File name: | FinCERT_BAPB_MLW2019052001.zip |
Full analysis: | https://app.any.run/tasks/2a030b60-86f6-495d-b641-09798b671638 |
Verdict: | Malicious activity |
Threats: | FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus. |
Analysis date: | May 20, 2019, 10:30:52 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | B7FF2DD4399EC4F52716165B2A8016FE |
SHA1: | D7218E938E1AEB2E017348720AEE6133E0778566 |
SHA256: | 3C4570155FD02A458055D4B9596C0CE4B8A6D7754D474847961A26CB91E23B9C |
SSDEEP: | 12288:Gbw/Ly9ZId9biyqeoxEW/dAN+pcWs3ZnDYqIuIu:Gc/+Zu5oxEEdAN+pcWs31YMT |
.zip | | | ZIP compressed archive (100) |
---|
ZipRequiredVersion: | 20 |
---|---|
ZipBitFlag: | 0x0001 |
ZipCompression: | Deflated |
ZipModifyDate: | 2019:05:20 11:40:15 |
ZipCRC: | 0xe50f1749 |
ZipCompressedSize: | 249628 |
ZipUncompressedSize: | 359747 |
ZipFileName: | [Content_Attachment] ITEM SPECIFICATIONS PO#7376153353.eml |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2716 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\FinCERT_BAPB_MLW2019052001.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
1816 | "C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE" /eml "C:\Users\admin\Desktop\[Content_Attachment] ITEM SPECIFICATIONS PO#7376153353.eml" | C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Outlook Version: 14.0.6025.1000 | ||||
3708 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Specifications PO#7376153353.z" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 | ||||
3332 | "C:\Users\admin\Desktop\Specifications PO#7376153353.scr" /S | C:\Users\admin\Desktop\Specifications PO#7376153353.scr | — | explorer.exe |
User: admin Company: boilover4 Integrity Level: MEDIUM Exit code: 0 Version: 1.04.0001 | ||||
3812 | C:\Users\admin\Desktop\Specifications PO#7376153353.scr" /S | C:\Users\admin\Desktop\Specifications PO#7376153353.scr | — | Specifications PO#7376153353.scr |
User: admin Company: boilover4 Integrity Level: MEDIUM Exit code: 0 Version: 1.04.0001 | ||||
3484 | "C:\Windows\System32\colorcpl.exe" | C:\Windows\System32\colorcpl.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Color Control Panel Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3836 | /c del "C:\Users\admin\Desktop\Specifications PO#7376153353.scr" | C:\Windows\System32\cmd.exe | — | colorcpl.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2044 | C:\Windows\Explorer.EXE | C:\Windows\explorer.exe | — | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2360 | "C:\Program Files\Mozilla Firefox\Firefox.exe" | C:\Program Files\Mozilla Firefox\Firefox.exe | colorcpl.exe | |
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 65.0.2 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2716 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb2716.27753\[Content_Attachment] ITEM SPECIFICATIONS PO#7376153353.eml | — | |
MD5:— | SHA256:— | |||
1816 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVR6E3E.tmp.cvr | — | |
MD5:— | SHA256:— | |||
1816 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\tmp7014.tmp | — | |
MD5:— | SHA256:— | |||
2044 | explorer.exe | C:\Users\admin\Desktop\[Content_Attachment] ITEM SPECIFICATIONS PO#7376153353.eml | eml | |
MD5:E10B101E4EE904576BCC5886D0231E91 | SHA256:BEA309477A4DC57CB4E579229FDCFC78A8D88B1EF42AAAC87BACA2D9CCE2FD7D | |||
3708 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3708.30235\Specifications PO#7376153353.scr | — | |
MD5:— | SHA256:— | |||
1816 | OUTLOOK.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotm | pgc | |
MD5:E792BD7ED245F6A450D78CD2DDA46850 | SHA256:BE1069B5251F55A83A8A87E19AADC651572FB8CA5E854BC088AD0322E7F41BC6 | |||
2044 | explorer.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\[Content_Attachment] ITEM SPECIFICATIONS PO#7376153353.eml.lnk | lnk | |
MD5:3BB46D733C79953C33EFB51A3A5A55C7 | SHA256:BF2EF0533A43524CB92263096416BDD0C88B401A1E7291994F340E8DA395F5E6 | |||
2044 | explorer.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012019052020190521\index.dat | dat | |
MD5:E0CF89355848B65AAF11B805423A4FDC | SHA256:B8F41A616CD83114A9F06E012350718BA57DB5D216524A01CBEBD82559CA81C1 | |||
2044 | explorer.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\1b4dd67f29cb1962.automaticDestinations-ms | automaticdestinations-ms | |
MD5:B11A03AED34B638CDE3E580008996BF5 | SHA256:A4FC0929B8858E30044541A6F0095E75328D1C6A88FF710B7778C0B4A0C94D47 | |||
1816 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\DNTFTN9G\Specifications PO#7376153353.z | compressed | |
MD5:7B10AF6ADBB108AE3D95D5187A317B96 | SHA256:70FCF4DA8CDBD078C6C592CD3E4642B44CC1545DE8889EAC0EB01C5D12BA2130 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
1816 | OUTLOOK.EXE | GET | — | 64.4.26.155:80 | http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig | US | — | — | whitelisted |
2044 | explorer.exe | GET | 404 | 199.192.26.4:80 | http://www.craxiny.com/as/?_RpDvB=i6iWcllMeOMlE1B/hCwSmm3rpLRGMSmTycj75IQYfNO7j760xX9G4g5dz3VkfQRR2rqMSA==&5j=NVYduv | US | html | 326 b | malicious |
2044 | explorer.exe | GET | 404 | 217.160.0.195:80 | http://www.amphibricks.store/as/?_RpDvB=pdLLd/Uld83zppTBugfvzV3qU/DT8DH6cCvgfxBrhLUtUwT//jVKVHZ9RU7djtXETdxmzw==&5j=NVYduv | DE | html | 823 b | malicious |
2044 | explorer.exe | GET | 301 | 59.106.152.68:80 | http://www.keian-smile.com/as/?_RpDvB=fGhF7T8oXAktrvdEPyK8pkF2zkAo4u5BM0QZJhhJltbkiM271g99qPz8/7Tmyk2TUH6pPA==&5j=NVYduv | JP | — | — | malicious |
2044 | explorer.exe | POST | 404 | 199.192.26.4:80 | http://www.craxiny.com/as/ | US | html | 291 b | malicious |
2044 | explorer.exe | POST | — | 199.192.26.4:80 | http://www.craxiny.com/as/ | US | — | — | malicious |
2044 | explorer.exe | POST | 404 | 199.192.26.4:80 | http://www.craxiny.com/as/ | US | html | 291 b | malicious |
2044 | explorer.exe | POST | — | 59.106.152.68:80 | http://www.keian-smile.com/as/ | JP | — | — | malicious |
2044 | explorer.exe | POST | — | 59.106.152.68:80 | http://www.keian-smile.com/as/ | JP | — | — | malicious |
2044 | explorer.exe | POST | — | 59.106.152.68:80 | http://www.keian-smile.com/as/ | JP | — | — | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2044 | explorer.exe | 59.106.152.68:80 | www.keian-smile.com | SAKURA Internet Inc. | JP | malicious |
2044 | explorer.exe | 217.160.0.195:80 | www.amphibricks.store | 1&1 Internet SE | DE | malicious |
1816 | OUTLOOK.EXE | 64.4.26.155:80 | config.messenger.msn.com | Microsoft Corporation | US | whitelisted |
2044 | explorer.exe | 199.192.26.4:80 | www.craxiny.com | — | US | malicious |
Domain | IP | Reputation |
---|---|---|
config.messenger.msn.com |
| whitelisted |
www.amphibricks.store |
| malicious |
www.craxiny.com |
| malicious |
www.transparent-funding.com |
| unknown |
www.keian-smile.com |
| malicious |
www.marcusism.com |
| unknown |
www.qhdcex.com |
| unknown |
www.488rax.info |
| unknown |
www.igorgalanin.net |
| unknown |
www.topgurutools.com |
| unknown |
PID | Process | Class | Message |
---|---|---|---|
2044 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] FormBook CnC Checkin (GET) |
2044 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] FormBook CnC Checkin (GET) |
2044 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] TrojanSpy:FormBook CnC Checkin (POST) |
2044 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] TrojanSpy:FormBook CnC Checkin (POST) |
2044 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] FormBook CnC Checkin (POST) |
2044 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] FormBook CnC Checkin (GET) |
2044 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] TrojanSpy:FormBook CnC Checkin (POST) |
2044 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] FormBook CnC Checkin (POST) |
2044 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] TrojanSpy:FormBook CnC Checkin (POST) |