Malware analysis Document.doc Malicious activity | ANY.RUN

Add for printing

File name:	Document.doc
Full analysis:	https://app.any.run/tasks/cbf9f448-1716-49db-83a3-57fd7ec6206c
Verdict:	Malicious activity
Threats:	A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools. A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links. Remcos is a RAT type malware that attackers use to perform actions on infected machines remotely. This malware is extremely actively caped up to date with updates coming out almost every single month. Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email. Malware Trends Tracker >>>
Analysis date:	July 18, 2019, 05:07:06
OS:	Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:	ole-embedded trojan opendir rat remcos loader keylogger maldoc-13
Indicators:
MIME:	text/rtf
File info:	Rich Text Format data, version 1, unknown character set
MD5:	BEB86A6171A5311949C82F451B8EB934
SHA1:	479D29D8F03DCC67E3F490ECC9B304C25FBAB506
SHA256:	3F7978A8ACCF0041A9F01DE14134256C7C6E8B667183641F21349C947CE92346
SSDEEP:	1536:mrokUe1ehegeqfD3oZ1OkHFRIxPILSQWns3R:mroeZmxgLSQWno

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 120 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: 60 seconds
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 8.0.7601.17514 undefined
Adobe Acrobat Reader DC MUI (15.023.20070)
Adobe Flash Player 26 ActiveX (26.0.0.131)
Adobe Flash Player 26 NPAPI (26.0.0.131)
Adobe Flash Player 26 PPAPI (26.0.0.131)
Adobe Refresh Manager (1.8.0)
CCleaner (5.35)
FileZilla Client 3.36.0 (3.36.0)
Google Chrome (75.0.3770.100)
Google Update Helper (1.3.34.7)
Java 8 Update 92 (8.0.920.14)
Java Auto Updater (2.8.92.14)
Microsoft .NET Framework 4.7.2 (4.7.03062)
Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Professional 2010 (14.0.6029.1000)
Microsoft Office Proof (English) 2010 (14.0.6029.1000)
Microsoft Office Proof (French) 2010 (14.0.6029.1000)
Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Single Image 2010 (14.0.6029.1000)
Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2019 Redistributable (x86) - 14.21.27702 (14.21.27702.2)
Microsoft Visual C++ 2019 X86 Additional Runtime - 14.21.27702 (14.21.27702)
Microsoft Visual C++ 2019 X86 Minimum Runtime - 14.21.27702 (14.21.27702)
Mozilla Firefox 67.0.4 (x86 en-US) (67.0.4)
Notepad++ (32-bit x86) (7.5.1)
Opera 12.15 (12.15.1748)
Skype version 8.29 (8.29)
Update for Microsoft .NET Framework 4.7.2 (KB4087364) (1)
VLC media player (2.2.6)
WinRAR 5.60 (32-bit) (5.60.0)

Hotfixes

Client LanguagePack Package
Client Refresh LanguagePack Package
CodecPack Basic Package
Foundation Package
IE Troubleshooters Package
InternetExplorer Optional Package
KB2534111
KB2999226
KB4019990
KB976902
LocalPack AU Package
LocalPack CA Package
LocalPack GB Package
LocalPack US Package
LocalPack ZA Package
ProfessionalEdition
UltimateEdition

Add for printing

MALICIOUS
- Application was dropped or rewritten from another process
  - u.exe (PID: 2988)
- Unusual execution from Microsoft Office
  - WINWORD.EXE (PID: 2856)
- Requests a remote executable file from MS Office
  - WINWORD.EXE (PID: 2856)
- Uses Task Scheduler to run other applications
  - u.exe (PID: 2988)
- Executable content was dropped or overwritten
  - WINWORD.EXE (PID: 2856)
- Loads the Task Scheduler COM API
  - schtasks.exe (PID: 2240)
  - schtasks.exe (PID: 3484)
- REMCOS was detected
  - vbc.exe (PID: 3912)
- Detected logs from REMCOS RAT
  - vbc.exe (PID: 3912)
- Connects to CnC server
  - vbc.exe (PID: 3912)
SUSPICIOUS
- Writes files like Keylogger logs
  - vbc.exe (PID: 3912)
- Executes scripts
  - u.exe (PID: 2988)
- Creates files in the user directory
  - vbc.exe (PID: 3912)
INFO
- Creates files in the user directory
  - WINWORD.EXE (PID: 2856)
- Reads Microsoft Office registry keys
  - WINWORD.EXE (PID: 2856)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.rtf	\|	Rich Text Format (100)

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
2856	"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\Document.doc.rtf"	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE		explorer.exe
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000
2988	C:\Users\admin\AppData\Roaming\u.exe	C:\Users\admin\AppData\Roaming\u.exe	—	WINWORD.EXE
User: admin Integrity Level: MEDIUM Exit code: 0
2240	"schtasks.exe" /query	C:\Windows\system32\schtasks.exe	—	u.exe
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Manages scheduled tasks Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255)
3484	"schtasks.exe" /create /sc MINUTE /tn microsoft /MO 1 /tr C:\Users\admin\AppData\Roaming\u.exe	C:\Windows\system32\schtasks.exe	—	u.exe
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Manages scheduled tasks Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255)
3912	"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe		u.exe
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Visual Basic Command Line Compiler Version: 8.0.50727.5420

Add for printing

Total events

643

Read events

616

Write events

Delete events

Modification events


(PID) Process:	(2856) WINWORD.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:	write	Name:	n)<
Value: 6E293C00280B0000010000000000000000000000
(PID) Process:	(2856) WINWORD.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:	write	Name:	1033
Value: Off
(PID) Process:	(2856) WINWORD.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:	write	Name:	1033
Value: On
(PID) Process:	(2856) WINWORD.EXE	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:	write	Name:	WORDFiles
Value: 1324482590
(PID) Process:	(2856) WINWORD.EXE	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:	write	Name:	ProductFiles
Value: 1324482704
(PID) Process:	(2856) WINWORD.EXE	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:	write	Name:	ProductFiles
Value: 1324482705
(PID) Process:	(2856) WINWORD.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word
Operation:	write	Name:	MTTT
Value: 280B0000B42206AC263DD50100000000
(PID) Process:	(2856) WINWORD.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:	write	Name:	'+<
Value: 272B3C00280B000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000
(PID) Process:	(2856) WINWORD.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:	delete value	Name:	'+<
Value: 272B3C00280B000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000
(PID) Process:	(2856) WINWORD.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	UNCAsIntranet
Value: 0

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
2856	WINWORD.EXE	C:\Users\admin\AppData\Local\Temp\CVRDDEE.tmp.cvr		—
		MD5:—	SHA256:—
2856	WINWORD.EXE	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\387B71FA.png		—
		MD5:—	SHA256:—
2856	WINWORD.EXE	C:\Users\admin\AppData\Local\Temp\~$cument.doc.rtf		pgc
		MD5:F9498376CA1A6CE563FAEF355D608F9E	SHA256:CD29C9FE78AF550D31143A828F73070E733A5899E133042BB54B4D6070E03A90
2856	WINWORD.EXE	C:\Users\admin\AppData\Local\Temp\Abctfhghghghghg.sct		binary
		MD5:A6F843FA4DEAACFF46C6AAC06BB2F836	SHA256:7712156253B0589ECE122D22B1BC795E746ABA461827EE21B01ECE2A52D2B333
2856	WINWORD.EXE	C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm		pgc
		MD5:4A940B0EB7813A577FC697A20F4AA1E7	SHA256:FDEDCB8C518AD29752CCC1FA87D523F7498CAADE24F16AAE91652B3E3E387953
2856	WINWORD.EXE	C:\Users\admin\AppData\Roaming\u.exe		executable
		MD5:20680A3D6510B524B3822862154CCC00	SHA256:45F7B1401F8197413D626E2C1C1DDC5C46EE7E8ACC6B1A8B502063A4F3A52131
2856	WINWORD.EXE	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\u[1].exe		executable
		MD5:20680A3D6510B524B3822862154CCC00	SHA256:45F7B1401F8197413D626E2C1C1DDC5C46EE7E8ACC6B1A8B502063A4F3A52131
3912	vbc.exe	C:\Users\admin\AppData\Roaming\remcos\logs.dat		text
		MD5:1476A52EA99CDBFBA33E3C9893B22D55	SHA256:011E7CC9C21ED0B2E2ACAECE626F4C68D767694FF9D244CA768059D27084FBD6

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
2856	WINWORD.EXE	GET	200	108.170.57.54:80	http://danmaxexpress.com/ssl/u.exe	US	executable	518 Kb	malicious

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
3912	vbc.exe	185.247.228.189:7535	princedaniels.duckdns.org	—	—	malicious
2856	WINWORD.EXE	108.170.57.54:80	danmaxexpress.com	SECURED SERVERS LLC	US	suspicious

DNS requests

Domain	IP	Reputation
danmaxexpress.com	108.170.57.54	malicious
princedaniels.duckdns.org	185.247.228.189	malicious

Threats

PID	Process	Class	Message
2856	WINWORD.EXE	A Network Trojan was detected	ET TROJAN Single char EXE direct download likely trojan (multiple families)
2856	WINWORD.EXE	A Network Trojan was detected	ET CURRENT_EVENTS Possible Malicious Macro DL EXE Feb 2016
2856	WINWORD.EXE	Potentially Bad Traffic	ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile
2856	WINWORD.EXE	Potential Corporate Privacy Violation	ET POLICY PE EXE or DLL Windows file download HTTP
—	—	Misc activity	ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
3912	vbc.exe	A Network Trojan was detected	ET TROJAN Remcos RAT Checkin 23
3912	vbc.exe	A Network Trojan was detected	MALWARE [PTsecurity] Win32/Remcos RAT Checkin
3912	vbc.exe	A Network Trojan was detected	MALWARE [PTsecurity] Remcos RAT
3912	vbc.exe	A Network Trojan was detected	MALWARE [PTsecurity] Win32/Remcos RAT Checkin
3912	vbc.exe	A Network Trojan was detected	MALWARE [PTsecurity] Remcos RAT

Add for printing

No debug info

General Info

Document.doc

BEB86A6171A5311949C82F451B8EB934

479D29D8F03DCC67E3F490ECC9B304C25FBAB506

3F7978A8ACCF0041A9F01DE14134256C7C6E8B667183641F21349C947CE92346

1536:mrokUe1ehegeqfD3oZ1OkHFRIxPILSQWns3R:mroeZmxgLSQWno

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Application was dropped or rewritten from another process

Unusual execution from Microsoft Office

Requests a remote executable file from MS Office

Uses Task Scheduler to run other applications

Executable content was dropped or overwritten

Loads the Task Scheduler COM API

REMCOS was detected

Detected logs from REMCOS RAT

Connects to CnC server

SUSPICIOUS

Writes files like Keylogger logs

Executes scripts

Creates files in the user directory

INFO

Creates files in the user directory

Reads Microsoft Office registry keys

Malware configuration

Static information

TRiD

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings