analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

0487260f91615f3e71583c7785f7b7434bfabc869668518765cfd6f2d01c48d1

Full analysis: https://app.any.run/tasks/a9158cb8-d283-4de0-a08f-a1b7e1084792
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: December 14, 2018, 20:26:39
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
exploit
CVE-2017-11882
loader
rat
remcos
Indicators:
MIME: application/vnd.openxmlformats-officedocument.wordprocessingml.document
File info: Microsoft Word 2007+
MD5:

813BAF945EF513A1EEAB93C92EEA074E

SHA1:

35CFF9570439EF001D87D21FB34D35F477D3F1C1

SHA256:

0487260F91615F3E71583C7785F7B7434BFABC869668518765CFD6F2D01C48D1

SSDEEP:

192:hhbLdFOE8yMtWNT70mqQTnhr5OFQT1QAP55VzObFTB8GoA6azkWKmqJ:hhbLu/yMtiT9LOFQT1QADVzEdnAmqJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Suspicious connection from the Equation Editor

      • EQNEDT32.EXE (PID: 2396)

    • Equation Editor starts application (CVE-2017-11882)

      • EQNEDT32.EXE (PID: 2396)

    • Downloads executable files from the Internet

      • EQNEDT32.EXE (PID: 2396)

    • Application was dropped or rewritten from another process

      • WinSystem.exe (PID: 3412)
      • WinSystem.exe (PID: 3352)
      • WinSystem.exe (PID: 2280)
      • Windows Data Card.exe (PID: 3316)
      • Windows Data Card.exe (PID: 3820)
      • Windows Data Card.exe (PID: 3976)
      • WinSystem.exe (PID: 2284)
      • WinSystem.exe (PID: 3932)
      • WinSystem.exe (PID: 2588)
      • WinSystem.exe (PID: 348)
      • WinSystem.exe (PID: 3032)
      • WinSystem.exe (PID: 3128)
      • WinSystem.exe (PID: 3304)
      • WinSystem.exe (PID: 3704)
      • WinSystem.exe (PID: 3228)
      • WinSystem.exe (PID: 3528)
      • WinSystem.exe (PID: 2352)
      • WinSystem.exe (PID: 2404)
      • WinSystem.exe (PID: 2584)

    • Changes the autorun value in the registry

      • WinSystem.exe (PID: 3352)
      • Windows Data Card.exe (PID: 3820)

    • Runs PING.EXE for delay simulation

      • cmd.exe (PID: 2856)

    • REMCOS RAT was detected

      • Windows Data Card.exe (PID: 3820)

  • SUSPICIOUS

    • Unusual connect from Microsoft Office

      • WINWORD.EXE (PID: 2948)

    • Executable content was dropped or overwritten

      • EQNEDT32.EXE (PID: 2396)
      • WinSystem.exe (PID: 3352)

    • Creates files in the user directory

      • EQNEDT32.EXE (PID: 2396)
      • WinSystem.exe (PID: 3352)
      • Windows Data Card.exe (PID: 3820)

    • Application launched itself

      • WinSystem.exe (PID: 2280)
      • Windows Data Card.exe (PID: 3976)
      • WinSystem.exe (PID: 3412)
      • WinSystem.exe (PID: 2284)
      • WinSystem.exe (PID: 3932)
      • WinSystem.exe (PID: 348)
      • WinSystem.exe (PID: 3704)
      • WinSystem.exe (PID: 3128)
      • WinSystem.exe (PID: 3304)
      • WinSystem.exe (PID: 3528)
      • WinSystem.exe (PID: 2404)

    • Starts CMD.EXE for commands execution

      • WinSystem.exe (PID: 3352)

  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2948)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2948)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.docx | Word Microsoft Office Open XML Format document (52.2)
.zip | Open Packaging Conventions container (38.8)
.zip | ZIP compressed archive (8.8)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0002
ZipCompression: Deflated
ZipModifyDate: 2018:11:13 00:18:04
ZipCRC: 0x82872409
ZipCompressedSize: 358
ZipUncompressedSize: 1422
ZipFileName: [Content_Types].xml

XML

Template: dotm.dotm
TotalEditTime: 1 minute
Pages: 1
Words: 1
Characters: 7
Application: Microsoft Office Word
DocSecurity: None
Lines: 1
Paragraphs: 1
ScaleCrop: No
HeadingPairs:
  • Название
  • 1
TitlesOfParts: -
Company: SPecialiST RePack
LinksUpToDate: No
CharactersWithSpaces: 7
SharedDoc: No
HyperlinksChanged: No
AppVersion: 14
LastModifiedBy: Microsoft
RevisionNumber: 1
CreateDate: 2017:09:24 17:26:00Z
ModifyDate: 2017:09:24 17:27:00Z

XMP

Creator: Microsoft
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
54
Monitored processes
23
Malicious processes
15
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start winword.exe eqnedt32.exe winsystem.exe no specs winsystem.exe winsystem.exe no specs cmd.exe no specs ping.exe no specs windows data card.exe no specs #REMCOS windows data card.exe windows data card.exe no specs winsystem.exe no specs winsystem.exe no specs winsystem.exe no specs winsystem.exe no specs winsystem.exe no specs winsystem.exe no specs winsystem.exe no specs winsystem.exe no specs winsystem.exe no specs winsystem.exe no specs winsystem.exe no specs winsystem.exe no specs winsystem.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2948"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\0487260f91615f3e71583c7785f7b7434bfabc869668518765cfd6f2d01c48d1.docx"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
2396"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
2280"C:\Users\admin\AppData\Roaming\WinSystem.exe" C:\Users\admin\AppData\Roaming\WinSystem.exe—EQNEDT32.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3352"C:\Users\admin\AppData\Roaming\WinSystem.exe" C:\Users\admin\AppData\Roaming\WinSystem.exe
WinSystem.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3412"C:\Users\admin\AppData\Roaming\WinSystem.exe" 2 3352 1819171C:\Users\admin\AppData\Roaming\WinSystem.exe—WinSystem.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2856cmd /c ""C:\Users\admin\AppData\Local\Temp\install.bat" "C:\Windows\system32\cmd.exe—WinSystem.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
660PING 127.0.0.1 -n 2 C:\Windows\system32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3976"C:\Users\admin\AppData\Roaming\Windows Data Card\Windows Data Card.exe" C:\Users\admin\AppData\Roaming\Windows Data Card\Windows Data Card.exe—cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3820"C:\Users\admin\AppData\Roaming\Windows Data Card\Windows Data Card.exe" C:\Users\admin\AppData\Roaming\Windows Data Card\Windows Data Card.exe
Windows Data Card.exe
User:
admin
Integrity Level:
MEDIUM
3316"C:\Users\admin\AppData\Roaming\Windows Data Card\Windows Data Card.exe" 2 3820 1840343C:\Users\admin\AppData\Roaming\Windows Data Card\Windows Data Card.exe—Windows Data Card.exe
User:
admin
Integrity Level:
MEDIUM
Total events
2 099
Read events
1 703
Write events
0
Delete events
0

Modification events

No data
Executable files
3
Suspicious files
24
Text files
9
Unknown types
2

Dropped files

PID
Process
Filename
Type
2948WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR91D6.tmp.cvr —
MD5:—
SHA256:—
2948WINWORD.EXEC:\Users\admin\AppData\Local\Temp\{D702C08D-DE70-405D-994E-179584A4982E} —
MD5:—
SHA256:—
2948WINWORD.EXEC:\Users\admin\AppData\Local\Temp\{FFAB94D9-D4AC-40D3-951F-61D024A3BC41} —
MD5:—
SHA256:—
2948WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\897656EA.doc —
MD5:—
SHA256:—
2948WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$87260f91615f3e71583c7785f7b7434bfabc869668518765cfd6f2d01c48d1.docxpgc
MD5:6B3DAC1E628B575C1DD7BADE836A16D4
SHA256:633C7494E2EFB87ABD5AB0DE1076D882D66AB86380C8809023FC7AD6B64880DC
2948WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSDbinary
MD5:D3464DBE59611B0D480188B937C34FAE
SHA256:911636ECC994758FDD7074D4E2C033B97E52A089BFD01DF224B56C2A0D895C55
2948WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSF-CTBL.FSFbinary
MD5:2C1081FF1B981552BC400CB57EA8A348
SHA256:6A881FB4BC9F84CA178ADB2A56EBDC312130039C7F623AFBC972351E27E3D07A
2948WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-CNRY.FSDbinary
MD5:965995A05DCFD31E65F06B4D5C9C64CC
SHA256:39AD595A2C130C21E38BBA45C56626C7FD415F05B64A62BBC34315082279CCB5
2948WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-{B03BC8B5-2D5C-4681-80D7-91F36E91533D}.FSDbinary
MD5:E6CC14C259072A0CEAD9ACD0AA3F55E5
SHA256:10BF4BDE51E352D2C116737E6C7B16F9ED72BD0F7C8B3352FC7B331E47F6F468
2948WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:005A2B05EDDE3A4A241B0268C93E6A79
SHA256:CF94C9FE9D2BD053F3F1A26A3B8911624ECEA6DE2B3781EBF52A9A9AF30DA19B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
27
TCP/UDP connections
12
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2948
WINWORD.EXE
HEAD
200
64.32.6.209:80
http://microsoftservice.dynamic-dns.net/update/update.doc
US
—
—
malicious
2948
WINWORD.EXE
OPTIONS
200
64.32.6.209:80
http://microsoftservice.dynamic-dns.net/update/
US
—
—
malicious
2948
WINWORD.EXE
HEAD
200
64.32.6.209:80
http://microsoftservice.dynamic-dns.net/update/update.doc
US
—
—
malicious
2948
WINWORD.EXE
HEAD
200
64.32.6.209:80
http://microsoftservice.dynamic-dns.net/update/update.doc
US
—
—
malicious
2948
WINWORD.EXE
GET
304
64.32.6.209:80
http://microsoftservice.dynamic-dns.net/update/update.doc
US
—
—
malicious
976
svchost.exe
OPTIONS
200
64.32.6.209:80
http://microsoftservice.dynamic-dns.net/update/
US
html
255 b
malicious
976
svchost.exe
PROPFIND
301
64.32.6.209:80
http://microsoftservice.dynamic-dns.net/update
US
html
255 b
malicious
976
svchost.exe
PROPFIND
301
64.32.6.209:80
http://microsoftservice.dynamic-dns.net/update
US
html
255 b
malicious
976
svchost.exe
PROPFIND
405
64.32.6.209:80
http://microsoftservice.dynamic-dns.net/update/
US
html
243 b
malicious
976
svchost.exe
PROPFIND
405
64.32.6.209:80
http://microsoftservice.dynamic-dns.net/update/
US
html
243 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2396
EQNEDT32.EXE
64.32.6.209:80
microsoftservice.dynamic-dns.net
Sharktech
US
malicious
976
svchost.exe
64.32.6.209:80
microsoftservice.dynamic-dns.net
Sharktech
US
malicious
2948
WINWORD.EXE
64.32.6.209:80
microsoftservice.dynamic-dns.net
Sharktech
US
malicious
3820
Windows Data Card.exe
194.5.99.158:137
—
—
FR
malicious

DNS requests

Domain
IP
Reputation
microsoftservice.dynamic-dns.net
  • 64.32.6.209
malicious
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

PID
Process
Class
Message
2948
WINWORD.EXE
A Network Trojan was detected
SC TROJAN_DOWNLOADER Suspicious DOC loader of embedded OLE from external source
2948
WINWORD.EXE
A Network Trojan was detected
MALWARE [PTsecurity] Possible RTF CVE-2017-11882 document
2948
WINWORD.EXE
A Network Trojan was detected
MALWARE [PTsecurity] Possible RTF CVE-2017-11882 document
2396
EQNEDT32.EXE
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
27 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
0487260f91615f3e71583c7785f7b7434bfabc869668518765cfd6f2d01c48d1