analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

40e928.doc

Full analysis: https://app.any.run/tasks/868ae20c-c862-479f-b6b7-9fc166bf74f3
Verdict: Malicious activity
Analysis date: November 14, 2018, 18:42:04
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ole-embedded
Indicators:
MIME: text/rtf
File info: Rich Text Format data, version 1, unknown character set
MD5:

987CDA2D7593CB61F1432D7955EB2CFD

SHA1:

54191C5052111BD7A8CFA06F4333C4DD99EEB366

SHA256:

40E9287FF8828FB0E6BAEDCFF873E8E35520C6227200F1C84B63446F07A59289

SSDEEP:

6144:fN987IjqHeVXPsrP5DLkQnAgfZZPHymnLogyM4fO:Q7IlZobnAgfW5m

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Executable content was dropped or overwritten

      • WINWORD.EXE (PID: 3340)
    • Starts CMD.EXE for commands execution

      • WINWORD.EXE (PID: 3340)
    • Unusual execution from Microsoft Office

      • WINWORD.EXE (PID: 3340)
    • Application was dropped or rewritten from another process

      • winlogon.exe (PID: 4016)
      • winlogon.exe (PID: 3220)
      • defender.exe (PID: 3004)
      • defender.exe (PID: 3596)
    • Changes the autorun value in the registry

      • winlogon.exe (PID: 3220)
    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 2508)
    • Uses Task Scheduler to run other applications

      • defender.exe (PID: 3004)
  • SUSPICIOUS

    • Uses REG.EXE to modify Windows registry

      • cmd.exe (PID: 3172)
      • cmd.exe (PID: 3104)
      • cmd.exe (PID: 3288)
    • Starts Microsoft Office Application

      • cmd.exe (PID: 3500)
    • Application launched itself

      • winlogon.exe (PID: 4016)
      • defender.exe (PID: 3004)
    • Creates files in the user directory

      • winlogon.exe (PID: 3220)
      • defender.exe (PID: 3004)
    • Executable content was dropped or overwritten

      • winlogon.exe (PID: 3220)
      • defender.exe (PID: 3004)
    • Connects to unusual port

      • defender.exe (PID: 3596)
  • INFO

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 3340)
      • WINWORD.EXE (PID: 2868)
    • Creates files in the user directory

      • WINWORD.EXE (PID: 3340)
      • WINWORD.EXE (PID: 2868)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rtf | Rich Text Format (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
52
Monitored processes
14
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start winword.exe winlogon.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs winword.exe no specs winlogon.exe defender.exe schtasks.exe no specs defender.exe

Process information

PID
CMD
Path
Indicators
Parent process
3340"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\40e928.doc.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
4016C:\Users\admin\AppData\Local\Temp\winlogon.exeC:\Users\admin\AppData\Local\Temp\winlogon.exeWINWORD.EXE
User:
admin
Company:
Defender Inc
Integrity Level:
MEDIUM
Description:
Microsoft Defander
Exit code:
0
Version:
6.6.5.1
3104cmd.exe /c reg delete "HKCU\Software\Microsoft\Office\12.0\Word\Resiliency" /FC:\Windows\system32\cmd.exeWINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3172cmd.exe /c reg delete "HKCU\Software\Microsoft\Office\14.0\Word\Resiliency" /FC:\Windows\system32\cmd.exeWINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3288cmd.exe /c reg delete "HKCU\Software\Microsoft\Office\15.0\Word\Resiliency" /FC:\Windows\system32\cmd.exeWINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3500cmd.exe /c dir %windir% && "C:\Users\admin\Desktop\40e928.doc.rtf"C:\Windows\system32\cmd.exeWINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3848reg delete "HKCU\Software\Microsoft\Office\12.0\Word\Resiliency" /FC:\Windows\system32\reg.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3972reg delete "HKCU\Software\Microsoft\Office\14.0\Word\Resiliency" /FC:\Windows\system32\reg.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2136reg delete "HKCU\Software\Microsoft\Office\15.0\Word\Resiliency" /FC:\Windows\system32\reg.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2868"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\40e928.doc.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXEcmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
Total events
1 865
Read events
1 478
Write events
0
Delete events
0

Modification events

No data
Executable files
3
Suspicious files
6
Text files
5
Unknown types
8

Dropped files

PID
Process
Filename
Type
3340WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR9E19.tmp.cvr
MD5:
SHA256:
3340WINWORD.EXEC:\Users\admin\AppData\Local\Temp\msoA8EE.tmp
MD5:
SHA256:
3340WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\E6DD57E5.jpeg
MD5:
SHA256:
2868WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRB088.tmp.cvr
MD5:
SHA256:
3340WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~$RO0000.docpgc
MD5:F85E6D404B9835A015B5E14E12D2325F
SHA256:EC3ABBBD8730ACD1B67A0228EF761047C0F77387C4D69E18BAD2F322B653661C
3340WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:70C278D8BB09C3041479A9BC2AF4E1A9
SHA256:D69E23B5D0FBBBEA2B15D68BAE73B8D21CB5A54E7F9352E099020E7F51DABA60
3340WINWORD.EXEC:\Users\admin\Desktop\40e928.doc.rtfdocument
MD5:2D9064943A93D1129A313D7D801448C4
SHA256:642D4794890683701D521899EA51E6A3CD698D45292591B3E064BAE13683256A
3340WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\DE0B0274.emfemf
MD5:9C539DA99A279ECAF0D3867A2BA645FB
SHA256:452C55912BFE110782BA6CB47A4FEEC3A30E22F277F6B573A01F569CD3BF9E60
3340WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{7D6C5307-2974-44DC-A420-C4C6CCADD0F6}.tmpbinary
MD5:0B0DAF408606997DA890E38146FA586D
SHA256:98AF4804802FD446A235EA888CDFEEF4BDBF6FE71E82A19D0FB3D76A9399B115
3340WINWORD.EXEC:\Users\admin\Desktop\~$e928.doc.rtfpgc
MD5:E950FA12F6179CFDC8650F093BA35BF1
SHA256:AAA3CE4EA0C1BF16F9296111C8C3613CE43661AD33EE303DAADFE022ED26EEE2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
2
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3596
defender.exe
45.32.232.70:6669
Choopa, LLC
NL
unknown

DNS requests

No data

Threats

No threats detected
No debug info