analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Sample1.zip

Full analysis: https://app.any.run/tasks/4719dfb2-30c8-4cfb-9b10-526122b68410
Verdict: Malicious activity
Threats:

FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus.

Malware Trends Tracker     >>>
Analysis date: July 18, 2019, 13:51:53
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
formbook
stealer
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

A0C6D990462AC9CC0B6E3C24AAEE0739

SHA1:

F55C51D24466F5879513111BC9FCE3817BB518A9

SHA256:

8EA2888DBD5D09954FC81E6BF9E60C5E15F632A0691E7773B74C11127CB60ED8

SSDEEP:

24576:kju0tZyEpqN2DQ6HS+UNLJnNSzjcgwjQLnsciAq:wGNgD5MLNgcjotiV

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • ayy.exe (PID: 2912)
      • ayy.exe (PID: 2712)
      • ayy.exe (PID: 3836)
      • ayy.exe (PID: 3760)
      • ayy.exe (PID: 1940)
      • ayy.exe (PID: 2816)
      • ayy.exe (PID: 2256)
      • ayy.exe (PID: 312)
      • ayy.exe (PID: 3848)
      • ayy.exe (PID: 1996)
      • ayy.exe (PID: 1844)
      • ayy.exe (PID: 3504)
      • ayy.exe (PID: 2776)
      • ayy.exe (PID: 2948)
      • utylw4f4hd.exe (PID: 3020)
      • ayy.exe (PID: 1980)
      • ayy.exe (PID: 1468)
      • ayy.exe (PID: 3572)
      • utylw4f4hd.exe (PID: 4040)
      • utylw4f4hd.exe (PID: 952)
      • utylw4f4hd.exe (PID: 2128)
      • ayy.exe (PID: 3392)
      • utylw4f4hd.exe (PID: 2252)
      • utylw4f4hd.exe (PID: 2432)
      • utylw4f4hd.exe (PID: 1104)
      • ayy.exe (PID: 3704)
      • ayy.exe (PID: 2704)
      • ayy.exe (PID: 3952)
      • ayy.exe (PID: 2516)
      • ayy.exe (PID: 3972)
      • ayy.exe (PID: 3764)
      • ayy.exe (PID: 3240)
      • ayy.exe (PID: 3252)
      • ayy.exe (PID: 3328)
      • ayy.exe (PID: 1868)
      • ayy.exe (PID: 592)
      • ayy.exe (PID: 3432)
      • ayy.exe (PID: 3588)

    • Changes the autorun value in the registry

      • ayy.exe (PID: 2712)
      • mstsc.exe (PID: 2352)
      • utylw4f4hd.exe (PID: 3020)

    • FORMBOOK was detected

      • explorer.exe (PID: 292)

    • Formbook was detected

      • mstsc.exe (PID: 2352)
      • Firefox.exe (PID: 4008)

    • Connects to CnC server

      • explorer.exe (PID: 292)

    • Actions looks like stealing of personal data

      • mstsc.exe (PID: 2352)

    • Stealing of credential data

      • mstsc.exe (PID: 2352)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • ayy.exe (PID: 2712)
      • WinRAR.exe (PID: 3852)
      • explorer.exe (PID: 292)
      • DllHost.exe (PID: 2260)

    • Suspicious files were dropped or overwritten

      • ayy.exe (PID: 2712)

    • Starts CMD.EXE for commands execution

      • mstsc.exe (PID: 2352)

    • Application launched itself

      • ayy.exe (PID: 2712)
      • utylw4f4hd.exe (PID: 3020)

    • Creates files in the user directory

      • mstsc.exe (PID: 2352)

    • Loads DLL from Mozilla Firefox

      • mstsc.exe (PID: 2352)

    • Executes scripts

      • explorer.exe (PID: 292)

    • Executed via COM

      • DllHost.exe (PID: 2260)

    • Creates files in the program directory

      • DllHost.exe (PID: 2260)

  • INFO

    • Manual execution by user

      • ayy.exe (PID: 2712)
      • mstsc.exe (PID: 2352)
      • autoconv.exe (PID: 3040)
      • wuapp.exe (PID: 3112)
      • msg.exe (PID: 1476)
      • rdpclip.exe (PID: 3456)

    • Creates files in the user directory

      • Firefox.exe (PID: 4008)

    • Application was crashed

      • utylw4f4hd.exe (PID: 3020)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: a8c6430ab780a74ebc613dc3e67a7f15500301b025ec3c34b59d10303bba123b.bin
ZipUncompressedSize: 1280512
ZipCompressedSize: 798572
ZipCRC: 0x05ab6f62
ZipModifyDate: 2019:07:18 13:49:17
ZipCompression: Deflated
ZipBitFlag: 0x0001
ZipRequiredVersion: 788
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
99
Monitored processes
59
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start winrar.exe ayy.exe ayy.exe no specs ayy.exe no specs ayy.exe no specs #FORMBOOK mstsc.exe cmd.exe no specs ayy.exe no specs ayy.exe no specs autoconv.exe no specs rdpclip.exe no specs ayy.exe no specs wuapp.exe no specs ayy.exe no specs msg.exe no specs #FORMBOOK explorer.exe #FORMBOOK firefox.exe no specs ayy.exe no specs ayy.exe no specs ayy.exe no specs ayy.exe no specs ayy.exe no specs chkdsk.exe no specs Copy/Move/Rename/Delete/Link Object utylw4f4hd.exe ayy.exe no specs audiodg.exe no specs ayy.exe no specs wscript.exe no specs ayy.exe no specs ayy.exe no specs services.exe no specs ayy.exe no specs ayy.exe no specs ayy.exe no specs cscript.exe no specs utylw4f4hd.exe no specs utylw4f4hd.exe no specs utylw4f4hd.exe no specs utylw4f4hd.exe no specs utylw4f4hd.exe no specs utylw4f4hd.exe no specs ayy.exe no specs ayy.exe no specs msdt.exe no specs ayy.exe no specs mstsc.exe no specs ayy.exe no specs wininit.exe no specs ayy.exe no specs ayy.exe no specs ayy.exe no specs cmmon32.exe no specs ayy.exe no specs ayy.exe no specs ayy.exe no specs services.exe no specs ayy.exe no specs wscript.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3852"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Sample1.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
2712"C:\Users\admin\Desktop\ayy.exe" C:\Users\admin\Desktop\ayy.exe
explorer.exe
User:
admin
Company:
diskraid
Integrity Level:
MEDIUM
Description:
Dism
Version:
422.642.997.65
2912"C:\Users\admin\Desktop\ayy.exe"C:\Users\admin\Desktop\ayy.exe—ayy.exe
User:
admin
Company:
diskraid
Integrity Level:
MEDIUM
Description:
Dism
Exit code:
0
Version:
422.642.997.65
2816"C:\Users\admin\Desktop\ayy.exe"C:\Users\admin\Desktop\ayy.exe—ayy.exe
User:
admin
Company:
diskraid
Integrity Level:
MEDIUM
Description:
Dism
Exit code:
0
Version:
422.642.997.65
1940"C:\Users\admin\Desktop\ayy.exe"C:\Users\admin\Desktop\ayy.exe—ayy.exe
User:
admin
Company:
diskraid
Integrity Level:
MEDIUM
Description:
Dism
Exit code:
0
Version:
422.642.997.65
2352"C:\Windows\System32\mstsc.exe"C:\Windows\System32\mstsc.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Remote Desktop Connection
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2304/c del "C:\Users\admin\Desktop\ayy.exe"C:\Windows\System32\cmd.exe—mstsc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3760"C:\Users\admin\Desktop\ayy.exe"C:\Users\admin\Desktop\ayy.exe—ayy.exe
User:
admin
Company:
diskraid
Integrity Level:
MEDIUM
Description:
Dism
Exit code:
0
Version:
422.642.997.65
3836"C:\Users\admin\Desktop\ayy.exe"C:\Users\admin\Desktop\ayy.exe—ayy.exe
User:
admin
Company:
diskraid
Integrity Level:
MEDIUM
Description:
Dism
Exit code:
0
Version:
422.642.997.65
3040"C:\Windows\System32\autoconv.exe"C:\Windows\System32\autoconv.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Auto File System Conversion Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
2 260
Read events
2 212
Write events
48
Delete events
0

Modification events

(PID) Process:(3852) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3852) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3852) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\70\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3852) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Sample1.zip
(PID) Process:(3852) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3852) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3852) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3852) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(292) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.zip\OpenWithList
Operation:writeName:a
Value:
WinRAR.exe
(PID) Process:(292) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.zip\OpenWithList
Operation:writeName:MRUList
Value:
a
Executable files
6
Suspicious files
73
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
2712ayy.exeC:\Users\Public\NeYQCBOkZD.vbstext
MD5:2129CCCE1FA3864B7088A27E25AE9D26
SHA256:0BB7B459CD9B48E846A3CD9D242C43944A6DE5BC35598F9D435FE97459D016B9
3852WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3852.46259\a8c6430ab780a74ebc613dc3e67a7f15500301b025ec3c34b59d10303bba123b.binexecutable
MD5:ADA39C2599EFF32E7E39B19C74E567ED
SHA256:A8C6430AB780A74EBC613DC3E67A7F15500301B025EC3C34B59D10303BBA123B
292explorer.exeC:\Users\admin\Desktop\a8c6430ab780a74ebc613dc3e67a7f15500301b025ec3c34b59d10303bba123b.binexecutable
MD5:ADA39C2599EFF32E7E39B19C74E567ED
SHA256:A8C6430AB780A74EBC613DC3E67A7F15500301B025EC3C34B59D10303BBA123B
292explorer.exeC:\Users\admin\Desktop\ayy.exeexecutable
MD5:ADA39C2599EFF32E7E39B19C74E567ED
SHA256:A8C6430AB780A74EBC613DC3E67A7F15500301B025EC3C34B59D10303BBA123B
2352mstsc.exeC:\Users\admin\AppData\Roaming\OM718DVE\OM7logrc.inibinary
MD5:2855A82ECDD565B4D957EC2EE05AED26
SHA256:88E38DA5B12DD96AFD9DC90C79929EC31D8604B1AFDEBDD5A02B19249C08C939
2712ayy.exeC:\Users\admin\AppData\Local\Temp\ActionCenterCPL\at.batexecutable
MD5:6E2848091A70F9812BD5A23E5992FD14
SHA256:12979CD3A8CBA0A9194C59BD0A1867C4DABDBE517E63886F59C6F7BFB57B6A2A
2352mstsc.exeC:\Users\admin\AppData\Roaming\OM718DVE\OM7logim.jpegimage
MD5:1C2A2DE0E091475BCFA2C40D7E4337B5
SHA256:3FAD2244570BC770B81D01947127692296F83B7E270C9813E4D101FEB71518B0
4008Firefox.exeC:\Users\admin\AppData\Roaming\OM718DVE\OM7logrf.inibinary
MD5:53028481B5B5795F1501241CCC7ABFF6
SHA256:75B5F3045E20C80F264568707E2D444DC7498DB119D9661AE51A91575960FC5A
2260DllHost.exeC:\Program Files\Wkhylq\utylw4f4hd.exeexecutable
MD5:ADA39C2599EFF32E7E39B19C74E567ED
SHA256:A8C6430AB780A74EBC613DC3E67A7F15500301B025EC3C34B59D10303BBA123B
292explorer.exeC:\Users\admin\AppData\Local\Temp\Wkhylq\utylw4f4hd.exeexecutable
MD5:ADA39C2599EFF32E7E39B19C74E567ED
SHA256:A8C6430AB780A74EBC613DC3E67A7F15500301B025EC3C34B59D10303BBA123B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
17
DNS requests
6
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
292
explorer.exe
POST
—
91.184.0.100:80
http://www.zorgeloosontruimen.com/ki/
NL
—
—
malicious
292
explorer.exe
GET
—
162.215.255.133:80
http://www.dducargo-vancouver.com/ki/?yVftqxDh=mM20bzQXHsnD3wKkmRZxih6GLVXnjRmY6kFRMh8bCXjRIQjwiJpWRc6F3caD/2adGz5fkw==&1b3=o8TpZlH&sql=1
US
—
—
malicious
292
explorer.exe
POST
—
162.215.255.133:80
http://www.dducargo-vancouver.com/ki/
US
—
—
malicious
292
explorer.exe
POST
—
91.184.0.100:80
http://www.zorgeloosontruimen.com/ki/
NL
—
—
malicious
292
explorer.exe
POST
—
107.154.192.178:80
http://www.xf6900.com/ki/
US
—
—
malicious
292
explorer.exe
GET
403
107.154.192.178:80
http://www.xf6900.com/ki/?yVftqxDh=8vdrInXG4N3PWtPuwUHbTlb7crQLhHSvXYnRadqvPDximIIly4DY77YIaRWIXONSRshcNg==&1b3=o8TpZlH&sql=1
US
html
807 b
malicious
292
explorer.exe
POST
—
107.154.192.178:80
http://www.xf6900.com/ki/
US
—
—
malicious
292
explorer.exe
POST
—
91.184.0.100:80
http://www.zorgeloosontruimen.com/ki/
NL
—
—
malicious
292
explorer.exe
POST
—
162.215.255.133:80
http://www.dducargo-vancouver.com/ki/
US
—
—
malicious
292
explorer.exe
GET
404
199.192.30.91:80
http://www.kerxbin.com/ki/?yVftqxDh=GUMbK9e7bDYWx5MZ5V13d8s+uoH9vku2W3mWGD6q3wUU6ffBAJF9lZjfFyLQx5Fwqvjy9Q==&1b3=o8TpZlH
US
html
326 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
292
explorer.exe
199.192.30.91:80
www.kerxbin.com
—
US
malicious
292
explorer.exe
91.184.0.100:80
www.zorgeloosontruimen.com
Hostnet B.V.
NL
malicious
—
—
91.184.0.100:80
www.zorgeloosontruimen.com
Hostnet B.V.
NL
malicious
292
explorer.exe
162.215.255.133:80
www.dducargo-vancouver.com
Krypt Technologies
US
malicious
—
—
54.36.26.9:80
www.paycatch.com
OVH SAS
FR
malicious
292
explorer.exe
54.36.26.9:80
www.paycatch.com
OVH SAS
FR
malicious
292
explorer.exe
107.154.192.178:80
www.xf6900.com
Incapsula Inc
US
malicious

DNS requests

Domain
IP
Reputation
www.kerxbin.com
  • 199.192.30.91
malicious
www.zorgeloosontruimen.com
  • 91.184.0.100
malicious
www.dducargo-vancouver.com
  • 162.215.255.133
malicious
www.xf6900.com
  • 107.154.192.178
malicious
www.paycatch.com
  • 54.36.26.9
malicious
www.easyvegefruits.com
  • —
unknown

Threats

PID
Process
Class
Message
292
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] FormBook CnC Checkin (GET)
292
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] FormBook CnC Checkin (GET)
292
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] TrojanSpy:FormBook CnC Checkin (POST)
292
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] TrojanSpy:FormBook CnC Checkin (POST)
292
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] FormBook CnC Checkin (POST)
292
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] FormBook CnC Checkin (GET)
292
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] TrojanSpy:FormBook CnC Checkin (POST)
292
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] FormBook CnC Checkin (POST)
292
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] TrojanSpy:FormBook CnC Checkin (POST)
292
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] FormBook CnC Checkin (GET)
12 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Sample1.zip