File name:

Purchase Order.docx

Full analysis: https://app.any.run/tasks/53d28757-ef8e-4efa-96ce-72c3219dff5b
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: January 11, 2019, 12:42:53
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
exploit
cve-2017-11882
loader
rat
remcos
Indicators:
MIME: application/vnd.openxmlformats-officedocument.wordprocessingml.document
File info: Microsoft Word 2007+
MD5:

CB3BC3B8873A3D49EB10BBA8C6DA4D44

SHA1:

DDFFC5AA35FB25211574D83BD8E8E4C6F0E9D2E2

SHA256:

76B9862183499F7BA53811E30CB514B6FA08F9439FFB67F66D2F59919464AB61

SSDEEP:

192:EAt8rWXyMtWNFR0mqQTnhr5ODQT1QOP55rAbFTB8GoA6aFkWwm3fj:EAtTXyMtiFzLODQT1QODrudxqmvj

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • WindowsSrv.exe (PID: 2340)
      • WindowsSrv.exe (PID: 2612)
      • WindowsSrv.exe (PID: 2716)
      • WinDir.exe (PID: 3720)
      • WinDir.exe (PID: 1672)
      • WinDir.exe (PID: 1036)
      • WindowsSrv.exe (PID: 3668)

    • Downloads executable files from the Internet

      • EQNEDT32.EXE (PID: 2388)

    • Suspicious connection from the Equation Editor

      • EQNEDT32.EXE (PID: 2388)

    • Changes the autorun value in the registry

      • WindowsSrv.exe (PID: 2612)
      • WinDir.exe (PID: 1672)

    • Equation Editor starts application (CVE-2017-11882)

      • EQNEDT32.EXE (PID: 2388)

    • Runs PING.EXE for delay simulation

      • cmd.exe (PID: 2428)

    • REMCOS RAT was detected

      • WinDir.exe (PID: 1672)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • WindowsSrv.exe (PID: 2612)

    • Creates files in the user directory

      • EQNEDT32.EXE (PID: 2388)
      • WindowsSrv.exe (PID: 2612)
      • WinDir.exe (PID: 1672)

    • Unusual connect from Microsoft Office

      • WINWORD.EXE (PID: 2980)

    • Executable content was dropped or overwritten

      • EQNEDT32.EXE (PID: 2388)
      • WindowsSrv.exe (PID: 2612)

    • Application launched itself

      • WindowsSrv.exe (PID: 2340)
      • WindowsSrv.exe (PID: 2716)
      • WinDir.exe (PID: 3720)

  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2980)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2980)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.docx | Word Microsoft Office Open XML Format document (52.2)
.zip | Open Packaging Conventions container (38.8)
.zip | ZIP compressed archive (8.8)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0002
ZipCompression: Deflated
ZipModifyDate: 2019:01:09 04:15:04
ZipCRC: 0x82872409
ZipCompressedSize: 358
ZipUncompressedSize: 1422
ZipFileName: [Content_Types].xml

XML

Template: dotm.dotm
TotalEditTime: 1 minute
Pages: 1
Words: 1
Characters: 7
Application: Microsoft Office Word
DocSecurity: None
Lines: 1
Paragraphs: 1
ScaleCrop: No
HeadingPairs:
  • Название
  • 1
TitlesOfParts: -
Company: SPecialiST RePack
LinksUpToDate: No
CharactersWithSpaces: 7
SharedDoc: No
HyperlinksChanged: No
AppVersion: 14
LastModifiedBy: Microsoft
RevisionNumber: 1
CreateDate: 2017:09:24 17:26:00Z
ModifyDate: 2017:09:24 17:27:00Z

XMP

Creator: Microsoft
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
11
Malicious processes
7
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start winword.exe eqnedt32.exe windowssrv.exe no specs windowssrv.exe windowssrv.exe no specs cmd.exe no specs ping.exe no specs windir.exe no specs windowssrv.exe no specs #REMCOS windir.exe windir.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1036"C:\Users\admin\AppData\Roaming\WinDir\WinDir.exe" 2 1672 2272625C:\Users\admin\AppData\Roaming\WinDir\WinDir.exe—WinDir.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\windir\windir.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1672"C:\Users\admin\AppData\Roaming\WinDir\WinDir.exe" C:\Users\admin\AppData\Roaming\WinDir\WinDir.exe
WinDir.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\windir\windir.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2340"C:\Users\admin\AppData\Roaming\WindowsSrv.exe" C:\Users\admin\AppData\Roaming\WindowsSrv.exe—EQNEDT32.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\windowssrv.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2388"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
Modules
Images
c:\program files\common files\microsoft shared\equation\eqnedt32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2428cmd /c ""C:\Users\admin\AppData\Local\Temp\install.bat" "C:\Windows\system32\cmd.exe—WindowsSrv.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2612"C:\Users\admin\AppData\Roaming\WindowsSrv.exe" C:\Users\admin\AppData\Roaming\WindowsSrv.exe
WindowsSrv.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\windowssrv.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2716"C:\Users\admin\AppData\Roaming\WindowsSrv.exe" 2 2612 2199968C:\Users\admin\AppData\Roaming\WindowsSrv.exe—WindowsSrv.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\windowssrv.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2980"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\Purchase Order.docx"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
3416PING 127.0.0.1 -n 2 C:\Windows\system32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ping.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
3668"C:\Users\admin\AppData\Roaming\WindowsSrv.exe"C:\Users\admin\AppData\Roaming\WindowsSrv.exe—WindowsSrv.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\windowssrv.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
1 975
Read events
1 584
Write events
379
Delete events
12

Modification events

(PID) Process:(2980) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:writeName:y.,
Value:
792E2C00A40B0000010000000000000000000000
(PID) Process:(2980) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
Off
(PID) Process:(2980) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
On
(PID) Process:(2980) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:WORDFiles
Value:
1311440919
(PID) Process:(2980) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:ProductFiles
Value:
1311441040
(PID) Process:(2980) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:ProductFiles
Value:
1311441041
(PID) Process:(2980) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word
Operation:writeName:MTTT
Value:
A40B0000D03AB334ABA9D40100000000
(PID) Process:(2980) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:writeName:20,
Value:
32302C00A40B000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000
(PID) Process:(2980) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:delete valueName:20,
Value:
32302C00A40B000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000
(PID) Process:(2980) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
Executable files
3
Suspicious files
24
Text files
8
Unknown types
2

Dropped files

PID
Process
Filename
Type
2980WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRE6F9.tmp.cvr —
MD5:—
SHA256:—
2980WINWORD.EXEC:\Users\admin\AppData\Local\Temp\{87F8C4B1-F288-4F27-95D4-1021E653E609} —
MD5:—
SHA256:—
2980WINWORD.EXEC:\Users\admin\AppData\Local\Temp\{B03A125E-8298-4604-B580-4B5B2FBA81D1} —
MD5:—
SHA256:—
2980WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\A9F47F90.doc —
MD5:—
SHA256:—
2980WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\E7D95C1E.doc —
MD5:—
SHA256:—
2980WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSF-CTBL.FSFbinary
MD5:—
SHA256:—
2980WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:—
SHA256:—
2980WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-{7676C162-2602-456B-ACB2-E271D1EE9197}.FSDbinary
MD5:—
SHA256:—
2980WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$rchase Order.docxpgc
MD5:—
SHA256:—
2980WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-CNRY.FSDbinary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
27
TCP/UDP connections
14
DNS requests
4
Threats
31

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2980
WINWORD.EXE
OPTIONS
200
64.32.6.209:80
http://micosoftoutlook.dns04.com/update/
US
—
—
malicious
2980
WINWORD.EXE
GET
304
64.32.6.209:80
http://micosoftoutlook.dns04.com/update/update.doc
US
—
—
malicious
2980
WINWORD.EXE
HEAD
200
64.32.6.209:80
http://micosoftoutlook.dns04.com/update/update.doc
US
—
—
malicious
976
svchost.exe
PROPFIND
301
64.32.6.209:80
http://micosoftoutlook.dns04.com/update
US
html
248 b
malicious
976
svchost.exe
OPTIONS
200
64.32.6.209:80
http://micosoftoutlook.dns04.com/update/
US
html
248 b
malicious
976
svchost.exe
PROPFIND
301
64.32.6.209:80
http://micosoftoutlook.dns04.com/update
US
html
248 b
malicious
2980
WINWORD.EXE
HEAD
200
64.32.6.209:80
http://micosoftoutlook.dns04.com/update/update.doc
US
text
7.16 Kb
malicious
2980
WINWORD.EXE
GET
200
64.32.6.209:80
http://micosoftoutlook.dns04.com/update/update.doc
US
text
7.16 Kb
malicious
976
svchost.exe
PROPFIND
405
64.32.6.209:80
http://micosoftoutlook.dns04.com/update/
US
html
243 b
malicious
2980
WINWORD.EXE
HEAD
200
64.32.6.209:80
http://micosoftoutlook.dns04.com/update/update.doc
US
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2980
WINWORD.EXE
64.32.6.209:80
micosoftoutlook.dns04.com
Sharktech
US
malicious
976
svchost.exe
64.32.6.209:80
micosoftoutlook.dns04.com
Sharktech
US
malicious
2388
EQNEDT32.EXE
64.32.6.209:80
micosoftoutlook.dns04.com
Sharktech
US
malicious
1672
WinDir.exe
77.48.28.216:137
—
Liberty Global Operations B.V.
CZ
malicious

DNS requests

Domain
IP
Reputation
micosoftoutlook.dns04.com
  • 64.32.6.209
malicious
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

PID
Process
Class
Message
2980
WINWORD.EXE
A Network Trojan was detected
SC TROJAN_DOWNLOADER Suspicious DOC loader of embedded OLE from external source
2980
WINWORD.EXE
A Network Trojan was detected
MALWARE [PTsecurity] Possible RTF CVE-2017-11882 document
2388
EQNEDT32.EXE
A Network Trojan was detected
ET CURRENT_EVENTS Possible Malicious Macro DL EXE Feb 2016
2388
EQNEDT32.EXE
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
27 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Purchase Order.docx