File name:

Product Specication.7z

Full analysis: https://app.any.run/tasks/2de1435d-663f-4248-bd51-c9dc9da6f71d
Verdict: Malicious activity
Threats:

AZORult can steal banking information, including passwords and credit card details, as well as cryptocurrency. This constantly updated information stealer malware should not be taken lightly, as it continues to be an active threat.

Malware Trends Tracker     >>>
Analysis date: February 21, 2020, 16:18:01
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
exploit
cve-2017-11882
trojan
rat
azorult
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

C73022492EEE329BE73E111D77F2A684

SHA1:

523364B27A7EE1FBFB532ED0497F2065A6B8072A

SHA256:

9879E2D3E88E7438236E325035B28AE5D7EB01C33FB4E8E7B2D0BFD82CF39203

SSDEEP:

192:pcbkJA6HCW90Yeckpc3rPYU/h0iSq0Pfo1G39cGLOgFPHTf9ZIKC:qb43CWoK3rR/VSq0no5GBFPQF

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Suspicious connection from the Equation Editor

      • EQNEDT32.EXE (PID: 620)

    • Equation Editor starts application (CVE-2017-11882)

      • EQNEDT32.EXE (PID: 620)

    • Application was dropped or rewritten from another process

      • name.exe (PID: 3952)
      • name.exe (PID: 3840)
      • name.exe (PID: 3536)
      • name.exe (PID: 3424)
      • name.exe (PID: 2652)
      • name.exe (PID: 548)
      • name.exe (PID: 3588)
      • name.exe (PID: 2536)
      • name.exe (PID: 2064)
      • name.exe (PID: 2480)
      • name.exe (PID: 1296)
      • name.exe (PID: 1412)
      • name.exe (PID: 2840)
      • name.exe (PID: 3436)
      • name.exe (PID: 2848)
      • name.exe (PID: 1944)
      • name.exe (PID: 2696)
      • name.exe (PID: 1772)
      • name.exe (PID: 3484)
      • name.exe (PID: 3868)
      • name.exe (PID: 440)
      • name.exe (PID: 1860)

    • Connects to CnC server

      • name.exe (PID: 3424)
      • name.exe (PID: 3952)
      • name.exe (PID: 3536)
      • name.exe (PID: 548)
      • name.exe (PID: 2536)
      • name.exe (PID: 2064)
      • name.exe (PID: 3436)
      • name.exe (PID: 1412)
      • name.exe (PID: 2480)
      • name.exe (PID: 2840)
      • name.exe (PID: 1860)
      • name.exe (PID: 2848)
      • name.exe (PID: 1772)
      • name.exe (PID: 2696)
      • name.exe (PID: 3484)
      • name.exe (PID: 440)
      • name.exe (PID: 3868)

    • AZORULT was detected

      • name.exe (PID: 3424)
      • name.exe (PID: 3952)
      • name.exe (PID: 3536)
      • name.exe (PID: 548)
      • name.exe (PID: 2536)
      • name.exe (PID: 3436)
      • name.exe (PID: 2480)
      • name.exe (PID: 1412)
      • name.exe (PID: 2840)
      • name.exe (PID: 1860)
      • name.exe (PID: 2848)
      • name.exe (PID: 2696)
      • name.exe (PID: 2064)
      • name.exe (PID: 1772)
      • name.exe (PID: 3484)
      • name.exe (PID: 440)
      • name.exe (PID: 3868)

  • SUSPICIOUS

    • Application launched itself

      • name.exe (PID: 3840)

    • Reads Internet Cache Settings

      • name.exe (PID: 3952)
      • EQNEDT32.EXE (PID: 620)
      • name.exe (PID: 3536)
      • name.exe (PID: 548)
      • name.exe (PID: 3424)
      • name.exe (PID: 2064)
      • name.exe (PID: 2536)
      • name.exe (PID: 2480)
      • name.exe (PID: 1412)
      • name.exe (PID: 3436)
      • name.exe (PID: 1860)
      • name.exe (PID: 2848)
      • name.exe (PID: 1772)
      • name.exe (PID: 2696)
      • name.exe (PID: 3484)
      • name.exe (PID: 3868)
      • name.exe (PID: 440)
      • name.exe (PID: 2840)

    • Connects to server without host name

      • name.exe (PID: 3952)
      • name.exe (PID: 3536)
      • name.exe (PID: 3424)
      • name.exe (PID: 2536)
      • name.exe (PID: 548)
      • name.exe (PID: 2064)
      • name.exe (PID: 2480)
      • name.exe (PID: 1412)
      • name.exe (PID: 2840)
      • name.exe (PID: 3436)
      • name.exe (PID: 1860)
      • name.exe (PID: 2696)
      • name.exe (PID: 1772)
      • name.exe (PID: 3484)
      • name.exe (PID: 2848)
      • name.exe (PID: 3868)
      • name.exe (PID: 440)

    • Creates files in the user directory

      • EQNEDT32.EXE (PID: 620)

    • Executed via COM

      • EQNEDT32.EXE (PID: 620)

    • Executable content was dropped or overwritten

      • EQNEDT32.EXE (PID: 620)

  • INFO

    • Reads Microsoft Office registry keys

      • EXCEL.EXE (PID: 2636)

    • Manual execution by user

      • EXCEL.EXE (PID: 2636)

    • Creates files in the user directory

      • EXCEL.EXE (PID: 2636)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
62
Monitored processes
25
Malicious processes
19
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start winrar.exe no specs excel.exe no specs eqnedt32.exe name.exe no specs #AZORULT name.exe #AZORULT name.exe #AZORULT name.exe name.exe no specs name.exe no specs #AZORULT name.exe #AZORULT name.exe #AZORULT name.exe name.exe no specs #AZORULT name.exe #AZORULT name.exe #AZORULT name.exe #AZORULT name.exe #AZORULT name.exe name.exe no specs #AZORULT name.exe #AZORULT name.exe #AZORULT name.exe #AZORULT name.exe #AZORULT name.exe #AZORULT name.exe

Process information

PID
CMD
Path
Indicators
Parent process
440"C:\Users\admin\AppData\Roaming\name.exe"C:\Users\admin\AppData\Roaming\name.exe
name.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\name.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
548"C:\Users\admin\AppData\Roaming\name.exe"C:\Users\admin\AppData\Roaming\name.exe
name.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\name.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
620"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
Modules
Images
c:\program files\common files\microsoft shared\equation\eqnedt32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1296"C:\Users\admin\AppData\Roaming\name.exe"C:\Users\admin\AppData\Roaming\name.exe—name.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\name.exe
c:\systemroot\system32\ntdll.dll
1412"C:\Users\admin\AppData\Roaming\name.exe"C:\Users\admin\AppData\Roaming\name.exe
name.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\name.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1772"C:\Users\admin\AppData\Roaming\name.exe"C:\Users\admin\AppData\Roaming\name.exe
name.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\name.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1860"C:\Users\admin\AppData\Roaming\name.exe"C:\Users\admin\AppData\Roaming\name.exe
name.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\windows\system32\msxml3.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll
c:\program files\common files\microsoft shared\office14\msoshext.dll
c:\windows\system32\msxml6.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\program files\common files\microsoft shared\filters\offfiltx.dll
c:\users\admin\appdata\roaming\name.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
1944"C:\Users\admin\AppData\Roaming\name.exe"C:\Users\admin\AppData\Roaming\name.exe—name.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\name.exe
c:\systemroot\system32\ntdll.dll
2064"C:\Users\admin\AppData\Roaming\name.exe"C:\Users\admin\AppData\Roaming\name.exe
name.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\name.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2480"C:\Users\admin\AppData\Roaming\name.exe"C:\Users\admin\AppData\Roaming\name.exe
name.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\name.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
1 329
Read events
1 090
Write events
228
Delete events
11

Modification events

(PID) Process:(3492) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3492) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3492) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3492) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Product Specication.7z
(PID) Process:(3492) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3492) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3492) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3492) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3492) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(3492) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
Executable files
2
Suspicious files
0
Text files
3
Unknown types
1

Dropped files

PID
Process
Filename
Type
3492WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3492.40899\Product Specication.xlsx —
MD5:—
SHA256:—
2636EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVRABE8.tmp.cvr —
MD5:—
SHA256:—
2636EXCEL.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\Product Specication.xlsx.LNK —
MD5:—
SHA256:—
620EQNEDT32.EXEC:\Users\admin\AppData\Roaming\name.exeexecutable
MD5:—
SHA256:—
620EQNEDT32.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\bui[1].exeexecutable
MD5:—
SHA256:—
2636EXCEL.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dattext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
29
TCP/UDP connections
34
DNS requests
1
Threats
218

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3952
name.exe
POST
—
217.160.59.64:80
http://217.160.59.64/index.php
DE
—
—
malicious
3436
name.exe
POST
—
217.160.59.64:80
http://217.160.59.64/index.php
DE
—
—
malicious
2536
name.exe
POST
—
217.160.59.64:80
http://217.160.59.64/index.php
DE
—
—
malicious
2840
name.exe
POST
—
217.160.59.64:80
http://217.160.59.64/index.php
DE
—
—
malicious
3536
name.exe
POST
—
217.160.59.64:80
http://217.160.59.64/index.php
DE
—
—
malicious
3436
name.exe
POST
—
217.160.59.64:80
http://217.160.59.64/index.php
DE
—
—
malicious
2848
name.exe
POST
—
217.160.59.64:80
http://217.160.59.64/index.php
DE
—
—
malicious
2536
name.exe
POST
—
217.160.59.64:80
http://217.160.59.64/index.php
DE
—
—
malicious
548
name.exe
POST
—
217.160.59.64:80
http://217.160.59.64/index.php
DE
—
—
malicious
2840
name.exe
POST
—
217.160.59.64:80
http://217.160.59.64/index.php
DE
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
620
EQNEDT32.EXE
208.115.234.234:80
yogeshcycles.com
Limestone Networks, Inc.
US
malicious
3424
name.exe
217.160.59.64:80
—
1&1 Internet SE
DE
malicious
548
name.exe
217.160.59.64:80
—
1&1 Internet SE
DE
malicious
2064
name.exe
217.160.59.64:80
—
1&1 Internet SE
DE
malicious
2536
name.exe
217.160.59.64:80
—
1&1 Internet SE
DE
malicious
3536
name.exe
217.160.59.64:80
—
1&1 Internet SE
DE
malicious
3952
name.exe
217.160.59.64:80
—
1&1 Internet SE
DE
malicious
1860
name.exe
217.160.59.64:80
—
1&1 Internet SE
DE
malicious
3436
name.exe
217.160.59.64:80
—
1&1 Internet SE
DE
malicious
2848
name.exe
217.160.59.64:80
—
1&1 Internet SE
DE
malicious

DNS requests

Domain
IP
Reputation
yogeshcycles.com
  • 208.115.234.234
malicious

Threats

PID
Process
Class
Message
620
EQNEDT32.EXE
Potentially Bad Traffic
ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile
620
EQNEDT32.EXE
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3536
name.exe
A Network Trojan was detected
ET TROJAN AZORult Variant.4 Checkin M2
3536
name.exe
A Network Trojan was detected
ET TROJAN Win32/AZORult V3.2 Client Checkin M3
3536
name.exe
A Network Trojan was detected
AV TROJAN AZORult CnC Beacon
3536
name.exe
A Network Trojan was detected
STEALER [PTsecurity] AZORult
3536
name.exe
Potentially Bad Traffic
ET INFO GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1
3536
name.exe
A Network Trojan was detected
ET TROJAN AZORult Variant.4 Checkin M2
3536
name.exe
A Network Trojan was detected
ET TROJAN Win32/AZORult V3.2 Client Checkin M3
3536
name.exe
A Network Trojan was detected
AV TROJAN Azorult CnC Beacon
17 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Product Specication.7z