analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Purchase Order.docx

Full analysis: https://app.any.run/tasks/53d28757-ef8e-4efa-96ce-72c3219dff5b
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: January 11, 2019, 12:42:53
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
exploit
CVE-2017-11882
loader
rat
remcos
Indicators:
MIME: application/vnd.openxmlformats-officedocument.wordprocessingml.document
File info: Microsoft Word 2007+
MD5:

CB3BC3B8873A3D49EB10BBA8C6DA4D44

SHA1:

DDFFC5AA35FB25211574D83BD8E8E4C6F0E9D2E2

SHA256:

76B9862183499F7BA53811E30CB514B6FA08F9439FFB67F66D2F59919464AB61

SSDEEP:

192:EAt8rWXyMtWNFR0mqQTnhr5ODQT1QOP55rAbFTB8GoA6aFkWwm3fj:EAtTXyMtiFzLODQT1QODrudxqmvj

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Suspicious connection from the Equation Editor

      • EQNEDT32.EXE (PID: 2388)

    • Downloads executable files from the Internet

      • EQNEDT32.EXE (PID: 2388)

    • Application was dropped or rewritten from another process

      • WindowsSrv.exe (PID: 2612)
      • WindowsSrv.exe (PID: 2340)
      • WindowsSrv.exe (PID: 2716)
      • WinDir.exe (PID: 3720)
      • WinDir.exe (PID: 1672)
      • WindowsSrv.exe (PID: 3668)
      • WinDir.exe (PID: 1036)

    • Equation Editor starts application (CVE-2017-11882)

      • EQNEDT32.EXE (PID: 2388)

    • Changes the autorun value in the registry

      • WindowsSrv.exe (PID: 2612)
      • WinDir.exe (PID: 1672)

    • Runs PING.EXE for delay simulation

      • cmd.exe (PID: 2428)

    • REMCOS RAT was detected

      • WinDir.exe (PID: 1672)

  • SUSPICIOUS

    • Unusual connect from Microsoft Office

      • WINWORD.EXE (PID: 2980)

    • Creates files in the user directory

      • EQNEDT32.EXE (PID: 2388)
      • WindowsSrv.exe (PID: 2612)
      • WinDir.exe (PID: 1672)

    • Executable content was dropped or overwritten

      • EQNEDT32.EXE (PID: 2388)
      • WindowsSrv.exe (PID: 2612)

    • Application launched itself

      • WindowsSrv.exe (PID: 2340)
      • WindowsSrv.exe (PID: 2716)
      • WinDir.exe (PID: 3720)

    • Starts CMD.EXE for commands execution

      • WindowsSrv.exe (PID: 2612)

  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2980)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2980)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.docx | Word Microsoft Office Open XML Format document (52.2)
.zip | Open Packaging Conventions container (38.8)
.zip | ZIP compressed archive (8.8)

EXIF

XMP

Creator: Microsoft

XML

ModifyDate: 2017:09:24 17:27:00Z
CreateDate: 2017:09:24 17:26:00Z
RevisionNumber: 1
LastModifiedBy: Microsoft
AppVersion: 14
HyperlinksChanged: No
SharedDoc: No
CharactersWithSpaces: 7
LinksUpToDate: No
Company: SPecialiST RePack
TitlesOfParts: -
HeadingPairs:
  • Название
  • 1
ScaleCrop: No
Paragraphs: 1
Lines: 1
DocSecurity: None
Application: Microsoft Office Word
Characters: 7
Words: 1
Pages: 1
TotalEditTime: 1 minute
Template: dotm.dotm

ZIP

ZipFileName: [Content_Types].xml
ZipUncompressedSize: 1422
ZipCompressedSize: 358
ZipCRC: 0x82872409
ZipModifyDate: 2019:01:09 04:15:04
ZipCompression: Deflated
ZipBitFlag: 0x0002
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
11
Malicious processes
7
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start winword.exe eqnedt32.exe windowssrv.exe no specs windowssrv.exe windowssrv.exe no specs cmd.exe no specs ping.exe no specs windir.exe no specs windowssrv.exe no specs #REMCOS windir.exe windir.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2980"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\Purchase Order.docx"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
2388"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
2340"C:\Users\admin\AppData\Roaming\WindowsSrv.exe" C:\Users\admin\AppData\Roaming\WindowsSrv.exe—EQNEDT32.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2612"C:\Users\admin\AppData\Roaming\WindowsSrv.exe" C:\Users\admin\AppData\Roaming\WindowsSrv.exe
WindowsSrv.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2716"C:\Users\admin\AppData\Roaming\WindowsSrv.exe" 2 2612 2199968C:\Users\admin\AppData\Roaming\WindowsSrv.exe—WindowsSrv.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2428cmd /c ""C:\Users\admin\AppData\Local\Temp\install.bat" "C:\Windows\system32\cmd.exe—WindowsSrv.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3416PING 127.0.0.1 -n 2 C:\Windows\system32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3720"C:\Users\admin\AppData\Roaming\WinDir\WinDir.exe" C:\Users\admin\AppData\Roaming\WinDir\WinDir.exe—cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3668"C:\Users\admin\AppData\Roaming\WindowsSrv.exe"C:\Users\admin\AppData\Roaming\WindowsSrv.exe—WindowsSrv.exe
User:
admin
Integrity Level:
MEDIUM
1672"C:\Users\admin\AppData\Roaming\WinDir\WinDir.exe" C:\Users\admin\AppData\Roaming\WinDir\WinDir.exe
WinDir.exe
User:
admin
Integrity Level:
MEDIUM
Total events
1 975
Read events
1 584
Write events
0
Delete events
0

Modification events

No data
Executable files
3
Suspicious files
24
Text files
8
Unknown types
2

Dropped files

PID
Process
Filename
Type
2980WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRE6F9.tmp.cvr —
MD5:—
SHA256:—
2980WINWORD.EXEC:\Users\admin\AppData\Local\Temp\{87F8C4B1-F288-4F27-95D4-1021E653E609} —
MD5:—
SHA256:—
2980WINWORD.EXEC:\Users\admin\AppData\Local\Temp\{B03A125E-8298-4604-B580-4B5B2FBA81D1} —
MD5:—
SHA256:—
2980WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\A9F47F90.doc —
MD5:—
SHA256:—
2980WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\E7D95C1E.doc —
MD5:—
SHA256:—
2980WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$rchase Order.docxpgc
MD5:D906F4735589D33D0425434DC842F1E6
SHA256:531282F05454D8442D83CE51C7BDC9A9A53DB913215BAFE5BCC422B2970A9822
2980WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-{7676C162-2602-456B-ACB2-E271D1EE9197}.FSDbinary
MD5:B9C4351E8A9A6C8C760EB47E3EEEB347
SHA256:EA26E666A31272D2092DCE4DFDE9D75A30049A93301247321C89C4929593374B
2980WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-CNRY.FSDbinary
MD5:85E8F6651044054CAB54481AF55475E2
SHA256:A20B083E4863CDE7490DFE6626728F0C504BFFE252AAF5977085292976ADFE8B
2980WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSDbinary
MD5:B1B040B6635722C4952A624803711E60
SHA256:57E85DC9457DA49DBAEAA30FC2953D7387BDD1BA6DBFE9EF6BF52982A2408001
2980WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSF-CTBL.FSFbinary
MD5:49680ACDFF7096877CD386B2AFB4F5DF
SHA256:25F0D395154C6E7783730D8B0810687A21D3098D5F33D04EE9F2DA1411AD90CF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
27
TCP/UDP connections
14
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2980
WINWORD.EXE
HEAD
200
64.32.6.209:80
http://micosoftoutlook.dns04.com/update/update.doc
US
—
—
malicious
2980
WINWORD.EXE
HEAD
200
64.32.6.209:80
http://micosoftoutlook.dns04.com/update/update.doc
US
—
—
malicious
2980
WINWORD.EXE
OPTIONS
200
64.32.6.209:80
http://micosoftoutlook.dns04.com/update/
US
—
—
malicious
976
svchost.exe
PROPFIND
405
64.32.6.209:80
http://micosoftoutlook.dns04.com/update/
US
html
243 b
malicious
976
svchost.exe
PROPFIND
301
64.32.6.209:80
http://micosoftoutlook.dns04.com/update
US
html
248 b
malicious
976
svchost.exe
PROPFIND
405
64.32.6.209:80
http://micosoftoutlook.dns04.com/update/
US
html
243 b
malicious
976
svchost.exe
OPTIONS
200
64.32.6.209:80
http://micosoftoutlook.dns04.com/update/
US
html
248 b
malicious
976
svchost.exe
PROPFIND
405
64.32.6.209:80
http://micosoftoutlook.dns04.com/update/
US
html
243 b
malicious
2980
WINWORD.EXE
HEAD
200
64.32.6.209:80
http://micosoftoutlook.dns04.com/update/update.doc
US
—
—
malicious
2980
WINWORD.EXE
GET
304
64.32.6.209:80
http://micosoftoutlook.dns04.com/update/update.doc
US
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2980
WINWORD.EXE
64.32.6.209:80
micosoftoutlook.dns04.com
Sharktech
US
malicious
976
svchost.exe
64.32.6.209:80
micosoftoutlook.dns04.com
Sharktech
US
malicious
2388
EQNEDT32.EXE
64.32.6.209:80
micosoftoutlook.dns04.com
Sharktech
US
malicious
1672
WinDir.exe
77.48.28.216:137
—
Liberty Global Operations B.V.
CZ
malicious

DNS requests

Domain
IP
Reputation
micosoftoutlook.dns04.com
  • 64.32.6.209
malicious
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

PID
Process
Class
Message
2980
WINWORD.EXE
A Network Trojan was detected
SC TROJAN_DOWNLOADER Suspicious DOC loader of embedded OLE from external source
2980
WINWORD.EXE
A Network Trojan was detected
MALWARE [PTsecurity] Possible RTF CVE-2017-11882 document
2388
EQNEDT32.EXE
A Network Trojan was detected
ET CURRENT_EVENTS Possible Malicious Macro DL EXE Feb 2016
2388
EQNEDT32.EXE
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
27 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Purchase Order.docx