analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

138d62f8ee7e4902ad23fe81e72a1f3b7ac860d3c1fd5889ed8b8236b51ba64b

Full analysis: https://app.any.run/tasks/6e907262-ab3d-4e08-8ccf-ba63aaf6a257
Verdict: Malicious activity
Analysis date: April 23, 2019, 16:49:09
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ole-embedded
generated-doc
exploit
CVE-2017-11882
Indicators:
MIME: text/rtf
File info: Rich Text Format data, version 1, unknown character set
MD5:

5AF6C9C49012DABD1468DCFA3F3E49A1

SHA1:

6F6D526287DD7DE10242BDF198D091A8035A5C5B

SHA256:

138D62F8EE7E4902AD23FE81E72A1F3B7AC860D3C1FD5889ED8B8236B51BA64B

SSDEEP:

12288:Q/4PzHsSm/x5XZMZtUvzwaFea9LcGlBqiNgTwa:u4LHsSm/xxz1FbL99Mwa

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • spoolsv.exe (PID: 2056)

    • Loads dropped or rewritten executable

      • spoolsv.exe (PID: 2056)

    • Equation Editor starts application (CVE-2017-11882)

      • EQNEDT32.EXE (PID: 1476)

    • Changes the autorun value in the registry

      • spoolsv.exe (PID: 2056)

  • SUSPICIOUS

    • Creates files in the user directory

      • EQNEDT32.EXE (PID: 4000)

    • Executable content was dropped or overwritten

      • EQNEDT32.EXE (PID: 4000)

  • INFO

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 916)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 916)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rtf | Rich Text Format (100)

EXIF

RTF

InternalVersionNumber: 85
CharactersWithSpaces: 2337
Characters: 1992
Words: 349
Pages: 6
TotalEditTime: -
RevisionNumber: 2
ModifyDate: 2017:12:08 06:29:00
CreateDate: 2017:12:08 06:29:00
LastModifiedBy: WINDOWS7
Author: information
Subject: .
Title: personal information
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
5
Malicious processes
1
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start winword.exe no specs eqnedt32.exe no specs eqnedt32.exe eqnedt32.exe no specs spoolsv.exe

Process information

PID
CMD
Path
Indicators
Parent process
916"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\138d62f8ee7e4902ad23fe81e72a1f3b7ac860d3c1fd5889ed8b8236b51ba64b.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
1476"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE—svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
4000"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
EQNEDT32.EXE
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
2328"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE—svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
2056"C:\Users\admin\AppData\Roaming\spoolsv.exe"C:\Users\admin\AppData\Roaming\spoolsv.exe
EQNEDT32.EXE
User:
admin
Company:
McAfee, Inc.
Integrity Level:
MEDIUM
Description:
VirusScan On-Demand Scan Task Properties
Exit code:
13184
Version:
8.8.0.777
Total events
1 144
Read events
747
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
2
Text files
0
Unknown types
2

Dropped files

PID
Process
Filename
Type
916WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR2F4A.tmp.cvr —
MD5:—
SHA256:—
4000EQNEDT32.EXEC:\Users\admin\AppData\Roaming\vsodscplbinary
MD5:C8D073323A9E287AB6461966D3269B8B
SHA256:B0F62BFD772AD67095D53E18ACFE1A9CE8A03004597D04526C41542BBEE6665E
916WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$8d62f8ee7e4902ad23fe81e72a1f3b7ac860d3c1fd5889ed8b8236b51ba64b.rtfpgc
MD5:C2AA2BE4579E9B8D9666BFF70FED74AE
SHA256:E384EABD617CF6EAA201B6DC980D8139E26E781D1881285F0212B91C48489F54
4000EQNEDT32.EXEC:\Users\admin\AppData\Roaming\spoolsv.exeexecutable
MD5:FA3C8D91EF4A8B245033DDB9AA3054A2
SHA256:59C467B1EFAD9BAD7E738C544B1B3A6BAA635E102AFCB6033B1150DA0595D809
916WINWORD.EXEC:\Users\admin\AppData\Local\Temp\8.tbinary
MD5:154C0A67A4E0F73624EC938CA35CB73E
SHA256:5C866FFC94071F8A674769C3FD2DEDCE4EB3E1F0EBCB1D615E2D7E6967BB05C3
916WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:9AA328F831C50DD9BBEFE2D9BC2194AD
SHA256:965B6A8A909D7CFA9EB1790958BDCACB88B5258F8EB535D32891D882224E44E2
4000EQNEDT32.EXEC:\Users\admin\AppData\Roaming\vsodscpl.dllexecutable
MD5:E82622E08BB27B63EA82DE8017B18079
SHA256:4F08F185FDB6240F269B6AADDBEDF16E327A6B053D0309A2840B0CBD539D615B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2056
spoolsv.exe
128.199.154.189:443
—
Digital Ocean, Inc.
SG
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
138d62f8ee7e4902ad23fe81e72a1f3b7ac860d3c1fd5889ed8b8236b51ba64b