File name:

CO & BL INV 452.docx

Full analysis: https://app.any.run/tasks/2c92e8e1-f29a-40c3-a353-cd1211953b6d
Verdict: Malicious activity
Threats:

AZORult can steal banking information, including passwords and credit card details, as well as cryptocurrency. This constantly updated information stealer malware should not be taken lightly, as it continues to be an active threat.

Analysis date: December 15, 2018, 01:58:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
exploit
cve-2017-11882
loader
rat
azorult
Indicators:
MIME: application/vnd.openxmlformats-officedocument.wordprocessingml.document
File info: Microsoft Word 2007+
MD5:

4F87665C7B04AAD7EC438C8008EFECE1

SHA1:

90F993CD4329EC6331457888D41E5C2F755B8BD1

SHA256:

2771307D115CB188EC94DC605E3D30FE656CC0B33DF7E937D074FDA0AAF77A38

SSDEEP:

192:0I/viR/2ww6yMtWN3v0mqQTnhr5OJQT1Q0P55dKbFTB8GoA6a7kWSm2:0I/viRfw6yMti3hLOJQT1Q0DdQd3om2

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Equation Editor starts application (CVE-2017-11882)

      • EQNEDT32.EXE (PID: 4008)
    • Suspicious connection from the Equation Editor

      • EQNEDT32.EXE (PID: 4008)
    • Application was dropped or rewritten from another process

      • 25802580.exe (PID: 3492)
      • 25802580.exe (PID: 4040)
    • Downloads executable files from the Internet

      • EQNEDT32.EXE (PID: 4008)
    • AZORULT was detected

      • 25802580.exe (PID: 4040)
    • Connects to CnC server

      • 25802580.exe (PID: 4040)
  • SUSPICIOUS

    • Unusual connect from Microsoft Office

      • WINWORD.EXE (PID: 2980)
    • Executable content was dropped or overwritten

      • EQNEDT32.EXE (PID: 4008)
  • INFO

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2980)
    • Creates files in the user directory

      • WINWORD.EXE (PID: 2980)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.docx | Word Microsoft Office Open XML Format document (52.2)
.zip | Open Packaging Conventions container (38.8)
.zip | ZIP compressed archive (8.8)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0002
ZipCompression: Deflated
ZipModifyDate: 2018:12:15 02:19:00
ZipCRC: 0x82872409
ZipCompressedSize: 358
ZipUncompressedSize: 1422
ZipFileName: [Content_Types].xml

XML

Template: dotm.dotm
TotalEditTime: 1 minute
Pages: 1
Words: 1
Characters: 7
Application: Microsoft Office Word
DocSecurity: None
Lines: 1
Paragraphs: 1
ScaleCrop: No
HeadingPairs:
  • Название
  • 1
TitlesOfParts: -
Company: SPecialiST RePack
LinksUpToDate: No
CharactersWithSpaces: 7
SharedDoc: No
HyperlinksChanged: No
AppVersion: 14
LastModifiedBy: Microsoft
RevisionNumber: 1
CreateDate: 2017:09:24 17:26:00Z
ModifyDate: 2017:09:24 17:27:00Z

XMP

Creator: Microsoft
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
33
Monitored processes
4
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start winword.exe eqnedt32.exe 25802580.exe no specs #AZORULT 25802580.exe

Process information

PID
CMD
Path
Indicators
Parent process
2980"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\CO & BL INV 452.docx"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
3492C:\Users\admin\AppData\Local\25802580.exeC:\Users\admin\AppData\Local\25802580.exeEQNEDT32.EXE
User:
admin
Company:
Adobe Inc.
Integrity Level:
MEDIUM
Description:
Adobe Dreamweaver CC 2019
Exit code:
1
Version:
19.0.0.11193
Modules
Images
c:\users\admin\appdata\local\25802580.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
4008"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
Modules
Images
c:\program files\common files\microsoft shared\equation\eqnedt32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
4040C:\Users\admin\AppData\Local\25802580.exeC:\Users\admin\AppData\Local\25802580.exe
25802580.exe
User:
admin
Company:
Adobe Inc.
Integrity Level:
MEDIUM
Description:
Adobe Dreamweaver CC 2019
Exit code:
0
Version:
19.0.0.11193
Modules
Images
c:\users\admin\appdata\local\25802580.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
743
Read events
651
Write events
84
Delete events
8

Modification events

(PID) Process:(2980) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:writeName:>30
Value:
3E333000A40B0000010000000000000000000000
(PID) Process:(2980) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
Off
(PID) Process:(2980) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
On
(PID) Process:(2980) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:WORDFiles
Value:
1301217301
(PID) Process:(2980) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:ProductFiles
Value:
1301217420
(PID) Process:(2980) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:ProductFiles
Value:
1301217421
(PID) Process:(2980) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word
Operation:writeName:MTTT
Value:
A40B00006C07B8AA1994D40100000000
(PID) Process:(2980) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:writeName:(40
Value:
28343000A40B000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000
(PID) Process:(2980) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:delete valueName:(40
Value:
28343000A40B000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000
(PID) Process:(2980) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
Executable files
2
Suspicious files
24
Text files
7
Unknown types
2

Dropped files

PID
Process
Filename
Type
2980WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR6B1E.tmp.cvr
MD5:
SHA256:
2980WINWORD.EXEC:\Users\admin\AppData\Local\Temp\{3AF89849-6A65-4918-8652-39916A41967A}
MD5:
SHA256:
2980WINWORD.EXEC:\Users\admin\AppData\Local\Temp\{D2626904-C7D7-490D-A07A-1AE5E36B9997}
MD5:
SHA256:
2980WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\C6609B35.doc
MD5:
SHA256:
2980WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\643EE80B.doc
MD5:
SHA256:
2980WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:
SHA256:
2980WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@u8f3e5jq[1].txttext
MD5:
SHA256:
2980WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSF-CTBL.FSFbinary
MD5:
SHA256:
2980WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-{492B5817-69DB-4A05-BE76-0C6CEC0D72DF}.FSDbinary
MD5:
SHA256:
2980WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSDbinary
MD5:
SHA256:
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
21
TCP/UDP connections
16
DNS requests
3
Threats
12

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2980
WINWORD.EXE
HEAD
200
104.27.135.189:80
http://gahtt9j6.u8f3e5jq.ru/CO%20&%20BL%20INV%20360.doc
US
malicious
2980
WINWORD.EXE
OPTIONS
200
104.27.135.189:80
http://gahtt9j6.u8f3e5jq.ru/
US
malicious
980
svchost.exe
OPTIONS
200
104.27.135.189:80
http://gahtt9j6.u8f3e5jq.ru/
US
malicious
2980
WINWORD.EXE
HEAD
200
104.27.135.189:80
http://gahtt9j6.u8f3e5jq.ru/CO%20&%20BL%20INV%20360.doc
US
malicious
2980
WINWORD.EXE
GET
304
104.27.135.189:80
http://gahtt9j6.u8f3e5jq.ru/CO%20&%20BL%20INV%20360.doc
US
malicious
2980
WINWORD.EXE
HEAD
200
104.27.135.189:80
http://gahtt9j6.u8f3e5jq.ru/CO%20&%20BL%20INV%20360.doc
US
malicious
2980
WINWORD.EXE
HEAD
200
104.27.135.189:80
http://gahtt9j6.u8f3e5jq.ru/CO%20&%20BL%20INV%20360.doc
US
malicious
2980
WINWORD.EXE
HEAD
200
104.27.135.189:80
http://gahtt9j6.u8f3e5jq.ru/CO%20&%20BL%20INV%20360.doc
US
malicious
2980
WINWORD.EXE
GET
304
104.27.135.189:80
http://gahtt9j6.u8f3e5jq.ru/CO%20&%20BL%20INV%20360.doc
US
malicious
980
svchost.exe
PROPFIND
405
104.27.135.189:80
http://gahtt9j6.u8f3e5jq.ru/
US
html
296 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4008
EQNEDT32.EXE
104.27.135.189:80
gahtt9j6.u8f3e5jq.ru
Cloudflare Inc
US
shared
980
svchost.exe
104.27.135.189:80
gahtt9j6.u8f3e5jq.ru
Cloudflare Inc
US
shared
2980
WINWORD.EXE
104.27.135.189:80
gahtt9j6.u8f3e5jq.ru
Cloudflare Inc
US
shared
4040
25802580.exe
151.80.147.153:53
OVH SAS
FR
malicious
4040
25802580.exe
91.217.137.44:53
Meganet-2003 LLC
RU
unknown
4040
25802580.exe
89.46.223.134:80
docusign.bit
Avolo Telecom Srl
RO
suspicious

DNS requests

Domain
IP
Reputation
gahtt9j6.u8f3e5jq.ru
  • 104.27.135.189
  • 104.27.134.189
malicious
docusign.bit
  • 89.46.223.134
malicious

Threats

PID
Process
Class
Message
2980
WINWORD.EXE
A Network Trojan was detected
SC TROJAN_DOWNLOADER Suspicious DOC loader of embedded OLE from external source
2980
WINWORD.EXE
A Network Trojan was detected
MALWARE [PTsecurity] Possible RTF CVE-2017-11882 document
4008
EQNEDT32.EXE
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
4008
EQNEDT32.EXE
A Network Trojan was detected
ET TROJAN Possible Windows executable sent when remote host claims to send a Text File
4040
25802580.exe
Potentially Bad Traffic
ET CURRENT_EVENTS DNS Query Domain .bit
4040
25802580.exe
Potentially Bad Traffic
ET CURRENT_EVENTS DNS Query Domain .bit
4040
25802580.exe
Potentially Bad Traffic
ET CURRENT_EVENTS DNS Query Domain .bit
4040
25802580.exe
Potentially Bad Traffic
ET CURRENT_EVENTS DNS Query Domain .bit
4040
25802580.exe
Potentially Bad Traffic
ET CURRENT_EVENTS DNS Query Domain .bit
4040
25802580.exe
Potentially Bad Traffic
ET CURRENT_EVENTS DNS Query Domain .bit
No debug info