analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

New Supply Quotation Request P.O 206.doc

Full analysis: https://app.any.run/tasks/ae530b9c-fb00-4edf-b616-73f0a4e47c44
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: April 23, 2019, 12:15:52
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
opendir
exploit
CVE-2017-11882
loader
Indicators:
MIME: text/rtf
File info: Rich Text Format data, unknown version
MD5:

F4F2E9A8C0AE72A7CE8EF7D990C05B9F

SHA1:

8E0A620783433AFB402C4E086440D26B7D85320E

SHA256:

0E26E82CAF4F75FD72913001B90FEECFF6B80092FA21288961800B4AA7526F3B

SSDEEP:

96:eDoCoeeqJl8R+3zEY1a6mdrkpAeknuro+pKi+jpkoG1HhTVKMrE/z8M1ybSWGBH:kz8qFI/rrkpAfuroTicynKI8YMccH

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Equation Editor starts application (CVE-2017-11882)

      • EQNEDT32.EXE (PID: 968)

    • Known privilege escalation attack

      • gjyrtehr.com (PID: 1704)

    • Application was dropped or rewritten from another process

      • gjyrtehr.com (PID: 1704)
      • gjyrtehr.com (PID: 3252)

    • Downloads executable files from the Internet

      • EQNEDT32.EXE (PID: 968)

    • Writes to a start menu file

      • gjyrtehr.com (PID: 3252)

    • Actions looks like stealing of personal data

      • RegAsm.exe (PID: 1868)

  • SUSPICIOUS

    • Modifies the open verb of a shell class

      • gjyrtehr.com (PID: 1704)

    • Creates files in the user directory

      • EQNEDT32.EXE (PID: 968)
      • gjyrtehr.com (PID: 3252)

    • Starts application with an unusual extension

      • EQNEDT32.EXE (PID: 968)
      • eventvwr.exe (PID: 2904)

    • Executable content was dropped or overwritten

      • EQNEDT32.EXE (PID: 968)
      • gjyrtehr.com (PID: 3252)

    • Loads DLL from Mozilla Firefox

      • RegAsm.exe (PID: 1868)

  • INFO

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 3588)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 3588)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rtf | Rich Text Format (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
7
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start winword.exe no specs eqnedt32.exe gjyrtehr.com no specs eventvwr.exe no specs eventvwr.exe gjyrtehr.com regasm.exe

Process information

PID
CMD
Path
Indicators
Parent process
3588"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\New Supply Quotation Request P.O 206.doc.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
968"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
1704"C:\Users\admin\AppData\Roaming\gjyrtehr.com"C:\Users\admin\AppData\Roaming\gjyrtehr.com—EQNEDT32.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3632"C:\Windows\System32\eventvwr.exe" C:\Windows\System32\eventvwr.exe—gjyrtehr.com
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Event Viewer Snapin Launcher
Exit code:
3221226540
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2904"C:\Windows\System32\eventvwr.exe" C:\Windows\System32\eventvwr.exe
gjyrtehr.com
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Event Viewer Snapin Launcher
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3252"C:\Users\admin\AppData\Roaming\gjyrtehr.com" C:\Users\admin\AppData\Roaming\gjyrtehr.com
eventvwr.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
1868"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
gjyrtehr.com
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft .NET Assembly Registration Utility
Version:
2.0.50727.5420 (Win7SP1.050727-5400)
Total events
1 250
Read events
895
Write events
0
Delete events
0

Modification events

No data
Executable files
3
Suspicious files
0
Text files
3
Unknown types
2

Dropped files

PID
Process
Filename
Type
3588WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR6676.tmp.cvr —
MD5:—
SHA256:—
968EQNEDT32.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\SKO[1].exeexecutable
MD5:F1BB5A017E0C8FA7104B7C9D8D6EFFDC
SHA256:A3F6D949AED67B2D95CED9A8F7690695B1C40CFD314AB56CA15A958B670F9D2B
3252gjyrtehr.comC:\Users\admin\AppData\Local\Temp\.exeexecutable
MD5:62D9A09062FE7D47DAF92B9F734F513C
SHA256:83D92EBF16B41198F7332584860D809C2B64F7A4CA5F1276069438E3DCC30B74
968EQNEDT32.EXEC:\Users\admin\AppData\Roaming\gjyrtehr.comexecutable
MD5:F1BB5A017E0C8FA7104B7C9D8D6EFFDC
SHA256:A3F6D949AED67B2D95CED9A8F7690695B1C40CFD314AB56CA15A958B670F9D2B
3588WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:825C45DD10C96600B19CB23B108C989D
SHA256:7C821062FDC859ADBA6F62E919301188567AB7912FBA2458B8EC3C72FE0F88DB
3588WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$w Supply Quotation Request P.O 206.doc.rtfpgc
MD5:186C77BBD1F191FFFF410F367FB8BD6A
SHA256:CF925FC4098EFBDE482000B0DEFECEB680C1BC29AEF407EA8CFF0F42F9E56B41
3252gjyrtehr.comC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.urltext
MD5:9B57CB3C1774FD9984C5951B97B4BE6C
SHA256:457A9293AF8BEEA804BFE45A9B727C1192638F9FDC3929EB5E6A2D479369955F
3252gjyrtehr.comC:\Users\admin\AppData\Local\Temp\.vbstext
MD5:6859CCE77170C96B3B8F7E1920E90628
SHA256:D3FE744CEFEBB2553873CF68F40F70363F8D286342AA8C2716D4E6602B6E1091
1868RegAsm.exeC:\Windows\system32\drivers\etc\hoststext
MD5:6EB47C1CF858E25486E42440074917F2
SHA256:9B13A3EA948A1071A81787AAC1930B89E30DF22CE13F8FF751F31B5D83E79FFB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
2
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
968
EQNEDT32.EXE
GET
200
192.185.74.46:80
http://sialkotgoods.com/cgg/SKO.exe
US
executable
1.78 Mb
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1868
RegAsm.exe
208.91.199.225:587
smtp.neweiico.com
PDR
US
shared
968
EQNEDT32.EXE
192.185.74.46:80
sialkotgoods.com
CyrusOne LLC
US
suspicious

DNS requests

Domain
IP
Reputation
sialkotgoods.com
  • 192.185.74.46
suspicious
smtp.neweiico.com
  • 208.91.199.225
  • 208.91.198.143
  • 208.91.199.224
  • 208.91.199.223
malicious

Threats

PID
Process
Class
Message
968
EQNEDT32.EXE
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
New Supply Quotation Request P.O 206.doc