File name:

RFQ for quotation.rar

Full analysis: https://app.any.run/tasks/b3724f73-579f-47b8-8ea6-af0a638f96ab
Verdict: Malicious activity
Threats:

FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus.

Analysis date: March 31, 2020, 07:49:56
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
formbook
stealer
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

67B7F7BA367AC389DF1E00981FD22E3F

SHA1:

ED79A201925FCC073F9A36F0F2E9D6729683F7E2

SHA256:

B1F08F3421D9CFEA602520D7F3A475AF2D4283B25A1F0D915C7F3B18EE0CD985

SSDEEP:

768:9RNLauSCeXdjdYkQHhBo7HfoPe+W/2rTXgSWB:TNLLSCetjOHyfVT+bWB

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • RFQ for quotation.exe (PID: 2876)
      • RFQ for quotation.exe (PID: 3912)
      • RFQ for quotation.exe (PID: 3360)
      • RFQ for quotation.exe (PID: 2764)
    • Changes the autorun value in the registry

      • wuauclt.exe (PID: 2608)
    • Actions looks like stealing of personal data

      • wuauclt.exe (PID: 2608)
    • FORMBOOK was detected

      • Firefox.exe (PID: 1848)
      • explorer.exe (PID: 372)
      • wuauclt.exe (PID: 2608)
    • Stealing of credential data

      • wuauclt.exe (PID: 2608)
    • Connects to CnC server

      • explorer.exe (PID: 372)
    • Changes settings of System certificates

      • RFQ for quotation.exe (PID: 3912)
  • SUSPICIOUS

    • Reads Internet Cache Settings

      • RFQ for quotation.exe (PID: 3912)
      • RFQ for quotation.exe (PID: 2764)
    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2564)
    • Application launched itself

      • RFQ for quotation.exe (PID: 2876)
      • RFQ for quotation.exe (PID: 3360)
    • Creates files in the user directory

      • RFQ for quotation.exe (PID: 3912)
      • wuauclt.exe (PID: 2608)
    • Starts CMD.EXE for commands execution

      • wuauclt.exe (PID: 2608)
    • Loads DLL from Mozilla Firefox

      • wuauclt.exe (PID: 2608)
    • Adds / modifies Windows certificates

      • RFQ for quotation.exe (PID: 3912)
  • INFO

    • Creates files in the user directory

      • Firefox.exe (PID: 1848)
    • Manual execution by user

      • wuauclt.exe (PID: 2608)
    • Reads the hosts file

      • wuauclt.exe (PID: 2608)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
9
Malicious processes
6
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start drop and start start winrar.exe rfq for quotation.exe no specs rfq for quotation.exe #FORMBOOK wuauclt.exe cmd.exe no specs #FORMBOOK explorer.exe #FORMBOOK firefox.exe no specs rfq for quotation.exe no specs rfq for quotation.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
372C:\Windows\Explorer.EXEC:\Windows\explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\winanr.dll
c:\windows\system32\wshtcpip.dll
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1848"C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe
wuauclt.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
68.0.1
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
2564"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\RFQ for quotation.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2608"C:\Windows\System32\wuauclt.exe"C:\Windows\System32\wuauclt.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Update
Exit code:
0
Version:
7.5.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\wuauclt.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2764"C:\Users\admin\AppData\Local\Temp\Rar$EXa2564.43777\RFQ for quotation.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2564.43777\RFQ for quotation.exeRFQ for quotation.exe
User:
admin
Company:
WONDerware
Integrity Level:
MEDIUM
Description:
Anterin3
Exit code:
0
Version:
1.00
Modules
Images
c:\windows\system32\mfc40.dll
c:\users\admin\appdata\local\temp\rar$exa2564.43777\rfq for quotation.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt40.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2876"C:\Users\admin\AppData\Local\Temp\Rar$EXa2564.34749\RFQ for quotation.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2564.34749\RFQ for quotation.exeWinRAR.exe
User:
admin
Company:
WONDerware
Integrity Level:
MEDIUM
Description:
Anterin3
Exit code:
0
Version:
1.00
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2564.34749\rfq for quotation.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
3360"C:\Users\admin\AppData\Local\Temp\Rar$EXa2564.43777\RFQ for quotation.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2564.43777\RFQ for quotation.exeWinRAR.exe
User:
admin
Company:
WONDerware
Integrity Level:
MEDIUM
Description:
Anterin3
Exit code:
0
Version:
1.00
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2564.43777\rfq for quotation.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
3524/c del "C:\Users\admin\AppData\Local\Temp\Rar$EXa2564.34749\RFQ for quotation.exe"C:\Windows\System32\cmd.exewuauclt.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3912"C:\Users\admin\AppData\Local\Temp\Rar$EXa2564.34749\RFQ for quotation.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2564.34749\RFQ for quotation.exe
RFQ for quotation.exe
User:
admin
Company:
WONDerware
Integrity Level:
MEDIUM
Description:
Anterin3
Exit code:
0
Version:
1.00
Modules
Images
c:\windows\system32\mfc40.dll
c:\users\admin\appdata\local\temp\rar$exa2564.34749\rfq for quotation.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt40.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
Total events
4 097
Read events
496
Write events
2 414
Delete events
1 187

Modification events

(PID) Process:(372) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2564) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2564) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2564) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2564) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\RFQ for quotation.rar
(PID) Process:(2564) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2564) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2564) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2564) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(372) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rar\OpenWithList
Operation:writeName:a
Value:
WinRAR.exe
Executable files
2
Suspicious files
79
Text files
2
Unknown types
3

Dropped files

PID
Process
Filename
Type
3912RFQ for quotation.exeC:\Users\admin\AppData\Local\Temp\CabAB7B.tmp
MD5:
SHA256:
3912RFQ for quotation.exeC:\Users\admin\AppData\Local\Temp\TarAB7C.tmp
MD5:
SHA256:
2564WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2564.34749\RFQ for quotation.exeexecutable
MD5:
SHA256:
3912RFQ for quotation.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BE8B021F9E811DFC8C8A28572A17C05A_BA8650709FF65A42B9202D73C10A8F29der
MD5:
SHA256:
3912RFQ for quotation.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BE8B021F9E811DFC8C8A28572A17C05A_0B97942EE72A6E3F514E8E84F294CC72binary
MD5:
SHA256:
3912RFQ for quotation.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\5PFFYNVE.txttext
MD5:
SHA256:
2608wuauclt.exeC:\Users\admin\AppData\Roaming\9389QUSF\938logrc.inibinary
MD5:
SHA256:
3912RFQ for quotation.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BE8B021F9E811DFC8C8A28572A17C05A_BA8650709FF65A42B9202D73C10A8F29binary
MD5:
SHA256:
2608wuauclt.exeC:\Users\admin\AppData\Roaming\9389QUSF\938logim.jpegimage
MD5:
SHA256:
1848Firefox.exeC:\Users\admin\AppData\Roaming\9389QUSF\938logrf.inibinary
MD5:
SHA256:
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
4
DNS requests
5
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
372
explorer.exe
GET
301
217.76.130.148:80
http://www.ussecorp.com/k19/?q4N=iI9gZg3Bjo8jADwQPCawrcP6hlQTIvOzbu4SAOAxTT40ioNFbLFdphHDRZ4WyC7VGb1C8Q==&rTXd=LLrHh
ES
malicious
3912
RFQ for quotation.exe
GET
200
172.217.21.195:80
http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJqhjYqpgSVpULg%3D
US
der
468 b
whitelisted
3912
RFQ for quotation.exe
GET
200
172.217.21.195:80
http://ocsp.pki.goog/gts1o1/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQDL%2FQslYWVuogIAAAAAXGdc
US
der
472 b
whitelisted
3912
RFQ for quotation.exe
GET
200
172.217.21.195:80
http://ocsp.pki.goog/gts1o1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEFOOHQjK5IlqCAAAAAAyCmA%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3912
RFQ for quotation.exe
172.217.23.110:443
drive.google.com
Google Inc.
US
whitelisted
3912
RFQ for quotation.exe
172.217.21.195:80
ocsp.pki.goog
Google Inc.
US
whitelisted
372
explorer.exe
217.76.130.148:80
www.ussecorp.com
1&1 Internet SE
ES
malicious
3912
RFQ for quotation.exe
172.217.21.193:443
doc-00-bk-docs.googleusercontent.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
drive.google.com
  • 172.217.23.110
shared
ocsp.pki.goog
  • 172.217.21.195
whitelisted
doc-00-bk-docs.googleusercontent.com
  • 172.217.21.193
shared
www.lxtcss.com
unknown
www.ussecorp.com
  • 217.76.130.148
malicious

Threats

PID
Process
Class
Message
372
explorer.exe
Generic Protocol Command Decode
SURICATA HTTP Unexpected Request body
372
explorer.exe
A Network Trojan was detected
SPYWARE [PTsecurity] FormBook
1 ETPRO signatures available at the full report
No debug info