://www.technovabyac.com/ke40/ | CA | — | — | malicious |
2036 | explorer.exe | POST | — | 197.221.14.4:80 | http://www.thereviewalight.com/ke40/ | ZA | — | — | malicious |
2036 | explorer.exe | GET | 200 | 188.93.150.58:80 | http://www.hubbahubbacomedytours.com/ke40/?lnBXn=LlqO3WEwW+0ZgfNHJXlQyNIKsmzv1EDpWD80zemv9t74vrgsZ7zS/a1y3Ep4yTsf0vmrMg==&2d=2d6HZl8xMrT8UJ4 | NL | html | 372 Kb | malicious |
2036 | explorer.exe | POST | — | 197.221.14.4:80 | http://www.thereviewalight.com/ke40/ | ZA | — | — | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2036 | explorer.exe | 23.227.38.64:80 | www.technovabyac.com | Shopify, Inc. | CA | malicious |
2036 | explorer.exe | 188.93.150.58:80 | www.hubbahubbacomedytours.com | mijndomein.nl BV | NL | malicious |
2036 | explorer.exe | 197.221.14.4:80 | www.thereviewalight.com | HETZNER | ZA | malicious |
Domain | IP | Reputation |
---|---|---|
www.orlandoberlin.win |
| unknown |
www.hubbahubbacomedytours.com |
| malicious |
www.technovabyac.com |
| malicious |
www.cassondraanita.com |
| unknown |
www.gathering.ltd |
| unknown |
www.thereviewalight.com |
| malicious |
PID | Process | Class | Message |
---|---|---|---|
2036 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] FormBook CnC Checkin (GET) |
2036 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] FormBook CnC Checkin (GET) |
2036 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] TrojanSpy:FormBook CnC Checkin (POST) |
2036 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] FormBook CnC Checkin (POST) |
2036 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] TrojanSpy:FormBook CnC Checkin (POST) |
2036 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] FormBook CnC Checkin (POST) |
2036 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] FormBook CnC Checkin (POST) |
2036 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] FormBook CnC Checkin (GET) |
2036 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] TrojanSpy:FormBook CnC Checkin (POST) |
2036 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] FormBook CnC Checkin (POST) |