| File name: | BL Original Shipping Doc.xlsx |
| Full analysis: | https://app.any.run/tasks/8ad3cc53-1625-41b1-b92c-37accabe0ef2 |
| Verdict: | Malicious activity |
| Threats: | FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus. |
| Analysis date: | July 22, 2022, 22:43:36 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/encrypted |
| File info: | CDFV2 Encrypted |
| MD5: | C62B1FDD34CF7EEF7D424080B68466C8 |
| SHA1: | 7752B0D9851BA6035C7C2D3EF6527BDA9656298F |
| SHA256: | DD1EA9D02CE735307690097F1BF03E2D5ED844E474A8B41F68310141C848393F |
| SSDEEP: | 6144:XirYdqe1nNRyx3jrJ6ONmshSKfuRN2h5FnDg2u:nd35NRY9fhp220 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 348 | "C:\Windows\System32\rdpclip.exe" | C:\Windows\System32\rdpclip.exe | Explorer.EXE | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: RDP Clip Monitor Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1376 | C:\Windows\Explorer.EXE | C:\Windows\Explorer.EXE | — | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1616 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAwAA== | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | regasm_svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 10.0.14409.1005 (rs1_srvoob.161208-1155) Modules
| |||||||||||||||
| 1836 | "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE | svchost.exe | ||||||||||||
User: admin Company: Design Science, Inc. Integrity Level: MEDIUM Description: Microsoft Equation Editor Exit code: 0 Version: 00110900 Modules
| |||||||||||||||
| 2268 | C:\Users\Public\regasm_svchost.exe | C:\Users\Public\regasm_svchost.exe | — | regasm_svchost.exe | |||||||||||
User: admin Company: Adobe Inc. Integrity Level: MEDIUM Description: Creative Cloud Desktop Exit code: 0 Version: 5.3.1.470 Modules
| |||||||||||||||
| 2648 | "C:\Users\Public\regasm_svchost.exe" | C:\Users\Public\regasm_svchost.exe | EQNEDT32.EXE | ||||||||||||
User: admin Company: Adobe Inc. Integrity Level: MEDIUM Description: Creative Cloud Desktop Exit code: 0 Version: 5.3.1.470 Modules
| |||||||||||||||
| 2948 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | — | Explorer.EXE | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Exit code: 0 Version: 14.0.6024.1000 Modules
| |||||||||||||||
| (PID) Process: | (1376) Explorer.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0 |
| Operation: | write | Name: | CheckSetting |
Value: 01000000D08C9DDF0115D1118C7A00C04FC297EB0100000001D39410131428449CB0A06380ACE85700000000020000000000106600000001000020000000D55BB0CF44FD1DC2F79AA896D74FC924259D8C983CAF7AEE9682B0E65229A044000000000E80000000020000200000003C01EB262E9B313401E857ABD3036D1392E13819DAE32EB8DD1C9CEE21C2AC653000000052A5AFC43BABCC506F8707BC3AC68AF69F4BAD1C06809725AF11973C474D6B5BCA3BBC701A083B0487B972CB919E178A40000000BAE4B7310F616E353EF146E4EAE59F6172A356BDBFB23287B404FB11F6E2A4BB77B3F31D6C6B89B70E1DCD2C753978449046264251684D4BA5E3450285650556 | |||
| (PID) Process: | (2948) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems |
| Operation: | write | Name: | +j; |
Value: 2B6A3B00840B0000010000000000000000000000 | |||
| (PID) Process: | (2948) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1033 |
Value: Off | |||
| (PID) Process: | (2948) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1041 |
Value: Off | |||
| (PID) Process: | (2948) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1046 |
Value: Off | |||
| (PID) Process: | (2948) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1036 |
Value: Off | |||
| (PID) Process: | (2948) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1031 |
Value: Off | |||
| (PID) Process: | (2948) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1040 |
Value: Off | |||
| (PID) Process: | (2948) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1049 |
Value: Off | |||
| (PID) Process: | (2948) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 3082 |
Value: Off | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2948 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVRD21C.tmp.cvr | — | |
MD5:— | SHA256:— | |||
| 1836 | EQNEDT32.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\vbc[1].exe | executable | |
MD5:— | SHA256:— | |||
| 1836 | EQNEDT32.EXE | C:\Users\Public\regasm_svchost.exe | executable | |
MD5:— | SHA256:— | |||
| 1616 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive | dbf | |
MD5:446DD1CF97EABA21CF14D03AEBC79F27 | SHA256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF | |||
| 2948 | EXCEL.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\46BB4625.emf | emf | |
MD5:D4FA23E8030099CDC6F9A493B2200575 | SHA256:FDA47C5606652D992C36DD6AC5360AAFBA644E3729F7267A339286A15DC11B8C | |||
| 1616 | powershell.exe | C:\Users\admin\AppData\Local\Temp\c02gaeu4.dbq.ps1 | binary | |
MD5:C4CA4238A0B923820DCC509A6F75849B | SHA256:— | |||
| 1616 | powershell.exe | C:\Users\admin\AppData\Local\Temp\1qrlkvop.hik.psm1 | binary | |
MD5:C4CA4238A0B923820DCC509A6F75849B | SHA256:— | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1376 | Explorer.EXE | GET | 301 | 34.117.168.233:80 | http://www.heqynox.com/4q5q/?pNJ=vP18rFBiZA3u/IdNZ4PYEJVmyFAE8LQu40c+U4nukH95d6d28AHu48MWdh86rOXbN0V5Z8o3NOF6shPYqA5q8kY83tMMO+XiTBcNmgs=&PT=bj4PDDWHX | US | — | — | malicious |
1376 | Explorer.EXE | GET | 302 | 54.225.97.249:80 | http://www.advocaretexasbowl.com/4q5q/?pNJ=P+nDfdLZW+MYnR3uKkf8hbW7C35gUcwwp27ZRm5I/pf3NvLuVJEhZB57MwqqIMl0ckReTm4sumUR5tPJblEki0uT0klGV4y2iJGzZI8=&PT=bj4PDDWHX | US | — | — | malicious |
1836 | EQNEDT32.EXE | GET | 200 | 107.172.13.136:80 | http://107.172.13.136/90/vbc.exe | US | executable | 369 Kb | malicious |
1376 | Explorer.EXE | GET | 200 | 23.217.138.108:80 | http://www.sharedhousingschool.info/4q5q/?pNJ=aAcANaZ8GaCR/BdYO2lkIsPwIO55bDURldQ7Yrw0JMLEvzOS7PPEb3QeIZO01mFDEgjvhEJQYKYb09Z7pgnl2yKYc6SuyA1UlZnrzDQ=&PT=bj4PDDWHX | US | html | 387 b | malicious |
1376 | Explorer.EXE | GET | 404 | 162.0.216.69:80 | http://www.suntivegas.com/4q5q/?pNJ=4I24t0szptoV6gsQuNPl2Z5alZdldLjH+temlfWLaVNdiHB/M67FmaOfz6KB26v0qj1iPJtxnlTLT0f+1C0lWF+hg+POS6B8XO6ZSog=&PT=bj4PDDWHX | CA | html | 280 b | malicious |
1376 | Explorer.EXE | GET | 301 | 3.71.215.20:80 | http://www.serenityhomecomfort.com/4q5q/?pNJ=BP7HGWEt0x0gugC8ufexGex8gpPuZhAv7yop73C9Y9v9AwAOqAydD/h8VCdrfWFLGVn0Z5+5FvwNaKBpbsmhkzicWm8FsdPg9kkVBwo=&PT=bj4PDDWHX | US | text | 56 b | malicious |
1376 | Explorer.EXE | GET | 301 | 118.123.16.215:80 | http://www.szsxycd.com/4q5q/?pNJ=ZF4wBeEfd7UittptHjubBXIftXwRgU4hi0BScM2BxjW6zQ68Il4TKbNs4PQeKF2p4+zhXqOPmANRRB6dhAiFaBawKN5iKnzdxh7YoOE=&PT=bj4PDDWHX | CN | html | 361 b | malicious |
1376 | Explorer.EXE | GET | 404 | 98.124.224.17:80 | http://www.laboratoirevinci.com/4q5q/?pNJ=8Yc90WJwjORTS9CyujHTb6MLi9pyjYSMimN2ZKbw0dEOkc0k3Oa8FYSL74x9tJNJyeB6tgSh2VK+BVDTH3bUNl2hYRJczQ2VmLx6Axw=&PT=bj4PDDWHX | US | html | 1.22 Kb | malicious |
1376 | Explorer.EXE | GET | 301 | 66.29.132.16:80 | http://www.helenagist.xyz/4q5q/?pNJ=tyjARxjfuc/njtY64WfQLxLYyoBrtRAeNekRkVJIzvjTl8d5uPZhwzni+EYrsPAnnCocDr8Pje2W8ViyB2STlmmucZ+N2N1/tv2Net4=&PT=bj4PDDWHX | US | html | 707 b | malicious |
1376 | Explorer.EXE | GET | 404 | 193.70.42.59:80 | http://www.endamica.net/4q5q/?pNJ=6dtPfXSXuEdZyJ28hsSh7ukzo1c+yM8GjN8559sM9IZp+d6/kU/sPH0OgSv0Vvfg2A6Nuf05epfSSQ8kyD8Dh4W1U7crrlEyczmQ1Ww=&PT=bj4PDDWHX | FR | html | 1.22 Kb | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
1836 | EQNEDT32.EXE | 107.172.13.136:80 | — | ColoCrossing | US | malicious |
2648 | regasm_svchost.exe | 13.107.42.13:443 | onedrive.live.com | Microsoft Corporation | US | malicious |
2648 | regasm_svchost.exe | 13.107.42.12:443 | ynuiqw.ch.files.1drv.com | Microsoft Corporation | US | suspicious |
1376 | Explorer.EXE | 23.217.138.108:80 | www.sharedhousingschool.info | Akamai Technologies, Inc. | US | whitelisted |
1376 | Explorer.EXE | 162.0.216.69:80 | www.suntivegas.com | AirComPlus Inc. | CA | malicious |
1376 | Explorer.EXE | 3.71.215.20:80 | www.serenityhomecomfort.com | — | US | malicious |
1376 | Explorer.EXE | 54.225.97.249:80 | www.advocaretexasbowl.com | Amazon.com, Inc. | US | malicious |
1376 | Explorer.EXE | 34.117.168.233:80 | www.heqynox.com | — | US | malicious |
1376 | Explorer.EXE | 193.70.42.59:80 | www.endamica.net | OVH SAS | FR | malicious |
1376 | Explorer.EXE | 66.29.132.16:80 | www.helenagist.xyz | Advantagecom Networks, Inc. | US | malicious |
Domain | IP | Reputation |
|---|---|---|
onedrive.live.com |
| shared |
ynuiqw.ch.files.1drv.com |
| suspicious |
www.suntivegas.com |
| malicious |
www.sharedhousingschool.info |
| malicious |
www.tmjlwzwoi9k.digital |
| unknown |
www.serenityhomecomfort.com |
| malicious |
www.advocaretexasbowl.com |
| malicious |
www.laboratoirevinci.com |
| malicious |
www.szsxycd.com |
| malicious |
www.bowlersmall.store |
| malicious |
PID | Process | Class | Message |
|---|---|---|---|
1836 | EQNEDT32.EXE | A Network Trojan was detected | ET INFO Executable Download from dotted-quad Host |
1836 | EQNEDT32.EXE | A Network Trojan was detected | ET TROJAN MSIL/GenKryptik.FQRH Download Request |
1836 | EQNEDT32.EXE | Potentially Bad Traffic | ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile |
1836 | EQNEDT32.EXE | A Network Trojan was detected | ET CURRENT_EVENTS Likely Evil EXE download from dotted Quad by MSXMLHTTP M1 |
1836 | EQNEDT32.EXE | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
1836 | EQNEDT32.EXE | A Network Trojan was detected | ET CURRENT_EVENTS Likely Evil EXE download from dotted Quad by MSXMLHTTP M2 |
1836 | EQNEDT32.EXE | Potentially Bad Traffic | ET INFO SUSPICIOUS Dotted Quad Host MZ Response |
1376 | Explorer.EXE | Generic Protocol Command Decode | SURICATA HTTP Unexpected Request body |
1376 | Explorer.EXE | A Network Trojan was detected | ET TROJAN FormBook CnC Checkin (GET) |
1376 | Explorer.EXE | A Network Trojan was detected | ET TROJAN FormBook CnC Checkin (GET) |