| File name: | OA # 2300133094.doc |
| Full analysis: | https://app.any.run/tasks/6127b48f-22d3-4839-a657-5e6e437f2f27 |
| Verdict: | Malicious activity |
| Threats: | NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins which allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website. |
| Analysis date: | February 19, 2019, 08:57:54 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | text/rtf |
| File info: | Rich Text Format data, version 1, unknown character set |
| MD5: | D3E22BE77D0C059D9492914CF1AB5137 |
| SHA1: | 4A7A4BD8DF8F3BA23C6DCCF3858B52B888EFD39D |
| SHA256: | 1B906236A6841582CC5D9DA95F1F8C4EC2C2FD6DDDAE7C5D5426C5C7C82FA015 |
| SSDEEP: | 24576:jakyUbuCyde71rrHWuzrR9ozXR6mawNDQ2k3dfZkm/cw7f:Z |
MALICIOUS
Runs app for hidden code execution
- cmd.exe (PID: 3444)
- cmd.exe (PID: 2708)
Unusual execution from Microsoft Office
- WINWORD.EXE (PID: 3104)
Executable content was dropped or overwritten
- WINWORD.EXE (PID: 3104)
Starts CMD.EXE for commands execution
- WINWORD.EXE (PID: 3104)
Application was dropped or rewritten from another process
- mondi.exe (PID: 3676)
- RegAsm.exe (PID: 3388)
Equation Editor starts application (CVE-2017-11882)
- EQNEDT32.EXE (PID: 3320)
NanoCore was detected
- RegAsm.exe (PID: 3388)
Changes the autorun value in the registry
- RegAsm.exe (PID: 3388)
SUSPICIOUS
Starts CMD.EXE for commands execution
- cmd.exe (PID: 3912)
- cmd.exe (PID: 3444)
- cmd.exe (PID: 2708)
- EQNEDT32.EXE (PID: 3320)
- cmd.exe (PID: 1328)
Application launched itself
- cmd.exe (PID: 3444)
- cmd.exe (PID: 1328)
Uses TASKKILL.EXE to kill Office Apps
- cmd.exe (PID: 1328)
Uses REG.EXE to modify Windows registry
- cmd.exe (PID: 1328)
- cmd.exe (PID: 2136)
- cmd.exe (PID: 3140)
- cmd.exe (PID: 3824)
- cmd.exe (PID: 3688)
- cmd.exe (PID: 3132)
- cmd.exe (PID: 2112)
Executable content was dropped or overwritten
- RegAsm.exe (PID: 3388)
Creates files in the user directory
- RegAsm.exe (PID: 3388)
Connects to unusual port
- RegAsm.exe (PID: 3388)
INFO
Reads Microsoft Office registry keys
- WINWORD.EXE (PID: 3104)
Creates files in the user directory
- WINWORD.EXE (PID: 3104)
Application was crashed
- EQNEDT32.EXE (PID: 3320)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .rtf | | | Rich Text Format (100) |
|---|
Total processes
66
Monitored processes
30
Malicious processes
7
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1328 | C:\Windows\system32\cmd.exe /K C:\Users\admin\AppData\Local\Temp\hondi.cmd | C:\Windows\system32\cmd.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2112 | C:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\12.0\Word\File MRU" /v "Item 1" | C:\Windows\system32\cmd.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2116 | reg delete HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Resiliency /f | C:\Windows\system32\reg.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Registry Console Tool Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2136 | C:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\14.0\Word\File MRU" /v "Item 1" | C:\Windows\system32\cmd.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2256 | REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\File MRU" /v "Item 1" | C:\Windows\system32\reg.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Registry Console Tool Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2308 | REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Word\File MRU" /v "Item 1" | C:\Windows\system32\reg.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Registry Console Tool Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2328 | REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\12.0\Word\File MRU" /v "Item 1" | C:\Windows\system32\reg.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Registry Console Tool Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2384 | REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\14.0\Word\File MRU" /v "Item 1" | C:\Windows\system32\reg.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Registry Console Tool Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2472 | reg delete HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\11.0\Word\Resiliency /f | C:\Windows\system32\reg.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Registry Console Tool Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2708 | "C:\Windows\System32\cmd.exe" /C CmD < "C:\Users\admin\AppData\Local\Temp\dqfm.cMd" | C:\Windows\System32\cmd.exe | — | WINWORD.EXE | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
Total events
672
Read events
648
Write events
21
Delete events
3
Modification events
| (PID) Process: | (3104) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
| Operation: | write | Name: | x2% |
Value: 78322500200C0000010000000000000000000000 | |||
| (PID) Process: | (3104) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1033 |
Value: Off | |||
| (PID) Process: | (3104) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1033 |
Value: On | |||
| (PID) Process: | (3104) WINWORD.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage |
| Operation: | write | Name: | WORDFiles |
Value: 1314062366 | |||
| (PID) Process: | (3104) WINWORD.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage |
| Operation: | write | Name: | ProductFiles |
Value: 1314062480 | |||
| (PID) Process: | (3104) WINWORD.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage |
| Operation: | write | Name: | ProductFiles |
Value: 1314062481 | |||
| (PID) Process: | (3104) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word |
| Operation: | write | Name: | MTTT |
Value: 200C00000A50994131C8D40100000000 | |||
| (PID) Process: | (3104) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
| Operation: | write | Name: | f5% |
Value: 66352500200C000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000 | |||
| (PID) Process: | (3104) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
| Operation: | delete value | Name: | f5% |
Value: 66352500200C000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000 | |||
| (PID) Process: | (3104) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
Executable files
2
Suspicious files
2
Text files
4
Unknown types
3
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3104 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR8EE8.tmp.cvr | — | |
MD5:— | SHA256:— | |||
| 3104 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:— | SHA256:— | |||
| 3104 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\gondi.doc | document | |
MD5:— | SHA256:— | |||
| 3104 | WINWORD.EXE | C:\Users\admin\Desktop\~$ # 2300133094.doc.rtf | pgc | |
MD5:— | SHA256:— | |||
| 3104 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\mondi.exe | executable | |
MD5:— | SHA256:— | |||
| 3104 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\dqfm.cmd | text | |
MD5:— | SHA256:— | |||
| 3388 | RegAsm.exe | C:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\run.dat | text | |
MD5:— | SHA256:— | |||
| 3104 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\hondi.cmd | text | |
MD5:— | SHA256:— | |||
| 3104 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{A85022E4-5CE6-43E2-A082-59ABE869B77F}.tmp | binary | |
MD5:— | SHA256:— | |||
| 3104 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{06589D78-8E02-40CD-82FE-80A004766545}.tmp | smt | |
MD5:5D4D94EE7E06BBB0AF9584119797B23A | SHA256:4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
9
DNS requests
0
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3388 | RegAsm.exe | 185.244.30.97:1989 | — | — | — | malicious |
DNS requests
Threats
Process | Message |
|---|---|
mondi.exe | User32.dll |
mondi.exe | User32.dll |
mondi.exe | User32.dll |
mondi.exe | User32.dll |
mondi.exe | User32.dll |
mondi.exe | User32.dll |
mondi.exe | User32.dll |
mondi.exe | User32.dll |
mondi.exe | User32.dll |
mondi.exe | User32.dll |