Malware analysis acb58cf1f819372ca5f461636f47ef790ec5d2748a5eaa3676104e46cdca1b19 Malicious activity

Add for printing

File name:	acb58cf1f819372ca5f461636f47ef790ec5d2748a5eaa3676104e46cdca1b19
Full analysis:	https://app.any.run/tasks/8d467123-8735-4f66-898a-7a272c2f895d
Verdict:	Malicious activity
Threats:	FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus. Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns. Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email. Malware Trends Tracker >>>
Analysis date:	December 06, 2018, 12:54:38
OS:	Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:	exe-to-msi trojan formbook stealer
Indicators:
MIME:	application/x-msi
File info:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Code page: 1252, Last Printed: Fri Sep 21 10:56:09 2012, Create Time/Date: Fri Sep 21 10:56:09 2012, Name of Creating Application: Windows Installer, Title: Exe to msi converter free, Author: www.exetomsi.com, Template: ;0, Last Saved By: devuser, Revision Number: {C35CF0AA-9B3F-4903-9F05-EBF606D58D3E}, Last Saved Time/Date: Tue May 21 12:56:44 2013, Number of Pages: 100, Number of Words: 0, Security: 0
MD5:	6D7ADA8915023EB188F47444A77D169D
SHA1:	F87023A7C0DE6B0FF4B0B2B799E58F41B938C332
SHA256:	ACB58CF1F819372CA5F461636F47EF790EC5D2748A5EAA3676104E46CDCA1B19
SSDEEP:	12288:TEqy7sSW7kNUhBiTL1wuG2YVkp455oaomdIbTbq:TE5wzAQUTO/2SkpWon

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 240 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: 180 seconds
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: off
Network:: on

Software preset

Internet Explorer 8.0.7601.17514 undefined
Adobe Acrobat Reader DC MUI (15.023.20070)
Adobe Flash Player 26 ActiveX (26.0.0.131)
Adobe Flash Player 26 NPAPI (26.0.0.131)
Adobe Flash Player 26 PPAPI (26.0.0.131)
Adobe Refresh Manager (1.8.0)
CCleaner (5.35)
FileZilla Client 3.36.0 (3.36.0)
Google Chrome (68.0.3440.106)
Google Update Helper (1.3.33.17)
Java 8 Update 92 (8.0.920.14)
Java Auto Updater (2.8.92.14)
Microsoft .NET Framework 4.6.1 (4.6.01055)
Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Professional 2010 (14.0.6029.1000)
Microsoft Office Proof (English) 2010 (14.0.6029.1000)
Microsoft Office Proof (French) 2010 (14.0.6029.1000)
Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Single Image 2010 (14.0.6029.1000)
Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2017 Redistributable (x86) - 14.15.26706 (14.15.26706.0)
Microsoft Visual C++ 2017 x86 Additional Runtime - 14.15.26706 (14.15.26706)
Microsoft Visual C++ 2017 x86 Minimum Runtime - 14.15.26706 (14.15.26706)
Mozilla Firefox 61.0.2 (x86 en-US) (61.0.2)
Notepad++ (32-bit x86) (7.5.1)
Opera 12.15 (12.15.1748)
Skype version 8.29 (8.29)
VLC media player (2.2.6)
WinRAR 5.60 (32-bit) (5.60.0)

Hotfixes

Client LanguagePack Package
Client Refresh LanguagePack Package
CodecPack Basic Package
Foundation Package
IE Troubleshooters Package
InternetExplorer Optional Package
KB2534111
KB2999226
KB976902
LocalPack AU Package
LocalPack CA Package
LocalPack GB Package
LocalPack US Package
LocalPack ZA Package
ProfessionalEdition
UltimateEdition

Add for printing

MALICIOUS
- FORMBOOK was detected
  - explorer.exe (PID: 236)
- Connects to CnC server
  - explorer.exe (PID: 236)
- Formbook was detected
  - wscript.exe (PID: 2816)
  - Firefox.exe (PID: 3136)
- Changes the autorun value in the registry
  - wscript.exe (PID: 2816)
- Actions looks like stealing of personal data
  - wscript.exe (PID: 2816)
- Application was dropped or rewritten from another process
  - vgacjt.exe (PID: 3640)
  - vgacjt.exe (PID: 2220)
- Stealing of credential data
  - wscript.exe (PID: 2816)
SUSPICIOUS
- Executable content was dropped or overwritten
  - msiexec.exe (PID: 2252)
  - explorer.exe (PID: 236)
  - DllHost.exe (PID: 3100)
- Starts Microsoft Installer
  - explorer.exe (PID: 236)
- Drop ExeToMSI Application
  - msiexec.exe (PID: 2252)
- Starts CMD.EXE for commands execution
  - wscript.exe (PID: 2816)
- Executes scripts
  - explorer.exe (PID: 236)
- Creates files in the user directory
  - wscript.exe (PID: 2816)
- Loads DLL from Mozilla Firefox
  - wscript.exe (PID: 2816)
- Creates files in the program directory
  - DllHost.exe (PID: 3100)
- Application launched itself
  - vgacjt.exe (PID: 3640)
INFO
- Searches for installed software
  - msiexec.exe (PID: 2252)
- Low-level read access rights to disk partition
  - vssvc.exe (PID: 2156)
- Dropped object may contain Bitcoin addresses
  - msiexec.exe (PID: 2252)
  - explorer.exe (PID: 236)
  - DllHost.exe (PID: 3100)
- Application was dropped or rewritten from another process
  - MSIDA38.tmp (PID: 2348)
  - MSIDA38.tmp (PID: 3204)
- Starts application with an unusual extension
  - msiexec.exe (PID: 2252)
  - MSIDA38.tmp (PID: 2348)
- Application launched itself
  - MSIDA38.tmp (PID: 2348)
- Creates files in the user directory
  - Firefox.exe (PID: 3136)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.msi	\|	Microsoft Installer (100)

EXIF

FlashPix

Security:	None
Words:	-
Pages:	100
ModifyDate:	2013:05:21 11:56:44
RevisionNumber:	{C35CF0AA-9B3F-4903-9F05-EBF606D58D3E}
LastModifiedBy:	devuser
Template:	;0
Comments:	-
Keywords:	-
Author:	www.exetomsi.com
Subject:	-
Title:	Exe to msi converter free
Software:	Windows Installer
CreateDate:	2012:09:21 09:56:09
LastPrinted:	2012:09:21 09:56:09
CodePage:	Windows Latin 1 (Western European)

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
2844	"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Temp\acb58cf1f819372ca5f461636f47ef790ec5d2748a5eaa3676104e46cdca1b19.msi"	C:\Windows\System32\msiexec.exe	—	explorer.exe
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows® installer Exit code: 0 Version: 5.0.7600.16385 (win7_rtm.090713-1255)
2252	C:\Windows\system32\msiexec.exe /V	C:\Windows\system32\msiexec.exe		services.exe
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows® installer Version: 5.0.7600.16385 (win7_rtm.090713-1255)
2156	C:\Windows\system32\vssvc.exe	C:\Windows\system32\vssvc.exe	—	services.exe
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft® Volume Shadow Copy Service Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255)
2620	DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot18" "" "" "6792c44eb" "00000000" "000003AC" "00000488"	C:\Windows\system32\DrvInst.exe	—	svchost.exe
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Driver Installation Module Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255)
2348	"C:\Windows\Installer\MSIDA38.tmp"	C:\Windows\Installer\MSIDA38.tmp		msiexec.exe
User: admin Integrity Level: MEDIUM Description: right.Properties Exit code: 0 Version: 1.0.0.0
3204	"C:\Windows\Installer\MSIDA38.tmp"	C:\Windows\Installer\MSIDA38.tmp		MSIDA38.tmp
User: SYSTEM Integrity Level: SYSTEM Description: right.Properties Exit code: 0 Version: 1.0.0.0
2816	"C:\Windows\System32\wscript.exe"	C:\Windows\System32\wscript.exe		explorer.exe
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Version: 5.8.7600.16385
3316	/c del "C:\Windows\Installer\MSIDA38.tmp"	C:\Windows\System32\cmd.exe	—	wscript.exe
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850)
236	C:\Windows\Explorer.EXE	C:\Windows\explorer.exe		—
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Version: 6.1.7600.16385 (win7_rtm.090713-1255)
3136	"C:\Program Files\Mozilla Firefox\Firefox.exe"	C:\Program Files\Mozilla Firefox\Firefox.exe		wscript.exe
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 61.0.2

Add for printing

Total events

574

Read events

389

Write events

Delete events

Modification events

No data

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
2252	msiexec.exe	C:\System Volume Information\SPP\metadata-2		—
		MD5:—	SHA256:—
2252	msiexec.exe	C:\System Volume Information\SPP\snapshot-2		binary
		MD5:56A1802A388CE1D933D447A5D3D22BBD	SHA256:8315B939A6947D0DE78F9F9DE380228FF454EF09EDD48F5B52AAA993923C7A39
2620	DrvInst.exe	C:\Windows\INF\setupapi.dev.log		ini
		MD5:0B1CEBF94A208D495B4DD2DC69AC89F6	SHA256:968F25EBD53B15B7897DA2D8009A27426CA64774418CEE352FFF477F7C33D37A
2156	vssvc.exe	C:		—
		MD5:—	SHA256:—
2252	msiexec.exe	C:\Users\admin\AppData\Local\Temp\~DF37D8F6B8F86EF487.TMP		—
		MD5:—	SHA256:—
2252	msiexec.exe	C:\Config.Msi\13c7fa.rbs		—
		MD5:—	SHA256:—
2252	msiexec.exe	C:\Users\admin\AppData\Local\Temp\~DF5B5DD80EAC7A744B.TMP		—
		MD5:—	SHA256:—
2620	DrvInst.exe	C:\Windows\INF\setupapi.ev3		binary
		MD5:76DCC60F78B3DFF1AE3627619074F465	SHA256:18541AC1875315C4F9EFF75050C574FAFF83717C029DAE6B366F9C6C3F0C19E0
2252	msiexec.exe	C:\System Volume Information\SPP\OnlineMetadataCache\{7a71f1a3-823d-4445-845c-6483412a3f00}_OnDiskSnapshotProp		binary
		MD5:56A1802A388CE1D933D447A5D3D22BBD	SHA256:8315B939A6947D0DE78F9F9DE380228FF454EF09EDD48F5B52AAA993923C7A39
2620	DrvInst.exe	C:\Windows\INF\setupapi.ev1		binary
		MD5:D075B9CCC870FACDC63AC194D74A1279	SHA256:3371347C9D7A8FD2E32AF6B41B3C4C4F4B597B36861C868E92069C17A6E9D8D4

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
236	explorer.exe	GET	301	91.216.107.156:80	http://www.midiomalinea.com/ai/?oLv=KbWunvhw/zpXP5wW0UeZ7BJvggAhLiR/U+yWF01r9OQaPoLd46pZ4MbN2sk8HpOuCMpePQ==&mLVDc=WZzhBBv0x0QLaRG	FR	html	429 b	malicious
236	explorer.exe	GET	500	160.153.32.192:80	http://www.brickellwatches.com/ai/?oLv=vANF0Oa22qgZseUw97TB+Swa2IWzfYKx3GaNAFricu5mcpvlFr62mhXvJ/dKFT11hcAXHQ==&mLVDc=WZzhBBv0x0QLaRG&sql=1	US	html	686 b	malicious
236	explorer.exe	GET	—	173.236.183.227:80	http://www.seattlepetadventures.com/ai/?oLv=+NF6fKO4+sNoFSvA9ydZPX2tEAxFaECdmO6MFoZMYbf7UBOz4BWLqkgGlYhSyAJHhQSHSw==&mLVDc=WZzhBBv0x0QLaRG&sql=1	US	—	—	malicious
236	explorer.exe	POST	—	160.153.32.192:80	http://www.brickellwatches.com/ai/	US	—	—	malicious
236	explorer.exe	POST	—	160.153.32.192:80	http://www.brickellwatches.com/ai/	US	—	—	malicious
236	explorer.exe	POST	—	160.153.32.192:80	http://www.brickellwatches.com/ai/	US	—	—	malicious

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
236	explorer.exe	160.153.32.192:80	www.brickellwatches.com	GoDaddy.com, LLC	US	malicious
236	explorer.exe	173.236.183.227:80	www.seattlepetadventures.com	New Dream Network, LLC	US	malicious
236	explorer.exe	91.216.107.156:80	www.midiomalinea.com	ADISTA SAS	FR	malicious

DNS requests

Domain	IP	Reputation
www.uaevas.com	—	unknown
www.midiomalinea.com	91.216.107.156	malicious
www.solutionfull.com	—	malicious
www.christianmarketinggifts.com	—	unknown
www.theapschool.com	—	unknown
www.riseupfloridakeys.com	—	unknown
www.brickellwatches.com	160.153.32.192	malicious
www.seattlepetadventures.com	173.236.183.227	malicious

Threats

PID	Process	Class	Message
236	explorer.exe	A Network Trojan was detected	SC TROJAN_DOWNLOADER Suspicious HTTP-GET request with body and minimal header
236	explorer.exe	A Network Trojan was detected	MALWARE [PTsecurity] FormBook CnC Checkin (GET)
236	explorer.exe	A Network Trojan was detected	SC TROJAN_DOWNLOADER Suspicious HTTP-GET request with body and minimal header
236	explorer.exe	A Network Trojan was detected	MALWARE [PTsecurity] FormBook CnC Checkin (GET)
236	explorer.exe	A Network Trojan was detected	MALWARE [PTsecurity] FormBook CnC Checkin (POST)
236	explorer.exe	A Network Trojan was detected	MALWARE [PTsecurity] TrojanSpy:FormBook CnC Checkin (POST)
236	explorer.exe	A Network Trojan was detected	MALWARE [PTsecurity] FormBook CnC Checkin (POST)
236	explorer.exe	A Network Trojan was detected	MALWARE [PTsecurity] TrojanSpy:FormBook CnC Checkin (POST)
236	explorer.exe	A Network Trojan was detected	MALWARE [PTsecurity] FormBook CnC Checkin (POST)
236	explorer.exe	A Network Trojan was detected	SC TROJAN_DOWNLOADER Suspicious HTTP-GET request with body and minimal header

5 ETPRO signatures available at the full report

Add for printing

Process	Message
MSIDA38.tmp	* HR originated: -2147024774 * Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1391
MSIDA38.tmp	* HR propagated: -2147024774 * Source File: d:\iso_whid\x86fre\base\isolation\com\identityauthority.cpp, line 278
MSIDA38.tmp	* HR originated: -2147024774 * Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1391
MSIDA38.tmp	* HR propagated: -2147024774 * Source File: d:\iso_whid\x86fre\base\isolation\com\identityauthority.cpp, line 278
MSIDA38.tmp	* HR originated: -2147024774 * Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1391
MSIDA38.tmp	* HR propagated: -2147024774 * Source File: d:\iso_whid\x86fre\base\isolation\com\identityauthority.cpp, line 278
MSIDA38.tmp	* HR originated: -2147024774 * Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1391
MSIDA38.tmp	* HR propagated: -2147024774 * Source File: d:\iso_whid\x86fre\base\isolation\com\identityauthority.cpp, line 278
vgacjt.exe	* HR originated: -2147024774 * Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1391
vgacjt.exe	* HR propagated: -2147024774 * Source File: d:\iso_whid\x86fre\base\isolation\com\identityauthority.cpp, line 278

General Info

acb58cf1f819372ca5f461636f47ef790ec5d2748a5eaa3676104e46cdca1b19

6D7ADA8915023EB188F47444A77D169D

F87023A7C0DE6B0FF4B0B2B799E58F41B938C332

ACB58CF1F819372CA5F461636F47EF790EC5D2748A5EAA3676104E46CDCA1B19

12288:TEqy7sSW7kNUhBiTL1wuG2YVkp455oaomdIbTbq:TE5wzAQUTO/2SkpWon

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

FORMBOOK was detected

Connects to CnC server

Formbook was detected

Changes the autorun value in the registry

Actions looks like stealing of personal data

Application was dropped or rewritten from another process

Stealing of credential data

SUSPICIOUS

Executable content was dropped or overwritten

Starts Microsoft Installer

Drop ExeToMSI Application

Starts CMD.EXE for commands execution

Executes scripts

Creates files in the user directory

Loads DLL from Mozilla Firefox

Creates files in the program directory

Application launched itself

INFO

Searches for installed software

Low-level read access rights to disk partition

Dropped object may contain Bitcoin addresses

Application was dropped or rewritten from another process

Starts application with an unusual extension

Application launched itself

Creates files in the user directory

Malware configuration

Static information

TRiD

EXIF

FlashPix

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings