analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

1107018 quote.doc

Full analysis: https://app.any.run/tasks/110a45b6-d16c-4573-8a18-31e17e753e90
Verdict: Malicious activity
Analysis date: November 08, 2018, 06:52:53
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ole-embedded
exploit
CVE-2017-11882
Indicators:
MIME: text/rtf
File info: Rich Text Format data, version 1, unknown character set
MD5:

EC4D83447D03BCD8EE4EFE33D5FEA155

SHA1:

07587AA6E9A5C17239A269FA5B72DBCF30BA85FC

SHA256:

958145EB55E0D378EF48CFF117305E949D567465458E9A571734AF780CC53D87

SSDEEP:

6144:7RoZ+Zt4joNBABxMJ21Kzjfwe226babZc+P9oqyAjgiSCgaKN9jf7rD4x:7RoZ+ZmBxMDjpR6babycoqBcJCgdZzvO

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Executable content was dropped or overwritten

      • WINWORD.EXE (PID: 1688)
    • Starts CMD.EXE for commands execution

      • WINWORD.EXE (PID: 1688)
    • Runs app for hidden code execution

      • cmd.exe (PID: 2788)
      • cmd.exe (PID: 2016)
    • Unusual execution from Microsoft Office

      • WINWORD.EXE (PID: 1688)
    • Application was dropped or rewritten from another process

      • mondi.exe (PID: 1772)
    • Equation Editor starts application (CVE-2017-11882)

      • EQNEDT32.EXE (PID: 4092)
  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 2016)
      • cmd.exe (PID: 3484)
      • cmd.exe (PID: 2788)
      • EQNEDT32.EXE (PID: 4092)
    • Executable content was dropped or overwritten

      • mondi.exe (PID: 1772)
    • Uses TASKKILL.EXE to kill Office Apps

      • cmd.exe (PID: 3496)
  • INFO

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 1688)
    • Creates files in the user directory

      • WINWORD.EXE (PID: 1688)
    • Application was crashed

      • EQNEDT32.EXE (PID: 4092)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rtf | Rich Text Format (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
49
Monitored processes
11
Malicious processes
2
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winword.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs timeout.exe no specs cmd.exe no specs mondi.exe taskkill.exe no specs eqnedt32.exe cmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1688"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\1107018 quote.doc.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
1
Version:
14.0.6024.1000
2788"C:\Windows\System32\cmd.exe" /C CmD < "C:\Users\admin\AppData\Local\Temp\dqfm.cMd"C:\Windows\System32\cmd.exeWINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3484CmD C:\Windows\system32\cmd.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3496C:\Windows\system32\cmd.exe /K C:\Users\admin\AppData\Local\Temp\"hondi.cmd"C:\Windows\system32\cmd.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2016"C:\Windows\System32\cmd.exe" /C CmD < "C:\Users\admin\AppData\Local\Temp\dqfm.cMd"C:\Windows\System32\cmd.exeWINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
1464TIMEOUT 1 C:\Windows\system32\timeout.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
4032CmD C:\Windows\system32\cmd.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
1772C:\Users\admin\AppData\Local\Temp\mondi.eXe C:\Users\admin\AppData\Local\Temp\mondi.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
2256TaSkKILL /F /IM winword.exe /TC:\Windows\system32\taskkill.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
4092"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Version:
00110900
Total events
643
Read events
621
Write events
21
Delete events
1

Modification events

(PID) Process:(1688) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:writeName:iwj
Value:
69776A0098060000010000000000000000000000
(PID) Process:(1688) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
Off
(PID) Process:(1688) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
On
(PID) Process:(1688) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:WORDFiles
Value:
1298661391
(PID) Process:(1688) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:ProductFiles
Value:
1298661504
(PID) Process:(1688) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:ProductFiles
Value:
1298661505
(PID) Process:(1688) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word
Operation:writeName:MTTT
Value:
98060000025EF1B82F77D40100000000
(PID) Process:(1688) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:writeName:1xj
Value:
31786A009806000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000
(PID) Process:(1688) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:delete valueName:1xj
Value:
31786A009806000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000
(PID) Process:(1688) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
Executable files
3
Suspicious files
1
Text files
5
Unknown types
3

Dropped files

PID
Process
Filename
Type
1688WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR9F49.tmp.cvr
MD5:
SHA256:
1688WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\C3C21CA.png
MD5:
SHA256:
1688WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:CC241CBE453475E8F8171B4F2646855D
SHA256:A2EB6C3F36EADCFE5C638DBB6AB89AB42400F4E039E89525E157CD8BCBF41F8A
1688WINWORD.EXEC:\Users\admin\AppData\Local\Temp\dqfm.cmdtext
MD5:24A0E12969C61D7FD4F947C3BEAC3FA0
SHA256:6FD5C00260692D64082411A0CCFC260485D678F8AEC610E3DC51AEF5070CE5E8
1688WINWORD.EXEC:\Users\admin\AppData\Local\Temp\trbatehtqevyay.ScTxml
MD5:29BEC7D4538EF7E4E8F785FD57AA1687
SHA256:A181AE53C94A7AA890CBEE613904D1E01836C99EA877D1580EBC1C2CA8C6BE72
1688WINWORD.EXEC:\Users\admin\AppData\Local\Temp\hondi.cmdtext
MD5:CDA919F76F7A3F7C4432A44BE93D4FF9
SHA256:5576D368B5565105FF2913FC987B34AF8D8F291DD2ED11FB8E8564B744E1D495
1772mondi.exeC:\Users\admin\AppData\Local\Temp\halves.dllexecutable
MD5:107F773DB9EA2FDDFCFA43A388C16E8A
SHA256:5F94751141D3203DB1D389CB12CE3C71C8F7BB03984B45BF2FA576590A75B5EB
1688WINWORD.EXEC:\Users\admin\AppData\Local\Temp\gondi.doctext
MD5:B3129B6A95DB680CF911660AB17D7A13
SHA256:56232B5BE28B819DC07AF5450612928F51FE29CFAA6BFE86A3DFDBFC3C5EE3B2
1688WINWORD.EXEC:\Users\admin\Desktop\~$07018 quote.doc.rtfpgc
MD5:5E0A63EAAB8E7FD35406F5B7D7182F7C
SHA256:E8043E27870EB18AA466DEAC7A736E36974513E69F4A98FE034D03CEFFEEB273
1688WINWORD.EXEC:\Users\admin\AppData\Local\Temp\mondi.exeexecutable
MD5:B69F36AC70CA86190C71A5D1ABD575C0
SHA256:BDD0956D40088A8DA1CE810C4666931BBF41FDA7E3A71FF66DA95C5DA4E66CDC
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info