analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

purchase.doc

Full analysis: https://app.any.run/tasks/74ca86cd-862d-47b9-a021-62858a0c11a6
Verdict: Malicious activity
Threats:

AZORult can steal banking information, including passwords and credit card details, as well as cryptocurrency. This constantly updated information stealer malware should not be taken lightly, as it continues to be an active threat.

Malware Trends Tracker     >>>
Analysis date: April 25, 2019, 14:48:04
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ole-embedded
exploit
CVE-2017-11882
trojan
rat
azorult
Indicators:
MIME: text/rtf
File info: Rich Text Format data, version 1, unknown character set
MD5:

8842B7217B824D86A4455E5F16F61489

SHA1:

0D0A14765B7B3992208F8E35038497AAE6978EA7

SHA256:

363F1E2D56C50BAFED197BC2E4542E2E41AD54A65A919AB5C8E78AFA5351724D

SSDEEP:

24576:VR1dSNls4SD8l3S8YBsSuumTetrkSM8E4DlOHzZ1zsKdOBNrZ8rz/4xv9OwXYSkV:E

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Equation Editor starts application (CVE-2017-11882)

      • EQNEDT32.EXE (PID: 3684)

    • Executable content was dropped or overwritten

      • WINWORD.EXE (PID: 3852)

    • Application was dropped or rewritten from another process

      • A.R (PID: 1360)
      • A.R (PID: 488)

    • Unusual execution from Microsoft Office

      • WINWORD.EXE (PID: 3852)

    • AZORULT was detected

      • A.R (PID: 488)

    • Connects to CnC server

      • A.R (PID: 488)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • EQNEDT32.EXE (PID: 3684)

    • Starts application with an unusual extension

      • CmD.exe (PID: 480)
      • A.R (PID: 1360)

    • Uses RUNDLL32.EXE to load library

      • WINWORD.EXE (PID: 3852)

    • Application launched itself

      • A.R (PID: 1360)

  • INFO

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 3852)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 3852)

    • Application was crashed

      • EQNEDT32.EXE (PID: 3684)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rtf | Rich Text Format (100)

EXIF

RTF

Author: wuyan
LastModifiedBy: wuyan
CreateDate: 2019:01:03 16:14:00
ModifyDate: 2019:01:03 16:34:00
RevisionNumber: 3
TotalEditTime: 1 minute
Pages: 1
Words: 4
Characters: 24
CharactersWithSpaces: 27
InternalVersionNumber: 57435
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
9
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winword.exe eqnedt32.exe cmd.exe no specs a.r no specs rundll32.exe no specs #AZORULT a.r rundll32.exe no specs rundll32.exe no specs mctadmin.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3852"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\purchase.doc.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
3684"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
480CmD /c %tMp%\A.RC:\Windows\system32\CmD.exe—EQNEDT32.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
1360C:\Users\admin\AppData\Local\Temp\A.RC:\Users\admin\AppData\Local\Temp\A.R—CmD.exe
User:
admin
Company:
APOSTO2
Integrity Level:
MEDIUM
Description:
Chinanta
Exit code:
0
Version:
1.05.0007
2528"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Local\Temp\A.RC:\Windows\system32\rundll32.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
488:\Users\admin\AppData\Local\Temp\A.RC:\Users\admin\AppData\Local\Temp\A.R
A.R
User:
admin
Company:
APOSTO2
Integrity Level:
MEDIUM
Description:
Chinanta
Version:
1.05.0007
2596"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Local\Temp\A.RC:\Windows\system32\rundll32.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1740"C:\Windows\System32\rundll32.exe" C:\Windows\System32\shell32.dll,Control_RunDLL C:\Windows\System32\intl.cplC:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2692C:\Windows\system32\mctadmin.exeC:\Windows\system32\mctadmin.exe—rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MCTAdmin
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
2 038
Read events
923
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
0
Text files
1
Unknown types
4

Dropped files

PID
Process
Filename
Type
3852WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR344C.tmp.cvr —
MD5:—
SHA256:—
3852WINWORD.EXEC:\Users\admin\AppData\Local\Temp\A.Rexecutable
MD5:38ED9A09A746D5C4105F1944B6F23271
SHA256:C9258176D4F37C43BEB2A82A5D8F549745493BB1F96CE3F4FC0660433F940A18
3852WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\6790245B.wmfwmf
MD5:09F2855474160D0316C0A6DCE964891F
SHA256:7E7898B55CDCAE3832AED430C5118CBC17958DFF9C4DF18A21AB1AB43ED22843
3852WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\592AE942.emfemf
MD5:F7961E44FE51CEEE06391905162E18E0
SHA256:DCD5C765BCCFAC9339A8985357B391A3FAC1AE571AC0E5A971938573742F306D
3852WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$rchase.doc.rtfpgc
MD5:432987802C3891B8B219415B34A52BF7
SHA256:A6C934B3AA0084564903CC14A383E9E94C9B0E5F7BE0986148643FEA029BDBD5
3852WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:E0A6D871DF9AF8A843020CC2FC70CA4E
SHA256:33FAFDD37700ECE853AC83901FBEAB68A9A8E725B6B27DF6C65EDBF64767BE47
3852WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lextext
MD5:F3B25701FE362EC84616A93A45CE9998
SHA256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
488
A.R
POST
—
194.87.239.100:80
http://uzoeze.online/index.php
RU
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
488
A.R
194.87.239.100:80
uzoeze.online
JSC Mediasoft ekspert
RU
malicious

DNS requests

Domain
IP
Reputation
uzoeze.online
  • 194.87.239.100
malicious

Threats

PID
Process
Class
Message
488
A.R
A Network Trojan was detected
MALWARE [PTsecurity] AZORult.Stealer HTTP Header
488
A.R
A Network Trojan was detected
MALWARE [PTsecurity] AZORult Request
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
purchase.doc