File name:

metrofax.doc

Full analysis: https://app.any.run/tasks/c39a0869-52dd-479c-947b-061186743cee
Verdict: Malicious activity
Threats:

Pony is a malware with two main functions — stealing information and dropping other viruses with different tasks on infected machines. It has been around since 2011, and it still actively attacks users in Europe and America.

Malware Trends Tracker     >>>
Analysis date: February 13, 2024, 18:48:47
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
ole-embedded
macros-on-open
trojan
pony
fareit
raccoon
stealer
Indicators:
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1251, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Tue Dec 22 08:04:00 2015, Last Saved Time/Date: Tue Dec 22 13:09:00 2015, Number of Pages: 1, Number of Words: 6, Number of Characters: 37, Security: 0
MD5:

28E855032F83ADBD2D8499AF6D2D0E22

SHA1:

6B590325E2E465D9762FA5D1877846667268558A

SHA256:

B13B29772C29CCB412D6AB360FF38525836FCF0F65BE637A7945A83A446DFD5E

SSDEEP:

3072:zVIfFuR6AqFMa2fL3NtkWL90y7K4mlQCww7zDTW6HNRn0nPmawH:zVIf8RsOtZclptz78PkH

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executable content was dropped or overwritten

      • WINWORD.EXE (PID: 2036)

    • Drops the executable file immediately after the start

      • WINWORD.EXE (PID: 3668)

    • Unusual execution from MS Office

      • WINWORD.EXE (PID: 3668)

    • Pony/Fareit Trojan is detected

      • 8tr.exe (PID: 3948)

    • Raccoon mutex has been detected

      • 8tr.exe (PID: 3948)

    • Steals credentials from Web Browsers

      • 8tr.exe (PID: 3948)

    • Actions looks like stealing of personal data

      • 8tr.exe (PID: 3948)

  • SUSPICIOUS

    • Searches for installed software

      • 8tr.exe (PID: 3948)

    • Starts CMD.EXE for commands execution

      • 8tr.exe (PID: 3948)

    • Loads DLL from Mozilla Firefox

      • 8tr.exe (PID: 3948)

    • Reads the Internet Settings

      • 8tr.exe (PID: 3948)

    • Runs shell command (SCRIPT)

      • WINWORD.EXE (PID: 3668)

    • Process requests binary or script from the Internet

      • 8tr.exe (PID: 3948)

    • Reads security settings of Internet Explorer

      • 8tr.exe (PID: 3948)

    • Executing commands from a ".bat" file

      • 8tr.exe (PID: 3948)

    • Accesses Microsoft Outlook profiles

      • 8tr.exe (PID: 3948)

  • INFO

    • Drops the executable file immediately after the start

      • WINWORD.EXE (PID: 2036)

    • The process uses the downloaded file

      • WINWORD.EXE (PID: 2036)

    • Checks supported languages

      • 8tr.exe (PID: 3948)

    • Reads the computer name

      • 8tr.exe (PID: 3948)

    • Manual execution by a user

      • WINWORD.EXE (PID: 2908)

    • Create files in a temporary directory

      • 8tr.exe (PID: 3948)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (35.9)
.xls | Microsoft Excel sheet (33.7)
.doc | Microsoft Word document (old ver.) (21.3)

EXIF

FlashPix

Identification: Word 8.0
LanguageCode: Russian
DocFlags: Has picture, 1Table, ExtChar
System: Windows
Word97: No
Title: -
Subject: -
Author: -
Keywords: -
Comments: -
Template: Normal.dotm
LastModifiedBy: -
Software: Microsoft Office Word
CreateDate: 2015:12:22 08:04:00
ModifyDate: 2015:12:22 13:09:00
Security: None
CodePage: Windows Cyrillic
Company: -
CharCountWithSpaces: 42
AppVersion: 15
ScaleCrop: No
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
TitleOfParts: -
HeadingPairs:
  • Название
  • 1
CompObjUserTypeLen: 32
CompObjUserType: ???????? Microsoft Word 97-2003
LastPrinted: 0000:00:00 00:00:00
RevisionNumber: 1
TotalEditTime: -
Words: 6
Characters: 37
Pages: 1
Paragraphs: 1
Lines: 1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
50
Monitored processes
7
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winword.exe no specs winword.exe #PONY 8tr.exe cmd.exe no specs PhotoViewer.dll no specs winword.exe no specs cmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1368C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\1790312.bat" "C:\Users\admin\AppData\Local\Temp\8tr.exe" "C:\Windows\System32\cmd.exe—8tr.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1836C:\Windows\system32\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}C:\Windows\System32\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2036"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -EmbeddingC:\Program Files\Microsoft Office\Office14\WINWORD.EXE
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
2908"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\willdisease.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
3668"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\metrofax.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
3932cmd /KC:\Windows\System32\cmd.exe—8tr.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3948C:\Users\admin\AppData\Local\Temp\8tr.exeC:\Users\admin\AppData\Local\Temp\8tr.exe
WINWORD.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\8tr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
Total events
22 663
Read events
20 790
Write events
1 135
Delete events
738

Modification events

(PID) Process:(3668) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:writeName:9h&
Value:
39682600540E0000010000000000000000000000
(PID) Process:(3668) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
Off
(PID) Process:(3668) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1041
Value:
Off
(PID) Process:(3668) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1046
Value:
Off
(PID) Process:(3668) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1036
Value:
Off
(PID) Process:(3668) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1031
Value:
Off
(PID) Process:(3668) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1040
Value:
Off
(PID) Process:(3668) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1049
Value:
Off
(PID) Process:(3668) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:3082
Value:
Off
(PID) Process:(3668) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1042
Value:
Off
Executable files
2
Suspicious files
12
Text files
6
Unknown types
3

Dropped files

PID
Process
Filename
Type
3668WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRF099.tmp.cvr —
MD5:—
SHA256:—
2036WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRFB77.tmp.cvr —
MD5:—
SHA256:—
2908WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRF018.tmp.cvr —
MD5:—
SHA256:—
3668WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~WRD0000.tmptext
MD5:266D5AD67EE3C4FEAF46EE0B22A13DDC
SHA256:44D3CAB03C1B908631C8F21DD34AB6462FDEA653BD565A8D721A457A00DAE91C
3668WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$trofax.docbinary
MD5:86A78EB038671E858A6F86F3F03E7AE2
SHA256:9D9710414DB3E5FF20595031E3034BA5DEE875E29CF40F057A64CC181C04280B
3668WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmbinary
MD5:9EFC7D9F08582EE73E789BC68B6D7879
SHA256:8E9379D141217F5345DCEC93121FB2DB6A14F1FD93A1D4269D97A60BED52B254
3668WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$fygbf.rtfbinary
MD5:CD340BB712FF78E84106E451396AA989
SHA256:E0EEBFDC9B9E94E4079CB13D52091BB58721A4BF5FD97269A0A90E960B58C2B6
3668WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$vbhja.rtfbinary
MD5:DB3F5EF7307927B21AC8FFAEAF891702
SHA256:506990E7A3FB23F802FE9FA2376A7EE1F1F5D5A9DD74A1F91B487066FC9EFE55
3668WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\90C75198.emfbinary
MD5:0ED5BC16545D23C325D756013579A697
SHA256:3E430584CD9774EA3B21D8E19B485B48212FE356776158DD5F3C5F63A5BDE7D3
2036WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$vbhja.rtfpgc
MD5:26A3347730F2133DC1FEA578EA2EE4D0
SHA256:D17F5A1B11D5563D360F06C845A05C7E734F293FAE8F6B35FAE21A20E7C27FCA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
6
DNS requests
9
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3948
8tr.exe
GET
404
177.53.141.201:80
http://www.dgfcomercial.com.br/wp-content/plugins/prism-highlight/opera1.exe
unknown
html
315 b
unknown
3948
8tr.exe
GET
301
177.53.141.201:80
http://dgfcomercial.com.br/wp-content/plugins/prism-highlight/opera1.exe
unknown
html
284 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
3948
8tr.exe
177.53.141.201:80
dgfcomercial.com.br
Brasil Site Informatica LTDA
BR
unknown

DNS requests

Domain
IP
Reputation
fouseevenghedt.ru
  • —
unknown
biledroben.ru
  • —
unknown
rohironrof.ru
  • —
unknown
eloraestate.com
  • —
unknown
edmontonlimo247.com
  • —
unknown
dgfcomercial.com.br
  • 177.53.141.201
unknown
www.dgfcomercial.com.br
  • 177.53.141.201
unknown

Threats

PID
Process
Class
Message
3948
8tr.exe
A Network Trojan was detected
ET MALWARE Possible Graftor EXE Download Common Header Order
3948
8tr.exe
A Network Trojan was detected
ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious
3948
8tr.exe
A Network Trojan was detected
ET MALWARE Possible Graftor EXE Download Common Header Order
3948
8tr.exe
A Network Trojan was detected
ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
metrofax.doc