analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| File name: | Quotation.ace |
| Full analysis: | https://app.any.run/tasks/eb42c445-c1ef-4ec4-b746-71f1a81ee710 |
| Verdict: | Malicious activity |
| Threats: | FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus. |
| Analysis date: | November 15, 2018, 13:39:13 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/octet-stream |
| File info: | ACE archive data version 20, from Win/32, version 20 to extract, solid |
| MD5: | A8688EBF68CDA818AABB00CCC040F146 |
| SHA1: | 868C9957B6578393F2B957DF92DCF9E772B3963A |
| SHA256: | 86ECA78C8168060CC9330CBC382871BB186B489A6AF4C60930F9D2A4958F262D |
| SSDEEP: | 6144:jNpexHfF1KAYqmqVp2c0+hv1W9Ir98EGkUOZGnrsKRUYrxO+:jNaHfF1KAYsSwv1958EGktCrTXrk+ |
MALICIOUS
Application was dropped or rewritten from another process
- Quotation.exe (PID: 3732)
- Quotation.exe (PID: 3480)
Changes the autorun value in the registry
- NETSTAT.EXE (PID: 3900)
Actions looks like stealing of personal data
- NETSTAT.EXE (PID: 3900)
Formbook was detected
- Firefox.exe (PID: 2336)
- NETSTAT.EXE (PID: 3900)
FORMBOOK was detected
- explorer.exe (PID: 1716)
Connects to CnC server
- explorer.exe (PID: 1716)
SUSPICIOUS
Executable content was dropped or overwritten
- WinRAR.exe (PID: 3184)
- Quotation.exe (PID: 3732)
- NETSTAT.EXE (PID: 3900)
Application launched itself
- Quotation.exe (PID: 3732)
Loads DLL from Mozilla Firefox
- NETSTAT.EXE (PID: 3900)
Uses NETSTAT.EXE to discover network connections
- explorer.exe (PID: 1716)
Starts CMD.EXE for commands execution
- NETSTAT.EXE (PID: 3900)
Creates files in the user directory
- NETSTAT.EXE (PID: 3900)
- explorer.exe (PID: 1716)
Reads Internet Cache Settings
- explorer.exe (PID: 1716)
INFO
Starts Microsoft Office Application
- explorer.exe (PID: 1716)
Reads Microsoft Office registry keys
- WINWORD.EXE (PID: 3756)
Creates files in the user directory
- Firefox.exe (PID: 2336)
- WINWORD.EXE (PID: 3756)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .ace | | | ACE compressed archive (100) |
|---|
Total processes
43
Monitored processes
8
Malicious processes
3
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 3184 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Quotation.ace" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 | ||||
| 3732 | "C:\Users\admin\Desktop\Quotation.exe" | C:\Users\admin\Desktop\Quotation.exe | explorer.exe | |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
| 3480 | "C:\Users\admin\Desktop\Quotation.exe" | C:\Users\admin\Desktop\Quotation.exe | — | Quotation.exe |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
| 3900 | "C:\Windows\System32\NETSTAT.EXE" | C:\Windows\System32\NETSTAT.EXE | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: TCP/IP Netstat Command Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
| 2724 | /c del "C:\Users\admin\Desktop\Quotation.exe" | C:\Windows\System32\cmd.exe | — | NETSTAT.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
| 1716 | C:\Windows\Explorer.EXE | C:\Windows\explorer.exe | — | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
| 2336 | "C:\Program Files\Mozilla Firefox\Firefox.exe" | C:\Program Files\Mozilla Firefox\Firefox.exe | NETSTAT.EXE | |
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 61.0.2 | ||||
| 3756 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\positivefi.rtf" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
Total events
4 441
Read events
4 038
Write events
0
Delete events
0
Modification events
Executable files
4
Suspicious files
2
Text files
3
Unknown types
8
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1716 | explorer.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\1b4dd67f29cb1962.automaticDestinations-ms | automaticdestinations-ms | |
MD5:E62D14E2B64F5769287B89D4F32FA4DF | SHA256:2D3372853FA97C76B58E256E41248C7869436D887B6531181F37FB7480E7DF47 | |||
| 3732 | Quotation.exe | C:\Users\admin\AppData\Local\Temp\Subabbot | binary | |
MD5:B0F9DA5B7B959AD7F4F96443BF6ADABE | SHA256:E679D3DB46DBAB1EB91AD2D3ABADF8D80C3277CDEFDC0279437E8317B48AFBEA | |||
| 3756 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dat | text | |
MD5:813FAE854A85F63C4C700453E3044E82 | SHA256:50407EE7D7AFF306F4750DAFB9EFFF184A6F3C6887492443A00F947077A2ACA2 | |||
| 1716 | explorer.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012018111520181116\index.dat | dat | |
MD5:463D59E7B03D2403499678934B23982C | SHA256:E33EAAA2328C4DBC3A71179D999CABE369AB656E3E4A2574486F0CB3B9DFBD3B | |||
| 1716 | explorer.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\positivefi.rtf.lnk | lnk | |
MD5:A16F8D27480C6EC0A48C1E301CAD2D3C | SHA256:796A58AB60C2C02C55A2E389B75E625BBECEE1A5521779CD939D32133ADDED5E | |||
| 3756 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:99D9E1EBD121EF8B2C402420C23096D7 | SHA256:E46C68AB39BDDC253EBC13F616A5F000F56C86681840863EC18677C5C839E700 | |||
| 3184 | WinRAR.exe | C:\Users\admin\Desktop\Quotation.exe | executable | |
MD5:BCA3D6F64C3B6960DD2C21AB8B7DDF0C | SHA256:7C85FB85E26277549156FAE460040EAC6EA64B20F1A8CCDAB4D1C1ED8C5494DF | |||
| 3732 | Quotation.exe | C:\Users\admin\AppData\Local\Temp\squamules.dll | executable | |
MD5:694748B0594AF99B9AA1FB096BCC1150 | SHA256:FE6179A9F337FAB0CBFDBD5F17A58A9F517E2CAED5AE1CE068AC1DAA9891853D | |||
| 3900 | NETSTAT.EXE | C:\Users\admin\AppData\Local\Temp\xrj8bnah.zip | compressed | |
MD5:10C809CDC0FF1B7A4A26FEC1D1370EE8 | SHA256:065A83AB4E942FE61837CBF10739C381F76C9BE41448969AE5F4BAF90285C324 | |||
| 3756 | WINWORD.EXE | C:\Users\admin\Desktop\~$sitivefi.rtf | pgc | |
MD5:81565EDEE8465D88BB7FCBFD1CE11CD9 | SHA256:76D3B5FCAA17DAA76D9B1B173AA5F88BD93968F0A8976D17AF5BEBF05A0679D7 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
17
DNS requests
8
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1716 | explorer.exe | POST | — | 192.0.78.25:80 | http://www.vickiscottmiller.com/c150/ | US | — | — | malicious |
1716 | explorer.exe | POST | — | 69.172.201.153:80 | http://www.epijet.com/c150/ | US | — | — | malicious |
1716 | explorer.exe | POST | — | 69.172.201.153:80 | http://www.epijet.com/c150/ | US | — | — | malicious |
1716 | explorer.exe | GET | 404 | 69.90.161.105:80 | http://www.paulandterra.com/c150/?E60dc=3trVv4qB6CUjoNOsFxZcUamXkTpBUc+SiOB7o2yJnlR94dxmw4q+EyLJged4sSbjebB7/w==&k2UD-=aDvHFTbp_&sql=1 | CA | html | 10.0 Kb | malicious |
1716 | explorer.exe | POST | — | 192.0.78.25:80 | http://www.vickiscottmiller.com/c150/ | US | — | — | malicious |
1716 | explorer.exe | POST | — | 69.90.161.105:80 | http://www.paulandterra.com/c150/ | CA | — | — | malicious |
1716 | explorer.exe | POST | — | 69.90.161.105:80 | http://www.paulandterra.com/c150/ | CA | — | — | malicious |
1716 | explorer.exe | POST | — | 69.90.161.105:80 | http://www.paulandterra.com/c150/ | CA | — | — | malicious |
1716 | explorer.exe | GET | 463 | 69.172.201.153:80 | http://www.epijet.com/c150/?E60dc=pni640ejZK98OGMew+UKzjQISQX+MOC69s07g5AQtnHb8J7/7RYHgtARVp17v2pOeG1tEg==&k2UD-=aDvHFTbp_&sql=1 | US | html | 8.64 Kb | malicious |
1716 | explorer.exe | GET | 301 | 176.28.3.57:80 | http://www.qiiomagazine.com/c150/?E60dc=Jjpw17W/CV4Dl/hw6Gffx2vQwfAt7T0J9b3FVjUPKI7wRBEZx2G8H59RxmGcU4PKrZc4kw==&k2UD-=aDvHFTbp_ | DE | html | 332 b | malicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
1716 | explorer.exe | 192.0.78.25:80 | www.vickiscottmiller.com | Automattic, Inc | US | malicious |
1716 | explorer.exe | 176.28.3.57:80 | www.qiiomagazine.com | Host Europe GmbH | DE | malicious |
1716 | explorer.exe | 69.172.201.153:80 | www.epijet.com | Dosarrest Internet Security LTD | US | malicious |
1716 | explorer.exe | 69.90.161.105:80 | www.paulandterra.com | Peer 1 Network (USA) Inc. | CA | malicious |
1716 | explorer.exe | 199.192.24.70:80 | www.jankolet.com | — | US | malicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
www.qiiomagazine.com |
| malicious |
www.yumakun.com |
| unknown |
www.paulandterra.com |
| malicious |
www.moosehead411.com |
| unknown |
www.ttgan29.com |
| unknown |
www.vickiscottmiller.com |
| malicious |
www.epijet.com |
| malicious |
www.jankolet.com |
| malicious |
Threats
PID | Process | Class | Message |
|---|---|---|---|
1716 | explorer.exe | A Network Trojan was detected | SC SPYWARE Trojan-Spy.Win32.Noon |
1716 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] FormBook CnC Checkin (GET) |
1716 | explorer.exe | A Network Trojan was detected | SC SPYWARE Trojan-Spy.Win32.Noon |
1716 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] FormBook CnC Checkin (GET) |
1716 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] FormBook CnC Checkin (POST) |
1716 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] TrojanSpy:FormBook CnC Checkin (POST) |
1716 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] FormBook CnC Checkin (POST) |
1716 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] TrojanSpy:FormBook CnC Checkin (POST) |
1716 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] FormBook CnC Checkin (POST) |
1716 | explorer.exe | A Network Trojan was detected | SC SPYWARE Trojan-Spy.Win32.Noon |
11 ETPRO signatures available at the full report