analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

purchase order.doc

Full analysis: https://app.any.run/tasks/7ea52ae3-0de7-4f25-bc3f-ccdfec22baa6
Verdict: Malicious activity
Threats:

Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.

Malware Trends Tracker     >>>
Analysis date: June 19, 2019, 03:16:48
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ole-embedded
evasion
trojan
rat
agenttesla
Indicators:
MIME: text/rtf
File info: Rich Text Format data, version 1, unknown character set
MD5:

B819877F4D1F3639902A3716C48E5994

SHA1:

82410483EAE34FC15F10CF1185E7B42787750518

SHA256:

24A6293BA60DBF92BC3391E24F9DBC78A8E2A1B8751C4A6333A19033E9522FAB

SSDEEP:

24576:pd6qlMEjK5+nmJdGMBHLCpVMkTYe/U0mn1pDkAE7EG2elVPGjOjrGv05SoFU:+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Runs app for hidden code execution

      • cmd.exe (PID: 1040)
      • cmd.exe (PID: 1572)

    • Starts CMD.EXE for commands execution

      • WINWORD.EXE (PID: 3932)

    • Unusual execution from Microsoft Office

      • WINWORD.EXE (PID: 3932)

    • Application was dropped or rewritten from another process

      • saver.scr (PID: 3900)
      • saver.scr (PID: 3308)

    • Actions looks like stealing of personal data

      • saver.scr (PID: 3308)

    • Changes settings of System certificates

      • saver.scr (PID: 3308)

    • AGENTTESLA was detected

      • saver.scr (PID: 3308)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 2324)
      • cmd.exe (PID: 1572)
      • cmd.exe (PID: 1040)
      • cmd.exe (PID: 2328)

    • Executable content was dropped or overwritten

      • cscript.exe (PID: 2172)

    • Executes scripts

      • cmd.exe (PID: 2328)

    • Uses REG.EXE to modify Windows registry

      • cmd.exe (PID: 3920)
      • cmd.exe (PID: 3120)
      • cmd.exe (PID: 2328)
      • cmd.exe (PID: 3100)
      • cmd.exe (PID: 1040)
      • cmd.exe (PID: 2600)
      • cmd.exe (PID: 3656)

    • Uses TASKKILL.EXE to kill Office Apps

      • cmd.exe (PID: 2328)

    • Application launched itself

      • cmd.exe (PID: 2328)
      • saver.scr (PID: 3900)

    • Starts application with an unusual extension

      • cmd.exe (PID: 2328)
      • saver.scr (PID: 3900)

    • Adds / modifies Windows certificates

      • saver.scr (PID: 3308)

    • Checks for external IP

      • saver.scr (PID: 3308)

    • Creates files in the user directory

      • notepad++.exe (PID: 944)

  • INFO

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 3932)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 3932)

    • Manual execution by user

      • explorer.exe (PID: 2484)
      • notepad++.exe (PID: 944)
      • NOTEPAD.EXE (PID: 3148)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rtf | Rich Text Format (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
80
Monitored processes
42
Malicious processes
6
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winword.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs timeout.exe no specs timeout.exe no specs timeout.exe no specs cmd.exe no specs timeout.exe no specs timeout.exe no specs cmd.exe no specs timeout.exe no specs timeout.exe no specs timeout.exe no specs timeout.exe no specs cscript.exe taskkill.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs saver.scr no specs cmd.exe no specs #AGENTTESLA saver.scr explorer.exe no specs notepad.exe no specs notepad++.exe gup.exe

Process information

PID
CMD
Path
Indicators
Parent process
3932"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\purchase order.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
1
Version:
14.0.6024.1000
1572"C:\Windows\System32\cmd.exe" /C CmD < "C:\Users\admin\AppData\Local\Temp\ufFm.cMD"C:\Windows\System32\cmd.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2324CmD C:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2328C:\Windows\system32\cmd.exe /K mt6nzqofd.CMDC:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2856TIMEOUT /T 1C:\Windows\system32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3084TIMEOUT /T 1 C:\Windows\system32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2180TIMEOUT /T 1 C:\Windows\system32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1040"C:\Windows\System32\cmd.exe" /C CmD < "C:\Users\admin\AppData\Local\Temp\ufFm.cMD"C:\Windows\System32\cmd.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
1892TIMEOUT /T 1 C:\Windows\system32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3144TIMEOUT /T 1 C:\Windows\system32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
1 288
Read events
1 205
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
3
Text files
15
Unknown types
4

Dropped files

PID
Process
Filename
Type
3932WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR42F8.tmp.cvr —
MD5:—
SHA256:—
2328cmd.exeC:\Users\admin\AppData\Local\Temp\_.vbstext
MD5:BF9646FA68CAE0CE69FBF7FFF70D65B5
SHA256:CC7DD8CF31F4634A109AC5A14931F8A4E55F528B36C40B0D109B9147B8E7C928
3932WINWORD.EXEC:\Users\admin\AppData\Local\Temp\kulebiaka.ZiPcompressed
MD5:2B5656B2F1626D9C406C325099EB89E3
SHA256:058A56FA1378E34E916E2F731466B24AAEC0BFF48AECA9F99A142FA431CCBF5C
2172cscript.exeC:\Users\admin\AppData\Local\Temp\saver.screxecutable
MD5:29FEC7816D483426CD55DE8714735D8C
SHA256:AF218E7B5A67091B7955C3CA4538EE49CB8E2A9B38D83E6F4B0443AACE856101
2172cscript.exeC:\Users\admin\AppData\Local\Temp\gondi.doctext
MD5:6291D5A22FCE652360616BD330E07082
SHA256:80AE0226822B684927280C63CA9F4E683C121FA62715E02909DECC298C03B506
3932WINWORD.EXEC:\Users\admin\AppData\Local\Temp\mt6nzqofd.cmdtext
MD5:B5B6D0CC5AE87D9B02585E5B3246C1A2
SHA256:15C6536DD7A47ADD995049F4E54D86F69F50BB20FE29B88B5AE809A888730A5E
3308saver.scrC:\Users\admin\AppData\Local\Temp\636965146553755000_8a35233a-b73f-4912-943d-d63da4467334.dbsqlite
MD5:0B3C43342CE2A99318AA0FE9E531C57B
SHA256:0CCB4915E00390685621DA3D75EBFD5EDADC94155A79C66415A7F4E9763D71B8
3932WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:B19FF5CEFD1DA5D0F2805A945B570C3C
SHA256:F75A592B67565D406D9D7F15EC8C276CD6D0D5E54AD5EF87413F565E44175FC9
3932WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{62D90A86-B78C-4F7A-BDE1-31C04A785FB9}.tmpbinary
MD5:2AE3D2C978E132C5C8142E99AD19407A
SHA256:8EAB0C94DAF2EB3E244968830785B88748FD9C3D141F4BF55A027293D248255F
3932WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$rchase order.docpgc
MD5:044F5E47F7834AF37E5A322E05D45A59
SHA256:48516477C16901A22B34B8AB9A9D2F1151D218867BE0F17C9C99F936277761CF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
4
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.16.186.35:80
http://isrg.trustid.ocsp.identrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D
unknown
der
1.37 Kb
whitelisted
3308
saver.scr
GET
200
34.233.102.38:80
http://checkip.amazonaws.com/
US
text
15 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
2.16.186.35:80
isrg.trustid.ocsp.identrust.com
Akamai International B.V.
—
whitelisted
3308
saver.scr
82.221.130.149:587
smtp.vivaldi.net
Thor Data Center ehf
IS
unknown
3308
saver.scr
34.233.102.38:80
checkip.amazonaws.com
Amazon.com, Inc.
US
shared
2776
gup.exe
37.59.28.236:443
notepad-plus-plus.org
OVH SAS
FR
whitelisted

DNS requests

Domain
IP
Reputation
smtp.vivaldi.net
  • 82.221.130.149
shared
notepad-plus-plus.org
  • 37.59.28.236
whitelisted
isrg.trustid.ocsp.identrust.com
  • 2.16.186.35
  • 2.16.186.11
whitelisted
checkip.amazonaws.com
  • 34.233.102.38
  • 52.6.79.229
  • 52.202.139.131
  • 52.200.125.74
  • 52.206.161.133
  • 18.211.215.84
shared

Threats

PID
Process
Class
Message
3308
saver.scr
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
3308
saver.scr
A Network Trojan was detected
MALWARE [PTsecurity] AgentTesla IP Check
2 ETPRO signatures available at the full report
Process
Message
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
42C4C5846BB675C74E2B2C90C69AB44366401093
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
purchase order.doc