analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

http://pyrzowiceekssiddillfirststepsacademym6web-tracking.cocomputewww.watchdogdns.duckdns.org/jae/win32.exe

Full analysis: https://app.any.run/tasks/a69ec09e-615b-404f-ba3a-9b597673effa
Verdict: Malicious activity
Threats:

FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus.

Malware Trends Tracker     >>>
Analysis date: February 18, 2019, 15:51:36
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
opendir
loader
trojan
formbook
stealer
Indicators:
MD5:

DDB9D569A44D334E102C896AFC345744

SHA1:

72DF2A59B0510FA588463EED62E5125473917F12

SHA256:

412EF62BB6A43D20D314EC47E83D1D4593A99668F18F16729365BF26117DB821

SSDEEP:

3:N1KOcXiSM2BBMHDWWkAzeFfjnfQmELS58CyaWi8AJNXkAn:COX/m6HDRkAahfQeiSWlArXkA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • win32[1].exe (PID: 3556)
      • MsOffice2019patch.exe (PID: 3344)
      • MsOffice2019patch.exe (PID: 1228)
      • MsOffice2019patch.exe (PID: 4032)
      • knjhvhlnjl.exe (PID: 1932)
      • MsOffice2019patch.exe (PID: 3932)
      • MsOffice2019patch.exe (PID: 4056)

    • Downloads executable files from the Internet

      • iexplore.exe (PID: 3280)

    • Changes the autorun value in the registry

      • WScript.exe (PID: 3268)
      • svchost.exe (PID: 1340)
      • WScript.exe (PID: 3804)

    • Uses SVCHOST.EXE for hidden code execution

      • explorer.exe (PID: 116)

    • FORMBOOK was detected

      • explorer.exe (PID: 116)

    • Formbook was detected

      • svchost.exe (PID: 1340)
      • Firefox.exe (PID: 2096)

    • Connects to CnC server

      • explorer.exe (PID: 116)

    • Actions looks like stealing of personal data

      • svchost.exe (PID: 1340)

    • Stealing of credential data

      • svchost.exe (PID: 1340)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 3280)
      • iexplore.exe (PID: 2980)
      • win32[1].exe (PID: 3556)
      • explorer.exe (PID: 116)
      • knjhvhlnjl.exe (PID: 1932)
      • DllHost.exe (PID: 3296)

    • Starts Internet Explorer

      • explorer.exe (PID: 116)

    • Executes scripts

      • win32[1].exe (PID: 3556)
      • knjhvhlnjl.exe (PID: 1932)

    • Starts itself from another location

      • win32[1].exe (PID: 3556)
      • knjhvhlnjl.exe (PID: 1932)

    • Application launched itself

      • MsOffice2019patch.exe (PID: 1228)

    • Loads DLL from Mozilla Firefox

      • svchost.exe (PID: 1340)

    • Starts CMD.EXE for commands execution

      • svchost.exe (PID: 1340)

    • Creates files in the user directory

      • svchost.exe (PID: 1340)

    • Creates files in the program directory

      • DllHost.exe (PID: 3296)

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 2980)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3280)
      • iexplore.exe (PID: 2980)

    • Changes internet zones settings

      • iexplore.exe (PID: 2980)

    • Creates files in the user directory

      • Firefox.exe (PID: 2096)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
53
Monitored processes
16
Malicious processes
7
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start drop and start drop and start drop and start iexplore.exe iexplore.exe win32[1].exe wscript.exe msoffice2019patch.exe no specs msoffice2019patch.exe msoffice2019patch.exe no specs #FORMBOOK svchost.exe cmd.exe no specs #FORMBOOK explorer.exe #FORMBOOK firefox.exe no specs Copy/Move/Rename/Delete/Link Object knjhvhlnjl.exe wscript.exe msoffice2019patch.exe no specs msoffice2019patch.exe

Process information

PID
CMD
Path
Indicators
Parent process
2980"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3280"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2980 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3556"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\win32[1].exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\win32[1].exe
iexplore.exe
User:
admin
Company:
Company Name
Integrity Level:
MEDIUM
Description:
File Description
Exit code:
0
Version:
1.00
3268"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\subfolder\MsOffice2019patch.vbs" C:\Windows\System32\WScript.exe
win32[1].exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
3344"C:\Users\admin\AppData\Local\Temp\subfolder\MsOffice2019patch.exe" C:\Users\admin\AppData\Local\Temp\subfolder\MsOffice2019patch.exe—win32[1].exe
User:
admin
Company:
Company Name
Integrity Level:
MEDIUM
Description:
File Description
Exit code:
3221226540
Version:
1.00
1228"C:\Users\admin\AppData\Local\Temp\subfolder\MsOffice2019patch.exe" C:\Users\admin\AppData\Local\Temp\subfolder\MsOffice2019patch.exe
win32[1].exe
User:
admin
Company:
Company Name
Integrity Level:
HIGH
Description:
File Description
Exit code:
0
Version:
1.00
4032C:\Users\admin\AppData\Local\Temp\subfolder\MsOffice2019patch.exe" C:\Users\admin\AppData\Local\Temp\subfolder\MsOffice2019patch.exe—MsOffice2019patch.exe
User:
admin
Company:
Company Name
Integrity Level:
HIGH
Description:
File Description
Exit code:
0
Version:
1.00
1340"C:\Windows\System32\svchost.exe"C:\Windows\System32\svchost.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1372/c del "C:\Users\admin\AppData\Local\Temp\subfolder\MsOffice2019patch.exe"C:\Windows\System32\cmd.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
116C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
6 730
Read events
2 857
Write events
0
Delete events
0

Modification events

No data
Executable files
6
Suspicious files
77
Text files
6
Unknown types
2

Dropped files

PID
Process
Filename
Type
2980iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF0F3B94F7CE14DFF6.TMP —
MD5:—
SHA256:—
2980iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFA5526E2D262A2229.TMP —
MD5:—
SHA256:—
2980iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{21B21B5B-3395-11E9-BAD8-5254004A04AF}.dat —
MD5:—
SHA256:—
3556win32[1].exeC:\Users\admin\AppData\Local\Temp\subfolder\MsOffice2019patch.exeexecutable
MD5:A86145C76A7CE5BA98BDE1D3441DE3C7
SHA256:F2A24F11EB69B0B239355B0948BB09E585D2AD639E48FF350B876780F7128089
2980iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\win32[1].exeexecutable
MD5:A86145C76A7CE5BA98BDE1D3441DE3C7
SHA256:F2A24F11EB69B0B239355B0948BB09E585D2AD639E48FF350B876780F7128089
3556win32[1].exeC:\Users\admin\AppData\Local\Temp\subfolder\MsOffice2019patch.vbstext
MD5:63DF9FC38CFF6353444F117700F10955
SHA256:4A7F650FF3C0FDC9F9B847982375016193C3612C3F031C638C02A491E1102DB0
2980iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012019021820190219\index.datdat
MD5:2D502425AB812156EDE32BC8037DA599
SHA256:CB1F72D0F96D357FC1DB1F066EB946F4015E796328220F1CC1D585F1BDB3FEBC
3280iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\MSHist012019021820190219\index.datdat
MD5:D82E457721B849B7B31A98F93E5A5F29
SHA256:1196C1C242029BC40BAEA5D279F25929455A4EB60263D2DB1DD32A6E7F4D553D
2980iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{21B21B5C-3395-11E9-BAD8-5254004A04AF}.datbinary
MD5:8771709DB532F03EB74E69306886FFF6
SHA256:F395145C42F2C14696CB757E1714B12B19C864F961973171A7A2D91F47459073
3280iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\win32[1].exeexecutable
MD5:A86145C76A7CE5BA98BDE1D3441DE3C7
SHA256:F2A24F11EB69B0B239355B0948BB09E585D2AD639E48FF350B876780F7128089
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
11
DNS requests
5
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
116
explorer.exe
GET
—
199.192.23.100:80
http://www.kervax.com/jw/?FPxL=PKmiM4JY2DU3mZ7YdpyehhCFg00ivQx3ST4LQG7oGDNsHdXseWS+JNlNtyZ/lTOs4Wx2ng==&BlD=8pmdRTbpUB&sql=1
US
—
—
malicious
116
explorer.exe
GET
301
199.34.228.59:80
http://www.sweetsenbake.com/jw/?FPxL=VgssHczy1Q6av0SVn+cbTmDI7SGqsehk2v9ajFoxWMTorxqrc3p1mbyGjXig7zmJhgmPIg==&BlD=8pmdRTbpUB
US
html
776 b
malicious
116
explorer.exe
GET
404
94.136.40.51:80
http://www.beverleycrown.com/jw/?FPxL=3e6rf10e2CJUXnTA4vVI3J4lZxt4ksHXus7y0Ifo6YYGGT7XgbRMA89bYfM1rXjxmhiEUA==&BlD=8pmdRTbpUB
GB
html
945 b
malicious
3280
iexplore.exe
GET
200
23.249.161.100:80
http://pyrzowiceekssiddillfirststepsacademym6web-tracking.cocomputewww.watchdogdns.duckdns.org/jae/win32.exe
US
executable
633 Kb
malicious
116
explorer.exe
POST
404
199.192.23.100:80
http://www.kervax.com/jw/
US
html
288 b
malicious
116
explorer.exe
POST
—
199.34.228.59:80
http://www.sweetsenbake.com/jw/
US
—
—
malicious
116
explorer.exe
POST
—
199.34.228.59:80
http://www.sweetsenbake.com/jw/
US
—
—
malicious
116
explorer.exe
POST
404
199.192.23.100:80
http://www.kervax.com/jw/
US
html
288 b
malicious
116
explorer.exe
POST
—
199.34.228.59:80
http://www.sweetsenbake.com/jw/
US
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2980
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3280
iexplore.exe
23.249.161.100:80
pyrzowiceekssiddillfirststepsacademym6web-tracking.cocomputewww.watchdogdns.duckdns.org
ColoCrossing
US
malicious
116
explorer.exe
94.136.40.51:80
www.beverleycrown.com
Host Europe GmbH
GB
malicious
116
explorer.exe
199.192.23.100:80
www.kervax.com
—
US
malicious
116
explorer.exe
199.34.228.59:80
www.sweetsenbake.com
Weebly, Inc.
US
malicious

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
pyrzowiceekssiddillfirststepsacademym6web-tracking.cocomputewww.watchdogdns.duckdns.org
  • 23.249.161.100
malicious
www.beverleycrown.com
  • 94.136.40.51
malicious
www.kervax.com
  • 199.192.23.100
malicious
www.sweetsenbake.com
  • 199.34.228.59
malicious

Threats

PID
Process
Class
Message
—
—
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
—
—
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
—
—
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
3280
iexplore.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
116
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] FormBook CnC Checkin (GET)
116
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] FormBook CnC Checkin (GET)
116
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] TrojanSpy:FormBook CnC Checkin (POST)
116
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] TrojanSpy:FormBook CnC Checkin (POST)
116
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] FormBook CnC Checkin (GET)
116
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] TrojanSpy:FormBook CnC Checkin (POST)
6 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
http://pyrzowiceekssiddillfirststepsacademym6web-tracking.cocomputewww.watchdogdns.duckdns.org/jae/win32.exe