analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

DOC11121198D11.doc

Full analysis: https://app.any.run/tasks/465df5c7-555a-4a45-958e-068867ee045d
Verdict: Malicious activity
Threats:

Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.

Malware Trends Tracker     >>>
Analysis date: December 06, 2018, 17:40:48
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
exploit
CVE-2017-11882
autoit
evasion
trojan
rat
agenttesla
Indicators:
MIME: text/plain
File info: ASCII text, with CRLF, LF line terminators
MD5:

D02FDC58DE9E4DBC5FA3DAF733D4EB66

SHA1:

A7870A55D3B59FA5A75A2A52A184891E8B6D0171

SHA256:

CFE255F42512BD4277F292B5EFDFD1BF69B75D97A813E400FB9B0181358F649A

SSDEEP:

98304:R+Oc3Md7bH7KNxpYpacX9+IhET5OIRafQU1qvJ3FmcbtkOa/MXznUVpiM8A/h9sd:R+Oc3Md7bHGNxGpacX9DhET5JRafQUA7

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Equation Editor starts application (CVE-2017-11882)

      • EQNEDT32.EXE (PID: 3968)

    • Executable content was dropped or overwritten

      • WINWORD.EXE (PID: 3076)

    • Application was dropped or rewritten from another process

      • dejiii.exe (PID: 3056)
      • jsr.exe (PID: 3316)
      • jsr.exe (PID: 2740)
      • RegSvcs.exe (PID: 2436)
      • RegSvcs.exe (PID: 3316)

    • Changes the autorun value in the registry

      • jsr.exe (PID: 2740)
      • RegSvcs.exe (PID: 2436)

    • AGENTTESLA was detected

      • RegSvcs.exe (PID: 2436)

    • Actions looks like stealing of personal data

      • RegSvcs.exe (PID: 2436)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • EQNEDT32.EXE (PID: 3968)

    • Executable content was dropped or overwritten

      • dejiii.exe (PID: 3056)
      • RegSvcs.exe (PID: 2436)

    • Drop AutoIt3 executable file

      • dejiii.exe (PID: 3056)

    • Application launched itself

      • jsr.exe (PID: 3316)

    • Checks for external IP

      • RegSvcs.exe (PID: 2436)

    • Reads Windows Product ID

      • RegSvcs.exe (PID: 2436)

    • Creates files in the user directory

      • RegSvcs.exe (PID: 2436)

    • Connects to SMTP port

      • RegSvcs.exe (PID: 2436)

    • Loads DLL from Mozilla Firefox

      • RegSvcs.exe (PID: 2436)

  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 3076)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 3076)

    • Application was crashed

      • EQNEDT32.EXE (PID: 3968)

    • Dropped object may contain Bitcoin addresses

      • jsr.exe (PID: 3316)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
8
Malicious processes
6
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start winword.exe eqnedt32.exe cmd.exe no specs dejiii.exe jsr.exe no specs jsr.exe #AGENTTESLA regsvcs.exe regsvcs.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3076"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\DOC11121198D11.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
3968"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
2592cmd.exe /c%temp%\dejiii.exe A CC:\Windows\system32\cmd.exe—EQNEDT32.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3056C:\Users\admin\AppData\Local\Temp\dejiii.exe A CC:\Users\admin\AppData\Local\Temp\dejiii.exe
cmd.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
VirtualBox
Exit code:
0
Version:
5.2.18.124319
3316"C:\Users\admin\AppData\Local\Temp\23981422\jsr.exe" fca=bww C:\Users\admin\AppData\Local\Temp\23981422\jsr.exe—dejiii.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script
Exit code:
0
Version:
3, 3, 14, 2
2740C:\Users\admin\AppData\Local\Temp\23981422\jsr.exe C:\Users\admin\AppData\Local\Temp\23981422\FZFXXC:\Users\admin\AppData\Local\Temp\23981422\jsr.exe
jsr.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script
Exit code:
0
Version:
3, 3, 14, 2
2436"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
jsr.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Services Installation Utility
Version:
4.6.1055.0 built by: NETFXREL2
3316"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe—jsr.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Services Installation Utility
Exit code:
1
Version:
4.6.1055.0 built by: NETFXREL2
Total events
2 038
Read events
1 614
Write events
0
Delete events
0

Modification events

No data
Executable files
3
Suspicious files
0
Text files
47
Unknown types
2

Dropped files

PID
Process
Filename
Type
3076WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRAF8D.tmp.cvr —
MD5:—
SHA256:—
3076WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:4F5F40C47DDD92765B47161B15380CF9
SHA256:3A34E29F643B0F7C1B38279E3FA88B8310EFE43FDAF57CAE22CE4944767D3F29
3056dejiii.exeC:\Users\admin\AppData\Local\Temp\23981422\hxh.txttext
MD5:D37E1931453E2A1C95316DB3F608FEE9
SHA256:FE4C96C5933DA44EAF0754F7150479D6FD6C8B03FCA45F01F69B6B0DDFC52C01
3056dejiii.exeC:\Users\admin\AppData\Local\Temp\23981422\mih.xltext
MD5:86E7833A3A654CA1D9051C1644AF7C51
SHA256:3D4DEDC4305EDA5A3AA92A17210492142CC2C92F5254343C6958BBCB7ECF3076
3076WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$C11121198D11.docpgc
MD5:DE8E30C99C72AE9A2BFAA79CBD02E062
SHA256:57445F4F9F0BF08E0F21C19D58BE11B6E14028F99E696DD87CB9D25D7FA3145E
3056dejiii.exeC:\Users\admin\AppData\Local\Temp\23981422\hqd.txttext
MD5:78A62251904B7DBEBD5AD0F67031BB62
SHA256:AC751A32150EEAD1EEC616EED0E5C5549E0C3DCACB5577184B142BCDA35674A9
3056dejiii.exeC:\Users\admin\AppData\Local\Temp\23981422\qts.mp4text
MD5:CE1BC6B091C898BD002CF6281D4B524C
SHA256:DDB14E3ADA44463383789C2CD550516993694B0DFE4C1EE10D7FB6FF08A9563D
3056dejiii.exeC:\Users\admin\AppData\Local\Temp\23981422\gqs.mp4text
MD5:4AE6C89DC610878CE5008028D1D43136
SHA256:D8056100AD6C0269B22329CF846841BA92997C4DD5A3BDA317DAC68FF2B7AE78
3076WINWORD.EXEC:\Users\admin\AppData\Local\Temp\dejiii.exeexecutable
MD5:4E28CE0240E8786C2B281220AC146124
SHA256:E810B9D5AA029ACA8804E6F92D536B9783DBCEE6527E1DEC4AF074C362487958
3056dejiii.exeC:\Users\admin\AppData\Local\Temp\23981422\rai.xltext
MD5:51C584BA7CF5EB963311A5B9C69B21F5
SHA256:E49EF44549E1632C08EEF74C7A479DE36E19C194CC5FB1D40CE65B165DC351DE
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
2
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2436
RegSvcs.exe
GET
200
216.146.43.70:80
http://checkip.dyndns.org/
US
html
107 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2436
RegSvcs.exe
209.99.16.58:587
webmail.kaypan.com
PDR
US
malicious
2436
RegSvcs.exe
216.146.43.70:80
checkip.dyndns.org
Dynamic Network Services, Inc.
US
shared

DNS requests

Domain
IP
Reputation
checkip.dyndns.org
  • 216.146.43.70
  • 216.146.43.71
  • 131.186.113.70
shared
webmail.kaypan.com
  • 209.99.16.58
malicious

Threats

PID
Process
Class
Message
—
—
Misc activity
ET INFO DYNAMIC_DNS Query to *.dyndns. Domain
2436
RegSvcs.exe
Potential Corporate Privacy Violation
ET POLICY External IP Lookup - checkip.dyndns.org
2436
RegSvcs.exe
Potentially Bad Traffic
ET POLICY DynDNS CheckIp External IP Address Server Response
2436
RegSvcs.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
2436
RegSvcs.exe
Generic Protocol Command Decode
SURICATA SMTP invalid reply
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
DOC11121198D11.doc