analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

order.doc

Full analysis: https://app.any.run/tasks/6d2caf88-88cf-4d70-8de3-9c320eba18f3
Verdict: Malicious activity
Threats:

AZORult can steal banking information, including passwords and credit card details, as well as cryptocurrency. This constantly updated information stealer malware should not be taken lightly, as it continues to be an active threat.

Malware Trends Tracker     >>>
Analysis date: February 18, 2019, 10:51:45
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ole-embedded
exploit
CVE-2017-11882
trojan
rat
azorult
Indicators:
MIME: text/rtf
File info: Rich Text Format data, version 1, unknown character set
MD5:

204F313CF88526490A67EB7A3E54AE77

SHA1:

B2068690C68DAC5EEA288432D415C67880741C80

SHA256:

30AB5E0A25585E79B81B640495756F669F78D6AECC6775D50556A7F9FE39AE85

SSDEEP:

6144:H3fz10gpuACdj9zcgxwPpbhQ96G0l5dZu+cVICyhq0AbJtSgS4/4kMjccc7cccA0:HvzylRj9zgbs60dVvylAbPSg1Qfg6

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executable content was dropped or overwritten

      • WINWORD.EXE (PID: 3096)

    • Equation Editor starts application (CVE-2017-11882)

      • EQNEDT32.EXE (PID: 2748)

    • Application was dropped or rewritten from another process

      • A.R (PID: 3920)

    • Connects to CnC server

      • A.R (PID: 3920)

    • AZORULT was detected

      • A.R (PID: 3920)

    • Actions looks like stealing of personal data

      • A.R (PID: 3920)

    • Loads dropped or rewritten executable

      • A.R (PID: 3920)

  • SUSPICIOUS

    • Starts application with an unusual extension

      • CmD.exe (PID: 3452)

    • Starts CMD.EXE for commands execution

      • EQNEDT32.EXE (PID: 2748)
      • A.R (PID: 3920)

    • Reads the cookies of Google Chrome

      • A.R (PID: 3920)

    • Executable content was dropped or overwritten

      • A.R (PID: 3920)

    • Reads the cookies of Mozilla Firefox

      • A.R (PID: 3920)

  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 3096)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 3096)

    • Application was crashed

      • EQNEDT32.EXE (PID: 2748)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rtf | Rich Text Format (100)

EXIF

RTF

Author: wuyan
LastModifiedBy: wuyan
CreateDate: 2019:01:03 16:14:00
ModifyDate: 2019:01:03 16:34:00
RevisionNumber: 3
TotalEditTime: 1 minute
Pages: 1
Words: 4
Characters: 24
CharactersWithSpaces: 27
InternalVersionNumber: 57435
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
6
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winword.exe eqnedt32.exe cmd.exe no specs #AZORULT a.r cmd.exe no specs timeout.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3096"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\order.doc.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
2748"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
3452CmD /c %tMp%\A.RC:\Windows\system32\CmD.exe—EQNEDT32.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3920C:\Users\admin\AppData\Local\Temp\A.RC:\Users\admin\AppData\Local\Temp\A.R
CmD.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3124"C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "A.R"C:\Windows\system32\cmd.exe—A.R
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2136C:\Windows\system32\timeout.exe 3 C:\Windows\system32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
1 303
Read events
623
Write events
0
Delete events
0

Modification events

No data
Executable files
49
Suspicious files
0
Text files
2
Unknown types
5

Dropped files

PID
Process
Filename
Type
3096WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR704E.tmp.cvr —
MD5:—
SHA256:—
3096WINWORD.EXEC:\Users\admin\AppData\Local\Temp\A.Rexecutable
MD5:18B3331CF6775FE5ABD41B0D2FE96D6B
SHA256:A1D507F6D0E3DB713C9296ACE54954225F017FE8B219BA4CA330BA45C604EFC2
3096WINWORD.EXEC:\Users\admin\Desktop\~$der.doc.rtfpgc
MD5:ED328F84FA5B103F8FA87D0E358B2062
SHA256:0DBB84FBC74ADFD0A46C476007F1683E9D1A173DCEC6BC87E290D429C42BC423
3096WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:AAECCC94E3ECDA32925DF38101B107AE
SHA256:6098494583438F2C06D94E99F7A7D02D962683B62FA41223DC27CFA126DDFF9E
3096WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\order.doc.rtf.LNKlnk
MD5:0D19A14DCCBFBBB0A093EA8CEBFD79EB
SHA256:3C87860A82009C6C9BA5C7CFB7F5848F97887E6B798C9E9D6B198035BE2CB4C5
3096WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\C0F97A17.emfemf
MD5:F7961E44FE51CEEE06391905162E18E0
SHA256:DCD5C765BCCFAC9339A8985357B391A3FAC1AE571AC0E5A971938573742F306D
3920A.RC:\Users\admin\AppData\Local\Temp\9622D276\api-ms-win-core-console-l1-1-0.dllexecutable
MD5:502263C56F931DF8440D7FD2FA7B7C00
SHA256:94A5DF1227818EDBFD0D5091C6A48F86B4117C38550343F780C604EEE1CD6231
3096WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.datini
MD5:2B556FD5ECC16E7290B34AD8247CA496
SHA256:DB672C955C0E9C03F75521432B01AA2DFBB9B24FECD9388612C38559CCE4CEDC
3920A.RC:\Users\admin\AppData\Local\Temp\9622D276\api-ms-win-core-handle-l1-1-0.dllexecutable
MD5:6DB54065B33861967B491DD1C8FD8595
SHA256:945CC64EE04B1964C1F9FCDC3124DD83973D332F5CFB696CDF128CA5C4CBD0E5
3920A.RC:\Users\admin\AppData\Local\Temp\9622D276\api-ms-win-core-namedpipe-l1-1-0.dllexecutable
MD5:6F6796D1278670CCE6E2D85199623E27
SHA256:C4F60F911068AB6D7F578D449BA7B5B9969F08FC683FD0CE8E2705BBF061F507
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
2
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3920
A.R
POST
200
185.62.103.118:80
http://adaeze.xyz/index.php
RU
text
2 b
malicious
3920
A.R
POST
200
185.62.103.118:80
http://adaeze.xyz/index.php
RU
binary
4.27 Mb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3920
A.R
185.62.103.118:80
adaeze.xyz
Start LLC
RU
malicious

DNS requests

Domain
IP
Reputation
adaeze.xyz
  • 185.62.103.118
malicious

Threats

PID
Process
Class
Message
3920
A.R
A Network Trojan was detected
MALWARE [PTsecurity] AZORult HTTP Header
3920
A.R
A Network Trojan was detected
MALWARE [PTsecurity] AZORult Request
3920
A.R
A Network Trojan was detected
MALWARE [PTsecurity] AZORult Response
3920
A.R
A Network Trojan was detected
MALWARE [PTsecurity] AZORult HTTP Header
3920
A.R
A Network Trojan was detected
ET TROJAN Generic - POST To .php w/Extended ASCII Characters (Likely Zeus Derivative)
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
order.doc