| File name: | 스캔_760485632.doc |
| Full analysis: | https://app.any.run/tasks/32710656-d3d8-4e73-9a51-dc63207c095c |
| Verdict: | Malicious activity |
| Threats: | FlawedAmmmyy is a RAT type malware that can be used to perform actions remotely on an infected PC. This malware is well known for being featured in especially large campaigns with wide target demographics. |
| Analysis date: | August 08, 2019, 22:16:11 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/msword |
| File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1251, Title: nXNTA, Subject: bbQVqUW, Author: bPIPL, Template: Normal.dotm, Last Saved By: 1, Revision Number: 2, Name of Creating Application: Microsoft Office Word, Last Printed: Wed Feb 16 04:10:00 2005, Create Time/Date: Thu Aug 8 21:03:00 2019, Last Saved Time/Date: Thu Aug 8 21:03:00 2019, Number of Pages: 1, Number of Words: 0, Number of Characters: 3, Security: 0 |
| MD5: | 78B4F9AC80DEBC012D2A80435E2D48B7 |
| SHA1: | 4CB08B9F53A2DE1EE40D37A51D6BC0CD7D50010B |
| SHA256: | ADBAB063ABAFA6E3773274B2095B688A44B71A93A1DC16069C86B86730B0D6F7 |
| SSDEEP: | 1536:frkJ1Zgrde3Frs1s2c2j5cm2PJdAtiLHy2hSZwv4OAm/NlfVlR3A:fjcg6Ojx6MELHNAwvDNtRA |
MALICIOUS
Executable content was dropped or overwritten
- WINWORD.EXE (PID: 3268)
Loads the Task Scheduler DLL interface
- WINWORD.EXE (PID: 3268)
Connects to CnC server
- rundl32.exe (PID: 3652)
Loads dropped or rewritten executable
- WINWORD.EXE (PID: 3268)
Unusual execution from Microsoft Office
- WINWORD.EXE (PID: 3268)
FLAWEDAMMYY was detected
- rundl32.exe (PID: 3652)
Application was dropped or rewritten from another process
- rundl32.exe (PID: 3652)
SUSPICIOUS
Executed via COM
- iexplore.exe (PID: 3668)
Creates files in the Windows directory
- WINWORD.EXE (PID: 3268)
INFO
Changes internet zones settings
- iexplore.exe (PID: 3668)
Reads Microsoft Office registry keys
- WINWORD.EXE (PID: 3268)
Creates files in the user directory
- WINWORD.EXE (PID: 3268)
Reads Internet Cache Settings
- iexplore.exe (PID: 1364)
Application launched itself
- iexplore.exe (PID: 3668)
Reads internet explorer settings
- iexplore.exe (PID: 1364)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .doc | | | Microsoft Word document (54.2) |
|---|---|---|
| .doc | | | Microsoft Word document (old ver.) (32.2) |
EXIF
FlashPix
| Title: | nXNTA |
|---|---|
| Subject: | bbQVqUW |
| Author: | bPIPL |
| Keywords: | - |
| Comments: | - |
| Template: | Normal.dotm |
| LastModifiedBy: | 1 |
| RevisionNumber: | 2 |
| Software: | Microsoft Office Word |
| TotalEditTime: | - |
| LastPrinted: | 2005:02:16 04:10:00 |
| CreateDate: | 2019:08:08 20:03:00 |
| ModifyDate: | 2019:08:08 20:03:00 |
| Pages: | 1 |
| Words: | - |
| Characters: | 3 |
| Security: | None |
| Company: | - |
| Bytes: | 67079 |
| Lines: | 1 |
| Paragraphs: | 1 |
| CharCountWithSpaces: | 3 |
| AppVersion: | 16 |
| ScaleCrop: | No |
| LinksUpToDate: | No |
| SharedDoc: | No |
| HyperlinksChanged: | No |
| TitleOfParts: |
|
| HeadingPairs: |
|
| CodePage: | Windows Cyrillic |
| LjfdIpwTP: | Sr2SbJ=pC+1NRwoLJm-x.KrlM24 |
| QGIoGkkHXU: | c$_/:i%8_/v|AbV?haQgI%}E9q |
| Ppczxz: | +SgRuc6,&{Y#Gxi |
| GHyRtn: | Rt%%}G&I^H.nd)Y%OJO}]$;*d~a |
| RXHaEKDoxm: | WaY^FMjfOV-cL/y&!y:@vG-V |
| LUCqnpqkK: | }J}ZF,6UG{,siB._aQSMpld:2TV@su |
| PKYptMJE: | Z)RW|T(vIKA)0x!_Fb}_H/CmKkR |
| ABepT: | _D3Qgi9AE&,!jMxOc@~#L8SF |
| NbLmR: | ],]LHs-,=mgWTr |
| CompObjUserTypeLen: | 32 |
| CompObjUserType: | ???????? Microsoft Word 97-2003 |
Total processes
39
Monitored processes
4
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1364 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3668 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3268 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\스캔_760485632.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Exit code: 0 Version: 14.0.6024.1000 Modules
| |||||||||||||||
| 3652 | "C:\temp\rundl32.exe" | C:\temp\rundl32.exe | WINWORD.EXE | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 3668 | "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding | C:\Program Files\Internet Explorer\iexplore.exe | svchost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
1 168
Read events
1 004
Write events
158
Delete events
6
Modification events
| (PID) Process: | (3268) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
| Operation: | write | Name: | 0.? |
Value: 302E3F00C40C0000010000000000000000000000 | |||
| (PID) Process: | (3268) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1033 |
Value: Off | |||
| (PID) Process: | (3268) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1033 |
Value: On | |||
| (PID) Process: | (3268) WINWORD.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage |
| Operation: | write | Name: | WORDFiles |
Value: 1325924382 | |||
| (PID) Process: | (3268) WINWORD.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage |
| Operation: | write | Name: | ProductFiles |
Value: 1325924496 | |||
| (PID) Process: | (3268) WINWORD.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage |
| Operation: | write | Name: | ProductFiles |
Value: 1325924497 | |||
| (PID) Process: | (3268) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word |
| Operation: | write | Name: | MTTT |
Value: C40C0000342D61EB364ED50100000000 | |||
| (PID) Process: | (3268) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
| Operation: | write | Name: | i/? |
Value: 692F3F00C40C000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000 | |||
| (PID) Process: | (3268) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
| Operation: | delete value | Name: | i/? |
Value: 692F3F00C40C000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000 | |||
| (PID) Process: | (3268) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
Executable files
2
Suspicious files
7
Text files
6
Unknown types
8
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3268 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRE6B0.tmp.cvr | — | |
MD5:— | SHA256:— | |||
| 3668 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
| 3668 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
| 3268 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\Retract.dll | — | |
MD5:— | SHA256:— | |||
| 3268 | WINWORD.EXE | C:\temp\temp.tmp | — | |
MD5:— | SHA256:— | |||
| 3268 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~DFCE37FC9CEE86FA84.TMP | — | |
MD5:— | SHA256:— | |||
| 3268 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\output.pdf | binary | |
MD5:— | SHA256:— | |||
| 3268 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~DFF1D8600810DFAD77.TMP | — | |
MD5:— | SHA256:— | |||
| 3268 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\VBE\MSForms.exd | tlb | |
MD5:— | SHA256:— | |||
| 3268 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~DF61C0672E4C717F70.TMP | — | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
5
DNS requests
1
Threats
4
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1364 | iexplore.exe | GET | 200 | 92.38.135.99:80 | http://92.38.135.99/99.txt | RU | text | 781 Kb | suspicious |
3268 | WINWORD.EXE | GET | 200 | 92.38.135.99:80 | http://92.38.135.99/22.b | RU | binary | 688 Kb | suspicious |
3668 | iexplore.exe | GET | 404 | 92.38.135.99:80 | http://92.38.135.99/favicon.ico | RU | html | 189 b | suspicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3668 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
3652 | rundl32.exe | 160.119.253.219:80 | — | — | ZA | malicious |
1364 | iexplore.exe | 92.38.135.99:80 | — | — | RU | suspicious |
3268 | WINWORD.EXE | 92.38.135.99:80 | — | — | RU | suspicious |
3668 | iexplore.exe | 92.38.135.99:80 | — | — | RU | suspicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
www.bing.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
3652 | rundl32.exe | A Network Trojan was detected | MALWARE [PTsecurity] FlawedAmmyy.RAT |
3652 | rundl32.exe | A Network Trojan was detected | MALWARE [PTsecurity] AMMYY RAT |
3652 | rundl32.exe | A Network Trojan was detected | ET TROJAN Win32/FlawedAmmyy RAT CnC Checkin |
3652 | rundl32.exe | A Network Trojan was detected | MALWARE [PTsecurity] FlawedAmmyy.RAT Checkin |