| File name: | 67356785362.doc |
| Full analysis: | https://app.any.run/tasks/f6ea64ad-b8dc-4b2f-9d64-a64f0487ef14 |
| Verdict: | Malicious activity |
| Threats: | FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus. |
| Analysis date: | November 08, 2018, 11:19:43 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.openxmlformats-officedocument.wordprocessingml.document |
| File info: | Microsoft Word 2007+ |
| MD5: | D81C711DCAE9FF7AB705F348BB764200 |
| SHA1: | 995AF42C3A2A30D4B002A37B45F93EE486253FA5 |
| SHA256: | 4512E0216E7A5B7802240F8AEB7D4420BE488C650EE2654AE249B3ADEA20CF6A |
| SSDEEP: | 6144:2mlLp/SnhYgMD7RSCD/QIWtYUqQADldpa625O+5Vi1iNubhUv14j:b8nhW7fVSQTEOSk1zbe8 |
MALICIOUS
Executable content was dropped or overwritten
- WINWORD.EXE (PID: 4068)
Application was dropped or rewritten from another process
- _output61F5490.exe (PID: 3508)
- _output61F5490.exe (PID: 3088)
- _output61F5490.exe (PID: 3804)
- _output61F5490.exe (PID: 2524)
- _output61F5490.exe (PID: 1716)
- _output61F5490.exe (PID: 3232)
Formbook was detected
- NETSTAT.EXE (PID: 3736)
- Firefox.exe (PID: 2532)
FORMBOOK was detected
- explorer.exe (PID: 1604)
Connects to CnC server
- explorer.exe (PID: 1604)
Changes the autorun value in the registry
- NETSTAT.EXE (PID: 3736)
Actions looks like stealing of personal data
- NETSTAT.EXE (PID: 3736)
Unusual execution from Microsoft Office
- WINWORD.EXE (PID: 4068)
Stealing of credential data
- NETSTAT.EXE (PID: 3736)
SUSPICIOUS
Application launched itself
- _output61F5490.exe (PID: 3232)
- _output61F5490.exe (PID: 1716)
- _output61F5490.exe (PID: 3088)
Starts CMD.EXE for commands execution
- NETSTAT.EXE (PID: 3736)
Creates files in the user directory
- NETSTAT.EXE (PID: 3736)
Loads DLL from Mozilla Firefox
- NETSTAT.EXE (PID: 3736)
INFO
Creates files in the user directory
- WINWORD.EXE (PID: 4068)
- Firefox.exe (PID: 2532)
Reads Microsoft Office registry keys
- WINWORD.EXE (PID: 4068)
Starts Microsoft Office Application
- explorer.exe (PID: 1604)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .docx | | | Word Microsoft Office Open XML Format document (52.2) |
|---|---|---|
| .zip | | | Open Packaging Conventions container (38.8) |
| .zip | | | ZIP compressed archive (8.8) |
EXIF
ZIP
| ZipRequiredVersion: | 20 |
|---|---|
| ZipBitFlag: | 0x0006 |
| ZipCompression: | Deflated |
| ZipModifyDate: | 1980:01:01 00:00:00 |
| ZipCRC: | 0x24886c04 |
| ZipCompressedSize: | 373 |
| ZipUncompressedSize: | 1460 |
| ZipFileName: | [Content_Types].xml |
XMP
| Title: | - |
|---|---|
| Subject: | - |
| Creator: | CHUCKS |
| Description: | - |
XML
| Keywords: | - |
|---|---|
| LastModifiedBy: | CHUCKS |
| RevisionNumber: | 1 |
| CreateDate: | 2018:11:07 06:26:00Z |
| ModifyDate: | 2018:11:07 06:26:00Z |
| Template: | Normal |
| TotalEditTime: | - |
| Pages: | 1 |
| Words: | 3 |
| Characters: | 19 |
| Application: | Microsoft Office Word |
| DocSecurity: | None |
| Lines: | 1 |
| Paragraphs: | 1 |
| ScaleCrop: | No |
| Company: | - |
| LinksUpToDate: | No |
| CharactersWithSpaces: | 21 |
| SharedDoc: | No |
| HyperlinksChanged: | No |
| AppVersion: | 15 |
Total processes
43
Monitored processes
13
Malicious processes
6
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1224 | "C:\Windows\System32\msiexec.exe" | C:\Windows\System32\msiexec.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows® installer Exit code: 0 Version: 5.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1604 | C:\Windows\Explorer.EXE | C:\Windows\explorer.exe | windanr.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1716 | "C:\Users\admin\AppData\Local\Temp\_output61F5490.exe" | C:\Users\admin\AppData\Local\Temp\_output61F5490.exe | — | WINWORD.EXE | |||||||||||
User: admin Company: dyola Integrity Level: MEDIUM Description: TEETHLIKE8 Exit code: 0 Version: 5.04 Modules
| |||||||||||||||
| 2524 | C:\Users\admin\AppData\Local\Temp\_output61F5490.exe" | C:\Users\admin\AppData\Local\Temp\_output61F5490.exe | — | _output61F5490.exe | |||||||||||
User: admin Company: dyola Integrity Level: MEDIUM Description: TEETHLIKE8 Exit code: 0 Version: 5.04 Modules
| |||||||||||||||
| 2532 | "C:\Program Files\Mozilla Firefox\Firefox.exe" | C:\Program Files\Mozilla Firefox\Firefox.exe | NETSTAT.EXE | ||||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 61.0.2 Modules
| |||||||||||||||
| 2568 | "C:\Windows\System32\wlanext.exe" | C:\Windows\System32\wlanext.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Wireless LAN 802.11 Extensibility Framework Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3088 | "C:\Users\admin\AppData\Local\Temp\_output61F5490.exe" | C:\Users\admin\AppData\Local\Temp\_output61F5490.exe | — | WINWORD.EXE | |||||||||||
User: admin Company: dyola Integrity Level: MEDIUM Description: TEETHLIKE8 Exit code: 0 Version: 5.04 Modules
| |||||||||||||||
| 3232 | "C:\Users\admin\AppData\Local\Temp\_output61F5490.exe" | C:\Users\admin\AppData\Local\Temp\_output61F5490.exe | — | WINWORD.EXE | |||||||||||
User: admin Company: dyola Integrity Level: MEDIUM Description: TEETHLIKE8 Exit code: 0 Version: 5.04 Modules
| |||||||||||||||
| 3508 | C:\Users\admin\AppData\Local\Temp\_output61F5490.exe" | C:\Users\admin\AppData\Local\Temp\_output61F5490.exe | — | _output61F5490.exe | |||||||||||
User: admin Company: dyola Integrity Level: MEDIUM Description: TEETHLIKE8 Exit code: 0 Version: 5.04 Modules
| |||||||||||||||
| 3736 | "C:\Windows\System32\NETSTAT.EXE" | C:\Windows\System32\NETSTAT.EXE | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: TCP/IP Netstat Command Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
1 739
Read events
972
Write events
762
Delete events
5
Modification events
| (PID) Process: | (4068) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
| Operation: | write | Name: | kel |
Value: 6B656C00E40F0000010000000000000000000000 | |||
| (PID) Process: | (4068) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1033 |
Value: Off | |||
| (PID) Process: | (4068) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1033 |
Value: On | |||
| (PID) Process: | (4068) WINWORD.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage |
| Operation: | write | Name: | WORDFiles |
Value: 1298661391 | |||
| (PID) Process: | (4068) WINWORD.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage |
| Operation: | write | Name: | ProductFiles |
Value: 1298661504 | |||
| (PID) Process: | (4068) WINWORD.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage |
| Operation: | write | Name: | ProductFiles |
Value: 1298661505 | |||
| (PID) Process: | (4068) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word |
| Operation: | write | Name: | MTTT |
Value: E40F0000964A93FD5477D40100000000 | |||
| (PID) Process: | (4068) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
| Operation: | write | Name: | tfl |
Value: 74666C00E40F000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000 | |||
| (PID) Process: | (4068) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
| Operation: | delete value | Name: | tfl |
Value: 74666C00E40F000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000 | |||
| (PID) Process: | (4068) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
Executable files
1
Suspicious files
86
Text files
1
Unknown types
3
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 4068 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR91EB.tmp.cvr | — | |
MD5:— | SHA256:— | |||
| 4068 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:— | SHA256:— | |||
| 4068 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~$356785362.doc | pgc | |
MD5:— | SHA256:— | |||
| 4068 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\_output61F5490.exe | executable | |
MD5:— | SHA256:— | |||
| 3736 | NETSTAT.EXE | C:\Users\admin\AppData\Roaming\O3-9N7-E\O3-logrc.ini | binary | |
MD5:— | SHA256:— | |||
| 3736 | NETSTAT.EXE | C:\Users\admin\AppData\Roaming\O3-9N7-E\O3-logri.ini | binary | |
MD5:— | SHA256:— | |||
| 3088 | _output61F5490.exe | C:\Users\admin\AppData\Local\Temp\~DF18B3F16F757CD863.TMP | binary | |
MD5:— | SHA256:— | |||
| 2532 | Firefox.exe | C:\Users\admin\AppData\Roaming\O3-9N7-E\O3-logrf.ini | binary | |
MD5:— | SHA256:— | |||
| 3232 | _output61F5490.exe | C:\Users\admin\AppData\Local\Temp\~DF6531FCC34CECA3A2.TMP | binary | |
MD5:— | SHA256:— | |||
| 1716 | _output61F5490.exe | C:\Users\admin\AppData\Local\Temp\~DF1BD6C50EA6506B73.TMP | binary | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
5
Threats
2
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1604 | explorer.exe | GET | 302 | 52.22.89.169:80 | http://www.hdvui.com/ma/?GX=Mby7zqqOqpiySRsYdK1F14gUgtOqtUA5y50cYSpyilixPcI2pNk1Vv4s6bpsy253sgG+mw==&uFO4=XPxDeFaPj | US | html | 181 b | malicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
1604 | explorer.exe | 52.22.89.169:80 | www.hdvui.com | Amazon.com, Inc. | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
www.rubychocolate.store |
| unknown |
www.jobincline.com |
| unknown |
www.takereflect.com |
| unknown |
www.servicedapartments.online |
| unknown |
www.hdvui.com |
| malicious |
Threats
PID | Process | Class | Message |
|---|---|---|---|
1604 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] FormBook CnC Checkin (GET) |
1 ETPRO signatures available at the full report