| File name: | Payment_Notification.pdf.img |
| Full analysis: | https://app.any.run/tasks/d5190f1b-9c32-4826-8795-8368a63db8d3 |
| Verdict: | Malicious activity |
| Threats: | FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus. |
| Analysis date: | May 20, 2019, 18:49:22 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-iso9660-image |
| File info: | ISO 9660 CD-ROM filesystem data 'Payment_Notification.pdf' |
| MD5: | C7479984C695F25119CC8B2FD1AFE2F8 |
| SHA1: | D776748F0D6EFAA886B85C212386F678C1CD93E1 |
| SHA256: | C36D8B58A3DF931B8604DA4554E8EBEE0A76B284D8E5FB6E48ABFBDEC7533649 |
| SSDEEP: | 12288:hyHoiS5fiPYt/gIPzx8AWUyODltPljeOlyWwfvV0RIDwJlt6+1lf:hyHvS5figtzNvyODlttKYqwJN1F |
MALICIOUS
Application was dropped or rewritten from another process
- Payment_Notification.pdf.exe (PID: 300)
- Payment_Notification.pdf.exe (PID: 3960)
FORMBOOK was detected
- explorer.exe (PID: 2036)
Formbook was detected
- services.exe (PID: 2092)
- Firefox.exe (PID: 3964)
Changes the autorun value in the registry
- services.exe (PID: 2092)
Actions looks like stealing of personal data
- services.exe (PID: 2092)
Connects to CnC server
- explorer.exe (PID: 2036)
Stealing of credential data
- services.exe (PID: 2092)
SUSPICIOUS
Uses RUNDLL32.EXE to load library
- explorer.exe (PID: 2036)
Creates files in the user directory
- explorer.exe (PID: 2036)
- Payment_Notification.pdf.exe (PID: 300)
- services.exe (PID: 2092)
Reads Internet Cache Settings
- explorer.exe (PID: 2036)
Executable content was dropped or overwritten
- WinRAR.exe (PID: 2728)
Starts CMD.EXE for commands execution
- services.exe (PID: 2092)
Loads DLL from Mozilla Firefox
- services.exe (PID: 2092)
INFO
Manual execution by user
- Payment_Notification.pdf.exe (PID: 300)
- services.exe (PID: 2092)
- lsm.exe (PID: 2652)
Creates files in the user directory
- Firefox.exe (PID: 3964)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .iso | | | ISO 9660 CD image (27.6) |
|---|---|---|
| .atn | | | Photoshop Action (27.1) |
| .gmc | | | Game Music Creator Music (6.1) |
EXIF
ISO
| System: | Win32 |
|---|---|
| VolumeName: | Payment_Notification.pdf |
| VolumeBlockCount: | 351 |
| VolumeBlockSize: | 2048 |
| RootDirectoryCreateDate: | 2019:05:20 07:02:16+02:00 |
| Software: | PowerISO |
| VolumeCreateDate: | 2019:05:20 07:02:16.00+02:00 |
| VolumeModifyDate: | 2019:05:20 07:02:16.00+02:00 |
Composite
| VolumeSize: | 702 kB |
|---|
Total processes
42
Monitored processes
9
Malicious processes
4
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 300 | "C:\Users\admin\Downloads\Payment_Notification.pdf.img\Payment_Notification.pdf.exe" | C:\Users\admin\Downloads\Payment_Notification.pdf.img\Payment_Notification.pdf.exe | — | explorer.exe | |||||||||||
User: admin Company: Alberto Rodr�guez Orozco Integrity Level: MEDIUM Description: 70s Gives Exit code: 0 Version: 3.6.41.92 Modules
| |||||||||||||||
| 1888 | /c del "C:\Users\admin\Downloads\Payment_Notification.pdf.img\Payment_Notification.pdf.exe" | C:\Windows\System32\cmd.exe | — | services.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2036 | C:\Windows\Explorer.EXE | C:\Windows\explorer.exe | — | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2092 | "C:\Windows\System32\services.exe" | C:\Windows\System32\services.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Services and Controller app Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2568 | "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\Downloads\Payment_Notification.pdf.img.iso | C:\Windows\system32\rundll32.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2652 | "C:\Windows\System32\lsm.exe" | C:\Windows\System32\lsm.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Local Session Manager Service Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2728 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Downloads\Payment_Notification.pdf.img.iso" | C:\Program Files\WinRAR\WinRAR.exe | rundll32.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 Modules
| |||||||||||||||
| 3960 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa2728.30046\Payment_Notification.pdf.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa2728.30046\Payment_Notification.pdf.exe | — | WinRAR.exe | |||||||||||
User: admin Company: Alberto Rodr�guez Orozco Integrity Level: MEDIUM Description: 70s Gives Exit code: 0 Version: 3.6.41.92 Modules
| |||||||||||||||
| 3964 | "C:\Program Files\Mozilla Firefox\Firefox.exe" | C:\Program Files\Mozilla Firefox\Firefox.exe | services.exe | ||||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 65.0.2 Modules
| |||||||||||||||
Total events
1 889
Read events
1 709
Write events
179
Delete events
1
Modification events
| (PID) Process: | (2568) rundll32.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (2568) rundll32.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E |
| Operation: | write | Name: | @C:\Windows\System32\isoburn.exe,-350 |
Value: Disc Image File | |||
| (PID) Process: | (2568) rundll32.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iso\OpenWithProgids |
| Operation: | write | Name: | Windows.IsoFile |
Value: | |||
| (PID) Process: | (2568) rundll32.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache |
| Operation: | write | Name: | LangID |
Value: 0904 | |||
| (PID) Process: | (2568) rundll32.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E |
| Operation: | write | Name: | @%SystemRoot%\System32\isoburn.exe,-352 |
Value: Windows Disc Image Burner | |||
| (PID) Process: | (2568) rundll32.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache |
| Operation: | write | Name: | C:\Windows\System32\isoburn.exe |
Value: Windows Disc Image Burner | |||
| (PID) Process: | (2568) rundll32.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache |
| Operation: | write | Name: | C:\Program Files\WinRAR\WinRAR.exe |
Value: WinRAR archiver | |||
| (PID) Process: | (2568) rundll32.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache |
| Operation: | write | Name: | C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe |
Value: Adobe Acrobat Reader DC | |||
| (PID) Process: | (2568) rundll32.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache |
| Operation: | write | Name: | C:\Windows\eHome\ehshell.exe |
Value: Windows Media Center | |||
| (PID) Process: | (2568) rundll32.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache |
| Operation: | write | Name: | C:\Program Files\Internet Explorer\iexplore.exe |
Value: Internet Explorer | |||
Executable files
2
Suspicious files
82
Text files
1
Unknown types
6
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2036 | explorer.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\1b4dd67f29cb1962.automaticDestinations-ms | automaticdestinations-ms | |
MD5:— | SHA256:— | |||
| 2036 | explorer.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\290532160612e071.automaticDestinations-ms | automaticdestinations-ms | |
MD5:— | SHA256:— | |||
| 2728 | WinRAR.exe | C:\Users\admin\Downloads\Payment_Notification.pdf.img\Payment_Notification.pdf.exe | executable | |
MD5:— | SHA256:— | |||
| 2728 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa2728.30046\Payment_Notification.pdf.exe | executable | |
MD5:— | SHA256:— | |||
| 2092 | services.exe | C:\Users\admin\AppData\Roaming\031R2A5E\031logim.jpeg | image | |
MD5:— | SHA256:— | |||
| 3964 | Firefox.exe | C:\Users\admin\AppData\Roaming\031R2A5E\031logrf.ini | binary | |
MD5:— | SHA256:— | |||
| 2036 | explorer.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012019052020190521\index.dat | dat | |
MD5:— | SHA256:— | |||
| 2036 | explorer.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\Downloads.lnk | lnk | |
MD5:— | SHA256:— | |||
| 2036 | explorer.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\Payment_Notification.pdf.img.iso.lnk | lnk | |
MD5:— | SHA256:— | |||
| 2092 | services.exe | C:\Users\admin\AppData\Roaming\031R2A5E\031logrc.ini | binary | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
6
DNS requests
13
Threats
11
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2036 | explorer.exe | GET | 301 | 2.16.187.32:80 | http://www.pattiradle.com/dy/?cx=vv3LB3t7AG5+oOlOmUOmLHqRYUfD6y430XH5RfNBRXuW1ljrWR4+FZ6QsYCkneRXjeNa9g==&Tj=YBcDkPE | unknown | — | — | suspicious |
2036 | explorer.exe | GET | 301 | 35.246.6.109:80 | http://www.market2boost.com/dy/?cx=I7dCZLFfctmE9c1y+iuiqXSeA+PhvqYwYgIbmAdtE6ONoMhEE/BFz5t+bShobe3gfoPOpw==&Tj=YBcDkPE&sql=1 | US | — | — | malicious |
2036 | explorer.exe | GET | — | 162.213.250.187:80 | http://www.jankolet.com/dy/?cx=w7XLkMN61pR0MnMB2qLaprTUq3KaA5aHdEqDphFd56KNj5fPvmuvIwpuWr/uCTdIhy40Vw==&Tj=YBcDkPE | US | — | — | malicious |
2036 | explorer.exe | POST | — | 35.246.6.109:80 | http://www.market2boost.com/dy/ | US | — | — | malicious |
2036 | explorer.exe | POST | — | 35.246.6.109:80 | http://www.market2boost.com/dy/ | US | — | — | malicious |
2036 | explorer.exe | POST | — | 35.246.6.109:80 | http://www.market2boost.com/dy/ | US | — | — | malicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2036 | explorer.exe | 2.16.187.32:80 | www.pattiradle.com | Akamai International B.V. | — | whitelisted |
2036 | explorer.exe | 35.246.6.109:80 | www.market2boost.com | — | US | malicious |
2036 | explorer.exe | 162.213.250.187:80 | www.jankolet.com | Namecheap, Inc. | US | malicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
www.personal-dudaust1-3.com |
| unknown |
www.khaledsleem.com |
| unknown |
www.6505drexel.info |
| unknown |
www.pattiradle.com |
| suspicious |
www.abatedourodogalego.com |
| unknown |
www.realmofcare.com |
| unknown |
www.fizzy-slim.site |
| unknown |
www.market2boost.com |
| malicious |
www.loanblasters.com |
| unknown |
www.jankolet.com |
| malicious |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2036 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] FormBook CnC Checkin (GET) |
2036 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] FormBook CnC Checkin (GET) |
2036 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] TrojanSpy:FormBook CnC Checkin (POST) |
2036 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] TrojanSpy:FormBook CnC Checkin (POST) |
2036 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] FormBook CnC Checkin (POST) |
2036 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] FormBook CnC Checkin (GET) |
5 ETPRO signatures available at the full report