analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Payment Slip-11th-02-19.docx

Full analysis: https://app.any.run/tasks/2822dade-724b-4e84-941e-bbc3c79d5196
Verdict: Malicious activity
Threats:

Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.

Malware Trends Tracker     >>>
Analysis date: February 11, 2019, 11:33:04
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
generated-doc
exploit
CVE-2017-11882
loader
stealer
rat
agenttesla
evasion
trojan
Indicators:
MIME: application/vnd.openxmlformats-officedocument.wordprocessingml.document
File info: Microsoft Word 2007+
MD5:

921E777E84C8D581DFBB1D97ABB1BAF7

SHA1:

49FCFDE9EC19244DCC8C69EB74E8A4B9355EABDF

SHA256:

D764EFEFC60C3F02008A190FD9DE5B851E9713917CCE1AB934C7DFED1A9A5859

SSDEEP:

384:Q0RzBKgYJYiIZ2MgdmDO5RWryJHvdVGuiedSJ4H1A0mWuLinAXn+bMNELpFW1:Q0RO42MgdmDOariPdPdHHgc4eX8

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • nagsedhr.exe (PID: 2696)
      • fhh.exe (PID: 2684)
      • fhh.exe (PID: 2988)
      • 90520db2-4777-4c96-9f74-f847213dd848.exe (PID: 2932)

    • Equation Editor starts application (CVE-2017-11882)

      • EQNEDT32.EXE (PID: 2724)

    • Suspicious connection from the Equation Editor

      • EQNEDT32.EXE (PID: 2724)

    • Downloads executable files from the Internet

      • EQNEDT32.EXE (PID: 2724)

    • Changes the autorun value in the registry

      • WScript.exe (PID: 2952)
      • fhh.exe (PID: 2988)

    • Known privilege escalation attack

      • fhh.exe (PID: 2988)

    • Stealing of credential data

      • 90520db2-4777-4c96-9f74-f847213dd848.exe (PID: 2932)

    • Actions looks like stealing of personal data

      • fhh.exe (PID: 2988)
      • 90520db2-4777-4c96-9f74-f847213dd848.exe (PID: 2932)

    • AGENTTESLA was detected

      • fhh.exe (PID: 2988)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • nagsedhr.exe (PID: 2696)
      • EQNEDT32.EXE (PID: 2724)
      • fhh.exe (PID: 2988)

    • Executes scripts

      • nagsedhr.exe (PID: 2696)

    • Starts itself from another location

      • nagsedhr.exe (PID: 2696)

    • Creates files in the user directory

      • EQNEDT32.EXE (PID: 2724)

    • Application launched itself

      • fhh.exe (PID: 2684)

    • Modifies the open verb of a shell class

      • fhh.exe (PID: 2988)

    • Loads DLL from Mozilla Firefox

      • 90520db2-4777-4c96-9f74-f847213dd848.exe (PID: 2932)

    • Connects to SMTP port

      • fhh.exe (PID: 2988)

    • Reads the machine GUID from the registry

      • 90520db2-4777-4c96-9f74-f847213dd848.exe (PID: 2932)

    • Checks for external IP

      • fhh.exe (PID: 2988)

  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 3020)

    • Reads the machine GUID from the registry

      • WINWORD.EXE (PID: 3020)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 3020)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.docx | Word Microsoft Office Open XML Format document (52.2)
.zip | Open Packaging Conventions container (38.8)
.zip | ZIP compressed archive (8.8)

EXIF

XMP

Creator: POLOLOCO

XML

ModifyDate: 2019:02:11 07:06:00Z
CreateDate: 2019:02:11 07:06:00Z
RevisionNumber: 1
LastModifiedBy: POLOLOCO
AppVersion: 12
HyperlinksChanged: No
SharedDoc: No
CharactersWithSpaces: -
LinksUpToDate: No
Company: -
ScaleCrop: No
Paragraphs: 1
Lines: 1
DocSecurity: None
Application: Microsoft Office Word
Characters: -
Words: -
Pages: 1
TotalEditTime: -
Template: Normal.dotm

ZIP

ZipFileName: [Content_Types].xml
ZipUncompressedSize: 1584
ZipCompressedSize: 377
ZipCRC: 0x2284e0ff
ZipModifyDate: 2019:02:11 00:08:10
ZipCompression: Deflated
ZipBitFlag: 0x0002
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
49
Monitored processes
9
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start winword.exe no specs eqnedt32.exe nagsedhr.exe wscript.exe fhh.exe no specs #AGENTTESLA fhh.exe eventvwr.exe no specs eventvwr.exe 90520db2-4777-4c96-9f74-f847213dd848.exe

Process information

PID
CMD
Path
Indicators
Parent process
3020"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\Payment Slip-11th-02-19.docx"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.5123.5000
2724"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
2696"C:\Users\admin\AppData\Roaming\nagsedhr.exe"C:\Users\admin\AppData\Roaming\nagsedhr.exe
EQNEDT32.EXE
User:
admin
Company:
insobriety1
Integrity Level:
MEDIUM
Exit code:
0
Version:
6.09.0006
2952"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\subfolder\fhh.vbs" C:\Windows\SysWOW64\WScript.exe
nagsedhr.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
2684"C:\Users\admin\AppData\Local\Temp\subfolder\fhh.exe" C:\Users\admin\AppData\Local\Temp\subfolder\fhh.exe—nagsedhr.exe
User:
admin
Company:
insobriety1
Integrity Level:
MEDIUM
Exit code:
0
Version:
6.09.0006
2988C:\Users\admin\AppData\Local\Temp\subfolder\fhh.exe" C:\Users\admin\AppData\Local\Temp\subfolder\fhh.exe
fhh.exe
User:
admin
Company:
insobriety1
Integrity Level:
MEDIUM
Version:
6.09.0006
1612"C:\Windows\System32\eventvwr.exe" C:\Windows\SysWOW64\eventvwr.exe—fhh.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Event Viewer Snapin Launcher
Exit code:
3221226540
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2912"C:\Windows\SysWOW64\eventvwr.exe" C:\Windows\SysWOW64\eventvwr.exe
fhh.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Event Viewer Snapin Launcher
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2932"C:\Users\admin\AppData\Local\Temp\90520db2-4777-4c96-9f74-f847213dd848.exe" C:\Users\admin\AppData\Local\Temp\500fa6ea-0689-4718-91b9-5d17a5a61ac9.tmpC:\Users\admin\AppData\Local\Temp\90520db2-4777-4c96-9f74-f847213dd848.exe
fhh.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
0.0.0.0
Total events
1 575
Read events
1 166
Write events
0
Delete events
0

Modification events

No data
Executable files
4
Suspicious files
3
Text files
4
Unknown types
3

Dropped files

PID
Process
Filename
Type
3020WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRF808.tmp.cvr —
MD5:—
SHA256:—
3020WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\14ED13.jpg —
MD5:—
SHA256:—
3020WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{56EB0901-928F-4C2B-953B-302B53B866C6}.tmp —
MD5:—
SHA256:—
3020WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{968E33EF-711F-4A67-A753-D0DC94C6A30C}.tmp —
MD5:—
SHA256:—
3020WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{AB32842A-762D-442C-83A3-B16176FD68D7}.tmp —
MD5:—
SHA256:—
2724EQNEDT32.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BDW1XBVN\DR[1].exeexecutable
MD5:0253CECDDEBB28A4624A935DD31078BC
SHA256:50929F95A4268F03630346A1AB9E5FF1FCAB8A7584F184C5852F32BB88DC0B6B
3020WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dattext
MD5:637D2838AA291507F9585926300CC797
SHA256:F7EAF4CE63B4FA3E89F9C0501A936FE41B2294916E92889B32EF223A49635B21
3020WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\Payment Slip-11th-02-19.LNKlnk
MD5:FE56F7C7942DB70D660672A71F2D9DBC
SHA256:84F01615BA60744D57F90035918F03EDE999FBDB6205D6B500F052D9809A9FBD
2724EQNEDT32.EXEC:\Users\admin\AppData\Roaming\nagsedhr.exeexecutable
MD5:0253CECDDEBB28A4624A935DD31078BC
SHA256:50929F95A4268F03630346A1AB9E5FF1FCAB8A7584F184C5852F32BB88DC0B6B
2696nagsedhr.exeC:\Users\admin\AppData\Local\Temp\subfolder\fhh.exeexecutable
MD5:0253CECDDEBB28A4624A935DD31078BC
SHA256:50929F95A4268F03630346A1AB9E5FF1FCAB8A7584F184C5852F32BB88DC0B6B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
3
DNS requests
3
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2988
fhh.exe
GET
200
52.0.208.170:80
http://checkip.amazonaws.com/
US
text
16 b
shared
2724
EQNEDT32.EXE
GET
200
207.174.213.181:80
http://geepaulcast.com/aas/DR.exe
US
executable
825 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2988
fhh.exe
208.91.198.143:587
smtp.neweiico.com
PDR
US
shared
2724
EQNEDT32.EXE
207.174.213.181:80
geepaulcast.com
PDR
US
malicious
2988
fhh.exe
52.0.208.170:80
checkip.amazonaws.com
Amazon.com, Inc.
US
shared

DNS requests

Domain
IP
Reputation
geepaulcast.com
  • 207.174.213.181
malicious
smtp.neweiico.com
  • 208.91.198.143
  • 208.91.199.224
  • 208.91.199.225
  • 208.91.199.223
malicious
checkip.amazonaws.com
  • 52.0.208.170
  • 52.200.125.74
  • 34.233.102.38
  • 18.233.42.138
  • 34.196.82.108
  • 52.202.139.131
shared

Threats

PID
Process
Class
Message
2724
EQNEDT32.EXE
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2988
fhh.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
2988
fhh.exe
A Network Trojan was detected
MALWARE [PTsecurity] Trojan-Spy.Keylogger.AgentTesla Exfiltration by SMTP
2988
fhh.exe
A Network Trojan was detected
MALWARE [PTsecurity] AgentTesla IP Check
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Payment Slip-11th-02-19.docx