analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

1fd18df9a18cd0f62b1cfc61f7fa61a6904b402bfe24bc2cafaee539f68f4ddf.doc

Full analysis: https://app.any.run/tasks/68d9dad7-6ad4-4e82-8998-6d60398840ff
Verdict: Malicious activity
Threats:

WarZone RAT is a remote access trojan, which is written in C++ and offered as a malware-as-a-service. It packs a wide range of capabilities, from stealing victims’ files and passwords to capturing desktop activities. WarZone RAT is primarily distributed via phishing emails and receives regular updates from its C2.

Analysis date: September 02, 2019, 07:38:56
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-close
trojan
stealer
rat
avemaria
Indicators:
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Author: Xyz, Template: Normal.dotm, Last Saved By: Xyz, Revision Number: 2, Name of Creating Application: Microsoft Office Word, Total Editing Time: 01:00, Create Time/Date: Mon Aug 26 18:57:00 2019, Last Saved Time/Date: Mon Aug 26 18:58:00 2019, Number of Pages: 1, Number of Words: 38, Number of Characters: 223, Security: 0
MD5:

DA9876099D168B9A8028D0D2DB854D28

SHA1:

D8AB80E07E0A433A57A4145568DF05AA29F5811D

SHA256:

1FD18DF9A18CD0F62B1CFC61F7FA61A6904B402BFE24BC2CAFAEE539F68F4DDF

SSDEEP:

12288:fhOrf+uHxdWPqTF7Y+YTlunGaNj2CE1DhhtvLTFnTyY:5OrRHxdWPqTF7Y+YTlunGaNj29DhgY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • pyfwygm.exe (PID: 3780)
      • tmpAF8E.exe (PID: 2340)
      • tmpAF8E.exe (PID: 1456)
      • tmpAF8E.exe (PID: 3348)
      • tmpAF8E.exe (PID: 3864)
    • Unusual execution from Microsoft Office

      • WINWORD.EXE (PID: 3368)
    • Executable content was dropped or overwritten

      • WINWORD.EXE (PID: 3368)
    • Uses Task Scheduler to run other applications

      • tmpAF8E.exe (PID: 2340)
    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 2400)
    • Application was injected by another process

      • explorer.exe (PID: 276)
    • Runs app for hidden code execution

      • tmpAF8E.exe (PID: 1456)
    • AVEMARIA was detected

      • tmpAF8E.exe (PID: 1456)
    • Runs injected code in another process

      • tmpAF8E.exe (PID: 1456)
    • Changes the autorun value in the registry

      • tmpAF8E.exe (PID: 1456)
    • Connects to CnC server

      • tmpAF8E.exe (PID: 1456)
    • Loads dropped or rewritten executable

      • dism.exe (PID: 2668)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • pyfwygm.exe (PID: 3780)
      • tmpAF8E.exe (PID: 2340)
      • cmd.exe (PID: 2260)
      • DllHost.exe (PID: 2132)
    • Application launched itself

      • tmpAF8E.exe (PID: 2340)
    • Creates files in the user directory

      • tmpAF8E.exe (PID: 2340)
    • Starts CMD.EXE for commands execution

      • tmpAF8E.exe (PID: 1456)
    • Reads the machine GUID from the registry

      • tmpAF8E.exe (PID: 1456)
    • Executed via COM

      • DllHost.exe (PID: 2132)
  • INFO

    • Starts Microsoft Office Application

      • explorer.exe (PID: 276)
    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 3368)
    • Creates files in the user directory

      • WINWORD.EXE (PID: 3368)
    • Application was crashed

      • tmpAF8E.exe (PID: 1456)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (54.2)
.doc | Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

CompObjUserType: Microsoft Word 97-2003 Document
CompObjUserTypeLen: 32
HeadingPairs:
  • Title
  • 1
TitleOfParts: -
HyperlinksChanged: No
SharedDoc: No
LinksUpToDate: No
ScaleCrop: No
AppVersion: 14
CharCountWithSpaces: 260
Paragraphs: 1
Lines: 1
Company: -
CodePage: Windows Latin 1 (Western European)
Security: None
Characters: 223
Words: 38
Pages: 1
ModifyDate: 2019:08:26 17:58:00
CreateDate: 2019:08:26 17:57:00
TotalEditTime: 1.0 minutes
Software: Microsoft Office Word
RevisionNumber: 2
LastModifiedBy: Xyz
Template: Normal.dotm
Comments: -
Keywords: -
Author: Xyz
Subject: -
Title: -
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
53
Monitored processes
13
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start inject winword.exe pyfwygm.exe tmpaf8e.exe schtasks.exe no specs #AVEMARIA tmpaf8e.exe explorer.exe cmd.exe Copy/Move/Rename/Delete/Link Object pkgmgr.exe no specs pkgmgr.exe dism.exe no specs tmpaf8e.exe no specs tmpaf8e.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3368"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\1fd18df9a18cd0f62b1cfc61f7fa61a6904b402bfe24bc2cafaee539f68f4ddf.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
3780C:\Users\admin\AppData\Roaming\pyfwygm.exeC:\Users\admin\AppData\Roaming\pyfwygm.exe
WINWORD.EXE
User:
admin
Company:
Sublime HQ Pty Ltd
Integrity Level:
MEDIUM
Description:
Sublime Text
Exit code:
0
Version:
3188
2340"C:\Users\admin\AppData\Local\Temp\tmpAF8E.exe" C:\Users\admin\AppData\Local\Temp\tmpAF8E.exe
pyfwygm.exe
User:
admin
Company:
Iobit Assemblies
Integrity Level:
MEDIUM
Description:
ComputerCleaner
Exit code:
0
Version:
2.9.9.2
2400"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SEOQwqLS" /XML "C:\Users\admin\AppData\Local\Temp\tmp8C32.tmp"C:\Windows\System32\schtasks.exetmpAF8E.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1456"C:\Users\admin\AppData\Local\Temp\tmpAF8E.exe"C:\Users\admin\AppData\Local\Temp\tmpAF8E.exe
tmpAF8E.exe
User:
admin
Company:
Iobit Assemblies
Integrity Level:
MEDIUM
Description:
ComputerCleaner
Exit code:
0
Version:
2.9.9.2
276C:\Windows\Explorer.EXEC:\Windows\explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2260"C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe
tmpAF8E.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2132C:\Windows\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}C:\Windows\system32\DllHost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2932"C:\Windows\system32\pkgmgr.exe" /n:%temp%\ellocnak.xmlC:\Windows\system32\pkgmgr.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Package Manager
Exit code:
3221226540
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3852"C:\Windows\system32\pkgmgr.exe" /n:%temp%\ellocnak.xmlC:\Windows\system32\pkgmgr.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Package Manager
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Total events
1 589
Read events
1 500
Write events
0
Delete events
0

Modification events

No data
Executable files
5
Suspicious files
0
Text files
2
Unknown types
2

Dropped files

PID
Process
Filename
Type
3368WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR988B.tmp.cvr
MD5:
SHA256:
3368WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~DF91B8216DB9E89A3D.TMP
MD5:
SHA256:
3368WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{FEAFD573-A489-4DC6-8AAD-62001ED858F0}.tmp
MD5:
SHA256:
3368WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{06AA1C27-F1B7-4649-9231-140DFF7868CF}.tmp
MD5:
SHA256:
2340tmpAF8E.exeC:\Users\admin\AppData\Local\Temp\tmp8C32.tmp
MD5:
SHA256:
3368WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$d18df9a18cd0f62b1cfc61f7fa61a6904b402bfe24bc2cafaee539f68f4ddf.docpgc
MD5:EE3D9D0A77EF1CBB9DCC504A9C4ED973
SHA256:72AFA137A37CDF443DB9A0C8B260758DA2CDA867B4B10C27A9B03B39D2EDED4E
2340tmpAF8E.exeC:\Users\admin\AppData\Roaming\SEOQwqLS.exeexecutable
MD5:3A90134EB6D72701FBB391CDEDD45DF1
SHA256:EE13C5B8A9335EA12D8498DEF4CCE5B1E459E44582C3E1DA67F48FAFF0A31C1C
3852pkgmgr.exeC:\Windows\Logs\CBS\CBS.logtext
MD5:B7AD3F707B9A61BF140A3648C15B282C
SHA256:FFD422402E5F3D957A5E84F0F99C4D826666D95A65709E82AFC50D7686817886
3368WINWORD.EXEC:\Users\admin\AppData\Roaming\pyfwygm.exeexecutable
MD5:88E6D0EA02237998ED467814662492A7
SHA256:D13C600C215DB6A1AB74D73F497DAFCC6532BD0844BFF2E442C59F6ACD52A929
3780pyfwygm.exeC:\Users\admin\AppData\Local\Temp\tmpAF8E.exeexecutable
MD5:3A90134EB6D72701FBB391CDEDD45DF1
SHA256:EE13C5B8A9335EA12D8498DEF4CCE5B1E459E44582C3E1DA67F48FAFF0A31C1C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
2
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3780
pyfwygm.exe
173.212.193.7:443
www.bpgc-golf.com
Contabo GmbH
DE
unknown
1456
tmpAF8E.exe
64.188.25.152:4965
QuadraNet, Inc
US
malicious

DNS requests

Domain
IP
Reputation
www.bpgc-golf.com
  • 173.212.193.7
unknown

Threats

PID
Process
Class
Message
1456
tmpAF8E.exe
A Network Trojan was detected
AV TROJAN Ave Maria RAT CnC Response
1456
tmpAF8E.exe
A Network Trojan was detected
MALWARE [PTsecurity] AveMaria.RAT Encrypted Checkin
No debug info