File name: | Statement of Account.doc |
Full analysis: | https://app.any.run/tasks/b885ff97-274c-4e34-b7f6-e07b56cbc9c7 |
Verdict: | Malicious activity |
Threats: | FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus. |
Analysis date: | November 15, 2018, 08:32:46 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | text/plain |
File info: | ASCII text, with CRLF, LF line terminators |
MD5: | 73197977D6258A7DC4C1D735704C3DE7 |
SHA1: | 25ED99A4FA46FA6BFDACCA127A0765C736977F2E |
SHA256: | ACCB161C0B0A2E94B0C77CB9BC4341006A113E8AF8494DDD2FE380195B966C02 |
SSDEEP: | 49152:ZlCMfUOJy5CBkjXC+CXHty5k7VcSTBepHOXC03N9rObXG:ZlCMfUOJy5CBkjXC+CXHty5k7VcSTBe6 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
1684 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\Statement of Account.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
2952 | "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE | svchost.exe | |
User: admin Company: Design Science, Inc. Integrity Level: MEDIUM Description: Microsoft Equation Editor Exit code: 0 Version: 00110900 | ||||
2236 | cmd.exe /c%temp%\w1.exe AC | C:\Windows\system32\cmd.exe | — | EQNEDT32.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
340 | C:\Users\admin\AppData\Local\Temp\w1.exe AC | C:\Users\admin\AppData\Local\Temp\w1.exe | — | cmd.exe |
User: admin Company: TRADUCEMENT2 Integrity Level: MEDIUM Description: Birdshots Exit code: 0 Version: 2.03 | ||||
3388 | "C:\Users\admin\AppData\Local\Temp\w1.exe" | C:\Users\admin\AppData\Local\Temp\w1.exe | — | WINWORD.EXE |
User: admin Company: TRADUCEMENT2 Integrity Level: MEDIUM Description: Birdshots Exit code: 0 Version: 2.03 | ||||
2124 | "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE | svchost.exe | |
User: admin Company: Design Science, Inc. Integrity Level: MEDIUM Description: Microsoft Equation Editor Exit code: 0 Version: 00110900 | ||||
3076 | cmd.exe /c%temp%\w1.exe AC | C:\Windows\system32\cmd.exe | — | EQNEDT32.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3516 | C:\Users\admin\AppData\Local\Temp\w1.exe AC | C:\Users\admin\AppData\Local\Temp\w1.exe | — | cmd.exe |
User: admin Company: TRADUCEMENT2 Integrity Level: MEDIUM Description: Birdshots Exit code: 0 Version: 2.03 | ||||
2848 | :\Users\admin\AppData\Local\Temp\w1.exe AC | C:\Users\admin\AppData\Local\Temp\w1.exe | — | w1.exe |
User: admin Company: TRADUCEMENT2 Integrity Level: MEDIUM Description: Birdshots Exit code: 0 Version: 2.03 | ||||
2588 | C:\Users\admin\AppData\Local\Temp\w1.exe" | C:\Users\admin\AppData\Local\Temp\w1.exe | — | w1.exe |
User: admin Company: TRADUCEMENT2 Integrity Level: MEDIUM Description: Birdshots Exit code: 0 Version: 2.03 |
PID | Process | Filename | Type | |
---|---|---|---|---|
1684 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR9F29.tmp.cvr | — | |
MD5:— | SHA256:— | |||
1684 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~$atement of Account.doc | pgc | |
MD5:E9EFFDB2FB73BE48DB009E065D9F3FB5 | SHA256:081678A0DE60E3E865FC356FF5F8081D6C46E16FE61D21280A5672A64D7525B5 | |||
1336 | lsass.exe | C:\Users\admin\AppData\Roaming\LM1B69UE\LM1logrc.ini | binary | |
MD5:2855A82ECDD565B4D957EC2EE05AED26 | SHA256:88E38DA5B12DD96AFD9DC90C79929EC31D8604B1AFDEBDD5A02B19249C08C939 | |||
1684 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:256A3EF47ED32A3D3038855D49DF0319 | SHA256:151B56C71BC28DD4D752808CE3A9352E96D9FA381320511F87B327A8208F5DD0 | |||
1684 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\566D8FE7.wmf | wmf | |
MD5:50DF8FCB199D64D05640AAE5E63AA6CF | SHA256:035076FF60F1D1F5A4F4876262DE7C4B995A1D859D9845FA936CCECA2E0E2C98 | |||
1684 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\w1.exe | executable | |
MD5:F92D222B22C18D47FC0FBA7E86FEFCAF | SHA256:45A057AEDF4AEF2023F466776A2EC7E46940078BFB7782DA6D2AD2DEB5E6F613 | |||
3516 | w1.exe | C:\Users\admin\AppData\Local\Temp\~DF0C2E0DAD075BD675.TMP | binary | |
MD5:F3C04D21909A9D61D9163CD802F63A9C | SHA256:DE39733EBF85E52A83ED99A56E478B2D1CCA0381BF7ABB1AC4098B3C5726FCB2 | |||
3388 | w1.exe | C:\Users\admin\AppData\Local\Temp\~DF97F03B69A60B2322.TMP | binary | |
MD5:F3C04D21909A9D61D9163CD802F63A9C | SHA256:DE39733EBF85E52A83ED99A56E478B2D1CCA0381BF7ABB1AC4098B3C5726FCB2 | |||
1336 | lsass.exe | C:\Users\admin\AppData\Roaming\LM1B69UE\LM1logim.jpeg | image | |
MD5:156B1A8955DDD0C8B6DF9766E97F011D | SHA256:9A8EA4178988EA720D8FF5085F17DBCBB140D4C1AFB4CDA11EFD3B1A33F9DFED | |||
340 | w1.exe | C:\Users\admin\AppData\Local\Temp\~DFE6B9CE50D58BEC4A.TMP | binary | |
MD5:F3C04D21909A9D61D9163CD802F63A9C | SHA256:DE39733EBF85E52A83ED99A56E478B2D1CCA0381BF7ABB1AC4098B3C5726FCB2 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
1604 | explorer.exe | GET | 302 | 67.55.121.97:80 | http://www.spsnk.com/uw/?ib-T4z9p=N8yD77r8jer3aHp0pEss/Kps1letITp14z/erB5y7uyuvowrxhj6fD5+11qkdjDatERKiw==&TZ=ytZxGHT0j | US | html | 154 b | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
1604 | explorer.exe | 67.55.121.97:80 | www.spsnk.com | Webair Internet Development Company Inc. | US | malicious |
Domain | IP | Reputation |
---|---|---|
www.wwwsj5999.com |
| unknown |
www.spsnk.com |
| malicious |
www.emprssleak.com |
| unknown |
www.playfulsaintenterprises.com |
| unknown |
PID | Process | Class | Message |
---|---|---|---|
1604 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] FormBook CnC Checkin (GET) |