analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

b8b359ddaa20e8cc58130c7148f764157c5594479a4df55d9064effa6a137275.rtf

Full analysis: https://app.any.run/tasks/8652bed5-34dd-40d3-b96a-6a15db2f91c1
Verdict: Malicious activity
Analysis date: March 22, 2019, 06:41:51
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ole-embedded
exploit
CVE-2017-11882
Indicators:
MIME: text/rtf
File info: Rich Text Format data, version 1, ANSI
MD5:

DC78C976EFD3351AAC7AC1F774A74A4D

SHA1:

2C32CC02A1FD25D398AE1C2BDE87D00BB47E443C

SHA256:

B8B359DDAA20E8CC58130C7148F764157C5594479A4DF55D9064EFFA6A137275

SSDEEP:

24576:4we1FjehAoZpB91lTuHvUfUu9j4ml/BGYwjs4syl15tEVSdDpCsBoFDkgR+y27g3:f

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executable content was dropped or overwritten

      • WINWORD.EXE (PID: 1048)

    • Equation Editor starts application (CVE-2017-11882)

      • EQNEDT32.EXE (PID: 2748)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • EQNEDT32.EXE (PID: 2748)

  • INFO

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 1048)

    • Application was crashed

      • EQNEDT32.EXE (PID: 2748)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 1048)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rtf | Rich Text Format (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
35
Monitored processes
3
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winword.exe eqnedt32.exe cmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1048"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\b8b359ddaa20e8cc58130c7148f764157c5594479a4df55d9064effa6a137275.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
2748"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
3540cmd.exe /c %temp%\hola.exe A CC:\Windows\system32\cmd.exe—EQNEDT32.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Total events
1 099
Read events
716
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
0
Text files
0
Unknown types
3

Dropped files

PID
Process
Filename
Type
1048WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRCC9D.tmp.cvr —
MD5:—
SHA256:—
1048WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$b359ddaa20e8cc58130c7148f764157c5594479a4df55d9064effa6a137275.rtfpgc
MD5:662BA4D1CFA24E03DAD41DA6419E6CCA
SHA256:0321097A6C60153F1057F0C103FF42797E5AFC6D6ACE00628B06D3C9D66D0FA1
1048WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:83668B130217059B5893F32BC0EA5CB8
SHA256:3FA926511F02224FCE99AD57CC8FFE65BE835045B020116B9A3827B2A36598E9
1048WINWORD.EXEC:\Users\admin\AppData\Local\Temp\hola.exeexecutable
MD5:38D7F97F8E004C2027C9D8B4DC4C47B0
SHA256:D7CAEF0CEE0C89EC6AB96CB87A4B677CF84D7BF3498C9A30BCE8CBC2F60661A2
1048WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\D34A66DA.wmfwmf
MD5:95BB648D6EB9265EEAF0F889731B1E23
SHA256:9639441A9D36E7E4FDA980961B75EEB334540B8CFBCEE71EB3CD857E0A838E0C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
b8b359ddaa20e8cc58130c7148f764157c5594479a4df55d9064effa6a137275.rtf