analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

INQUIRY.xlsx

Full analysis: https://app.any.run/tasks/eeafd156-a9f2-40ad-b3a9-c5535eb34fd3
Verdict: Malicious activity
Threats:

FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus.

Analysis date: July 18, 2019, 04:18:12
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
encrypted
opendir
exploit
CVE-2017-11882
loader
trojan
formbook
stealer
Indicators:
MIME: application/encrypted
File info: CDFV2 Encrypted
MD5:

7560F795E299DF5979265612739C901E

SHA1:

5AEBD69B131339FAE39A9FBC7AB30917D7F71672

SHA256:

4A980701F0FE7CCDF9F5B0E6BF33F969B0268DFAA4F2A36F24375D687264D9D6

SSDEEP:

1536:NnCAEGVU100V6gF/XoSAcp+M4UDS3leud:BCjGVw02F/YSoMIlX

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Equation Editor starts application (CVE-2017-11882)

      • EQNEDT32.EXE (PID: 1456)
    • Application was dropped or rewritten from another process

      • vbc.exe (PID: 2480)
      • vbc.exe (PID: 1340)
      • vbc.exe (PID: 3596)
      • vbc.exe (PID: 3640)
      • vbc.exe (PID: 2500)
      • vbc.exe (PID: 3924)
      • vbc.exe (PID: 2624)
      • vbc.exe (PID: 952)
      • vbc.exe (PID: 2224)
      • vbc.exe (PID: 1264)
      • vbc.exe (PID: 1636)
      • vbc.exe (PID: 2280)
      • vbc.exe (PID: 2304)
      • vbc.exe (PID: 592)
    • Downloads executable files from the Internet

      • EQNEDT32.EXE (PID: 1456)
    • FORMBOOK was detected

      • explorer.exe (PID: 292)
    • Changes the autorun value in the registry

      • lsass.exe (PID: 2544)
    • Formbook was detected

      • lsass.exe (PID: 2544)
      • Firefox.exe (PID: 3856)
    • Connects to CnC server

      • explorer.exe (PID: 292)
    • Actions looks like stealing of personal data

      • lsass.exe (PID: 2544)
    • Stealing of credential data

      • lsass.exe (PID: 2544)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • EQNEDT32.EXE (PID: 1456)
    • Executed via COM

      • EQNEDT32.EXE (PID: 1456)
    • Application launched itself

      • vbc.exe (PID: 2480)
    • Starts CMD.EXE for commands execution

      • lsass.exe (PID: 2544)
    • Loads DLL from Mozilla Firefox

      • lsass.exe (PID: 2544)
    • Creates files in the user directory

      • lsass.exe (PID: 2544)
  • INFO

    • Starts Microsoft Office Application

      • explorer.exe (PID: 292)
    • Reads Microsoft Office registry keys

      • EXCEL.EXE (PID: 3860)
    • Manual execution by user

      • lsass.exe (PID: 2544)
      • NAPSTAT.EXE (PID: 1196)
      • autoconv.exe (PID: 2536)
      • autoconv.exe (PID: 2840)
      • wuapp.exe (PID: 2920)
    • Application was crashed

      • vbc.exe (PID: 2480)
    • Creates files in the user directory

      • Firefox.exe (PID: 3856)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
61
Monitored processes
24
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start excel.exe no specs eqnedt32.exe vbc.exe vbc.exe no specs vbc.exe no specs vbc.exe no specs vbc.exe no specs #FORMBOOK lsass.exe cmd.exe no specs vbc.exe no specs napstat.exe no specs vbc.exe no specs vbc.exe no specs autoconv.exe no specs autoconv.exe no specs wuapp.exe no specs vbc.exe no specs vbc.exe no specs vbc.exe no specs vbc.exe no specs vbc.exe no specs vbc.exe no specs #FORMBOOK explorer.exe #FORMBOOK firefox.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3860"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /ddeC:\Program Files\Microsoft Office\Office14\EXCEL.EXEexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Version:
14.0.6024.1000
1456"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
2480"C:\Users\Public\vbc.exe" C:\Users\Public\vbc.exe
EQNEDT32.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
3640"C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exevbc.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2500"C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exevbc.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3596"C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exevbc.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
1340"C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exevbc.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2544"C:\Windows\System32\lsass.exe"C:\Windows\System32\lsass.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Local Security Authority Process
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3320/c del "C:\Users\Public\vbc.exe"C:\Windows\System32\cmd.exelsass.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3924"C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exevbc.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Total events
633
Read events
582
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
73
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
3860EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVRF472.tmp.cvr
MD5:
SHA256:
2544lsass.exeC:\Users\admin\AppData\Roaming\77M3PD5E\77Mlogrc.inibinary
MD5:2855A82ECDD565B4D957EC2EE05AED26
SHA256:88E38DA5B12DD96AFD9DC90C79929EC31D8604B1AFDEBDD5A02B19249C08C939
1456EQNEDT32.EXEC:\Users\Public\vbc.exeexecutable
MD5:3746F192F65E8E557F8D089FDBD0F49E
SHA256:793B2CBD9E75DA7C2141E9ECC5AC1949CA36CBC2491DF2F09DC5528757595A3A
1456EQNEDT32.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\jhn[1].exeexecutable
MD5:3746F192F65E8E557F8D089FDBD0F49E
SHA256:793B2CBD9E75DA7C2141E9ECC5AC1949CA36CBC2491DF2F09DC5528757595A3A
2544lsass.exeC:\Users\admin\AppData\Roaming\77M3PD5E\77Mlogim.jpegimage
MD5:DE9959F76827F0C876297DAA3823F052
SHA256:099E003FE8C802705DBAF44C7EB9F4ECFCC4703BD902DE5A97B3B731F0A0F49E
2544lsass.exeC:\Users\admin\AppData\Roaming\77M3PD5E\77Mlogri.inibinary
MD5:D63A82E5D81E02E399090AF26DB0B9CB
SHA256:EAECE2EBA6310253249603033C744DD5914089B0BB26BDE6685EC9813611BAAE
3856Firefox.exeC:\Users\admin\AppData\Roaming\77M3PD5E\77Mlogrf.inibinary
MD5:53028481B5B5795F1501241CCC7ABFF6
SHA256:75B5F3045E20C80F264568707E2D444DC7498DB119D9661AE51A91575960FC5A
2544lsass.exeC:\Users\admin\AppData\Roaming\77M3PD5E\77Mlogrv.inibinary
MD5:BA3B6BC807D4F76794C4B81B09BB9BA5
SHA256:6EEBF968962745B2E9DE2CA969AF7C424916D4E3FE3CC0BB9B3D414ABFCE9507
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
40
TCP/UDP connections
43
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
292
explorer.exe
GET
50.63.202.40:80
http://www.nitincreationsphotography.com/jo/?GzyLF=OEX4fKCCXmBLkssY7FHX9KNR5fIgU3FomDIGpaWwPqpCUif3LlnDOO6uF5tMQERiXaGVpQ==&Ann=oJIttXspZ
US
malicious
2024
WerFault.exe
GET
52.158.209.219:80
http://watson.microsoft.com/StageOne/vbc_exe/0_0_0_0/5d2e31f6/StackHash_0a9e/0_0_0_0/00000000/c0000005/001100be.htm?LCID=1033&OS=6.1.7601.2.00010100.1.0.48.17514&SM=DELL&SPN=DELL&BV=DELL&MID=3ADE2C42-4AB9-49B7-B142-BE9AEEA69063
US
whitelisted
292
explorer.exe
POST
198.204.237.165:80
http://www.emilymayphotography.com/jo/
US
malicious
292
explorer.exe
POST
195.201.179.80:80
http://www.getstudynews.com/jo/
RU
malicious
292
explorer.exe
POST
195.201.179.80:80
http://www.getstudynews.com/jo/
RU
malicious
292
explorer.exe
GET
404
195.201.179.80:80
http://www.getstudynews.com/jo/?GzyLF=w7C3kWilSUfdx85OmTrKHiGMqQwst4j23ZEVXfnSdJ6+X+VczIYY94sxmTzsf6V8JjAwxw==&Ann=oJIttXspZ&sql=1
RU
html
287 b
malicious
1456
EQNEDT32.EXE
GET
200
23.249.165.218:80
http://zerodayv3startedexploitpcwithexcelgreat.duckdns.org/bartn/jhn.exe
US
executable
1.29 Mb
malicious
292
explorer.exe
POST
198.204.237.165:80
http://www.emilymayphotography.com/jo/
US
malicious
292
explorer.exe
POST
195.201.179.80:80
http://www.getstudynews.com/jo/
RU
malicious
292
explorer.exe
POST
217.160.0.193:80
http://www.getmetoibiza.com/jo/
DE
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
292
explorer.exe
50.63.202.40:80
www.nitincreationsphotography.com
GoDaddy.com, LLC
US
malicious
2024
WerFault.exe
52.158.209.219:80
watson.microsoft.com
Microsoft Corporation
US
suspicious
1456
EQNEDT32.EXE
23.249.165.218:80
zerodayv3startedexploitpcwithexcelgreat.duckdns.org
ColoCrossing
US
malicious
292
explorer.exe
195.201.179.80:80
www.getstudynews.com
Awanti Ltd.
RU
malicious
292
explorer.exe
217.160.0.193:80
www.getmetoibiza.com
1&1 Internet SE
DE
malicious
292
explorer.exe
162.241.252.101:80
www.supplychainrisk-management.com
CyrusOne LLC
US
malicious
292
explorer.exe
198.204.237.165:80
www.emilymayphotography.com
DataShack, LC
US
malicious
292
explorer.exe
198.187.30.241:80
www.boxcay.com
Namecheap, Inc.
US
malicious
292
explorer.exe
13.115.27.140:80
www.qian73.com
Amazon.com, Inc.
JP
malicious
50.63.202.57:80
www.untamedprovisions.us
GoDaddy.com, LLC
US
malicious

DNS requests

Domain
IP
Reputation
zerodayv3startedexploitpcwithexcelgreat.duckdns.org
  • 23.249.165.218
malicious
www.salliorecentralle-amazon.com
unknown
watson.microsoft.com
  • 52.158.209.219
whitelisted
www.nitincreationsphotography.com
  • 50.63.202.40
malicious
www.getstudynews.com
  • 195.201.179.80
malicious
www.emilymayphotography.com
  • 198.204.237.165
malicious
www.getmetoibiza.com
  • 217.160.0.193
malicious
www.xn--xhq44jgvd3c878f.net
unknown
www.supplychainrisk-management.com
  • 162.241.252.101
malicious
www.qian73.com
  • 13.115.27.140
malicious

Threats

PID
Process
Class
Message
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
1456
EQNEDT32.EXE
Potentially Bad Traffic
ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile
1456
EQNEDT32.EXE
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2024
WerFault.exe
Potential Corporate Privacy Violation
ET POLICY Application Crash Report Sent to Microsoft
2024
WerFault.exe
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
292
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] FormBook CnC Checkin (GET)
292
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] TrojanSpy:FormBook CnC Checkin (POST)
292
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] FormBook CnC Checkin (POST)
292
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] TrojanSpy:FormBook CnC Checkin (POST)
292
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] FormBook CnC Checkin (POST)
31 ETPRO signatures available at the full report
No debug info