| File name: | sample.rtf |
| Full analysis: | https://app.any.run/tasks/e7946656-33c7-4cdf-a655-ea6cc682772b |
| Verdict: | Malicious activity |
| Analysis date: | September 11, 2019, 09:33:59 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | text/rtf |
| File info: | Rich Text Format data, version 1, unknown character set |
| MD5: | 5E8F773B77D1D8595E977F62AAB17613 |
| SHA1: | 898F966769C0ADE31C6FB9E4431A3F2A69A81382 |
| SHA256: | 25691A8345051DD841F7F2F74624B9AC13D175676DDAA441A795817DBCADBF8A |
| SSDEEP: | 12288:M6RoIsVvaXpwG6XtwLrFl3xcco8kD6RoIsVvaXpwG6XtwLrFl3xcco8kLVf1tmYy:CGpw1MPA8k7Gpw1MPA8kLt1tzoN2M |
MALICIOUS
Executable content was dropped or overwritten
- WINWORD.EXE (PID: 3820)
Unusual execution from Microsoft Office
- WINWORD.EXE (PID: 3820)
Starts CMD.EXE for commands execution
- WINWORD.EXE (PID: 3820)
Application was dropped or rewritten from another process
- NMI0Y9HRR0LF0YV.exe (PID: 3472)
- NMI0Y9HRR0LF0YV.exe (PID: 4060)
- NMI0Y9HRR0LF0YV.exe (PID: 3512)
Loads the Task Scheduler DLL interface
- NMI0Y9HRR0LF0YV.exe (PID: 3472)
SUSPICIOUS
Application launched itself
- cmd.exe (PID: 3724)
- cmd.exe (PID: 2352)
Uses TASKKILL.EXE to kill Office Apps
- cmd.exe (PID: 2352)
Starts CMD.EXE for commands execution
- cmd.exe (PID: 3724)
- cmd.exe (PID: 2352)
- NMI0Y9HRR0LF0YV.exe (PID: 3472)
Uses REG.EXE to modify Windows registry
- cmd.exe (PID: 2352)
- cmd.exe (PID: 324)
- cmd.exe (PID: 2796)
- cmd.exe (PID: 2444)
- cmd.exe (PID: 3732)
- cmd.exe (PID: 2788)
- cmd.exe (PID: 3460)
- cmd.exe (PID: 2444)
- cmd.exe (PID: 2780)
Executable content was dropped or overwritten
- cmd.exe (PID: 2352)
- NMI0Y9HRR0LF0YV.exe (PID: 3472)
- cmd.exe (PID: 2368)
Creates files in the user directory
- NMI0Y9HRR0LF0YV.exe (PID: 3472)
- cmd.exe (PID: 2352)
- cmd.exe (PID: 2368)
Creates files in the Windows directory
- NMI0Y9HRR0LF0YV.exe (PID: 3472)
INFO
Dropped object may contain Bitcoin addresses
- WINWORD.EXE (PID: 3820)
Reads Microsoft Office registry keys
- WINWORD.EXE (PID: 3820)
Creates files in the user directory
- WINWORD.EXE (PID: 3820)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .rtf | | | Rich Text Format (100) |
|---|
EXIF
RTF
| Title: | ÔÚ2009¼¶ÐÂÉú¾üѵ×ܽá±íÕÃôß¿ªÑ§µäÀñÉϵĽ²»°£¨Ö®¶þ£© ¡ª¡ªÎ侯ºþ±±×ܶÓÒ»Ö§¶ÓÖ¸µ¼Ô±»ÆÖÇ |
|---|---|
| Author: | Windows Óû§ |
| LastModifiedBy: | Windows Óû§ |
| CreateDate: | 2018:09:04 14:21:00 |
| ModifyDate: | 2018:09:04 14:21:00 |
| RevisionNumber: | 2 |
| TotalEditTime: | - |
| Pages: | 2 |
| Words: | 208 |
| Characters: | 1190 |
| CharactersWithSpaces: | 1396 |
| InternalVersionNumber: | 57433 |
Total processes
69
Monitored processes
34
Malicious processes
4
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 324 | C:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\8.0\Word\File MRU" /v "Item 1" | C:\Windows\system32\cmd.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2064 | REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\14.0\Word\File MRU" /v "Item 1" | C:\Windows\system32\reg.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Registry Console Tool Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2068 | reg delete HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Word\Resiliency /f | C:\Windows\system32\reg.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Registry Console Tool Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2340 | REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\8.0\Word\File MRU" /v "Item 1" | C:\Windows\system32\reg.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Registry Console Tool Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2352 | C:\Windows\system32\cmd.exe /K C:\Users\admin\AppData\Local\Temp\RBUCQ8IW.bat | C:\Windows\system32\cmd.exe | cmd.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2356 | REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\11.0\Word\File MRU" /v "Item 1" | C:\Windows\system32\reg.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Registry Console Tool Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2360 | reg delete HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Word\Resiliency /f | C:\Windows\system32\reg.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Registry Console Tool Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2368 | cmd /c C:\Users\admin\AppData\Roaming\Microsoft\Crypto\AutoUpdate.bat | C:\Windows\system32\cmd.exe | NMI0Y9HRR0LF0YV.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2392 | REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Word\File MRU" /v "Item 1" | C:\Windows\system32\reg.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Registry Console Tool Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2444 | C:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\10.0\Word\File MRU" /v "Item 1" | C:\Windows\system32\cmd.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
Total events
712
Read events
683
Write events
26
Delete events
3
Modification events
| (PID) Process: | (3820) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
| Operation: | write | Name: | 73% |
Value: 37332500EC0E0000010000000000000000000000 | |||
| (PID) Process: | (3820) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1033 |
Value: Off | |||
| (PID) Process: | (3820) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1033 |
Value: On | |||
| (PID) Process: | (3820) WINWORD.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage |
| Operation: | write | Name: | WORDFiles |
Value: 1328218142 | |||
| (PID) Process: | (3820) WINWORD.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage |
| Operation: | write | Name: | ProductFiles |
Value: 1328218256 | |||
| (PID) Process: | (3820) WINWORD.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage |
| Operation: | write | Name: | ProductFiles |
Value: 1328218257 | |||
| (PID) Process: | (3820) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word |
| Operation: | write | Name: | MTTT |
Value: EC0E00005CB09B1B8468D50100000000 | |||
| (PID) Process: | (3820) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
| Operation: | write | Name: | `4% |
Value: 60342500EC0E000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000 | |||
| (PID) Process: | (3820) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
| Operation: | delete value | Name: | `4% |
Value: 60342500EC0E000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000 | |||
| (PID) Process: | (3820) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
Executable files
4
Suspicious files
4
Text files
4
Unknown types
4
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3820 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRA397.tmp.cvr | — | |
MD5:— | SHA256:— | |||
| 3472 | NMI0Y9HRR0LF0YV.exe | C:\Users\admin\AppData\Roaming\Microsoft\Crypto\AutoUpdate.bat | — | |
MD5:— | SHA256:— | |||
| 3820 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:— | SHA256:— | |||
| 3820 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~$sample.rtf | pgc | |
MD5:— | SHA256:— | |||
| 3820 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\4E360E91.wmf | wmf | |
MD5:— | SHA256:— | |||
| 3820 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\RMODN7J6.bat | text | |
MD5:— | SHA256:— | |||
| 3820 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\25MYAXP8DT2OIX5.sct | xml | |
MD5:— | SHA256:— | |||
| 3820 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\RBUCQ8IW.bat | text | |
MD5:— | SHA256:— | |||
| 3820 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\JO1I3BKJTLZ4YC0.doc | text | |
MD5:— | SHA256:— | |||
| 3820 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\NMI0Y9HRR0LF0YV.exe | executable | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report