File name:

euro.doc

Full analysis: https://app.any.run/tasks/3ae758e2-dd00-4b49-b0a3-085c66f9e25c
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Malware Trends Tracker     >>>
Analysis date: June 27, 2022, 08:02:23
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ole-embedded
generated-doc
trojan
donotgroup
apt
Indicators:
MIME: text/rtf
File info: Rich Text Format data, version 1, unknown character set
MD5:

18AF861C7923DF5245F462D37830B486

SHA1:

D81B63F942B2A8D37671FADA1B869024F1E17811

SHA256:

41C221C4F14A5F93039DE577D0A76E918C915862986A8B9870DF1C679469895C

SSDEEP:

768:MgnpnhOjj8MxfX3EqBjLW5qoX7LICSDmjl2/cqXz3HGSSmLdMjmxPcGecWAS+DUI:MM/hwRXymLdMjiMcWpK++JsLO/mOYPvM

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • EQNEDT32.EXE (PID: 3180)

    • Loads the Task Scheduler COM API

      • EQNEDT32.EXE (PID: 3180)

    • DONOTGROUP was detected

      • WINWORD.EXE (PID: 2948)

    • Drops executable file immediately after starts

      • EQNEDT32.EXE (PID: 3180)

  • SUSPICIOUS

    • Reads the computer name

      • EQNEDT32.EXE (PID: 3180)
      • WINWORD.EXE (PID: 2440)

    • Checks supported languages

      • EQNEDT32.EXE (PID: 3180)
      • WINWORD.EXE (PID: 2440)

    • Executable content was dropped or overwritten

      • EQNEDT32.EXE (PID: 3180)

    • Drops a file with a compile date too recent

      • EQNEDT32.EXE (PID: 3180)

    • Executed via COM

      • EQNEDT32.EXE (PID: 3180)

  • INFO

    • Checks supported languages

      • WINWORD.EXE (PID: 2948)

    • Reads the computer name

      • WINWORD.EXE (PID: 2948)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2948)

    • Manual execution by user

      • WINWORD.EXE (PID: 2440)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2948)
      • WINWORD.EXE (PID: 2440)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rtf | Rich Text Format (100)

EXIF

RTF

InternalVersionNumber: 49247
CharactersWithSpaces: 162
Company: home
Characters: 139
Words: 24
Pages: 1
TotalEditTime: -
RevisionNumber: 2
ModifyDate: 2022:05:14 15:37:00
CreateDate: 2022:05:14 15:37:00
LastModifiedBy: ismail - [2010]
Author: Windows User
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
3
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #DONOTGROUP winword.exe eqnedt32.exe winword.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2440"C:\PROGRA~1\MICROS~1\Office14\WINWORD.EXE" C:\Users\admin\AppData\Local\Temp\document.docC:\PROGRA~1\MICROS~1\Office14\WINWORD.EXE—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\system32\gdi32.dll
2948"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\euro.doc.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\user32.dll
3180"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
Modules
Images
c:\program files\common files\microsoft shared\equation\eqnedt32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
Total events
3 176
Read events
2 850
Write events
198
Delete events
128

Modification events

(PID) Process:(2948) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:writeName:g~;
Value:
677E3B00840B0000010000000000000000000000
(PID) Process:(2948) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
Off
(PID) Process:(2948) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1041
Value:
Off
(PID) Process:(2948) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1046
Value:
Off
(PID) Process:(2948) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1036
Value:
Off
(PID) Process:(2948) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1031
Value:
Off
(PID) Process:(2948) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1040
Value:
Off
(PID) Process:(2948) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1049
Value:
Off
(PID) Process:(2948) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:3082
Value:
Off
(PID) Process:(2948) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1042
Value:
Off
Executable files
1
Suspicious files
11
Text files
7
Unknown types
5

Dropped files

PID
Process
Filename
Type
2948WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRD2E7.tmp.cvr —
MD5:—
SHA256:—
2948WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-CNRY.FSDbinary
MD5:—
SHA256:—
2948WINWORD.EXEC:\Users\admin\AppData\Local\Temp\oloiue.dllbinary
MD5:—
SHA256:—
2948WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$ro.doc.rtfpgc
MD5:—
SHA256:—
2948WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSDbinary
MD5:—
SHA256:—
2440WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRB037.tmp.cvr —
MD5:—
SHA256:—
2948WINWORD.EXEC:\Users\admin\AppData\Local\Temp\{82349FE4-CDE3-4D38-A23E-54CAF70ABA26}binary
MD5:—
SHA256:—
2948WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\template[1].doctext
MD5:—
SHA256:—
2948WINWORD.EXEC:\Users\admin\AppData\Local\Temp\{1603DB63-46E3-452A-9967-515C4C8E429B}binary
MD5:—
SHA256:—
2948WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-{BB28F91D-7081-41A8-AA27-0030E6CA4AAB}.FSDbinary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
6
DNS requests
2
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2948
WINWORD.EXE
OPTIONS
200
193.149.176.82:80
http://who.worksolution.buzz/pq7uzPUMBBQpn8ub/
DK
—
—
malicious
2948
WINWORD.EXE
GET
200
193.149.176.82:80
http://who.worksolution.buzz/pq7uzPUMBBQpn8ub/HZNnKZmaMsQMFGX3.php
DK
text
543 Kb
malicious
3180
EQNEDT32.EXE
GET
200
193.149.176.82:80
http://who.worksolution.buzz/pq7uzPUMBBQpn8ub/HZNnKZmaMsQMFGX3YtjSkvyumPAsnckh5SZGE7nlj7WSghAI
DK
binary
6.38 Kb
malicious
3180
EQNEDT32.EXE
GET
200
193.149.176.82:80
http://who.worksolution.buzz/pq7uzPUMBBQpn8ub/HZNnKZmaMsQMFGX3YtjSkvyumPAsnckh5SZGE7nlj7WSghAI.rtf
DK
text
38.9 Kb
malicious
3180
EQNEDT32.EXE
GET
500
193.149.176.82:80
http://who.worksolution.buzz/pq7uzPUMBBQpn8ub/HZNnKZmaMsQMFGX3YtjSkvyumPAsnckh5SZGE7nlj7WSghAI.mp3/9//V39jJwYz83sPPyd/f8Yz/1d/YycGM38Hf34LJ1MmMz9/e39+CydTJjNvFwsXCxdiCydTJjM/f3t/fgsnUyYzbxcLAw8vDwoLJ1MmM38ne2sXPyd+CydTJjMDfzd/fgsnUyYzA38GCydTJjN/az8TD39iCydTJjN/az8TD39iCydTJjN/az8TD39iCydTJjN/az8TD39iCydTJjN/az8TD39iCydTJjN/az8TD39iCydTJjN/az8TD39iCydTJjN/az8TD39iCydTJjN/cw8PA39qCydTJjN/az8TD39iCydTJjN/az8TD39iCydTJjOXh6ejl7/j5/Ojt+OmC6fTpjN/az8TD39iCydTJjNjN38fEw9/YgsnUyYzYzd/HycLLgsnUyYzI28GCydTJjMnU3MDD3snegsnUyYzP2MrBw8KCydTJjP/Jzd7PxOXCyMnUyd6CydTJjP/Jzd7PxPzew9jDz8PA5MPf2ILJ1MmM/8nN3s/E6sXA2Mne5MPf2ILJ1MmM++Xi++P+6ILp9OmMzdnIxcPIy4LJ1MmM6f3i6ej4n56C6fTpjMjAwMTD39iCydTJjA==
DK
html
532 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2948
WINWORD.EXE
193.149.176.82:80
who.worksolution.buzz
DUPONT NUTRITION BIOSCIENCES ApS
DK
malicious
3180
EQNEDT32.EXE
193.149.176.82:80
who.worksolution.buzz
DUPONT NUTRITION BIOSCIENCES ApS
DK
malicious

DNS requests

Domain
IP
Reputation
who.worksolution.buzz
  • 193.149.176.82
malicious
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

PID
Process
Class
Message
2948
WINWORD.EXE
Potentially Bad Traffic
ET INFO HTTP Request to a *.buzz domain
2948
WINWORD.EXE
A Network Trojan was detected
ET TROJAN DonotGroup Maldoc Activity (GET)
2948
WINWORD.EXE
Potentially Bad Traffic
ET INFO HTTP Request to a *.buzz domain
3180
EQNEDT32.EXE
Potentially Bad Traffic
ET INFO HTTP Request to a *.buzz domain
3180
EQNEDT32.EXE
Potentially Bad Traffic
ET INFO HTTP Request to a *.buzz domain
3180
EQNEDT32.EXE
Potentially Bad Traffic
ET INFO HTTP Request to a *.buzz domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
euro.doc