analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

fresh.msi

Full analysis: https://app.any.run/tasks/e93b005f-fce7-4a2b-9967-2bce3c5a4df6
Verdict: Malicious activity
Threats:

FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus.

Malware Trends Tracker     >>>
Analysis date: September 11, 2019, 12:01:06
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
exe-to-msi
trojan
formbook
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Code page: 1252, Last Printed: Fri Sep 21 10:56:09 2012, Create Time/Date: Fri Sep 21 10:56:09 2012, Name of Creating Application: Windows Installer, Title: Exe to msi converter free, Author: www.exetomsi.com, Template: ;0, Last Saved By: devuser, Revision Number: {C35CF0AA-9B3F-4903-9F05-EBF606D58D3E}, Last Saved Time/Date: Tue May 21 12:56:44 2013, Number of Pages: 100, Number of Words: 0, Security: 0
MD5:

0FD934C1C2A35B2B685D1E23285C9AB1

SHA1:

879A0CF167ED1E78B87BED754BAD7DE29848AD90

SHA256:

5C9C882A4D2160978378B5FC431873EFE9560C309C0AA7EC42ECE982B17669CD

SSDEEP:

6144:iEKC6urtW9MRPnCRRQ48Cm8dBouHk0jQuKkyh3v39AQflcVv39Fh1x0TqI6:iEKbMBtv8dtfsv9AQdW3Tfx+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • FORMBOOK was detected

      • explorer.exe (PID: 276)
      • NETSTAT.EXE (PID: 2224)
      • Firefox.exe (PID: 3112)

    • Connects to CnC server

      • explorer.exe (PID: 276)

    • Actions looks like stealing of personal data

      • NETSTAT.EXE (PID: 2224)

    • Changes the autorun value in the registry

      • NETSTAT.EXE (PID: 2224)

    • Stealing of credential data

      • NETSTAT.EXE (PID: 2224)

  • SUSPICIOUS

    • Starts Microsoft Installer

      • explorer.exe (PID: 276)

    • Executed as Windows Service

      • vssvc.exe (PID: 2868)

    • Executed via COM

      • DrvInst.exe (PID: 3968)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 3012)

    • Drop ExeToMSI Application

      • msiexec.exe (PID: 3012)

    • Uses NETSTAT.EXE to discover network connections

      • explorer.exe (PID: 276)

    • Starts CMD.EXE for commands execution

      • NETSTAT.EXE (PID: 2224)

    • Loads DLL from Mozilla Firefox

      • NETSTAT.EXE (PID: 2224)

    • Creates files in the user directory

      • NETSTAT.EXE (PID: 2224)

  • INFO

    • Low-level read access rights to disk partition

      • vssvc.exe (PID: 2868)

    • Searches for installed software

      • msiexec.exe (PID: 3012)

    • Application was dropped or rewritten from another process

      • MSID836.tmp (PID: 2776)
      • MSID836.tmp (PID: 2364)

    • Starts application with an unusual extension

      • msiexec.exe (PID: 3012)
      • MSID836.tmp (PID: 2776)

    • Application launched itself

      • MSID836.tmp (PID: 2776)

    • Reads the hosts file

      • NETSTAT.EXE (PID: 2224)

    • Manual execution by user

      • NETSTAT.EXE (PID: 2224)

    • Creates files in the user directory

      • Firefox.exe (PID: 3112)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Installer (100)

EXIF

FlashPix

Security: None
Words: -
Pages: 100
ModifyDate: 2013:05:21 11:56:44
RevisionNumber: {C35CF0AA-9B3F-4903-9F05-EBF606D58D3E}
LastModifiedBy: devuser
Template: ;0
Comments: -
Keywords: -
Author: www.exetomsi.com
Subject: -
Title: Exe to msi converter free
Software: Windows Installer
CreateDate: 2012:09:21 09:56:09
LastPrinted: 2012:09:21 09:56:09
CodePage: Windows Latin 1 (Western European)
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
10
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start msiexec.exe no specs msiexec.exe vssvc.exe no specs drvinst.exe no specs msid836.tmp no specs msid836.tmp #FORMBOOK netstat.exe cmd.exe no specs #FORMBOOK explorer.exe #FORMBOOK firefox.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3424"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Temp\fresh.msi"C:\Windows\System32\msiexec.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
3012C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
2868C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3968DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot22" "" "" "695c3f483" "00000000" "000005B8" "000002D4"C:\Windows\system32\DrvInst.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2776"C:\Windows\Installer\MSID836.tmp"C:\Windows\Installer\MSID836.tmp—msiexec.exe
User:
admin
Company:
TRANSPLANT4HADES8
Integrity Level:
MEDIUM
Description:
TRANSPLANT4Woolstock3
Exit code:
0
Version:
1.05.0006
2364"C:\Windows\Installer\MSID836.tmp"C:\Windows\Installer\MSID836.tmp
MSID836.tmp
User:
SYSTEM
Company:
TRANSPLANT4HADES8
Integrity Level:
SYSTEM
Description:
TRANSPLANT4Woolstock3
Exit code:
0
Version:
1.05.0006
2224"C:\Windows\System32\NETSTAT.EXE"C:\Windows\System32\NETSTAT.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Netstat Command
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3092/c del "C:\Windows\Installer\MSID836.tmp"C:\Windows\System32\cmd.exe—NETSTAT.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
276C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3112"C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe
NETSTAT.EXE
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
68.0.1
Total events
511
Read events
330
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
88
Text files
32
Unknown types
0

Dropped files

PID
Process
Filename
Type
3012msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
3012msiexec.exeC:\Users\admin\AppData\Local\Temp\~DFAC5415D6356CA344.TMP —
MD5:—
SHA256:—
2868vssvc.exeC: —
MD5:—
SHA256:—
3012msiexec.exeC:\Config.Msi\16d1cf.rbs —
MD5:—
SHA256:—
3012msiexec.exeC:\Users\admin\AppData\Local\Temp\~DFBDADD2061C7517BB.TMP —
MD5:—
SHA256:—
3012msiexec.exeC:\System Volume Information\SPP\snapshot-2binary
MD5:50BE7F31703FFA4BBA100ACF59C02BB2
SHA256:3697E3D93CD67D9661D0482AC01FB3D27EC4B13196A1E5F420FADBF630802055
3968DrvInst.exeC:\Windows\INF\setupapi.ev3binary
MD5:8F761032829FB6121AEE77E26DC667A6
SHA256:F83E1592023B7C8F6C15847F26D30770C0A52E6C7304DBA951EEA437E2737649
3968DrvInst.exeC:\Windows\INF\setupapi.ev1binary
MD5:0C466B38761A1060C08FDD45736EC779
SHA256:A70D9794ECEBFB8E527D1C7DDEDFABACFB5A12BE8E9D5C5A627AF5D36F84D67F
3012msiexec.exeC:\Windows\Installer\16d1ce.ipibinary
MD5:685359E9AC0190122B8D86C8B60FB035
SHA256:12927881F2044FB0F94AD97186E39DD37DD0E172E8DEC1F461147ED20B2C17D0
2224NETSTAT.EXEC:\Users\admin\AppData\Roaming\7K93541E\7K9logrc.inibinary
MD5:ABC3E65903C43305DBA1DD27B3F62364
SHA256:0A8AABF9A5B3E255164B22988E6415FFC71F2F89E7217B6D6D3827DD8A69B2CF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
13
DNS requests
9
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
276
explorer.exe
GET
—
162.241.253.144:80
http://www.sunnyandfree.com/do/?T8wXJlW=28oisobrpnp4gzKjm/boXKBSHoGcFzk4SjUKa11vZDD0tae8IjxWygsnTuOyZ7e+d+DFlw==&-ZBXn=1bvHF&sql=1
US
—
—
malicious
276
explorer.exe
GET
404
52.1.217.30:80
http://www.steveshydrationinfo.us/do/?T8wXJlW=tUQy/CN+oh/pJdgHdZybN09IuGYN30K0D+zl0Y11kMtDopqGKOP6t705t7QRc/PC8D4T2g==&-ZBXn=1bvHF&sql=1
US
html
2.53 Kb
malicious
276
explorer.exe
POST
—
52.1.217.30:80
http://www.steveshydrationinfo.us/do/
US
—
—
malicious
276
explorer.exe
POST
—
52.1.217.30:80
http://www.steveshydrationinfo.us/do/
US
—
—
malicious
276
explorer.exe
GET
—
50.63.202.41:80
http://www.rudyglez.com/do/?T8wXJlW=NUZflwQlIgwvsGdabocXY66awDa+UhvvRcnXrd95V9Re/eAN77dEtzEu8Kw2JipIWKvMQg==&-ZBXn=1bvHF&sql=1
US
—
—
malicious
276
explorer.exe
GET
302
199.34.228.176:80
http://www.luxzurybeauty.com/do/?T8wXJlW=J04Wm4XAgNqxU/f2fTNxULpSFQma1vU1ns2/SuCcwDgYu9DDVg+gEbFp+DcYAFa2tbtO8w==&-ZBXn=1bvHF
US
html
372 b
malicious
276
explorer.exe
POST
—
162.241.253.144:80
http://www.sunnyandfree.com/do/
US
—
—
malicious
276
explorer.exe
POST
—
162.241.253.144:80
http://www.sunnyandfree.com/do/
US
—
—
malicious
276
explorer.exe
POST
—
52.1.217.30:80
http://www.steveshydrationinfo.us/do/
US
—
—
malicious
276
explorer.exe
POST
—
162.241.253.144:80
http://www.sunnyandfree.com/do/
US
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
276
explorer.exe
52.1.217.30:80
www.steveshydrationinfo.us
Amazon.com, Inc.
US
malicious
276
explorer.exe
199.34.228.176:80
www.luxzurybeauty.com
Weebly, Inc.
US
malicious
276
explorer.exe
162.241.253.144:80
www.sunnyandfree.com
CyrusOne LLC
US
malicious
276
explorer.exe
50.63.202.41:80
www.rudyglez.com
GoDaddy.com, LLC
US
malicious

DNS requests

Domain
IP
Reputation
www.luxzurybeauty.com
  • 199.34.228.176
malicious
www.xn--5brp51b2jpe3i.com
  • —
unknown
www.lupayiwu33.party
  • —
unknown
www.steveshydrationinfo.us
  • 52.1.217.30
malicious
www.ggexp.info
  • —
unknown
www.basantstudiojodhpur.com
  • —
unknown
www.sunnyandfree.com
  • 162.241.253.144
malicious
www.rudyglez.com
  • 50.63.202.41
malicious
www.kitchencastle.win
  • —
unknown

Threats

PID
Process
Class
Message
276
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] FormBook CnC Checkin (GET)
276
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] FormBook CnC Checkin (GET)
276
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] TrojanSpy:FormBook CnC Checkin (POST)
276
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] TrojanSpy:FormBook CnC Checkin (POST)
276
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] FormBook CnC Checkin (GET)
276
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] TrojanSpy:FormBook CnC Checkin (POST)
276
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] TrojanSpy:FormBook CnC Checkin (POST)
276
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] FormBook CnC Checkin (POST)
276
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] FormBook CnC Checkin (GET)
276
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] TrojanSpy:FormBook CnC Checkin (POST)
9 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
fresh.msi