File name:

PO-990101-0703.doc

Full analysis: https://app.any.run/tasks/bfa088ce-783a-445f-918c-580eafb195d3
Verdict: Malicious activity
Threats:

FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus.

Analysis date: March 14, 2019, 23:20:50
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
generated-doc
trojan
loader
formbook
stealer
Indicators:
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Author: PC, Template: Normal.dotm, Last Saved By: PC, Revision Number: 4, Name of Creating Application: Microsoft Office Word, Create Time/Date: Wed Mar 13 22:55:00 2019, Last Saved Time/Date: Wed Mar 13 22:55:00 2019, Number of Pages: 1, Number of Words: 0, Number of Characters: 1, Security: 0
MD5:

E3B75B5421C383D26B3DAA28D550AEEF

SHA1:

249FC53405AA94F66B71CD29855A9A70FF47F9EA

SHA256:

4EB0D63BDEAE06A5DE41E0E858316FE9A67D6305D003A6745DDEAC0E493B1929

SSDEEP:

1536:UYxSupfQcHOhWy9z40mamePd6ZpA+6LOA9iMPfaqx:UASupzukCz40rd6Zmt9iMPC

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Downloads executable files from the Internet

      • powershell.exe (PID: 3816)
    • FORMBOOK was detected

      • explorer.exe (PID: 116)
    • Unusual execution from Microsoft Office

      • WINWORD.EXE (PID: 2848)
    • Executes PowerShell scripts

      • WINWORD.EXE (PID: 2848)
    • Application was dropped or rewritten from another process

      • 0956877.exe (PID: 2260)
      • 0956877.exe (PID: 2820)
    • Changes the autorun value in the registry

      • taskhost.exe (PID: 3228)
      • 0956877.exe (PID: 2260)
    • Connects to CnC server

      • explorer.exe (PID: 116)
    • Formbook was detected

      • taskhost.exe (PID: 3228)
      • Firefox.exe (PID: 2128)
    • Stealing of credential data

      • taskhost.exe (PID: 3228)
    • Actions looks like stealing of personal data

      • taskhost.exe (PID: 3228)
  • SUSPICIOUS

    • Creates files in the user directory

      • powershell.exe (PID: 3816)
      • taskhost.exe (PID: 3228)
    • Application launched itself

      • 0956877.exe (PID: 2260)
    • Executable content was dropped or overwritten

      • powershell.exe (PID: 3816)
      • 0956877.exe (PID: 2260)
    • Starts CMD.EXE for commands execution

      • taskhost.exe (PID: 3228)
    • Loads DLL from Mozilla Firefox

      • taskhost.exe (PID: 3228)
  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2848)
      • Firefox.exe (PID: 2128)
    • Starts Microsoft Office Application

      • explorer.exe (PID: 116)
    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2848)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (54.2)
.doc | Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

Title: -
Subject: -
Author: PC
Keywords: -
Comments: -
Template: Normal.dotm
LastModifiedBy: PC
RevisionNumber: 4
Software: Microsoft Office Word
TotalEditTime: -
CreateDate: 2019:03:13 22:55:00
ModifyDate: 2019:03:13 22:55:00
Pages: 1
Words: -
Characters: 1
Security: None
CodePage: Windows Latin 1 (Western European)
Company: -
Lines: 1
Paragraphs: 1
CharCountWithSpaces: 1
AppVersion: 15
ScaleCrop: No
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
TitleOfParts: -
HeadingPairs:
  • Title
  • 1
CompObjUserTypeLen: 32
CompObjUserType: Microsoft Word 97-2003 Document
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
8
Malicious processes
4
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start drop and start winword.exe no specs powershell.exe 0956877.exe 0956877.exe no specs #FORMBOOK taskhost.exe cmd.exe no specs #FORMBOOK explorer.exe #FORMBOOK firefox.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
116C:\Windows\Explorer.EXEC:\Windows\explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\winanr.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshtcpip.dll
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
2128"C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe
taskhost.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
61.0.2
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\version.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\vcruntime140.dll
2260"C:\Users\admin\AppData\Roaming\0956877.exe" C:\Users\admin\AppData\Roaming\0956877.exe
powershell.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\0956877.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2820"C:\Users\admin\AppData\Roaming\0956877.exe" C:\Users\admin\AppData\Roaming\0956877.exe0956877.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\0956877.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2848"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\PO-990101-0703.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXEexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
3228"C:\Windows\System32\taskhost.exe"C:\Windows\System32\taskhost.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskhost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3816C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass C:\Users\admin\AppData\Roaming\dxfChFC.ps1C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
4060/c del "C:\Users\admin\AppData\Roaming\0956877.exe"C:\Windows\System32\cmd.exetaskhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
1 725
Read events
1 310
Write events
410
Delete events
5

Modification events

(PID) Process:(2848) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:writeName:)=$
Value:
293D2400200B0000010000000000000000000000
(PID) Process:(2848) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
Off
(PID) Process:(2848) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
On
(PID) Process:(2848) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:WORDFiles
Value:
1315831838
(PID) Process:(2848) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:ProductFiles
Value:
1315831952
(PID) Process:(2848) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:ProductFiles
Value:
1315831953
(PID) Process:(2848) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word
Operation:writeName:MTTT
Value:
200B0000B2AC28A1BCDAD40100000000
(PID) Process:(2848) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:writeName:n>$
Value:
6E3E2400200B000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000
(PID) Process:(2848) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:delete valueName:n>$
Value:
6E3E2400200B000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000
(PID) Process:(2848) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
Executable files
2
Suspicious files
75
Text files
2
Unknown types
3

Dropped files

PID
Process
Filename
Type
2848WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR9929.tmp.cvr
MD5:
SHA256:
3816powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ZTKSDATSTAZZ057P9GQ3.temp
MD5:
SHA256:
2848WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$-990101-0703.docpgc
MD5:
SHA256:
2848WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:
SHA256:
2848WINWORD.EXEC:\Users\admin\AppData\Roaming\dxfChFC.ps1text
MD5:
SHA256:
3816powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:
SHA256:
3228taskhost.exeC:\Users\admin\AppData\Roaming\O6RB74TE\O6Rlogrc.inibinary
MD5:
SHA256:
3816powershell.exeC:\Users\admin\AppData\Roaming\0956877.exeexecutable
MD5:
SHA256:
22600956877.exeC:\Users\admin\AppData\Local\Mozilla\Foxgmc
MD5:
SHA256:
22600956877.exeC:\Users\admin\AppData\Local\Mozilla\MiniCalc.exeexecutable
MD5:
SHA256:
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
22
TCP/UDP connections
22
DNS requests
12
Threats
40

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
116
explorer.exe
GET
302
67.227.226.240:80
http://www.assflare.com/br/?GV1H=8Cj81RD3KsksJPT7uhvC8bWhCwYx9Cn7sjpWwJ2a+QvaJhVOkrpwb8EjR4Gb2Z3O2CYslg==&arN=tXixnrypJn&sql=1
US
malicious
116
explorer.exe
GET
204
36.255.221.29:80
http://www.szzhwu.com/br/?GV1H=zLBPfxAzYRF8xjz+7GTA3khRuKErsuGqlGyUmKMInAnqiMLtRRVLCHf7a4Sj+8F6AL/+/g==&arN=tXixnrypJn
CN
malicious
116
explorer.exe
POST
184.168.131.241:80
http://www.lambdakraft.com/br/
US
malicious
3816
powershell.exe
GET
200
107.180.27.166:80
http://mincoindia.com/wp-admin/AI/0956877.exe
US
executable
1.05 Mb
malicious
116
explorer.exe
POST
67.227.226.240:80
http://www.assflare.com/br/
US
malicious
116
explorer.exe
GET
302
203.170.82.97:80
http://www.audiosislam.com/br/?GV1H=AYY10C60wxBlkkN30f+tHP7qrejf6EoQQqUVNXpw0abiamP+ulv6UJQriAtr/3SKfgEcgg==&arN=tXixnrypJn&sql=1
AU
html
240 b
malicious
116
explorer.exe
POST
184.168.131.241:80
http://www.lambdakraft.com/br/
US
malicious
116
explorer.exe
POST
67.227.226.240:80
http://www.assflare.com/br/
US
malicious
116
explorer.exe
POST
184.168.131.241:80
http://www.lambdakraft.com/br/
US
malicious
116
explorer.exe
POST
192.252.144.52:80
http://www.metodosdecobranza.com/br/
US
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
116
explorer.exe
67.227.226.240:80
www.assflare.com
Liquid Web, L.L.C
US
malicious
3816
powershell.exe
107.180.27.166:80
mincoindia.com
GoDaddy.com, LLC
US
malicious
116
explorer.exe
36.255.221.29:80
www.szzhwu.com
Shanghai UCloud Information Technology Company Limited
CN
malicious
116
explorer.exe
203.170.82.97:80
www.audiosislam.com
Dreamscape Networks Limited
AU
malicious
116
explorer.exe
192.252.144.52:80
www.metodosdecobranza.com
Savvis
US
malicious
116
explorer.exe
184.168.131.241:80
www.lambdakraft.com
GoDaddy.com, LLC
US
shared
116
explorer.exe
192.64.116.17:80
www.vaxosyk.com
Namecheap, Inc.
US
malicious

DNS requests

Domain
IP
Reputation
mincoindia.com
  • 107.180.27.166
malicious
www.easyclickprofits.info
unknown
www.szzhwu.com
  • 36.255.221.29
malicious
www.assflare.com
  • 67.227.226.240
malicious
www.nuclearexpert.net
unknown
www.audiosislam.com
  • 203.170.82.97
malicious
www.sobjpk10.com
unknown
www.saferedir.com
unknown
www.nj-aisino.com
unknown
www.lambdakraft.com
  • 184.168.131.241
malicious

Threats

PID
Process
Class
Message
3816
powershell.exe
A Network Trojan was detected
ET TROJAN EXE Download Request To Wordpress Folder Likely Malicious
3816
powershell.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3816
powershell.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
116
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] FormBook CnC Checkin (GET)
116
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] FormBook CnC Checkin (GET)
116
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] TrojanSpy:FormBook CnC Checkin (POST)
116
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] TrojanSpy:FormBook CnC Checkin (POST)
116
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] FormBook CnC Checkin (POST)
116
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] FormBook CnC Checkin (GET)
116
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] TrojanSpy:FormBook CnC Checkin (POST)
16 ETPRO signatures available at the full report
No debug info