analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

138d62f8ee7e4902ad23fe81e72a1f3b7ac860d3c1fd5889ed8b8236b51ba64b

Full analysis: https://app.any.run/tasks/b8d8dbfa-f980-4932-8548-bf7fa6fc07de
Verdict: Malicious activity
Analysis date: April 23, 2019, 16:40:05
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ole-embedded
generated-doc
exploit
CVE-2017-11882
Indicators:
MIME: text/rtf
File info: Rich Text Format data, version 1, unknown character set
MD5:

5AF6C9C49012DABD1468DCFA3F3E49A1

SHA1:

6F6D526287DD7DE10242BDF198D091A8035A5C5B

SHA256:

138D62F8EE7E4902AD23FE81E72A1F3B7AC860D3C1FD5889ED8B8236B51BA64B

SSDEEP:

12288:Q/4PzHsSm/x5XZMZtUvzwaFea9LcGlBqiNgTwa:u4LHsSm/xxz1FbL99Mwa

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Equation Editor starts application (CVE-2017-11882)

      • EQNEDT32.EXE (PID: 4092)

    • Application was dropped or rewritten from another process

      • spoolsv.exe (PID: 3576)

    • Changes the autorun value in the registry

      • spoolsv.exe (PID: 3576)

    • Loads dropped or rewritten executable

      • spoolsv.exe (PID: 3576)

  • SUSPICIOUS

    • Application launched itself

      • EQNEDT32.EXE (PID: 4092)

    • Creates files in the user directory

      • EQNEDT32.EXE (PID: 4004)

    • Executable content was dropped or overwritten

      • EQNEDT32.EXE (PID: 4004)

  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2172)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2172)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rtf | Rich Text Format (100)

EXIF

RTF

Title: personal information
Subject: .
Author: information
LastModifiedBy: WINDOWS7
CreateDate: 2017:12:08 06:29:00
ModifyDate: 2017:12:08 06:29:00
RevisionNumber: 2
TotalEditTime: -
Pages: 6
Words: 349
Characters: 1992
CharactersWithSpaces: 2337
InternalVersionNumber: 85
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
5
Malicious processes
1
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start winword.exe no specs eqnedt32.exe no specs eqnedt32.exe eqnedt32.exe no specs spoolsv.exe

Process information

PID
CMD
Path
Indicators
Parent process
2172"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\138d62f8ee7e4902ad23fe81e72a1f3b7ac860d3c1fd5889ed8b8236b51ba64b.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
4092"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE—svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
4004"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
EQNEDT32.EXE
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
2328"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE—svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
3576"C:\Users\admin\AppData\Roaming\spoolsv.exe"C:\Users\admin\AppData\Roaming\spoolsv.exe
EQNEDT32.EXE
User:
admin
Company:
McAfee, Inc.
Integrity Level:
MEDIUM
Description:
VirusScan On-Demand Scan Task Properties
Exit code:
13184
Version:
8.8.0.777
Total events
1 143
Read events
746
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
2
Text files
0
Unknown types
2

Dropped files

PID
Process
Filename
Type
2172WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR2EED.tmp.cvr —
MD5:—
SHA256:—
4004EQNEDT32.EXEC:\Users\admin\AppData\Roaming\vsodscplbinary
MD5:C8D073323A9E287AB6461966D3269B8B
SHA256:B0F62BFD772AD67095D53E18ACFE1A9CE8A03004597D04526C41542BBEE6665E
2172WINWORD.EXEC:\Users\admin\AppData\Local\Temp\8.tbinary
MD5:154C0A67A4E0F73624EC938CA35CB73E
SHA256:5C866FFC94071F8A674769C3FD2DEDCE4EB3E1F0EBCB1D615E2D7E6967BB05C3
4004EQNEDT32.EXEC:\Users\admin\AppData\Roaming\vsodscpl.dllexecutable
MD5:E82622E08BB27B63EA82DE8017B18079
SHA256:4F08F185FDB6240F269B6AADDBEDF16E327A6B053D0309A2840B0CBD539D615B
4004EQNEDT32.EXEC:\Users\admin\AppData\Roaming\spoolsv.exeexecutable
MD5:FA3C8D91EF4A8B245033DDB9AA3054A2
SHA256:59C467B1EFAD9BAD7E738C544B1B3A6BAA635E102AFCB6033B1150DA0595D809
2172WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$8d62f8ee7e4902ad23fe81e72a1f3b7ac860d3c1fd5889ed8b8236b51ba64b.rtfpgc
MD5:2D952CDC4D3C799DF40B2DEE83DCFFE4
SHA256:8A91BF80F4730C207DF4E259F0BBC31C3ABDE52EC127B1ECBCB224356CC6BA1D
2172WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:9AA328F831C50DD9BBEFE2D9BC2194AD
SHA256:965B6A8A909D7CFA9EB1790958BDCACB88B5258F8EB535D32891D882224E44E2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3576
spoolsv.exe
128.199.154.189:443
—
Digital Ocean, Inc.
SG
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
138d62f8ee7e4902ad23fe81e72a1f3b7ac860d3c1fd5889ed8b8236b51ba64b