analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

2f2ff0008cd3177041066f039a345307a917704207c407d7dde255483c42764a.rtf

Full analysis: https://app.any.run/tasks/ef043708-a3ce-47c6-9e63-35b956632331
Verdict: Malicious activity
Analysis date: March 15, 2019, 03:06:02
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ole-embedded
Indicators:
MIME: text/rtf
File info: Rich Text Format data, version 1, unknown character set
MD5:

473909C2647D2C200FD40CC2F44ADFBE

SHA1:

515804545A7C51CCD9553198C28BAE85DF2A9C1D

SHA256:

2F2FF0008CD3177041066F039A345307A917704207C407D7DDE255483C42764A

SSDEEP:

24576:pd6qlMEjK5vK59lDYY88E19qd1UVueD10515VPiKPpz6mpKZglenGZxL:t

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Unusual execution from Microsoft Office

      • WINWORD.EXE (PID: 2996)

    • Starts CMD.EXE for commands execution

      • WINWORD.EXE (PID: 2996)

    • Runs app for hidden code execution

      • cmd.exe (PID: 3948)
      • cmd.exe (PID: 2460)

    • Application was dropped or rewritten from another process

      • saver.scr (PID: 3332)
      • saver.scr (PID: 2788)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 2380)
      • cmd.exe (PID: 3948)
      • cmd.exe (PID: 2460)
      • cmd.exe (PID: 2652)

    • Executes scripts

      • cmd.exe (PID: 2652)

    • Executable content was dropped or overwritten

      • cscript.exe (PID: 3896)

    • Uses REG.EXE to modify Windows registry

      • cmd.exe (PID: 2652)
      • cmd.exe (PID: 2792)
      • cmd.exe (PID: 3736)
      • cmd.exe (PID: 2732)
      • cmd.exe (PID: 3684)
      • cmd.exe (PID: 2404)
      • cmd.exe (PID: 3328)

    • Application launched itself

      • cmd.exe (PID: 2652)
      • saver.scr (PID: 3332)

    • Uses TASKKILL.EXE to kill Office Apps

      • cmd.exe (PID: 2652)

    • Starts application with an unusual extension

      • cmd.exe (PID: 2652)
      • saver.scr (PID: 3332)

  • INFO

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2996)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2996)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rtf | Rich Text Format (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
69
Monitored processes
37
Malicious processes
4
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winword.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs timeout.exe no specs timeout.exe no specs timeout.exe no specs cmd.exe no specs timeout.exe no specs cmd.exe no specs timeout.exe no specs timeout.exe no specs timeout.exe no specs timeout.exe no specs cscript.exe taskkill.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs saver.scr no specs cmd.exe no specs saver.scr no specs

Process information

PID
CMD
Path
Indicators
Parent process
2996"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\2f2ff0008cd3177041066f039a345307a917704207c407d7dde255483c42764a.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
1
Version:
14.0.6024.1000
3948"C:\Windows\System32\cmd.exe" /C CmD < "C:\Users\admin\AppData\Local\Temp\ufFm.cMD"C:\Windows\System32\cmd.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2380CmD C:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2652C:\Windows\system32\cmd.exe /K mt6nzqofd.CMDC:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3156TIMEOUT /T 1C:\Windows\system32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3616TIMEOUT /T 1 C:\Windows\system32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
764TIMEOUT /T 1 C:\Windows\system32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2460"C:\Windows\System32\cmd.exe" /C CmD < "C:\Users\admin\AppData\Local\Temp\ufFm.cMD"C:\Windows\System32\cmd.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2872TIMEOUT /T 1 C:\Windows\system32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3348CmD C:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Total events
1 095
Read events
1 064
Write events
28
Delete events
3

Modification events

(PID) Process:(2996) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:writeName:7<,
Value:
373C2C00B40B0000010000000000000000000000
(PID) Process:(2996) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
Off
(PID) Process:(2996) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
On
(PID) Process:(2996) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:WORDFiles
Value:
1315897367
(PID) Process:(2996) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:ProductFiles
Value:
1315897488
(PID) Process:(2996) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:ProductFiles
Value:
1315897489
(PID) Process:(2996) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word
Operation:writeName:MTTT
Value:
B40B000082D62C10DCDAD40100000000
(PID) Process:(2996) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:writeName:1=,
Value:
313D2C00B40B000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000
(PID) Process:(2996) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:delete valueName:1=,
Value:
313D2C00B40B000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000
(PID) Process:(2996) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
Executable files
1
Suspicious files
4
Text files
9
Unknown types
3

Dropped files

PID
Process
Filename
Type
2996WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRE497.tmp.cvr —
MD5:—
SHA256:—
2996WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:80FF86DAC76F41990EC221F8645C8BB0
SHA256:24502A90A58581D125E7DB1DFA2ADB4113CD4073F2D98A5472087BB9A71D331C
2996WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$2ff0008cd3177041066f039a345307a917704207c407d7dde255483c42764a.rtfpgc
MD5:097AA5289F1EA6F06EE6BC3E870449E1
SHA256:2554C88D2662D103912A286306D56B1A80FF27888D48AFAAD6DDDCFA159D6CAA
2996WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{AB3B682E-F42A-4DD0-B4D7-DE44965742E8}.tmpbinary
MD5:2939B0A4E12B5DCC2DFBBF4DCCF46EAF
SHA256:00BE3E19CDF913EF815E2FAF3158E5667B7F2E7CD578C65329DC5A9B1219D070
2652cmd.exeC:\Users\admin\AppData\Local\Temp\_.vbstext
MD5:BF9646FA68CAE0CE69FBF7FFF70D65B5
SHA256:CC7DD8CF31F4634A109AC5A14931F8A4E55F528B36C40B0D109B9147B8E7C928
2996WINWORD.EXEC:\Users\admin\AppData\Local\Temp\mt6nzqofd.cmdtext
MD5:B5B6D0CC5AE87D9B02585E5B3246C1A2
SHA256:15C6536DD7A47ADD995049F4E54D86F69F50BB20FE29B88B5AE809A888730A5E
2996WINWORD.EXEC:\Users\admin\AppData\Local\Temp\kulebiaka.ZiPcompressed
MD5:720C5A2AFAA3C56512E4056E48A0CE70
SHA256:F17E4C2D87AC6809D0CDB74CC8DED9840F4548987A21EC4DD483D75FDB5F3F9D
3896cscript.exeC:\Users\admin\AppData\Local\Temp\gondi.doctext
MD5:6291D5A22FCE652360616BD330E07082
SHA256:80AE0226822B684927280C63CA9F4E683C121FA62715E02909DECC298C03B506
3332saver.scrC:\Users\admin\AppData\Local\Temp\~DFF74CB86A335FE1F5.TMPbinary
MD5:3DFD4FB5DA2EF3046E3E5053F0372F20
SHA256:D0117DAA672DED1E38A902705D3CD81B731C6EEE2B5EA42B1648C8868781471B
2996WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{3FF639A6-C22C-4E9B-B5CF-1823B65FCF7D}.tmpbinary
MD5:0010ADD74D7B693681C32F91813E162D
SHA256:B71769DA5BB8A682D982C0A73FC911536665E35FF085469F9105F08E32BC5578
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
2f2ff0008cd3177041066f039a345307a917704207c407d7dde255483c42764a.rtf