analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

sample.rtf

Full analysis: https://app.any.run/tasks/e7946656-33c7-4cdf-a655-ea6cc682772b
Verdict: Malicious activity
Analysis date: September 11, 2019, 09:33:59
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
generated-doc
ole-embedded
Indicators:
MIME: text/rtf
File info: Rich Text Format data, version 1, unknown character set
MD5:

5E8F773B77D1D8595E977F62AAB17613

SHA1:

898F966769C0ADE31C6FB9E4431A3F2A69A81382

SHA256:

25691A8345051DD841F7F2F74624B9AC13D175676DDAA441A795817DBCADBF8A

SSDEEP:

12288:M6RoIsVvaXpwG6XtwLrFl3xcco8kD6RoIsVvaXpwG6XtwLrFl3xcco8kLVf1tmYy:CGpw1MPA8k7Gpw1MPA8kLt1tzoN2M

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executable content was dropped or overwritten

      • WINWORD.EXE (PID: 3820)

    • Starts CMD.EXE for commands execution

      • WINWORD.EXE (PID: 3820)

    • Unusual execution from Microsoft Office

      • WINWORD.EXE (PID: 3820)

    • Loads the Task Scheduler DLL interface

      • NMI0Y9HRR0LF0YV.exe (PID: 3472)

    • Application was dropped or rewritten from another process

      • NMI0Y9HRR0LF0YV.exe (PID: 3472)
      • NMI0Y9HRR0LF0YV.exe (PID: 4060)
      • NMI0Y9HRR0LF0YV.exe (PID: 3512)

  • SUSPICIOUS

    • Uses REG.EXE to modify Windows registry

      • cmd.exe (PID: 2352)
      • cmd.exe (PID: 3732)
      • cmd.exe (PID: 3460)
      • cmd.exe (PID: 2796)
      • cmd.exe (PID: 324)
      • cmd.exe (PID: 2444)
      • cmd.exe (PID: 2788)
      • cmd.exe (PID: 2780)
      • cmd.exe (PID: 2444)

    • Application launched itself

      • cmd.exe (PID: 3724)
      • cmd.exe (PID: 2352)

    • Uses TASKKILL.EXE to kill Office Apps

      • cmd.exe (PID: 2352)

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 2352)
      • cmd.exe (PID: 3724)
      • NMI0Y9HRR0LF0YV.exe (PID: 3472)

    • Executable content was dropped or overwritten

      • NMI0Y9HRR0LF0YV.exe (PID: 3472)
      • cmd.exe (PID: 2352)
      • cmd.exe (PID: 2368)

    • Creates files in the user directory

      • NMI0Y9HRR0LF0YV.exe (PID: 3472)
      • cmd.exe (PID: 2352)
      • cmd.exe (PID: 2368)

    • Creates files in the Windows directory

      • NMI0Y9HRR0LF0YV.exe (PID: 3472)

  • INFO

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 3820)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 3820)

    • Dropped object may contain Bitcoin addresses

      • WINWORD.EXE (PID: 3820)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rtf | Rich Text Format (100)

EXIF

RTF

InternalVersionNumber: 57433
CharactersWithSpaces: 1396
Characters: 1190
Words: 208
Pages: 2
TotalEditTime: -
RevisionNumber: 2
ModifyDate: 2018:09:04 14:21:00
CreateDate: 2018:09:04 14:21:00
LastModifiedBy: Windows Óû§
Author: Windows Óû§
Title: ÔÚ2009¼¶ÐÂÉú¾üѵ×ܽá±íÕÃôß¿ªÑ§µäÀñÉϵĽ²»°£¨Ö®¶þ£© ¡ª¡ªÎ侯ºþ±±×ܶÓÒ»Ö§¶ÓÖ¸µ¼Ô±»ÆÖÇ
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
69
Monitored processes
34
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start winword.exe cmd.exe no specs cmd.exe cmd.exe no specs timeout.exe no specs taskkill.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs nmi0y9hrr0lf0yv.exe cmd.exe nmi0y9hrr0lf0yv.exe no specs nmi0y9hrr0lf0yv.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3820"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\sample.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
1
Version:
14.0.6024.1000
3724"C:\Windows\System32\cmd.exe" /C C:\Users\admin\AppData\Local\Temp\RMODN7J6.batC:\Windows\System32\cmd.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2352C:\Windows\system32\cmd.exe /K C:\Users\admin\AppData\Local\Temp\RBUCQ8IW.batC:\Windows\system32\cmd.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2856"C:\Windows\System32\cmd.exe" /C C:\Users\admin\AppData\Local\Temp\RMODN7J6.batC:\Windows\System32\cmd.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3016TIMEOUT 1C:\Windows\system32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2600taskkill /f /im WiNwOrD.ExE C:\Windows\system32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3024reg delete HKEY_CURRENT_USER\Software\Microsoft\Office\8.0\Word\Resiliency /f C:\Windows\system32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3608reg delete HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Resiliency /f C:\Windows\system32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3980reg delete HKEY_CURRENT_USER\Software\Microsoft\Office\10.0\Word\Resiliency /f C:\Windows\system32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2360reg delete HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Word\Resiliency /f C:\Windows\system32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
712
Read events
683
Write events
0
Delete events
0

Modification events

No data
Executable files
4
Suspicious files
4
Text files
4
Unknown types
4

Dropped files

PID
Process
Filename
Type
3820WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRA397.tmp.cvr —
MD5:—
SHA256:—
3472NMI0Y9HRR0LF0YV.exeC:\Users\admin\AppData\Roaming\Microsoft\Crypto\AutoUpdate.bat —
MD5:—
SHA256:—
3820WINWORD.EXEC:\Users\admin\AppData\Local\Temp\NMI0Y9HRR0LF0YV.exeexecutable
MD5:E7DC34FF00FF3041562FFF6A0DBB7B03
SHA256:DF46AF086F1784A3502B08DEDA2E0BE3C2BC2B3507554D2DB81F4CD44905B8B7
3820WINWORD.EXEC:\Users\admin\AppData\Local\Temp\JO1I3BKJTLZ4YC0.doctext
MD5:43B5535618B642D6363CB1FBB54E7517
SHA256:E31F3F6B8E9E960412F1C0B4B7707961F6C421494E0564922DEF656CF1E9FE1C
3820WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\4E360E91.wmfwmf
MD5:9366E4D52CC4DCDBA2F0E4F88A01628B
SHA256:3BAC39FFDD8ACC5C6BCB9786C4A390FE24E3FAA91A2239E68B8B2E7864EEDA9B
3820WINWORD.EXEC:\Users\admin\AppData\Local\Temp\RMODN7J6.battext
MD5:13AC176E1AD48B64A78A3E5B5C2BA965
SHA256:BB8B45B6D0CC8E01279EEC068B58EB22BD10331CB6C85E04CBD27D4B8991B6FC
3820WINWORD.EXEC:\Users\admin\AppData\Local\Temp\25MYAXP8DT2OIX5.sctxml
MD5:E45B37ED3840B9A422249B7D03F6BB5C
SHA256:A9795AE966100EEEB43110FF2B8A61518A2C6F6855634C3669AA772E40270189
2368cmd.exeC:\Users\admin\AppData\Roaming\Microsoft\Crypto\loglib.tmpexecutable
MD5:E7DC34FF00FF3041562FFF6A0DBB7B03
SHA256:DF46AF086F1784A3502B08DEDA2E0BE3C2BC2B3507554D2DB81F4CD44905B8B7
3472NMI0Y9HRR0LF0YV.exeC:\Windows\Tasks\ECDSA.jobbinary
MD5:035374953DE8477B54EE2716798A3166
SHA256:F13CAE2B0E2D1E4BFB8A2733568DBB32209CBE6EAA3906CA8528E6742CFAB82A
3820WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$sample.rtfpgc
MD5:12C398BE0680874CA9CE843FA3777FEB
SHA256:30389EA714DE3C05721528757297069B567C0371AAA049B196EF6D65B81151FC
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
sample.rtf