File name:

shipping quote1232_pdf.zip

Full analysis: https://app.any.run/tasks/57f991b2-1caf-45cc-a1e0-98156bb8fb4d
Verdict: Malicious activity
Threats:

FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus.

Analysis date: March 31, 2020, 07:54:15
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
formbook
trojan
stealer
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

167D29FD346B734B545586D15C291D79

SHA1:

10B16D594A426B9FCEE9B39F693262A3DC378B0E

SHA256:

B937A3F01C12690106D2A5C9A85E8793852B2F63A134A50C0BA8AB25080DB2D1

SSDEEP:

24576:2M3vNPUzs2zqX2UXFpdzghOQKeSyBmjidorWLAvu2xfkMlit:x1czsLXtQOc1EEMfHlit

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Shipping quote1232_pdf.exe (PID: 1348)
      • Shipping quote1232_pdf.exe (PID: 2720)
    • Connects to CnC server

      • explorer.exe (PID: 372)
    • FORMBOOK was detected

      • explorer.exe (PID: 372)
      • msdt.exe (PID: 3620)
      • Firefox.exe (PID: 2692)
    • Actions looks like stealing of personal data

      • msdt.exe (PID: 3620)
    • Changes the autorun value in the registry

      • msdt.exe (PID: 3620)
    • Stealing of credential data

      • msdt.exe (PID: 3620)
  • SUSPICIOUS

    • Application launched itself

      • Shipping quote1232_pdf.exe (PID: 1348)
    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3808)
    • Creates files in the user directory

      • msdt.exe (PID: 3620)
    • Loads DLL from Mozilla Firefox

      • msdt.exe (PID: 3620)
    • Starts CMD.EXE for commands execution

      • msdt.exe (PID: 3620)
  • INFO

    • Reads the hosts file

      • msdt.exe (PID: 3620)
    • Manual execution by user

      • msdt.exe (PID: 3620)
    • Creates files in the user directory

      • Firefox.exe (PID: 2692)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2020:03:31 00:14:13
ZipCRC: 0x9742d8ce
ZipCompressedSize: 1203925
ZipUncompressedSize: 1630208
ZipFileName: Shipping quote1232_pdf.exe
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
7
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start winrar.exe shipping quote1232_pdf.exe no specs shipping quote1232_pdf.exe no specs #FORMBOOK msdt.exe cmd.exe no specs #FORMBOOK explorer.exe #FORMBOOK firefox.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
372C:\Windows\Explorer.EXEC:\Windows\explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\winanr.dll
c:\windows\system32\wshtcpip.dll
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1348"C:\Users\admin\AppData\Local\Temp\Rar$EXa3808.10821\Shipping quote1232_pdf.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3808.10821\Shipping quote1232_pdf.exeWinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3808.10821\shipping quote1232_pdf.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\version.dll
1844/c del "C:\Users\admin\AppData\Local\Temp\Rar$EXa3808.10821\Shipping quote1232_pdf.exe"C:\Windows\System32\cmd.exemsdt.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2692"C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe
msdt.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
68.0.1
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
2720"C:\Users\admin\AppData\Local\Temp\Rar$EXa3808.10821\Shipping quote1232_pdf.exe"C:\Users\admin\AppData\Local\Temp\Rar$EXa3808.10821\Shipping quote1232_pdf.exeShipping quote1232_pdf.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3808.10821\shipping quote1232_pdf.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3620"C:\Windows\System32\msdt.exe"C:\Windows\System32\msdt.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Diagnostics Troubleshooting Wizard
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msdt.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3808"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\shipping quote1232_pdf.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
Total events
464
Read events
444
Write events
20
Delete events
0

Modification events

(PID) Process:(3808) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3808) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3808) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3808) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\shipping quote1232_pdf.zip
(PID) Process:(3808) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3808) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3808) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3808) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(372) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.zip\OpenWithList
Operation:writeName:a
Value:
WinRAR.exe
(PID) Process:(372) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.zip\OpenWithList
Operation:writeName:MRUList
Value:
a
Executable files
1
Suspicious files
73
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
3808WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3808.10821\Shipping quote1232_pdf.exeexecutable
MD5:
SHA256:
3620msdt.exeC:\Users\admin\AppData\Roaming\4QN086VE\4QNlogri.inibinary
MD5:D63A82E5D81E02E399090AF26DB0B9CB
SHA256:EAECE2EBA6310253249603033C744DD5914089B0BB26BDE6685EC9813611BAAE
3620msdt.exeC:\Users\admin\AppData\Roaming\4QN086VE\4QNlogim.jpegimage
MD5:
SHA256:
2692Firefox.exeC:\Users\admin\AppData\Roaming\4QN086VE\4QNlogrf.inibinary
MD5:
SHA256:
3620msdt.exeC:\Users\admin\AppData\Roaming\4QN086VE\4QNlogrc.inibinary
MD5:
SHA256:
3620msdt.exeC:\Users\admin\AppData\Roaming\4QN086VE\4QNlogrv.inibinary
MD5:BA3B6BC807D4F76794C4B81B09BB9BA5
SHA256:6EEBF968962745B2E9DE2CA969AF7C424916D4E3FE3CC0BB9B3D414ABFCE9507
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
18
TCP/UDP connections
21
DNS requests
7
Threats
66

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
372
explorer.exe
GET
184.168.221.88:80
http://www.guideonwebs.com/k8g/?0ph=Xn9dmeINecPQ+IwFR1eHYb2x98hoRafi5f8Y11XvFF/o1l0h7/6YQbHiuLp49VJQqg2HJQ==&00=Kxd09b7XJ
US
malicious
372
explorer.exe
GET
198.54.117.210:80
http://www.matabishi.com/k8g/?0ph=KXYIa96KmMLkH/9ukUAZ9nByBsayi1UQmYcHYFNcpj2uJC2CRbRNPGCNFNU/4ae7xcfw8w==&00=Kxd09b7XJ
US
malicious
372
explorer.exe
POST
184.168.221.88:80
http://www.guideonwebs.com/k8g/
US
malicious
372
explorer.exe
POST
23.20.239.12:80
http://www.sanfranciscosound.com/k8g/
US
shared
372
explorer.exe
GET
302
23.20.239.12:80
http://www.sanfranciscosound.com/k8g/?0ph=HFT/yqDra9GCYrZMXg9yOuPz9+GBS5G6qwo4xxaIGSDg11JlZ0lUqJWlINryMEVwAIzuOQ==&00=Kxd09b7XJ
US
html
193 b
shared
372
explorer.exe
POST
184.168.221.88:80
http://www.guideonwebs.com/k8g/
US
malicious
372
explorer.exe
POST
199.192.27.69:80
http://www.crokve.com/k8g/
US
malicious
372
explorer.exe
POST
198.54.117.210:80
http://www.matabishi.com/k8g/
US
malicious
372
explorer.exe
POST
103.247.11.208:80
http://www.mediamazballon.com/k8g/
ID
malicious
372
explorer.exe
POST
103.247.11.208:80
http://www.mediamazballon.com/k8g/
ID
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
372
explorer.exe
154.90.167.87:80
www.xuanyu-tj.com
MULTACOM CORPORATION
US
malicious
372
explorer.exe
199.192.27.69:80
www.crokve.com
US
malicious
372
explorer.exe
23.20.239.12:80
www.sanfranciscosound.com
Amazon.com, Inc.
US
shared
372
explorer.exe
184.168.221.88:80
www.guideonwebs.com
GoDaddy.com, LLC
US
malicious
372
explorer.exe
103.247.11.208:80
www.mediamazballon.com
Rumahweb Indonesia CV.
ID
malicious
372
explorer.exe
198.54.117.210:80
www.matabishi.com
Namecheap, Inc.
US
malicious

DNS requests

Domain
IP
Reputation
www.xuanyu-tj.com
  • 154.90.167.87
malicious
www.crokve.com
  • 199.192.27.69
malicious
www.guideonwebs.com
  • 184.168.221.88
malicious
www.accstandard.com
unknown
www.sanfranciscosound.com
  • 23.20.239.12
shared
www.matabishi.com
  • 198.54.117.210
  • 198.54.117.218
  • 198.54.117.216
  • 198.54.117.212
  • 198.54.117.217
  • 198.54.117.211
  • 198.54.117.215
malicious
www.mediamazballon.com
  • 103.247.11.208
malicious

Threats

PID
Process
Class
Message
372
explorer.exe
Generic Protocol Command Decode
SURICATA HTTP Unexpected Request body
372
explorer.exe
A Network Trojan was detected
SPYWARE [PTsecurity] FormBook
372
explorer.exe
Generic Protocol Command Decode
SURICATA HTTP Unexpected Request body
372
explorer.exe
A Network Trojan was detected
SPYWARE [PTsecurity] FormBook
372
explorer.exe
Generic Protocol Command Decode
SURICATA HTTP Unexpected Request body
372
explorer.exe
A Network Trojan was detected
SPYWARE [PTsecurity] FormBook
372
explorer.exe
A Network Trojan was detected
SPYWARE [PTsecurity] FormBook
372
explorer.exe
A Network Trojan was detected
SPYWARE [PTsecurity] FormBook
372
explorer.exe
Generic Protocol Command Decode
SURICATA HTTP Unexpected Request body
372
explorer.exe
A Network Trojan was detected
SPYWARE [PTsecurity] FormBook
16 ETPRO signatures available at the full report
No debug info