72cca77c...d17f

VTI SCORE: 100/100

Dynamic Analysis Report

Classification:

Spyware

Threat Names:

FormBook

Trojan.GenericKDZ.70241

Gen:Variant.Babar.21405

mFO4ED9hfrpsSO4O.exe

Windows Exe (x86-32)

Created at 2020-09-22T01:40:00

Remarks (1/1)

Anti-Sleep Triggered (0x0200000E): The overall sleep time of all monitored processes was truncated from "41 seconds" to "10 seconds" to reveal dormant functionality.

Indicators

File (20)

Filename	Hash	Operations	Category	Severity
C:\Users\FD1HVy\Desktop\mFO4ED9hfrpsSO4O.exe	MD5: 51a292587a2d735306afb24d54002ba5 SHA1: c22a6a4cefcd2fe4c06a4244dce0c13bcf63d269 SHA256: 72cca77c38132f30a09c57d24815d52ec3d5bb48c19415f52b7a38190b92d17f SSDeep: 12288:Y2fVnLF0eRwlTaOcJFCS7TPIIDZZAzR//JIcJa7KoJ7/zDaLdkH66lmv5G/++r6h:t5iav+STPlrAzR//JIcJkfzHzwURrO ImpHash: f34d5f2d4577ed6d9ceec516c1f5a744		Sample File	Malicious
C:\Users\FD1HVy\AppData\Local\Temp\DB1	MD5: 5c2161fc7b16d12b45b3e53d56fad16a SHA1: 06a317f3d6519cf226db3ab029a212293d318a1b SHA256: cdad85eefaeee766286a12d8c4039c819a3515170da3070967a7f5198119b35a SSDeep: 24:LLUH0KL7G0TMJHUyyJtmCm0XKY6lOKQAE9V8MffD4fOzeCmly6Uwc6FZW:Uz+JH3yJUheCVE9V8MX0PFlNU12ZW ImpHash: -	Access, Create	Dropped File	Whitelisted
C:\Users\FD1HVy\AppData\Local\Google\Chrome\User Data\Default\Login Data	-	Access		Not Available
C:\Users\FD1HVy\Desktop\mFO4ED9hfrpsSO4O.exe.config	-	Access		Not Available
C:\WINDOWS\system32	-	Access		Not Available
C:\Windows\SysWOW64\cmd.exe	-	Access		Not Available
\??\C:\Program Files (x86)\Mozilla Firefox\Firefox.exe	-	Access, Create		Not Available
\??\C:\Program Files\Mozilla Firefox\Firefox.exe	-	Access, Create		Not Available
\??\C:\Users\FD1HVy\AppData\Local\Google\Chrome\User Data\Default\Login Data	-	Access, Create		Not Available
\??\C:\Users\FD1HVy\AppData\Roaming\-6NBP70T	-	Access		Not Available
\??\C:\Users\FD1HVy\AppData\Roaming\-6NBP70T\-6Nlog.ini	-	Access		Not Available
\??\C:\Users\FD1HVy\AppData\Roaming\-6NBP70T\-6Nlogrc.ini	-	Access, Create, Write		Not Available
\??\C:\Users\FD1HVy\AppData\Roaming\-6NBP70T\-6Nlogrg.ini	-	Access, Create, Write		Not Available
\??\C:\Users\FD1HVy\AppData\Roaming\-6NBP70T\-6Nlogri.ini	-	Access, Create, Write		Not Available
\??\C:\Users\FD1HVy\AppData\Roaming\-6NBP70T\-6Nlogrv.ini	-	Access, Create, Write		Not Available
\??\C:\Users\FD1HVy\AppData\Roaming\Opera Software\Opera Stable\Login Data	-	Access, Create		Not Available
\??\C:\Users\FD1HVy\Desktop\mFO4ED9hfrpsSO4O.exe	-	Access, Create, Read		Not Available
\??\C:\WINDOWS\SYSTEM32\ntdll.dll	-	Access, Create, Read		Not Available
\??\C:\WINDOWS\System32\drivers\etc\hosts	-	Access, Create, Read		Not Available
\??\C:\Windows\SysWOW64\netsh.exe	-	Access, Create, Read		Not Available

Registry (64)

Registry Key Name	Operations
HKEY_CURRENT_USER\Software\Microsoft\Command Processor	Access
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\AutoRun	Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\CompletionChar	Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DefaultColor	Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DelayedExpansion	Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DisableUNCCheck	Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\EnableExtensions	Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\PathCompletionChar	Access, Read
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System	Access
HKEY_LOCAL_MACHINE	Access
HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0	Access
HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0\Identifier	Access, Read
HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0	Access
HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0	Access
HKEY_LOCAL_MACHINE\HARDWARE\Description\System	Access
HKEY_LOCAL_MACHINE\HARDWARE\Description\System\SystemBiosVersion	Access, Read
HKEY_LOCAL_MACHINE\HARDWARE\Description\System\VideoBiosVersion	Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\AppContext	Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319	Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319\WMIDisableCOMSecurity	Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion	Access, Create
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductName	Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox\	Access, Create
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Thunderbird\	Access, Create
HKEY_LOCAL_MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	Access
HKEY_LOCAL_MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	Access
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000	Access
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc	Access, Read
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\Settings	Access
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\Settings\Device Description	Access, Read
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	Access
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\AutoRun	Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\CompletionChar	Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DefaultColor	Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DelayedExpansion	Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DisableUNCCheck	Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\EnableExtensions	Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\PathCompletionChar	Access, Read
HKEY_PERFORMANCE_DATA	Access
HKEY_USERS\S-1-5-21-1051304884-625712362-2192934891-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	Access, Create
HKEY_USERS\S-1-5-21-1051304884-625712362-2192934891-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\	Access, Create
HKEY_USERS\S-1-5-21-1051304884-625712362-2192934891-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\	Access, Create
HKEY_USERS\S-1-5-21-1051304884-625712362-2192934891-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\00568502698af0439be8841b68034dfb	Access, Create
HKEY_USERS\S-1-5-21-1051304884-625712362-2192934891-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\0a0d020000000000c000000000000046	Access, Create
HKEY_USERS\S-1-5-21-1051304884-625712362-2192934891-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\13dbb0c8aa05101a9bb000aa002fc45a	Access, Create
HKEY_USERS\S-1-5-21-1051304884-625712362-2192934891-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\218578a43d628c44a10b99677e0ac26d	Access, Create
HKEY_USERS\S-1-5-21-1051304884-625712362-2192934891-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\3517490d76624c419a828607e2a54604	Access, Create
HKEY_USERS\S-1-5-21-1051304884-625712362-2192934891-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\359319914d3d374fbfb59d68dc930dae	Access, Create
HKEY_USERS\S-1-5-21-1051304884-625712362-2192934891-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\639e40e39678b140ba542215785646ac	Access, Create
HKEY_USERS\S-1-5-21-1051304884-625712362-2192934891-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\82926373c8be9c41a6f55990abdb6a7a	Access, Create
HKEY_USERS\S-1-5-21-1051304884-625712362-2192934891-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\8503020000000000c000000000000046	Access, Create
HKEY_USERS\S-1-5-21-1051304884-625712362-2192934891-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9207f3e0a3b11019908b08002b2a56c2	Access, Create
HKEY_USERS\S-1-5-21-1051304884-625712362-2192934891-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Access, Create
HKEY_USERS\S-1-5-21-1051304884-625712362-2192934891-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Access, Create
HKEY_USERS\S-1-5-21-1051304884-625712362-2192934891-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Access, Create
HKEY_USERS\S-1-5-21-1051304884-625712362-2192934891-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Access, Create
HKEY_USERS\S-1-5-21-1051304884-625712362-2192934891-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\c02ebc5353d9cd11975200aa004ae40e	Access, Create
HKEY_USERS\S-1-5-21-1051304884-625712362-2192934891-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\db257a828627ae4aa57a2e41ad166870	Access, Create
HKEY_USERS\S-1-5-21-1051304884-625712362-2192934891-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\f7a20347e930b94fadcc6ece7cd55c43	Access, Create
HKEY_USERS\S-1-5-21-1051304884-625712362-2192934891-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\f86ed2903a4a11cfb57e524153480001	Access, Create
HKEY_USERS\S-1-5-21-1051304884-625712362-2192934891-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook_2016\	Access, Create
HKEY_USERS\S-1-5-21-1051304884-625712362-2192934891-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\	Access, Create

Mutex (4)

Mutex Name	Operations
-6NBP70TX9468WZz	Access
310A-4BA29U3JAIZ	Access
S-1-5-21-1051304-1376254591059	Access
dgykghSf	Access

Export to TXT Export to JSON

Function Logfile

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".

Remarks (1/1)

Indicators

Before

After