analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Order_673N78333.xlsx

Full analysis: https://app.any.run/tasks/696a8f47-fdd1-4ccd-aa17-83a33bc9776f
Verdict: Malicious activity
Threats:

FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus.

Analysis date: May 20, 2022, 20:01:32
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
encrypted
opendir
trojan
exploit
CVE-2017-11882
loader
formbook
stealer
Indicators:
MIME: application/encrypted
File info: CDFV2 Encrypted
MD5:

E8AE0C61B486A0931F907F6AAEA809DA

SHA1:

6B1E9D52B095D295640E59856A1A8AE3CD3FAA8B

SHA256:

6D9565D2D419EB384B07F73CF7CAE07B178A24A963B3902BD168687875D7EE7C

SSDEEP:

6144:QnEUSMaZVcAGVSFjRvx+8uXd2tTMwPgS7aTHY:TiaZVQytvvADwPgBHY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Equation Editor starts application (CVE-2017-11882)

      • EQNEDT32.EXE (PID: 2444)
    • Drops executable file immediately after starts

      • EQNEDT32.EXE (PID: 2444)
      • vbc.exe (PID: 3364)
    • Application was dropped or rewritten from another process

      • vbc.exe (PID: 3364)
      • hrtmb.exe (PID: 1300)
      • hrtmb.exe (PID: 1416)
    • FORMBOOK detected by memory dumps

      • raserver.exe (PID: 3876)
    • Connects to CnC server

      • Explorer.EXE (PID: 1172)
    • FORMBOOK was detected

      • Explorer.EXE (PID: 1172)
  • SUSPICIOUS

    • Reads the computer name

      • EQNEDT32.EXE (PID: 2444)
      • vbc.exe (PID: 3364)
      • hrtmb.exe (PID: 1416)
    • Executed via COM

      • EQNEDT32.EXE (PID: 2444)
    • Checks supported languages

      • EQNEDT32.EXE (PID: 2444)
      • vbc.exe (PID: 3364)
      • hrtmb.exe (PID: 1300)
      • hrtmb.exe (PID: 1416)
    • Executable content was dropped or overwritten

      • EQNEDT32.EXE (PID: 2444)
      • vbc.exe (PID: 3364)
    • Drops a file with a compile date too recent

      • EQNEDT32.EXE (PID: 2444)
      • vbc.exe (PID: 3364)
    • Application launched itself

      • hrtmb.exe (PID: 1300)
    • Starts CMD.EXE for commands execution

      • raserver.exe (PID: 3876)
    • Reads Environment values

      • raserver.exe (PID: 3876)
  • INFO

    • Reads the computer name

      • EXCEL.EXE (PID: 1000)
      • raserver.exe (PID: 3876)
    • Checks supported languages

      • EXCEL.EXE (PID: 1000)
      • raserver.exe (PID: 3876)
      • cmd.exe (PID: 2416)
    • Starts Microsoft Office Application

      • Explorer.EXE (PID: 1172)
    • Manual execution by user

      • raserver.exe (PID: 3876)
      • autoconv.exe (PID: 3776)
      • autofmt.exe (PID: 3828)
    • Reads Microsoft Office registry keys

      • EXCEL.EXE (PID: 1000)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Formbook

(PID) Process(3876) raserver.exe
Modules (42)kernel32.dll
advapi32.dll
ws2_32.dll
svchost.exe
msiexec.exe
wuauclt.exe
lsass.exe
wlanext.exe
msg.exe
lsm.exe
dwm.exe
help.exe
chkdsk.exe
cmmon32.exe
nbtstat.exe
spoolsv.exe
rdpclip.exe
control.exe
taskhost.exe
rundll32.exe
systray.exe
audiodg.exe
wininit.exe
services.exe
autochk.exe
autoconv.exe
autofmt.exe
cmstp.exe
colorcpl.exe
cscript.exe
explorer.exe
WWAHost.exe
ipconfig.exe
msdt.exe
mstsc.exe
NAPSTAT.EXE
netsh.exe
NETSTAT.EXE
raserver.exe
wscript.exe
wuapp.exe
cmd.exe
Decoys and strings (143)USERNAME
LOCALAPPDATA
USERPROFILE
APPDATA
TEMP
ProgramFiles
CommonProgramFiles
ALLUSERSPROFILE
/c copy "
/c del "
\Run
\Policies
\Explorer
\Registry\User
\Registry\Machine
\SOFTWARE\Microsoft\Windows\CurrentVersion
Office\15.0\Outlook\Profiles\Outlook\
NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\
\SOFTWARE\Mozilla\Mozilla
\Mozilla
Username:
Password:
formSubmitURL
usernameField
encryptedUsername
encryptedPassword
\logins.json
\signons.sqlite
\Microsoft\Vault\
SELECT encryptedUsername, encryptedPassword, formSubmitURL FROM moz_logins
\Google\Chrome\User Data\Default\Login Data
SELECT origin_url, username_value, password_value FROM logins
.exe
.com
.scr
.pif
.cmd
.bat
ms
win
gdi
mfc
vga
igfx
user
help
config
update
regsvc
chkdsk
systray
audiodg
certmgr
autochk
taskhost
colorcpl
services
IconCache
ThumbCache
Cookies
SeDebugPrivilege
SeShutdownPrivilege
\BaseNamedObjects
config.php
POST
HTTP/1.1
Host:
Connection: close
Content-Length:
Cache-Control: no-cache
Origin: http://
User-Agent: Mozilla Firefox/4.0
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://
Accept-Language: en-US
Accept-Encoding: gzip, deflate dat=
f-start
prvzz.xyz
jhh9999.com
myshellsnaturals.com
kaminemper.xyz
whatongodsgreedearth.com
xiaoxinyan.com
bruv.media
solarpenels-es-open.site
cymail.ca
viaplan.site
a2700ou.com
klinkai.com
e2ojcduey3b1.xyz
summerfarm.site
justlable.store
burghwallisjubilee.com
kangarooblog2022.com
graficaolimpo.com
hjsdsgtdfg.xyz
keezelevenrsa.xyz
caseynevaeh.xyz
calender.pro
paysoshomozwv.xyz
beccashop.com
b0jpt2.xyz
betscorestips.store
foreignbills4u.com
dignitycareatoasis.com
milktowngoats.com
elijahchairs.com
yhllwyj.xyz
magicalmeta.xyz
elusiveminds.institute
onenight19.com
bestpremiumwordpressthemes.com
brightstonexm.com
southwestfloridamattress.com
wanderlabs.media
idiotideas.com
t4yhofie0.xyz
voice-of-april.com
feelmypayne.com
istanbulhikayeleri.com
navlgatorkcy.website
beijinghongritianchuang.site
phemsoq.xyz
redeemliquor.com
modocinema.com
donutprints.info
malerbetriebbock.com
akimotrade.com
yeavaneu.xyz
digitaliseringsstyrelsen.xyz
ib-moneta-zmrazeny.info
explainedpro.com
xdygu.xyz
ozdemirdtm.com
godhcf.xyz
openerlotion.site
7477a.xyz
penguinmoonwalker.com
matchperfeito.com
fqvsi.xyz
grandudes.com
f-end
C2www.zy.company/r75h/
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
10
Malicious processes
4
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start drop and start excel.exe no specs eqnedt32.exe vbc.exe hrtmb.exe no specs hrtmb.exe no specs autoconv.exe no specs autofmt.exe no specs #FORMBOOK raserver.exe no specs cmd.exe no specs #FORMBOOK explorer.exe

Process information

PID
CMD
Path
Indicators
Parent process
1000"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /ddeC:\Program Files\Microsoft Office\Office14\EXCEL.EXEExplorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Version:
14.0.6024.1000
2444"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
3364"C:\Users\Public\vbc.exe" C:\Users\Public\vbc.exe
EQNEDT32.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
1300C:\Users\admin\AppData\Local\Temp\hrtmb.exe C:\Users\admin\AppData\Local\Temp\bxhfnC:\Users\admin\AppData\Local\Temp\hrtmb.exevbc.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
1416C:\Users\admin\AppData\Local\Temp\hrtmb.exe C:\Users\admin\AppData\Local\Temp\bxhfnC:\Users\admin\AppData\Local\Temp\hrtmb.exehrtmb.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3776"C:\Windows\System32\autoconv.exe"C:\Windows\System32\autoconv.exeExplorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Auto File System Conversion Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3828"C:\Windows\System32\autofmt.exe"C:\Windows\System32\autofmt.exeExplorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Auto File System Format Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3876"C:\Windows\System32\raserver.exe"C:\Windows\System32\raserver.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Remote Assistance COM Server
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Formbook
(PID) Process(3876) raserver.exe
Modules (42)kernel32.dll
advapi32.dll
ws2_32.dll
svchost.exe
msiexec.exe
wuauclt.exe
lsass.exe
wlanext.exe
msg.exe
lsm.exe
dwm.exe
help.exe
chkdsk.exe
cmmon32.exe
nbtstat.exe
spoolsv.exe
rdpclip.exe
control.exe
taskhost.exe
rundll32.exe
systray.exe
audiodg.exe
wininit.exe
services.exe
autochk.exe
autoconv.exe
autofmt.exe
cmstp.exe
colorcpl.exe
cscript.exe
explorer.exe
WWAHost.exe
ipconfig.exe
msdt.exe
mstsc.exe
NAPSTAT.EXE
netsh.exe
NETSTAT.EXE
raserver.exe
wscript.exe
wuapp.exe
cmd.exe
Decoys and strings (143)USERNAME
LOCALAPPDATA
USERPROFILE
APPDATA
TEMP
ProgramFiles
CommonProgramFiles
ALLUSERSPROFILE
/c copy "
/c del "
\Run
\Policies
\Explorer
\Registry\User
\Registry\Machine
\SOFTWARE\Microsoft\Windows\CurrentVersion
Office\15.0\Outlook\Profiles\Outlook\
NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\
\SOFTWARE\Mozilla\Mozilla
\Mozilla
Username:
Password:
formSubmitURL
usernameField
encryptedUsername
encryptedPassword
\logins.json
\signons.sqlite
\Microsoft\Vault\
SELECT encryptedUsername, encryptedPassword, formSubmitURL FROM moz_logins
\Google\Chrome\User Data\Default\Login Data
SELECT origin_url, username_value, password_value FROM logins
.exe
.com
.scr
.pif
.cmd
.bat
ms
win
gdi
mfc
vga
igfx
user
help
config
update
regsvc
chkdsk
systray
audiodg
certmgr
autochk
taskhost
colorcpl
services
IconCache
ThumbCache
Cookies
SeDebugPrivilege
SeShutdownPrivilege
\BaseNamedObjects
config.php
POST
HTTP/1.1
Host:
Connection: close
Content-Length:
Cache-Control: no-cache
Origin: http://
User-Agent: Mozilla Firefox/4.0
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://
Accept-Language: en-US
Accept-Encoding: gzip, deflate dat=
f-start
prvzz.xyz
jhh9999.com
myshellsnaturals.com
kaminemper.xyz
whatongodsgreedearth.com
xiaoxinyan.com
bruv.media
solarpenels-es-open.site
cymail.ca
viaplan.site
a2700ou.com
klinkai.com
e2ojcduey3b1.xyz
summerfarm.site
justlable.store
burghwallisjubilee.com
kangarooblog2022.com
graficaolimpo.com
hjsdsgtdfg.xyz
keezelevenrsa.xyz
caseynevaeh.xyz
calender.pro
paysoshomozwv.xyz
beccashop.com
b0jpt2.xyz
betscorestips.store
foreignbills4u.com
dignitycareatoasis.com
milktowngoats.com
elijahchairs.com
yhllwyj.xyz
magicalmeta.xyz
elusiveminds.institute
onenight19.com
bestpremiumwordpressthemes.com
brightstonexm.com
southwestfloridamattress.com
wanderlabs.media
idiotideas.com
t4yhofie0.xyz
voice-of-april.com
feelmypayne.com
istanbulhikayeleri.com
navlgatorkcy.website
beijinghongritianchuang.site
phemsoq.xyz
redeemliquor.com
modocinema.com
donutprints.info
malerbetriebbock.com
akimotrade.com
yeavaneu.xyz
digitaliseringsstyrelsen.xyz
ib-moneta-zmrazeny.info
explainedpro.com
xdygu.xyz
ozdemirdtm.com
godhcf.xyz
openerlotion.site
7477a.xyz
penguinmoonwalker.com
matchperfeito.com
fqvsi.xyz
grandudes.com
f-end
C2www.zy.company/r75h/
2416/c del "C:\Users\admin\AppData\Local\Temp\hrtmb.exe"C:\Windows\System32\cmd.exeraserver.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
1172C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
1 958
Read events
1 871
Write events
76
Delete events
11

Modification events

(PID) Process:(1000) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
Operation:writeName:kt3
Value:
6B743300E8030000010000000000000000000000
(PID) Process:(1000) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
Off
(PID) Process:(1000) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1041
Value:
Off
(PID) Process:(1000) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1046
Value:
Off
(PID) Process:(1000) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1036
Value:
Off
(PID) Process:(1000) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1031
Value:
Off
(PID) Process:(1000) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1040
Value:
Off
(PID) Process:(1000) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1049
Value:
Off
(PID) Process:(1000) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:3082
Value:
Off
(PID) Process:(1000) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1042
Value:
Off
Executable files
3
Suspicious files
3
Text files
0
Unknown types
2

Dropped files

PID
Process
Filename
Type
1000EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVR98EB.tmp.cvr
MD5:
SHA256:
3364vbc.exeC:\Users\admin\AppData\Local\Temp\hrtmb.exeexecutable
MD5:D8D7186A46FB0078E44ED89C64AA3881
SHA256:4982AAF13A3DC1C128975A9FFFC5636280AB0ACFE390574164EDAA019C1B3B9C
3364vbc.exeC:\Users\admin\AppData\Local\Temp\afy7cbsqdzzlq5ud0binary
MD5:8DC56B738DB64FE02A247DAEFEC0466D
SHA256:D3D766A35F0D10AB029B4E978851F6E2ED2E08C59FEACA21F4A8FE60AB8CEDAB
2444EQNEDT32.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\vbc[1].exeexecutable
MD5:588E64F0CECB7BE8FFB253782164867B
SHA256:7F9EAD41557A685C5F7CD82C6607D7BBE98397BF87CF04BE8E7E7E13BEA41938
3364vbc.exeC:\Users\admin\AppData\Local\Temp\bxhfnbinary
MD5:8D939C4619A1B93A91EC769E50865A30
SHA256:6D7F790627A73FC30AA77D515AB674C0B444910974826A403A4C978D8CEDE3A4
2444EQNEDT32.EXEC:\Users\Public\vbc.exeexecutable
MD5:588E64F0CECB7BE8FFB253782164867B
SHA256:7F9EAD41557A685C5F7CD82C6607D7BBE98397BF87CF04BE8E7E7E13BEA41938
3364vbc.exeC:\Users\admin\AppData\Local\Temp\nsrB0AA.tmpbinary
MD5:402ED41E9B1B3CB0ED776923524F41D8
SHA256:DEF718CBB32BB01E5FDDDDE34E47BF926C72A664AF361422DE3348A563E75206
1000EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\BF156E35.emfemf
MD5:894A796F9211E1080192AC72B6D54A9D
SHA256:8232CC0DF629D8D89A7155A1793B35D611073D60F2BEEC4BABBF78179978B71A
1000EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\6EDFAE04.emfemf
MD5:8E3A74F7AA420B02D34C69E625969C0A
SHA256:0CD83C55739629F98FE6AFD3E25A5BCBB346CBEF58BC592C1260E9F0FA8575A9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
3
DNS requests
9
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1172
Explorer.EXE
GET
45.113.203.147:80
http://www.b0jpt2.xyz/r75h/?6loPdxQ8=ZWRZVyKV+jzsCxNkWsTtdpDC/5UqOvRouv71vnOGq+gAmz8CHTCOYUrPEWoxUKKDisCyVg==&3f6=YnM0yt2x
CN
malicious
2444
EQNEDT32.EXE
GET
200
198.12.89.154:80
http://198.12.89.154/450/vbc.exe
US
executable
209 Kb
malicious
1172
Explorer.EXE
GET
404
156.226.218.214:80
http://www.jhh9999.com/r75h/?6loPdxQ8=5gPu29TqcIwODq2QILsIZu7pgJD0Y8PRHWogwA/1Lfzsy6zppku2vs68JDEv5oYfX1otIQ==&3f6=YnM0yt2x
ZA
html
146 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1172
Explorer.EXE
45.113.203.147:80
www.b0jpt2.xyz
CN
malicious
1172
Explorer.EXE
156.226.218.214:80
www.jhh9999.com
MacroLAN
ZA
malicious
2444
EQNEDT32.EXE
198.12.89.154:80
ColoCrossing
US
malicious

DNS requests

Domain
IP
Reputation
www.b0jpt2.xyz
  • 45.113.203.147
malicious
www.jhh9999.com
  • 156.226.218.214
malicious
www.prvzz.xyz
unknown
www.xiaoxinyan.com
unknown

Threats

PID
Process
Class
Message
2444
EQNEDT32.EXE
A Network Trojan was detected
ET INFO Executable Download from dotted-quad Host
2444
EQNEDT32.EXE
A Network Trojan was detected
ET TROJAN MSIL/GenKryptik.FQRH Download Request
2444
EQNEDT32.EXE
Potentially Bad Traffic
ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile
2444
EQNEDT32.EXE
A Network Trojan was detected
ET CURRENT_EVENTS Likely Evil EXE download from dotted Quad by MSXMLHTTP M1
2444
EQNEDT32.EXE
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2444
EQNEDT32.EXE
A Network Trojan was detected
ET CURRENT_EVENTS Likely Evil EXE download from dotted Quad by MSXMLHTTP M2
2444
EQNEDT32.EXE
Potentially Bad Traffic
ET INFO SUSPICIOUS Dotted Quad Host MZ Response
1172
Explorer.EXE
Generic Protocol Command Decode
SURICATA HTTP Unexpected Request body
1172
Explorer.EXE
A Network Trojan was detected
ET TROJAN FormBook CnC Checkin (GET)
1172
Explorer.EXE
A Network Trojan was detected
ET TROJAN FormBook CnC Checkin (GET)
No debug info