| File name: | sample2.doc |
| Full analysis: | https://app.any.run/tasks/c27f17a2-31ba-46b9-b243-8931da7aba39 |
| Verdict: | Malicious activity |
| Threats: | FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus. |
| Analysis date: | April 23, 2019, 09:29:36 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/msword |
| File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.3, Code page: 1252, Title: od6586, Subject: j2ec698, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Mon Apr 22 22:30:00 2019, Last Saved Time/Date: Mon Apr 22 22:30:00 2019, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Security: 0 |
| MD5: | E29E3020B3AE80BCF53E16A3F71CD9DD |
| SHA1: | 6543EF5EFE35438A746857538365BD6C224ABD8E |
| SHA256: | B7096A1FC9D5483F33D286DE03FB00A17717695A69EC97933A3396989C03BC9C |
| SSDEEP: | 384:V8iS8px8SMDOeF2R94usNo9nFN46+XhEx+xbcpf1dOPw1Ggi8eV3my+qtsJiN0jO:J3y4Hsm9FNoX+s544V2yHWU |
MALICIOUS
Starts CMD.EXE for commands execution
- WINWORD.EXE (PID: 2240)
Unusual execution from Microsoft Office
- WINWORD.EXE (PID: 2240)
Application was dropped or rewritten from another process
- t8d2ae6.exe (PID: 1472)
FORMBOOK was detected
- explorer.exe (PID: 116)
Connects to CnC server
- explorer.exe (PID: 116)
Changes the autorun value in the registry
- msg.exe (PID: 1248)
Formbook was detected
- msg.exe (PID: 1248)
- Firefox.exe (PID: 4060)
Actions looks like stealing of personal data
- msg.exe (PID: 1248)
Stealing of credential data
- msg.exe (PID: 1248)
SUSPICIOUS
Executable content was dropped or overwritten
- cmd.exe (PID: 2524)
Starts CMD.EXE for commands execution
- msg.exe (PID: 1248)
Creates files in the user directory
- msg.exe (PID: 1248)
Loads DLL from Mozilla Firefox
- msg.exe (PID: 1248)
INFO
Starts Microsoft Office Application
- explorer.exe (PID: 116)
Creates files in the user directory
- WINWORD.EXE (PID: 2240)
- Firefox.exe (PID: 4060)
Reads Microsoft Office registry keys
- WINWORD.EXE (PID: 2240)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .doc | | | Microsoft Word document (54.2) |
|---|---|---|
| .doc | | | Microsoft Word document (old ver.) (32.2) |
EXIF
FlashPix
| Title: | od6586 |
|---|---|
| Subject: | j2ec698 |
| Author: | - |
| Keywords: | - |
| Comments: | - |
| Template: | Normal.dotm |
| LastModifiedBy: | - |
| RevisionNumber: | 1 |
| Software: | Microsoft Office Word |
| TotalEditTime: | - |
| CreateDate: | 2019:04:22 21:30:00 |
| ModifyDate: | 2019:04:22 21:30:00 |
| Pages: | 1 |
| Words: | - |
| Characters: | - |
| Security: | None |
| CodePage: | Windows Latin 1 (Western European) |
| Bytes: | 11000 |
| Lines: | - |
| Paragraphs: | - |
| CharCountWithSpaces: | - |
| AppVersion: | 16 |
| ScaleCrop: | No |
| LinksUpToDate: | No |
| SharedDoc: | No |
| HyperlinksChanged: | No |
| TitleOfParts: | od6586 |
| HeadingPairs: |
|
| CompObjUserTypeLen: | 32 |
| CompObjUserType: | Microsoft Word 97-2003 Document |
Total processes
40
Monitored processes
7
Malicious processes
4
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 116 | C:\Windows\Explorer.EXE | C:\Windows\explorer.exe | — | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1248 | "C:\Windows\System32\msg.exe" | C:\Windows\System32\msg.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Message Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1472 | "C:\Users\admin\AppData\Local\Temp\t8d2ae6.exe" | C:\Users\admin\AppData\Local\Temp\t8d2ae6.exe | — | cmd.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 2240 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\sample2.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Exit code: 0 Version: 14.0.6024.1000 Modules
| |||||||||||||||
| 2448 | /c del "C:\Users\admin\AppData\Local\Temp\t8d2ae6.exe" | C:\Windows\System32\cmd.exe | — | msg.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2524 | "C:\Windows\System32\cmd.exe" /c ren "C:\Users\admin\AppData\Local\Temp\t8d2ae6.txt" "t8d2ae6.exe" &start "" "C:\Users\admin\AppData\Local\Temp\t8d2ae6.exe" | C:\Windows\System32\cmd.exe | WINWORD.EXE | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 4060 | "C:\Program Files\Mozilla Firefox\Firefox.exe" | C:\Program Files\Mozilla Firefox\Firefox.exe | msg.exe | ||||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 65.0.2 Modules
| |||||||||||||||
Total events
1 152
Read events
800
Write events
347
Delete events
5
Modification events
| (PID) Process: | (2240) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
| Operation: | write | Name: | p 4 |
Value: 70203400C0080000010000000000000000000000 | |||
| (PID) Process: | (2240) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1033 |
Value: Off | |||
| (PID) Process: | (2240) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1033 |
Value: On | |||
| (PID) Process: | (2240) WINWORD.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage |
| Operation: | write | Name: | WORDFiles |
Value: 1318518814 | |||
| (PID) Process: | (2240) WINWORD.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage |
| Operation: | write | Name: | ProductFiles |
Value: 1318518928 | |||
| (PID) Process: | (2240) WINWORD.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage |
| Operation: | write | Name: | ProductFiles |
Value: 1318518929 | |||
| (PID) Process: | (2240) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word |
| Operation: | write | Name: | MTTT |
Value: C00800008C41471DB7F9D40100000000 | |||
| (PID) Process: | (2240) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
| Operation: | write | Name: | 6"4 |
Value: 36223400C008000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000 | |||
| (PID) Process: | (2240) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
| Operation: | delete value | Name: | 6"4 |
Value: 36223400C008000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000 | |||
| (PID) Process: | (2240) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
Executable files
1
Suspicious files
73
Text files
1
Unknown types
2
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2240 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR5CF0.tmp.cvr | — | |
MD5:— | SHA256:— | |||
| 2240 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\t8d2ae6.txt | — | |
MD5:— | SHA256:— | |||
| 2240 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:— | SHA256:— | |||
| 2240 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~$ample2.doc | pgc | |
MD5:— | SHA256:— | |||
| 2524 | cmd.exe | C:\Users\admin\AppData\Local\Temp\t8d2ae6.exe | executable | |
MD5:— | SHA256:— | |||
| 4060 | Firefox.exe | C:\Users\admin\AppData\Roaming\O3-9N7-E\O3-logrf.ini | binary | |
MD5:— | SHA256:— | |||
| 1248 | msg.exe | C:\Users\admin\AppData\Roaming\O3-9N7-E\O3-logrc.ini | binary | |
MD5:— | SHA256:— | |||
| 1248 | msg.exe | C:\Users\admin\AppData\Roaming\O3-9N7-E\O3-logim.jpeg | image | |
MD5:— | SHA256:— | |||
| 1248 | msg.exe | C:\Users\admin\AppData\Roaming\O3-9N7-E\O3-logri.ini | binary | |
MD5:D63A82E5D81E02E399090AF26DB0B9CB | SHA256:EAECE2EBA6310253249603033C744DD5914089B0BB26BDE6685EC9813611BAAE | |||
| 1248 | msg.exe | C:\Users\admin\AppData\Roaming\O3-9N7-E\O3-logrv.ini | binary | |
MD5:BA3B6BC807D4F76794C4B81B09BB9BA5 | SHA256:6EEBF968962745B2E9DE2CA969AF7C424916D4E3FE3CC0BB9B3D414ABFCE9507 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
21
TCP/UDP connections
22
DNS requests
18
Threats
49
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
116 | explorer.exe | GET | — | 23.20.239.12:80 | http://www.findnursingschool.com/ma/?h6eD7BM=brN7AQ4sTjmtXs+RvxPtFgm5sWRuttZYKoVhvxhqVATouhZ6FNa2DKCLBX4d9jlPE79BhQ==&MJoH=Fdm09tQ8qp8LelC0 | US | — | — | shared |
116 | explorer.exe | GET | — | 192.64.116.237:80 | http://www.balonck.com/ma/?h6eD7BM=/v2RQsfcB4Q6qGDPygIIRXLYa/kE1fw2A9JQIWUr6qNr8r+MuhxrIEyDSzIfBkU/Dln1Ag==&MJoH=Fdm09tQ8qp8LelC0&sql=1 | US | — | — | malicious |
116 | explorer.exe | POST | — | 23.227.38.64:80 | http://www.giggypets.com/ma/ | CA | — | — | malicious |
116 | explorer.exe | POST | — | 23.227.38.64:80 | http://www.giggypets.com/ma/ | CA | — | — | malicious |
116 | explorer.exe | POST | — | 23.227.38.64:80 | http://www.giggypets.com/ma/ | CA | — | — | malicious |
116 | explorer.exe | POST | — | 192.64.116.237:80 | http://www.balonck.com/ma/ | US | — | — | malicious |
116 | explorer.exe | GET | 403 | 23.227.38.64:80 | http://www.giggypets.com/ma/?h6eD7BM=Mx3KSaNyAdZXUf57ORb5UWCCrwXq/nsnxSr/+kl4KNB+71d9j24AqREIQl63UE+KK210wg==&MJoH=Fdm09tQ8qp8LelC0&sql=1 | CA | html | 1.74 Kb | malicious |
116 | explorer.exe | POST | — | 75.126.102.243:80 | http://www.losaltoseye.com/ma/ | US | — | — | malicious |
116 | explorer.exe | POST | — | 154.209.2.147:80 | http://www.whlies.com/ma/ | US | — | — | malicious |
116 | explorer.exe | GET | 302 | 23.20.239.12:80 | http://www.kikoss.com/ma/?h6eD7BM=z8m6cf1LAo/uPSuYsmxNYBvMG/ccVL1W9pCYxAja3ya/ncV226Vwp9G+eea642s6ADpLrg==&MJoH=Fdm09tQ8qp8LelC0 | US | html | 182 b | shared |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2240 | WINWORD.EXE | 217.64.195.171:443 | www.rossofuoco.com | SEEWEB s.r.l. | IT | unknown |
116 | explorer.exe | 23.227.38.64:80 | www.giggypets.com | Shopify, Inc. | CA | malicious |
116 | explorer.exe | 23.20.239.12:80 | www.findnursingschool.com | Amazon.com, Inc. | US | shared |
116 | explorer.exe | 154.209.2.147:80 | www.whlies.com | MULTACOM CORPORATION | US | malicious |
116 | explorer.exe | 192.64.116.237:80 | www.balonck.com | Namecheap, Inc. | US | malicious |
116 | explorer.exe | 75.126.102.243:80 | www.losaltoseye.com | SoftLayer Technologies Inc. | US | malicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
www.rossofuoco.com |
| unknown |
www.findnursingschool.com |
| shared |
www.hxhwhg.com |
| unknown |
www.giggypets.com |
| malicious |
www.theceramicgarden.net |
| unknown |
www.balonck.com |
| malicious |
www.pbwsic.online |
| unknown |
www.isurro.com |
| unknown |
www.losaltoseye.com |
| malicious |
www.glindatv.com |
| unknown |
Threats
PID | Process | Class | Message |
|---|---|---|---|
116 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] FormBook CnC Checkin (GET) |
116 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] FormBook CnC Checkin (GET) |
116 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] TrojanSpy:FormBook CnC Checkin (POST) |
116 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] FormBook CnC Checkin (POST) |
116 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] TrojanSpy:FormBook CnC Checkin (POST) |
116 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] FormBook CnC Checkin (POST) |
116 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] TrojanSpy:FormBook CnC Checkin (POST) |
116 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] FormBook CnC Checkin (GET) |
116 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] TrojanSpy:FormBook CnC Checkin (POST) |
116 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] TrojanSpy:FormBook CnC Checkin (POST) |
16 ETPRO signatures available at the full report