File name:

0029283728373.zip

Full analysis: https://app.any.run/tasks/be143735-9c4c-439e-b7fa-2a78d2da03a5
Verdict: Malicious activity
Threats:

FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus.

Malware Trends Tracker     >>>
Analysis date: June 28, 2023, 12:54:03
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
stealer
formbook
trojan
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

B67817804F095505BF9270EEAA6D9763

SHA1:

E6B93ED19A54EFF8740108416A5C93BEE8F4B5AB

SHA256:

59C894670CED59ED542601FE57B655DC2EC3368C1380747BAB1C739523DCD527

SSDEEP:

12288:Ih8ZPJ+/SeMBCXZMa20pOlSeyrCy6T6S0aAOD:w8ZPeSHBCXN2MshyrCTTN0a/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • 0029283728373.exe (PID: 2076)

    • FORMBOOK was detected

      • explorer.exe (PID: 1068)

    • Steals credentials

      • lsass.exe (PID: 3004)

    • Connects to the CnC server

      • explorer.exe (PID: 1068)

    • Actions looks like stealing of personal data

      • lsass.exe (PID: 3004)

  • SUSPICIOUS

    • Reads the Internet Settings

      • explorer.exe (PID: 1068)
      • 0029283728373.exe (PID: 2076)
      • lsass.exe (PID: 3004)
      • taskmgr.exe (PID: 932)

    • Adds/modifies Windows certificates

      • explorer.exe (PID: 1068)

    • Executable content was dropped or overwritten

      • 0029283728373.exe (PID: 2076)
      • lsass.exe (PID: 3004)

    • Reads settings of System Certificates

      • 0029283728373.exe (PID: 2076)

    • Suspicious files were dropped or overwritten

      • 0029283728373.exe (PID: 2076)

    • Loads DLL from Mozilla Firefox

      • lsass.exe (PID: 3004)

    • Application launched itself

      • taskmgr.exe (PID: 932)

    • Reads browser cookies

      • lsass.exe (PID: 3004)

  • INFO

    • The process checks LSA protection

      • 0029283728373.exe (PID: 2076)
      • lsass.exe (PID: 3004)
      • taskmgr.exe (PID: 932)

    • Checks proxy server information

      • 0029283728373.exe (PID: 2076)
      • lsass.exe (PID: 3004)

    • Checks supported languages

      • 0029283728373.exe (PID: 2076)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3096)

    • Manual execution by a user

      • 0029283728373.exe (PID: 2076)
      • lsass.exe (PID: 3004)

    • Reads the computer name

      • 0029283728373.exe (PID: 2076)

    • Process checks computer location settings

      • 0029283728373.exe (PID: 2076)

    • Reads the machine GUID from the registry

      • 0029283728373.exe (PID: 2076)

    • Creates files or folders in the user directory

      • lsass.exe (PID: 3004)

    • Application launched itself

      • chrome.exe (PID: 2732)

    • Create files in a temporary directory

      • lsass.exe (PID: 3004)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: 0029283728373.exe
ZipUncompressedSize: -
ZipCompressedSize: -
ZipCRC: 0x00000000
ZipModifyDate: 2023:06:28 07:43:08
ZipCompression: Deflated
ZipBitFlag: 0x0808
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
79
Monitored processes
35
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe 0029283728373.exe lsass.exe #FORMBOOK explorer.exe firefox.exe no specs taskmgr.exe no specs taskmgr.exe chrome.exe chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs taskmgr.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
548"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1036,10937573187824384195,9351378581096268066,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1776 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
744"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1036,10937573187824384195,9351378581096268066,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2552 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
844"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1036,10937573187824384195,9351378581096268066,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1332 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
932"C:\Windows\system32\taskmgr.exe" /4C:\Windows\System32\taskmgr.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Task Manager
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
952"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1036,10937573187824384195,9351378581096268066,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1884 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
1036"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1036,10937573187824384195,9351378581096268066,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1012 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
1068C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1108"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1036,10937573187824384195,9351378581096268066,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1780 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernel32.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shlwapi.dll
1160"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1036,10937573187824384195,9351378581096268066,131072 --enable-features=PasswordImport --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1052 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1212"C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe—lsass.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
83.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
Total events
22 179
Read events
21 948
Write events
223
Delete events
8

Modification events

(PID) Process:(1068) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0
Operation:writeName:CheckSetting
Value:
01000000D08C9DDF0115D1118C7A00C04FC297EB010000003D77C3133A5D7248BA6D7744BB9A3E16000000000200000000001066000000010000200000004A9CAAC251DD88A0E7E33FFB23F636A225CB7CC4485369C7C9B03862A811D096000000000E8000000002000020000000659B7585C71088AEEB1875008044DFB4B07623A0B20C3E867A78A9695191E29230000000F9C4E47AAD7D214C673E4CDC8385C59DDC5AE0E28396FCF21F9D028C590E79749BDDC16862F8E26B3D4F8E8966EEF17C4000000006EE6EDF8BC2D3544F7C9D682CF07277A50A34FA9DF6D8FB7B39CA5834F62523E20C12EF252EC87A75BE0FA4A5D7BD80B713248892E659363C3419474A1FEA18
(PID) Process:(3096) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3096) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3096) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3096) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3096) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3096) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3096) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3096) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1068) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.zip\OpenWithList
Operation:writeName:MRUList
Value:
a
Executable files
8
Suspicious files
160
Text files
121
Unknown types
0

Dropped files

PID
Process
Filename
Type
2732chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-649C2DD4-AAC.pma —
MD5:—
SHA256:—
3096WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3096.33830\0029283728373.exeexecutable
MD5:E7C68C679B6F033F61A056EEE833984E
SHA256:7C5ABD42009A780F6CD6C42AE547B0E90B055BC1DF9F4B8BCB0535FD6E1F8621
3004lsass.exeC:\Users\admin\AppData\Local\Temp\sqlite3.deftext
MD5:DE71633DE073966EB5D5F787EAC989BB
SHA256:C810A7589A228352269413CC503647DF82B4320B7C0B596A15D2842DAC7F843A
1068explorer.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\1b4dd67f29cb1962.automaticDestinations-msbinary
MD5:0DFBB23BC8B608563C0DC73114094A75
SHA256:03EB0DE31E24FCCEC8AD4824C844B04E8CBB345F5B0525CF8FBD381B8FF8E16F
2732chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.datbinary
MD5:9C016064A1F864C8140915D77CF3389A
SHA256:0E7265D4A8C16223538EDD8CD620B8820611C74538E420A88E333BE7F62AC787
1068explorer.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\0029283728373.zip.lnkbinary
MD5:6B2E0AAB5D3A096B112C2D14B9B536E4
SHA256:70FE74C9836E0908ABB8C72CAD8A907FE0ED43F4BE068155CF0C69EB41DD9858
3004lsass.exeC:\Users\admin\AppData\Local\Temp\37283T0binary
MD5:CC104C4E4E904C3AD7AD5C45FBFA7087
SHA256:321BE844CECC903EF1E7F875B729C96BB3ED0D4986314384CD5944A29A670C9B
1068explorer.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\290532160612e071.automaticDestinations-msbinary
MD5:4CE4A8C3A88ACF909B2D2B628F4C6BCD
SHA256:BCACDA74097068D97728C48091CDDDA6FC8EA579503183C4A905D6DFFBAB1733
20760029283728373.exeC:\Users\Public\Libraries\Nwnxhfcw.batexecutable
MD5:E7C68C679B6F033F61A056EEE833984E
SHA256:7C5ABD42009A780F6CD6C42AE547B0E90B055BC1DF9F4B8BCB0535FD6E1F8621
2732chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old~RF133358.TMPtext
MD5:64AD8ED3E666540337BA541C549F72F7
SHA256:BECBDB08B5B37D203A85F2E974407334053BB1D2270F0B3C9A4DB963896F2206
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
56
TCP/UDP connections
82
DNS requests
36
Threats
23

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1068
explorer.exe
GET
404
176.32.230.249:80
http://www.colbere.uk/6qne/?j8tDt=HR4edITcJCWL3R75on/jvryBj9AI8BKN4C7ylJfIbTcrsWjXTdf3XdEEuk/MIY9ZW6FeGhUvuuH/UpPZ3n/gKdB9EkQeiavN2eiKj10=&yv=789DavuHXtYt_V
GB
html
260 b
malicious
1068
explorer.exe
POST
404
46.30.211.38:80
http://www.barabell.com/6qne/
DK
html
162 b
malicious
3004
lsass.exe
GET
200
45.33.6.223:80
http://www.sqlite.org/2016/sqlite-dll-win32-x86-3140000.zip
US
compressed
423 Kb
whitelisted
1068
explorer.exe
POST
—
43.240.144.35:80
http://www.78669vip.com/6qne/
CN
—
—
malicious
844
chrome.exe
GET
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUwyMERESEZGVmJnQQ/1.0.0.6_nmmhkkegccagdldgiimedpiccmgmieda.crx
US
crx
242 Kb
whitelisted
1068
explorer.exe
POST
—
43.240.144.35:80
http://www.78669vip.com/6qne/
CN
—
—
malicious
1068
explorer.exe
POST
—
43.240.144.35:80
http://www.78669vip.com/6qne/
CN
—
—
malicious
1068
explorer.exe
POST
404
46.30.211.38:80
http://www.barabell.com/6qne/
DK
html
162 b
malicious
1068
explorer.exe
POST
404
46.30.211.38:80
http://www.barabell.com/6qne/
DK
html
162 b
malicious
1068
explorer.exe
POST
403
79.98.25.1:80
http://www.christmatoy.com/6qne/
LT
html
199 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1076
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2076
0029283728373.exe
13.107.42.13:443
onedrive.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
malicious
1076
svchost.exe
192.168.100.2:53
—
—
—
whitelisted
2076
0029283728373.exe
13.107.42.12:443
3vkq1q.ph.files.1drv.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
suspicious
1068
explorer.exe
176.32.230.249:80
www.colbere.uk
Host Europe GmbH
GB
malicious
3004
lsass.exe
45.33.6.223:80
www.sqlite.org
Linode, LLC
US
suspicious
1068
explorer.exe
79.98.25.1:80
www.christmatoy.com
UAB Interneto vizija
LT
malicious
1068
explorer.exe
46.30.211.38:80
www.barabell.com
One.com A/S
DK
malicious
844
chrome.exe
172.217.16.196:443
www.google.com
GOOGLE
US
whitelisted
2732
chrome.exe
239.255.255.250:1900
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
onedrive.live.com
  • 13.107.42.13
shared
3vkq1q.ph.files.1drv.com
  • 13.107.42.12
suspicious
www.themesterofsuepnse.rest
  • —
suspicious
www.colbere.uk
  • 176.32.230.249
malicious
www.sqlite.org
  • 45.33.6.223
whitelisted
www.barabell.com
  • 46.30.211.38
malicious
www.visawe.online
  • —
unknown
www.christmatoy.com
  • 79.98.25.1
malicious
clientservices.googleapis.com
  • 142.250.186.35
whitelisted
accounts.google.com
  • 142.250.186.173
shared

Threats

PID
Process
Class
Message
2076
0029283728373.exe
Potential Corporate Privacy Violation
POLICY [ANY.RUN] Downloading from a file sharing service is observed
1068
explorer.exe
Malware Command and Control Activity Detected
ET MALWARE FormBook CnC Checkin (POST) M2
1068
explorer.exe
Malware Command and Control Activity Detected
ET MALWARE FormBook CnC Checkin (POST) M2
1068
explorer.exe
Malware Command and Control Activity Detected
ET MALWARE FormBook CnC Checkin (GET)
1068
explorer.exe
Malware Command and Control Activity Detected
ET MALWARE FormBook CnC Checkin (GET)
1068
explorer.exe
Malware Command and Control Activity Detected
ET MALWARE FormBook CnC Checkin (GET)
1068
explorer.exe
Malware Command and Control Activity Detected
ET MALWARE FormBook CnC Checkin (GET)
1068
explorer.exe
Malware Command and Control Activity Detected
ET MALWARE FormBook CnC Checkin (GET)
1068
explorer.exe
Malware Command and Control Activity Detected
ET MALWARE FormBook CnC Checkin (GET)
1068
explorer.exe
Malware Command and Control Activity Detected
ET MALWARE FormBook CnC Checkin (POST) M2
11 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
0029283728373.zip