File name:

1fd18df9a18cd0f62b1cfc61f7fa61a6904b402bfe24bc2cafaee539f68f4ddf.doc

Full analysis: https://app.any.run/tasks/68d9dad7-6ad4-4e82-8998-6d60398840ff
Verdict: Malicious activity
Threats:

WarZone RAT is a remote access trojan, which is written in C++ and offered as a malware-as-a-service. It packs a wide range of capabilities, from stealing victims’ files and passwords to capturing desktop activities. WarZone RAT is primarily distributed via phishing emails and receives regular updates from its C2.

Analysis date: September 02, 2019, 07:38:56
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-close
trojan
stealer
rat
avemaria
Indicators:
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Author: Xyz, Template: Normal.dotm, Last Saved By: Xyz, Revision Number: 2, Name of Creating Application: Microsoft Office Word, Total Editing Time: 01:00, Create Time/Date: Mon Aug 26 18:57:00 2019, Last Saved Time/Date: Mon Aug 26 18:58:00 2019, Number of Pages: 1, Number of Words: 38, Number of Characters: 223, Security: 0
MD5:

DA9876099D168B9A8028D0D2DB854D28

SHA1:

D8AB80E07E0A433A57A4145568DF05AA29F5811D

SHA256:

1FD18DF9A18CD0F62B1CFC61F7FA61A6904B402BFE24BC2CAFAEE539F68F4DDF

SSDEEP:

12288:fhOrf+uHxdWPqTF7Y+YTlunGaNj2CE1DhhtvLTFnTyY:5OrRHxdWPqTF7Y+YTlunGaNj29DhgY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Unusual execution from Microsoft Office

      • WINWORD.EXE (PID: 3368)
    • Application was dropped or rewritten from another process

      • pyfwygm.exe (PID: 3780)
      • tmpAF8E.exe (PID: 2340)
      • tmpAF8E.exe (PID: 1456)
      • tmpAF8E.exe (PID: 3864)
      • tmpAF8E.exe (PID: 3348)
    • Executable content was dropped or overwritten

      • WINWORD.EXE (PID: 3368)
    • Uses Task Scheduler to run other applications

      • tmpAF8E.exe (PID: 2340)
    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 2400)
    • Runs app for hidden code execution

      • tmpAF8E.exe (PID: 1456)
    • AVEMARIA was detected

      • tmpAF8E.exe (PID: 1456)
    • Runs injected code in another process

      • tmpAF8E.exe (PID: 1456)
    • Changes the autorun value in the registry

      • tmpAF8E.exe (PID: 1456)
    • Application was injected by another process

      • explorer.exe (PID: 276)
    • Connects to CnC server

      • tmpAF8E.exe (PID: 1456)
    • Loads dropped or rewritten executable

      • dism.exe (PID: 2668)
  • SUSPICIOUS

    • Creates files in the user directory

      • tmpAF8E.exe (PID: 2340)
    • Executable content was dropped or overwritten

      • pyfwygm.exe (PID: 3780)
      • tmpAF8E.exe (PID: 2340)
      • DllHost.exe (PID: 2132)
      • cmd.exe (PID: 2260)
    • Starts CMD.EXE for commands execution

      • tmpAF8E.exe (PID: 1456)
    • Application launched itself

      • tmpAF8E.exe (PID: 2340)
    • Executed via COM

      • DllHost.exe (PID: 2132)
    • Reads the machine GUID from the registry

      • tmpAF8E.exe (PID: 1456)
  • INFO

    • Starts Microsoft Office Application

      • explorer.exe (PID: 276)
    • Creates files in the user directory

      • WINWORD.EXE (PID: 3368)
    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 3368)
    • Application was crashed

      • tmpAF8E.exe (PID: 1456)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (54.2)
.doc | Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

Title: -
Subject: -
Author: Xyz
Keywords: -
Comments: -
Template: Normal.dotm
LastModifiedBy: Xyz
RevisionNumber: 2
Software: Microsoft Office Word
TotalEditTime: 1.0 minutes
CreateDate: 2019:08:26 17:57:00
ModifyDate: 2019:08:26 17:58:00
Pages: 1
Words: 38
Characters: 223
Security: None
CodePage: Windows Latin 1 (Western European)
Company: -
Lines: 1
Paragraphs: 1
CharCountWithSpaces: 260
AppVersion: 14
ScaleCrop: No
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
TitleOfParts: -
HeadingPairs:
  • Title
  • 1
CompObjUserTypeLen: 32
CompObjUserType: Microsoft Word 97-2003 Document
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
53
Monitored processes
13
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start inject winword.exe pyfwygm.exe tmpaf8e.exe schtasks.exe no specs #AVEMARIA tmpaf8e.exe explorer.exe cmd.exe Copy/Move/Rename/Delete/Link Object pkgmgr.exe no specs pkgmgr.exe dism.exe no specs tmpaf8e.exe no specs tmpaf8e.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
276C:\Windows\Explorer.EXEC:\Windows\explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\winanr.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshtcpip.dll
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
1456"C:\Users\admin\AppData\Local\Temp\tmpAF8E.exe"C:\Users\admin\AppData\Local\Temp\tmpAF8E.exe
tmpAF8E.exe
User:
admin
Company:
Iobit Assemblies
Integrity Level:
MEDIUM
Description:
ComputerCleaner
Exit code:
0
Version:
2.9.9.2
Modules
Images
c:\users\admin\appdata\local\temp\tmpaf8e.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
2132C:\Windows\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}C:\Windows\system32\DllHost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2260"C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe
tmpAF8E.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
2340"C:\Users\admin\AppData\Local\Temp\tmpAF8E.exe" C:\Users\admin\AppData\Local\Temp\tmpAF8E.exe
pyfwygm.exe
User:
admin
Company:
Iobit Assemblies
Integrity Level:
MEDIUM
Description:
ComputerCleaner
Exit code:
0
Version:
2.9.9.2
Modules
Images
c:\users\admin\appdata\local\temp\tmpaf8e.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2400"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SEOQwqLS" /XML "C:\Users\admin\AppData\Local\Temp\tmp8C32.tmp"C:\Windows\System32\schtasks.exetmpAF8E.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
2668"C:\Windows\system32\dism.exe" /online /norestart /apply-unattend:"C:\Users\admin\AppData\Local\Temp\ellocnak.xml"C:\Windows\system32\dism.exepkgmgr.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Dism Image Servicing Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dism.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2932"C:\Windows\system32\pkgmgr.exe" /n:%temp%\ellocnak.xmlC:\Windows\system32\pkgmgr.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Package Manager
Exit code:
3221226540
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\pkgmgr.exe
c:\systemroot\system32\ntdll.dll
3348"C:\Users\admin\AppData\Local\Temp\tmpAF8E.exe"C:\Users\admin\AppData\Local\Temp\tmpAF8E.exeexplorer.exe
User:
admin
Company:
Iobit Assemblies
Integrity Level:
MEDIUM
Description:
ComputerCleaner
Exit code:
0
Version:
2.9.9.2
Modules
Images
c:\windows\system32\iertutil.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\pkgmgr.exe
c:\windows\system32\wldap32.dll
c:\windows\system32\gpapi.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\imagehlp.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\cryptbase.dll
3368"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\1fd18df9a18cd0f62b1cfc61f7fa61a6904b402bfe24bc2cafaee539f68f4ddf.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
Total events
1 589
Read events
1 500
Write events
80
Delete events
9

Modification events

(PID) Process:(3368) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:writeName:;d#
Value:
3B642300280D0000010000000000000000000000
(PID) Process:(3368) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
Off
(PID) Process:(3368) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
On
(PID) Process:(3368) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:WORDFiles
Value:
1327628318
(PID) Process:(3368) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:ProductFiles
Value:
1327628432
(PID) Process:(3368) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:ProductFiles
Value:
1327628433
(PID) Process:(3368) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word
Operation:writeName:MTTT
Value:
280D000052A968846161D50100000000
(PID) Process:(3368) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:writeName:de#
Value:
64652300280D000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000
(PID) Process:(3368) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:delete valueName:de#
Value:
64652300280D000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000
(PID) Process:(3368) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
Executable files
5
Suspicious files
0
Text files
2
Unknown types
2

Dropped files

PID
Process
Filename
Type
3368WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR988B.tmp.cvr
MD5:
SHA256:
3368WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~DF91B8216DB9E89A3D.TMP
MD5:
SHA256:
3368WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{FEAFD573-A489-4DC6-8AAD-62001ED858F0}.tmp
MD5:
SHA256:
3368WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{06AA1C27-F1B7-4649-9231-140DFF7868CF}.tmp
MD5:
SHA256:
2340tmpAF8E.exeC:\Users\admin\AppData\Local\Temp\tmp8C32.tmp
MD5:
SHA256:
3368WINWORD.EXEC:\Users\admin\AppData\Roaming\pyfwygm.exeexecutable
MD5:
SHA256:
3780pyfwygm.exeC:\Users\admin\AppData\Local\Temp\tmpAF8E.exeexecutable
MD5:
SHA256:
2340tmpAF8E.exeC:\Users\admin\AppData\Roaming\SEOQwqLS.exeexecutable
MD5:
SHA256:
3852pkgmgr.exeC:\Windows\Logs\CBS\CBS.logtext
MD5:
SHA256:
3368WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:
SHA256:
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
2
DNS requests
1
Threats
2

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3780
pyfwygm.exe
173.212.193.7:443
www.bpgc-golf.com
Contabo GmbH
DE
unknown
1456
tmpAF8E.exe
64.188.25.152:4965
QuadraNet, Inc
US
malicious

DNS requests

Domain
IP
Reputation
www.bpgc-golf.com
  • 173.212.193.7
unknown

Threats

PID
Process
Class
Message
1456
tmpAF8E.exe
A Network Trojan was detected
AV TROJAN Ave Maria RAT CnC Response
1456
tmpAF8E.exe
A Network Trojan was detected
MALWARE [PTsecurity] AveMaria.RAT Encrypted Checkin
No debug info