File name:

unionreturns.rtf.exe

Full analysis: https://app.any.run/tasks/706ebf1a-5aa2-4970-8c95-20ec04f033c4
Verdict: Malicious activity
Analysis date: December 02, 2023, 21:13:39
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

4C2ED6148F7E4787FD8D1017BD81CC11

SHA1:

6ACF9A455C5CABE93D4AA625E7B70BC42200A533

SHA256:

B73C950CCC87F4C49A9A5AC1B5E28936B07F40CEF46CFAC60C0ED43D15F2D994

SSDEEP:

24576:1oFbrcrnIxMfzcayo389j1GwZlZ/Zvi4z/v6HsEnWeonu2NAz1tsliem9B:1oFbrcrnIxMfzcayo389j1GwZlZ/ZviL

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • devenv.exe (PID: 1640)
      • unionreturns.rtf.exe (PID: 2644)

    • Changes appearance of the Explorer extensions

      • unionreturns.rtf.exe (PID: 2644)
      • unionreturns.rtf.exe (PID: 240)

    • Actions looks like stealing of personal data

      • unionreturns.rtf.exe (PID: 2644)

    • Changes the autorun value in the registry

      • unionreturns.rtf.exe (PID: 240)

    • Steals credentials from Web Browsers

      • unionreturns.rtf.exe (PID: 2644)

  • SUSPICIOUS

    • Detected use of alternative data streams (AltDS)

      • unionreturns.rtf.exe (PID: 2644)

    • Reads the Internet Settings

      • unionreturns.rtf.exe (PID: 2644)
      • devenv.exe (PID: 1640)
      • unionreturns.rtf.exe (PID: 240)

    • Creates/Modifies COM task schedule object

      • WINWORD.EXE (PID: 2988)

    • Connects to unusual port

      • admtools.exe (PID: 3064)

    • Changes default file association

      • WINWORD.EXE (PID: 2988)

  • INFO

    • Checks supported languages

      • unionreturns.rtf.exe (PID: 2644)
      • devenv.exe (PID: 1640)
      • admtools.exe (PID: 3064)
      • wmpnscfg.exe (PID: 2108)
      • unionreturns.rtf.exe (PID: 240)

    • Reads the computer name

      • unionreturns.rtf.exe (PID: 2644)
      • devenv.exe (PID: 1640)
      • admtools.exe (PID: 3064)
      • wmpnscfg.exe (PID: 2108)
      • unionreturns.rtf.exe (PID: 240)

    • Reads the machine GUID from the registry

      • unionreturns.rtf.exe (PID: 2644)
      • admtools.exe (PID: 3064)
      • devenv.exe (PID: 1640)
      • unionreturns.rtf.exe (PID: 240)

    • Creates files or folders in the user directory

      • unionreturns.rtf.exe (PID: 2644)

    • Checks proxy server information

      • devenv.exe (PID: 1640)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 2108)
      • unionreturns.rtf.exe (PID: 240)

    • Create files in a temporary directory

      • unionreturns.rtf.exe (PID: 2644)

    • Reads Microsoft Office registry keys

      • unionreturns.rtf.exe (PID: 240)
      • unionreturns.rtf.exe (PID: 2644)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (62)
.exe | Win64 Executable (generic) (23.3)
.dll | Win32 Dynamic Link Library (generic) (5.5)
.exe | Win32 Executable (generic) (3.8)
.exe | Win16/32 Executable Delphi generic (1.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2105:05:31 07:12:31+02:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 80
CodeSize: 558080
InitializedDataSize: 117248
UninitializedDataSize: -
EntryPoint: 0x8a2ce
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 4.2.51.0
ProductVersionNumber: 4.2.51.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: -
FileVersion: 4.2.51.0
InternalName: -.exe
LegalCopyright: © Microsoft Corporation
LegalTrademarks: -
OriginalFileName: -.exe
ProductName: -
ProductVersion: 4.2.51.0
AssemblyVersion: 4.2.51.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
49
Monitored processes
6
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start unionreturns.rtf.exe devenv.exe no specs admtools.exe wmpnscfg.exe no specs unionreturns.rtf.exe winword.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
240"C:\Users\admin\Desktop\unionreturns.rtf.exe" C:\Users\admin\Desktop\unionreturns.rtf.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
4.2.51.0
Modules
Images
c:\users\admin\desktop\unionreturns.rtf.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1640"C:\Users\Public\Documents\devenv.exe" C:\Users\Public\Documents\devenv.exe—unionreturns.rtf.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
0.0.0.0
Modules
Images
c:\users\public\documents\devenv.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2108"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2644"C:\Users\admin\Desktop\unionreturns.rtf.exe" C:\Users\admin\Desktop\unionreturns.rtf.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
4.2.51.0
Modules
Images
c:\users\admin\desktop\unionreturns.rtf.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2988"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\unionreturns.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—unionreturns.rtf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
3064"C:\Users\Public\Documents\admtools.exe" C:\Users\Public\Documents\admtools.exe
unionreturns.rtf.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\public\documents\admtools.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
5 115
Read events
4 596
Write events
360
Delete events
159

Modification events

(PID) Process:(2644) unionreturns.rtf.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2644) unionreturns.rtf.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2644) unionreturns.rtf.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2644) unionreturns.rtf.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2644) unionreturns.rtf.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Operation:writeName:Hidden
Value:
1
(PID) Process:(2644) unionreturns.rtf.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Operation:writeName:HideFileExt
Value:
0
(PID) Process:(1640) devenv.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1640) devenv.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1640) devenv.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(1640) devenv.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000005A010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
1 096
Suspicious files
5
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2644unionreturns.rtf.exeC:\Users\admin\NTUSER.DAT.exeexecutable
MD5:4C2ED6148F7E4787FD8D1017BD81CC11
SHA256:B73C950CCC87F4C49A9A5AC1B5E28936B07F40CEF46CFAC60C0ED43D15F2D994
1640devenv.exeC:\Users\Public\Documents\p2p.dllexecutable
MD5:6CFFF9C292A1BB84D395AF36A514B969
SHA256:A3967A0CC27A52334C159387BE84DBA99EC5F5F2978260F6B1E3AFA648A060DB
2644unionreturns.rtf.exeC:\Users\admin\AppData\Local\Temp\RCX6B42.tmpexecutable
MD5:4C2ED6148F7E4787FD8D1017BD81CC11
SHA256:B73C950CCC87F4C49A9A5AC1B5E28936B07F40CEF46CFAC60C0ED43D15F2D994
2644unionreturns.rtf.exeC:\Users\admin\ntuser.dat.LOG1.exeexecutable
MD5:4C2ED6148F7E4787FD8D1017BD81CC11
SHA256:B73C950CCC87F4C49A9A5AC1B5E28936B07F40CEF46CFAC60C0ED43D15F2D994
2644unionreturns.rtf.exeC:\Users\admin\AppData\Local\Temp\RCX6B63.tmpexecutable
MD5:816736344C21EC110D9B944C2A2C83C8
SHA256:D894376711656D8DA5F3EB5971F88B15C9A9BE526701D37ED2E7897036173171
2644unionreturns.rtf.exeC:\Users\Public\Documents\devenv.exeexecutable
MD5:3FE2B1337F824DFCBF545CCFFB5454F3
SHA256:001D3941132DD30110E1A650ABBC4DD49D352F06D08D491A4F6503ACFF875E67
2644unionreturns.rtf.exeC:\Users\admin\AppData\Local\Temp\RCX6BC3.tmpexecutable
MD5:0CCEF3AE5F7A2CCDB0E0973DEF563328
SHA256:A4F9065043E552253F14BED9A0C4C5934D68991061EB7A0DB18F99223ABE9D99
2644unionreturns.rtf.exeC:\Users\admin\AppData\Local\Temp\RCX6BE4.tmpexecutable
MD5:4C2ED6148F7E4787FD8D1017BD81CC11
SHA256:B73C950CCC87F4C49A9A5AC1B5E28936B07F40CEF46CFAC60C0ED43D15F2D994
2644unionreturns.rtf.exeC:\Users\admin\AppData\Local\Temp\RCX6C27.tmpexecutable
MD5:81078B783B885C5D96384FB3D4A9AF4F
SHA256:023A2FEBEEB802D2C98F04937E9287F5CB469735727EAAC98A65144360563F23
2644unionreturns.rtf.exeC:\Users\admin\AppData\Local\Temp\RCX6C48.tmpexecutable
MD5:4C2ED6148F7E4787FD8D1017BD81CC11
SHA256:B73C950CCC87F4C49A9A5AC1B5E28936B07F40CEF46CFAC60C0ED43D15F2D994
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
7
DNS requests
2
Threats
1

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3064
admtools.exe
45.84.227.157:50
pex.0x01.cf
Beget LLC
RU
unknown

DNS requests

Domain
IP
Reputation
api.peer2profit.com
  • —
unknown
pex.0x01.cf
  • 45.84.227.157
unknown

Threats

PID
Process
Class
Message
1080
svchost.exe
Misc activity
ET INFO DNS Query for Suspicious .cf Domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
unionreturns.rtf.exe