File name:

3c37d89b7b7a5d8bb2ad098c0208107c836b0f1c8b49bd3c058436b9683296fe.rtf

Full analysis: https://app.any.run/tasks/e4603d56-81d6-4522-b709-af561a9ad90a
Verdict: Malicious activity
Threats:

FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus.

Analysis date: March 14, 2019, 20:49:54
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ole-embedded
generated-doc
trojan
exploit
cve-2017-11882
loader
formbook
stealer
Indicators:
MIME: text/rtf
File info: Rich Text Format data, unknown version
MD5:

EB3A5949733A99EA6E31C1A05ACB078D

SHA1:

92627DF4C832379984A2553DF690E16591C7A08A

SHA256:

3C37D89B7B7A5D8BB2AD098C0208107C836B0F1C8B49BD3C058436B9683296FE

SSDEEP:

1536:NBsG2OiYC8X3xdHoP13Gm+xaA2kUm4MSRh2radgngQ:NlhiYC8Zr

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Equation Editor starts application (CVE-2017-11882)

      • EQNEDT32.EXE (PID: 3904)
    • Application was dropped or rewritten from another process

      • 3.exe (PID: 3484)
      • 3.exe (PID: 3184)
      • autochkbld.exe (PID: 2132)
      • autochkbld.exe (PID: 2916)
    • Suspicious connection from the Equation Editor

      • EQNEDT32.EXE (PID: 3904)
    • Downloads executable files from the Internet

      • EQNEDT32.EXE (PID: 3904)
    • Connects to CnC server

      • explorer.exe (PID: 284)
    • FORMBOOK was detected

      • explorer.exe (PID: 284)
    • Actions looks like stealing of personal data

      • raserver.exe (PID: 2988)
    • Formbook was detected

      • raserver.exe (PID: 2988)
      • Firefox.exe (PID: 3388)
    • Changes the autorun value in the registry

      • raserver.exe (PID: 2988)
    • Stealing of credential data

      • raserver.exe (PID: 2988)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • EQNEDT32.EXE (PID: 3904)
      • explorer.exe (PID: 284)
      • DllHost.exe (PID: 1088)
    • Application launched itself

      • 3.exe (PID: 3484)
      • autochkbld.exe (PID: 2132)
    • Creates files in the user directory

      • EQNEDT32.EXE (PID: 3904)
      • raserver.exe (PID: 2988)
    • Starts CMD.EXE for commands execution

      • raserver.exe (PID: 2988)
    • Loads DLL from Mozilla Firefox

      • raserver.exe (PID: 2988)
    • Creates files in the program directory

      • DllHost.exe (PID: 1088)
  • INFO

    • Starts Microsoft Office Application

      • explorer.exe (PID: 284)
    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 3500)
    • Creates files in the user directory

      • WINWORD.EXE (PID: 3500)
      • Firefox.exe (PID: 3388)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rtf | Rich Text Format (100)

EXIF

RTF

Author: Windows User
LastModifiedBy: Windows User
CreateDate: 2019:01:20 14:19:00
ModifyDate: 2019:01:20 14:19:00
RevisionNumber: 2
TotalEditTime: -
Pages: 1
Words: -
Characters: 4
CharactersWithSpaces: 4
InternalVersionNumber: 85
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
12
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start winword.exe no specs eqnedt32.exe 3.exe no specs 3.exe no specs #FORMBOOK raserver.exe cmd.exe no specs #FORMBOOK explorer.exe #FORMBOOK firefox.exe no specs Copy/Move/Rename/Delete/Link Object autochkbld.exe no specs autochkbld.exe no specs audiodg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
284C:\Windows\Explorer.EXEC:\Windows\explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\winanr.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshtcpip.dll
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
1088C:\Windows\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}C:\Windows\system32\DllHost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2132"C:\Program Files\K8pmxrtbp\autochkbld.exe"C:\Program Files\K8pmxrtbp\autochkbld.exeexplorer.exe
User:
admin
Company:
PLURILINGUAL8
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.03.0002
Modules
Images
c:\program files\k8pmxrtbp\autochkbld.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2916C:\Program Files\K8pmxrtbp\autochkbld.exe"C:\Program Files\K8pmxrtbp\autochkbld.exeautochkbld.exe
User:
admin
Company:
PLURILINGUAL8
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.03.0002
Modules
Images
c:\program files\k8pmxrtbp\autochkbld.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2988"C:\Windows\System32\raserver.exe"C:\Windows\System32\raserver.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Remote Assistance COM Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\raserver.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3184:\Users\Public\3.exeC:\Users\Public\3.exe3.exe
User:
admin
Company:
PLURILINGUAL8
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.03.0002
Modules
Images
c:\users\public\3.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
3200"C:\Windows\System32\audiodg.exe"C:\Windows\System32\audiodg.exeexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Audio Device Graph Isolation
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\audiodg.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\mmdevapi.dll
c:\windows\system32\sechost.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3388"C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe
raserver.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
61.0.2
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\version.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\vcruntime140.dll
3484C:\Users\Public\3.exeC:\Users\Public\3.exeEQNEDT32.EXE
User:
admin
Company:
PLURILINGUAL8
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.03.0002
Modules
Images
c:\users\public\3.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
3500"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\3c37d89b7b7a5d8bb2ad098c0208107c836b0f1c8b49bd3c058436b9683296fe.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXEexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
Total events
1 616
Read events
968
Write events
638
Delete events
10

Modification events

(PID) Process:(3500) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:writeName:t,(
Value:
742C2800AC0D0000010000000000000000000000
(PID) Process:(3500) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
Off
(PID) Process:(3500) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
On
(PID) Process:(3500) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:WORDFiles
Value:
1315831829
(PID) Process:(3500) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:ProductFiles
Value:
1315831948
(PID) Process:(3500) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:ProductFiles
Value:
1315831949
(PID) Process:(3500) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word
Operation:writeName:MTTT
Value:
AC0D00007AA0B482A7DAD40100000000
(PID) Process:(3500) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:writeName:-.(
Value:
2D2E2800AC0D000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000
(PID) Process:(3500) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:delete valueName:-.(
Value:
2D2E2800AC0D000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000
(PID) Process:(3500) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
Executable files
4
Suspicious files
83
Text files
2
Unknown types
3

Dropped files

PID
Process
Filename
Type
3500WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRDCF4.tmp.cvr
MD5:
SHA256:
3500WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{3C9A769D-770D-4387-982D-1B8E51226270}.tmp
MD5:
SHA256:
3500WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{09A964ED-7E63-4D2C-A923-28198CD80C09}.tmp
MD5:
SHA256:
3500WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{FDFCEAAD-B14E-4501-A16E-E86FEA1E57B2}.tmp
MD5:
SHA256:
3500WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:
SHA256:
2988raserver.exeC:\Users\admin\AppData\Roaming\3Q8O943E\3Q8logim.jpegimage
MD5:
SHA256:
1088DllHost.exeC:\Program Files\K8pmxrtbp\autochkbld.exeexecutable
MD5:
SHA256:
3388Firefox.exeC:\Users\admin\AppData\Roaming\3Q8O943E\3Q8logrf.inibinary
MD5:
SHA256:
2988raserver.exeC:\Users\admin\AppData\Roaming\3Q8O943E\3Q8logrc.inibinary
MD5:
SHA256:
3500WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{769BA9E7-2F2D-4B77-99D1-484862B228DC}.tmpbinary
MD5:
SHA256:
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
15
DNS requests
13
Threats
28

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
284
explorer.exe
GET
301
138.197.206.197:80
http://www.horugame.com/nk/?8p=YkgU8Qs+yU9oBJ/N1zBUE1b04PZ80lmhZVPatlw7C85ZrSbvpFzm2L3ApLReymSUBVApgg==&n2=iLj8LXix
US
malicious
3904
EQNEDT32.EXE
GET
301
67.199.248.10:80
http://bit.ly/2O2KOku
US
html
118 b
shared
3904
EQNEDT32.EXE
GET
200
45.67.14.199:80
http://v39t67xz.ru/NewOrder.jpg
unknown
executable
509 Kb
malicious
284
explorer.exe
POST
162.213.250.187:80
http://www.symtual.com/nk/
US
malicious
284
explorer.exe
GET
404
162.213.250.187:80
http://www.symtual.com/nk/?8p=HOgvtAkoy5xX7DSGkMySvfQymB7oXtIIQrGF12lTFoE3FF+PBnvvwbHC3dw2M19jGDO2Mw==&n2=iLj8LXix&sql=1
US
html
326 b
malicious
284
explorer.exe
GET
198.54.117.217:80
http://www.onlineprices.win/nk/?8p=LRbk0SzEDYEbav2sOxLDDnjuV83UFYwnXyhGbMdvwR4XhK+y1pnWzAe28ENUx4SuLSM7jA==&n2=iLj8LXix&sql=1
US
malicious
284
explorer.exe
POST
138.197.206.197:80
http://www.horugame.com/nk/
US
malicious
284
explorer.exe
GET
403
23.227.38.64:80
http://www.maneproject.online/nk/?8p=0yIE6IQvRohyNShN76SfvYtA2Afj4vZHQmkxFxgeRRxL4dPC6PLMCMFSINCWX5uIL7jbyw==&n2=iLj8LXix
CA
html
1.74 Kb
malicious
284
explorer.exe
POST
198.54.117.217:80
http://www.onlineprices.win/nk/
US
malicious
284
explorer.exe
POST
198.54.117.217:80
http://www.onlineprices.win/nk/
US
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3904
EQNEDT32.EXE
67.199.248.10:80
bit.ly
Bitly Inc
US
shared
3904
EQNEDT32.EXE
45.67.14.199:80
v39t67xz.ru
suspicious
284
explorer.exe
23.227.38.64:80
www.maneproject.online
Shopify, Inc.
CA
malicious
284
explorer.exe
198.54.117.217:80
www.onlineprices.win
Namecheap, Inc.
US
malicious
284
explorer.exe
162.213.250.187:80
www.symtual.com
Namecheap, Inc.
US
malicious
284
explorer.exe
138.197.206.197:80
www.horugame.com
Digital Ocean, Inc.
US
malicious

DNS requests

Domain
IP
Reputation
bit.ly
  • 67.199.248.10
  • 67.199.248.11
shared
v39t67xz.ru
  • 45.67.14.199
malicious
www.diversityvoice.net
unknown
www.todaysliftinggains.com
unknown
www.thewineandaletrailsj.com
unknown
www.maneproject.online
  • 23.227.38.64
malicious
www.onlineprices.win
  • 198.54.117.217
  • 198.54.117.215
  • 198.54.117.210
  • 198.54.117.216
  • 198.54.117.211
  • 198.54.117.218
  • 198.54.117.212
malicious
www.symtual.com
  • 162.213.250.187
malicious
www.twitteh.com
unknown
www.crisefabio.net
unknown

Threats

PID
Process
Class
Message
3904
EQNEDT32.EXE
Misc activity
SUSPICIOUS [PTsecurity] Cmd.Powershell.Download HTTP UserAgent (Win7)
3904
EQNEDT32.EXE
A Network Trojan was detected
ET TROJAN JS/WSF Downloader Dec 08 2016 M4
3904
EQNEDT32.EXE
Misc activity
SUSPICIOUS [PTsecurity] PE as Image Content type mismatch
3904
EQNEDT32.EXE
Generic Protocol Command Decode
SURICATA STREAM excessive retransmissions
284
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] FormBook CnC Checkin (GET)
284
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] FormBook CnC Checkin (GET)
284
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] TrojanSpy:FormBook CnC Checkin (POST)
284
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] FormBook CnC Checkin (GET)
284
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] TrojanSpy:FormBook CnC Checkin (POST)
284
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] TrojanSpy:FormBook CnC Checkin (POST)
12 ETPRO signatures available at the full report
No debug info