File name:

9d4e4cb20e3f583a570e84cb53ce9e6ddbdc2920ec1286b45fc75e45f59fedeb

Full analysis: https://app.any.run/tasks/e71de380-23c3-463e-a1e2-9f72689078a0
Verdict: Malicious activity
Threats:

FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus.

Malware Trends Tracker     >>>
Analysis date: January 10, 2025, 19:46:52
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
formbook
xloader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

7CA54C459C8A04446A34C74071C0220A

SHA1:

88DBF3F1B1DEB41E36001DEF7642A76E17F421F4

SHA256:

9D4E4CB20E3F583A570E84CB53CE9E6DDBDC2920EC1286B45FC75E45F59FEDEB

SSDEEP:

98304:72mAKZ0Bc17k7/NysSgZ8rses9wwElMn38jYH8lvfTbw9iFitVvyelNTC8qG:5KKUn95

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • FORMBOOK has been detected (YARA)

      • 9d4e4cb20e3f583a570e84cb53ce9e6ddbdc2920ec1286b45fc75e45f59fedeb.exe (PID: 6260)

  • SUSPICIOUS

    • Executes application which crashes

      • 9d4e4cb20e3f583a570e84cb53ce9e6ddbdc2920ec1286b45fc75e45f59fedeb.exe (PID: 6260)

  • INFO

    • Reads the machine GUID from the registry

      • 9d4e4cb20e3f583a570e84cb53ce9e6ddbdc2920ec1286b45fc75e45f59fedeb.exe (PID: 6168)

    • Manual execution by a user

      • 9d4e4cb20e3f583a570e84cb53ce9e6ddbdc2920ec1286b45fc75e45f59fedeb.exe (PID: 6260)

    • Reads the computer name

      • 9d4e4cb20e3f583a570e84cb53ce9e6ddbdc2920ec1286b45fc75e45f59fedeb.exe (PID: 6168)

    • Checks supported languages

      • 9d4e4cb20e3f583a570e84cb53ce9e6ddbdc2920ec1286b45fc75e45f59fedeb.exe (PID: 6168)

    • Checks proxy server information

      • WerFault.exe (PID: 2940)

    • Reads the software policy settings

      • WerFault.exe (PID: 2940)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (55.8)
.exe | Win64 Executable (generic) (21)
.scr | Windows screen saver (9.9)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

AssemblyVersion: 1.0.0.0
ProductVersion: 1.0.0.0
ProductName: Vrjuvaicajo
OriginalFileName: Vrjuvaicajo.exe
LegalTrademarks: -
LegalCopyright: Copyright © 2010
InternalName: Vrjuvaicajo.exe
FileVersion: 1.0.0.0
FileDescription: Vrjuvaicajo
CompanyName: -
Comments: -
CharacterSet: Unicode
LanguageCode: Neutral
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 1.0.0.0
FileVersionNumber: 1.0.0.0
Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: -
OSVersion: 4
EntryPoint: 0x1ff8ce
UninitializedDataSize: -
InitializedDataSize: 2048
CodeSize: 2087424
LinkerVersion: 8
PEType: PE32
ImageFileCharacteristics: Executable, 32-bit
TimeStamp: 2024:12:04 09:06:35+00:00
MachineType: Intel 386 or later, and compatibles
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
131
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 9d4e4cb20e3f583a570e84cb53ce9e6ddbdc2920ec1286b45fc75e45f59fedeb.exe no specs #FORMBOOK 9d4e4cb20e3f583a570e84cb53ce9e6ddbdc2920ec1286b45fc75e45f59fedeb.exe werfault.exe

Process information

PID
CMD
Path
Indicators
Parent process
6168"C:\Users\admin\AppData\Local\Temp\9d4e4cb20e3f583a570e84cb53ce9e6ddbdc2920ec1286b45fc75e45f59fedeb.exe" C:\Users\admin\AppData\Local\Temp\9d4e4cb20e3f583a570e84cb53ce9e6ddbdc2920ec1286b45fc75e45f59fedeb.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Vrjuvaicajo
Exit code:
4294967295
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\9d4e4cb20e3f583a570e84cb53ce9e6ddbdc2920ec1286b45fc75e45f59fedeb.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
6260"C:\Users\admin\AppData\Local\Temp\9d4e4cb20e3f583a570e84cb53ce9e6ddbdc2920ec1286b45fc75e45f59fedeb.exe"C:\Users\admin\AppData\Local\Temp\9d4e4cb20e3f583a570e84cb53ce9e6ddbdc2920ec1286b45fc75e45f59fedeb.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Vrjuvaicajo
Exit code:
3221225477
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\9d4e4cb20e3f583a570e84cb53ce9e6ddbdc2920ec1286b45fc75e45f59fedeb.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
2940C:\WINDOWS\SysWOW64\WerFault.exe -u -p 6260 -s 228C:\Windows\SysWOW64\WerFault.exe
9d4e4cb20e3f583a570e84cb53ce9e6ddbdc2920ec1286b45fc75e45f59fedeb.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
Total events
3 213
Read events
3 213
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
6
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
2940WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_9d4e4cb20e3f583a_40191fe7edc44d11b7cb46539ae0d8eab9bd5c_cea5bada_04c30173-1704-4859-833f-7f3fab2a94c7\Report.wer —
MD5:—
SHA256:—
2940WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\9d4e4cb20e3f583a570e84cb53ce9e6ddbdc2920ec1286b45fc75e45f59fedeb.exe.6260.dmpbinary
MD5:A99014523E3D28223E39F60B78ACD9FA
SHA256:B5461E8783718182071374754E70EAB0ED91093AC222A6AE0C159D81F24B3C99
2940WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\21253908F3CB05D51B1C2DA8B681A785binary
MD5:DEBF58FD5F53762C4F32C6C7C291C19B
SHA256:1BB33851961410B773AF8A47A1893A0597A76C7AC69E4EC70A22F0EBD7DA53B4
2940WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\37C951188967C8EB88D99893D9D191FEbinary
MD5:FA84E4BCC92AA5DB735AB50711040CDE
SHA256:6D7205E794FDE4219A62D9692ECDDF612663A5CF20399E79BE87B851FCA4CA33
2940WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERC912.tmp.xmlxml
MD5:8F44C4FF6E9D58E7B2ACCBB22A1E7CF5
SHA256:3B1AE88B5D56E249897F147F77280A8EDBAFD0B8E0D2E241413360B39491226B
2940WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERC8A2.tmp.dmpbinary
MD5:B0E94429E78A7BF0B0DA940D5933C99C
SHA256:A5AD73C231FD27277B0445904C7EF1102879E472DD7CC9D1021B379BA31C7BA8
2940WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\37C951188967C8EB88D99893D9D191FEbinary
MD5:6D07B0902D33B25EAD4934DAE74E6D24
SHA256:D051601650820D4B3A2770377000DE1431EB0CBB688270F34354D4498A967808
2940WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERC8E2.tmp.WERInternalMetadata.xmlxml
MD5:02F36F479024284227195910D1BD4B7E
SHA256:2C085272D00D585E39EBC882B95CCE445A5D2DE7BB8618764A9260B1764E697B
2940WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\21253908F3CB05D51B1C2DA8B681A785binary
MD5:F6F53CD09A41E968C363419B279D3112
SHA256:6D2BB01CC7A9BADE2113B219CAC1BDA86B2733196B7E1BD0C807CE1E396B1892
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
35
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6972
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5740
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
6972
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2940
WerFault.exe
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2940
WerFault.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
5064
SearchApp.exe
2.23.227.208:443
—
Ooredoo Q.S.C.
QA
unknown
4712
MoUsoCoreWorker.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
3884
svchost.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
1076
svchost.exe
2.23.242.9:443
go.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
1176
svchost.exe
40.126.32.140:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 2.16.241.12
  • 2.16.241.19
whitelisted
google.com
  • 142.250.186.78
whitelisted
www.microsoft.com
  • 2.23.246.101
  • 95.101.149.131
whitelisted
go.microsoft.com
  • 2.23.242.9
whitelisted
login.live.com
  • 40.126.32.140
  • 20.190.160.20
  • 40.126.32.136
  • 20.190.160.17
  • 40.126.32.133
  • 40.126.32.134
  • 20.190.160.14
  • 40.126.32.74
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
arc.msn.com
  • 20.74.47.205
whitelisted
fd.api.iris.microsoft.com
  • 20.103.156.88
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
9d4e4cb20e3f583a570e84cb53ce9e6ddbdc2920ec1286b45fc75e45f59fedeb