analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Afras USA PO 3546.doc

Full analysis: https://app.any.run/tasks/ed86d197-bc20-479c-b298-84082b550413
Verdict: Malicious activity
Analysis date: January 23, 2019, 10:48:21
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ole-embedded
Indicators:
MIME: text/rtf
File info: Rich Text Format data, version 1, unknown character set
MD5:

112BB054B7BD80238EC5AE7E01D37CEB

SHA1:

538F41BA7210B1966DB66DC645ADF5DCF13C3A65

SHA256:

C9C61C6065A6F545557FBEF5DBFC7223022259C5F8419A74CBFAF742BFCE6FFD

SSDEEP:

12288:zPPZ5ha1mi0UNOtrH9uA8hE47nJF/xNXqKIopHE79LS+4a1PpF84Ji6mE1S+0luT:zPLha1mi0U6rH9T8B7PEUk79LS+4OPpf

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts CMD.EXE for commands execution

      • WINWORD.EXE (PID: 2880)

    • Runs app for hidden code execution

      • cmd.exe (PID: 3952)
      • cmd.exe (PID: 2612)

    • Unusual execution from Microsoft Office

      • WINWORD.EXE (PID: 2880)

    • Application was dropped or rewritten from another process

      • saver.scr (PID: 3796)
      • Host.exe (PID: 3108)
      • Saver.SCR (PID: 2608)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 3952)
      • cmd.exe (PID: 2612)
      • cmd.exe (PID: 2360)
      • cmd.exe (PID: 2632)

    • Executable content was dropped or overwritten

      • cscript.exe (PID: 2232)
      • Saver.SCR (PID: 2608)

    • Executes scripts

      • cmd.exe (PID: 2632)

    • Uses REG.EXE to modify Windows registry

      • cmd.exe (PID: 2632)
      • cmd.exe (PID: 1760)
      • cmd.exe (PID: 3204)
      • cmd.exe (PID: 3548)
      • cmd.exe (PID: 3096)
      • cmd.exe (PID: 2364)
      • cmd.exe (PID: 3172)

    • Uses TASKKILL.EXE to kill Office Apps

      • cmd.exe (PID: 2632)

    • Application launched itself

      • cmd.exe (PID: 2632)
      • saver.scr (PID: 3796)

    • Starts application with an unusual extension

      • cmd.exe (PID: 2632)
      • saver.scr (PID: 3796)

    • Creates files in the user directory

      • Saver.SCR (PID: 2608)

    • Starts itself from another location

      • Saver.SCR (PID: 2608)

  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2880)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2880)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rtf | Rich Text Format (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
70
Monitored processes
39
Malicious processes
6
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start winword.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs timeout.exe no specs timeout.exe no specs timeout.exe no specs cmd.exe no specs timeout.exe no specs timeout.exe no specs cmd.exe no specs timeout.exe no specs timeout.exe no specs timeout.exe no specs timeout.exe no specs cscript.exe taskkill.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs saver.scr no specs cscript.exe no specs saver.scr host.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2880"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\Afras USA PO 3546.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
1
Version:
14.0.6024.1000
3952"C:\Windows\System32\cmd.exe" /C CmD < "C:\Users\admin\AppData\Local\Temp\ufFm.cMD"C:\Windows\System32\cmd.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2360CmD C:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2632C:\Windows\system32\cmd.exe /K itnqknf5.CMDC:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3184TIMEOUT /T 1C:\Windows\system32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3644TIMEOUT /T 1 C:\Windows\system32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
4084TIMEOUT /T 1 C:\Windows\system32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2612"C:\Windows\System32\cmd.exe" /C CmD < "C:\Users\admin\AppData\Local\Temp\ufFm.cMD"C:\Windows\System32\cmd.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2692TIMEOUT /T 1 C:\Windows\system32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3396TIMEOUT /T 1 C:\Windows\system32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
1 481
Read events
1 448
Write events
30
Delete events
3

Modification events

(PID) Process:(2880) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:writeName:9$
Value:
397F2400400B0000010000000000000000000000
(PID) Process:(2880) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
Off
(PID) Process:(2880) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
On
(PID) Process:(2880) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:WORDFiles
Value:
1312227358
(PID) Process:(2880) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:ProductFiles
Value:
1312227472
(PID) Process:(2880) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:ProductFiles
Value:
1312227473
(PID) Process:(2880) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word
Operation:writeName:MTTT
Value:
400B0000B067EE3909B3D40100000000
(PID) Process:(2880) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:writeName:-a$
Value:
2D612400400B000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000
(PID) Process:(2880) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:delete valueName:-a$
Value:
2D612400400B000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000
(PID) Process:(2880) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
Executable files
2
Suspicious files
4
Text files
13
Unknown types
3

Dropped files

PID
Process
Filename
Type
2880WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR9BB9.tmp.cvr —
MD5:—
SHA256:—
2232cscript.exeC:\Users\admin\AppData\Local\Temp\gondi.docdocument
MD5:A708A92F9C95AED4BDFF6D976F889763
SHA256:059E7B288D7B7F169200C3E0EE6ACC77E6B6B6753E4CD58058EAFBEB1351340D
2880WINWORD.EXEC:\Users\admin\AppData\Local\Temp\a.ScTxml
MD5:B079D52F89759AB61A9B7EFA9367CA17
SHA256:A9EEF1BEA82EBAF0F71E356D77EC980FA087F56F6C665C58011BCB6FA98E4501
2880WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{F34CF3D5-131D-478F-ABFE-73294A69B807}.tmpbinary
MD5:E664589D58EF9BB3BE96ACFC4CA4C9C6
SHA256:81BBC94F294895C9A9716390F3F7D7719D7529CD81EE9F26EB9084015D4477E2
2880WINWORD.EXEC:\Users\admin\AppData\Local\Temp\itnqknf5.cmdtext
MD5:0C9003B594F4B692933844ABCF070BDD
SHA256:927BD846EC7AF587B5A06579545F83161AE570A4F046D6386E6AE73A00B9ADF7
2232cscript.exeC:\Users\admin\AppData\Local\Temp\saver.screxecutable
MD5:D211FDDED84B1A605532FE4539BEADB4
SHA256:3E5AD2242206BA3F7F84096588A9738A553295CF0A7A6E7BFABC1FC042509360
2632cmd.exeC:\Users\admin\AppData\Local\Temp\_.vbstext
MD5:778643D184339788FEAD87C5043A6BEA
SHA256:FFEDB6EF220F09EC30ECAD07D897C14F59591A2F05D160308C11FC763AFF6060
2880WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:41379A924454D4DBF21EC8153C20C10F
SHA256:0C15CF2B44D7D8698623838B4214E135CD0F5B33F8FE0D860DBE04AB98A65B80
2880WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{4E0FCACC-C084-47EE-9E79-E7B760733F9B}.tmpbinary
MD5:E9FA09CECA1AF2ECA7C192E1F9E3481A
SHA256:2EC5F21D58DC0EEF40544B1ED01EB695AA1BF7109362037D226D0155C75661BC
2880WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$ras USA PO 3546.docpgc
MD5:15FE141FA37AEAE02B3377E53DF8D6D1
SHA256:6DCAB103BA731DF79391F0A5681D6120AA203B028FE3B170257270766FB36D58
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Afras USA PO 3546.doc