analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

copy22-01-2019.doc

Full analysis: https://app.any.run/tasks/18fd87d9-e427-49be-8209-244e4acabd71
Verdict: Malicious activity
Analysis date: January 23, 2019, 08:41:37
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ole-embedded
Indicators:
MIME: text/rtf
File info: Rich Text Format data, version 1, ANSI
MD5:

6D5EEF8F3DF1D7730F7FF22A4B13B23F

SHA1:

9452DB4D96BA98D72629AC1EB50E4FAE55F7F401

SHA256:

E3C786FEC0479F5AF52D7740E77479014C8863E5E9F0C639095595D999C2D80F

SSDEEP:

6144:kX0OPX0OVX0OiX0OXX0O0X0OrX0OxX0Oy:kv1C3ULRS

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Starts MSHTA.EXE for opening HTA or HTMLS files

      • EXCEL.EXE (PID: 2232)
      • EXCEL.EXE (PID: 3548)
      • EXCEL.EXE (PID: 3484)
      • EXCEL.EXE (PID: 3420)
      • EXCEL.EXE (PID: 3664)
      • EXCEL.EXE (PID: 3864)
      • EXCEL.EXE (PID: 2532)
      • EXCEL.EXE (PID: 2984)
    • Unusual execution from Microsoft Office

      • EXCEL.EXE (PID: 2232)
      • EXCEL.EXE (PID: 3548)
      • EXCEL.EXE (PID: 3484)
      • EXCEL.EXE (PID: 3420)
      • EXCEL.EXE (PID: 3664)
      • EXCEL.EXE (PID: 2532)
      • EXCEL.EXE (PID: 3864)
      • EXCEL.EXE (PID: 2984)
  • SUSPICIOUS

    No suspicious indicators.
  • INFO

    • Reads internet explorer settings

      • mshta.exe (PID: 3040)
      • mshta.exe (PID: 3584)
      • mshta.exe (PID: 3572)
      • mshta.exe (PID: 3624)
      • mshta.exe (PID: 3532)
      • mshta.exe (PID: 2368)
      • mshta.exe (PID: 2188)
      • mshta.exe (PID: 3920)
    • Creates files in the user directory

      • WINWORD.EXE (PID: 3476)
    • Reads Microsoft Office registry keys

      • EXCEL.EXE (PID: 2232)
      • WINWORD.EXE (PID: 3476)
      • EXCEL.EXE (PID: 3548)
      • EXCEL.EXE (PID: 3484)
      • EXCEL.EXE (PID: 3664)
      • EXCEL.EXE (PID: 3420)
      • EXCEL.EXE (PID: 2532)
      • EXCEL.EXE (PID: 3864)
      • EXCEL.EXE (PID: 2984)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rtf | Rich Text Format (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
47
Monitored processes
17
Malicious processes
8
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winword.exe no specs excel.exe no specs mshta.exe excel.exe no specs mshta.exe excel.exe no specs mshta.exe excel.exe no specs mshta.exe excel.exe no specs mshta.exe excel.exe no specs mshta.exe excel.exe no specs mshta.exe excel.exe no specs mshta.exe

Process information

PID
CMD
Path
Indicators
Parent process
3476"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\copy22-01-2019.doc.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXEexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
2232"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" -EmbeddingC:\Program Files\Microsoft Office\Office14\EXCEL.EXEsvchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Exit code:
0
Version:
14.0.6024.1000
3040mshta.exe https://methodsofcreation.blogspot.com/p/encryption2.htmlC:\Windows\system32\mshta.exe
EXCEL.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3548"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" -EmbeddingC:\Program Files\Microsoft Office\Office14\EXCEL.EXEsvchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Exit code:
0
Version:
14.0.6024.1000
3584mshta.exe https://methodsofcreation.blogspot.com/p/encryption2.htmlC:\Windows\system32\mshta.exe
EXCEL.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3484"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" -EmbeddingC:\Program Files\Microsoft Office\Office14\EXCEL.EXEsvchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Exit code:
0
Version:
14.0.6024.1000
3572mshta.exe https://methodsofcreation.blogspot.com/p/encryption2.htmlC:\Windows\system32\mshta.exe
EXCEL.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3420"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" -EmbeddingC:\Program Files\Microsoft Office\Office14\EXCEL.EXEsvchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Exit code:
0
Version:
14.0.6024.1000
3624mshta.exe https://methodsofcreation.blogspot.com/p/encryption2.htmlC:\Windows\system32\mshta.exe
EXCEL.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3664"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" -EmbeddingC:\Program Files\Microsoft Office\Office14\EXCEL.EXEsvchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Exit code:
0
Version:
14.0.6024.1000
Total events
3 593
Read events
2 981
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
0
Text files
0
Unknown types
4

Dropped files

PID
Process
Filename
Type
3476WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR6AFF.tmp.cvr
MD5:
SHA256:
2232EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVR7494.tmp.cvr
MD5:
SHA256:
2232EXCEL.EXEC:\Users\admin\AppData\Local\Temp\~DF29B975D1E6B6C070.TMP
MD5:
SHA256:
3548EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVRA1AF.tmp.cvr
MD5:
SHA256:
3476WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\C92843B9.wmf
MD5:
SHA256:
3548EXCEL.EXEC:\Users\admin\AppData\Local\Temp\~DFF85BDBD054FD7DD1.TMP
MD5:
SHA256:
3484EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVRB7D7.tmp.cvr
MD5:
SHA256:
3476WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\DF182666.wmf
MD5:
SHA256:
3484EXCEL.EXEC:\Users\admin\AppData\Local\Temp\~DFD4557FBA0B392186.TMP
MD5:
SHA256:
3420EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVRC5C1.tmp.cvr
MD5:
SHA256:
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
16
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3572
mshta.exe
172.217.18.161:443
methodsofcreation.blogspot.com
Google Inc.
US
whitelisted
3040
mshta.exe
172.217.18.161:443
methodsofcreation.blogspot.com
Google Inc.
US
whitelisted
3584
mshta.exe
172.217.18.161:443
methodsofcreation.blogspot.com
Google Inc.
US
whitelisted
3532
mshta.exe
172.217.18.161:443
methodsofcreation.blogspot.com
Google Inc.
US
whitelisted
2188
mshta.exe
172.217.18.161:443
methodsofcreation.blogspot.com
Google Inc.
US
whitelisted
2368
mshta.exe
172.217.18.161:443
methodsofcreation.blogspot.com
Google Inc.
US
whitelisted
3624
mshta.exe
172.217.18.161:443
methodsofcreation.blogspot.com
Google Inc.
US
whitelisted
3920
mshta.exe
172.217.18.161:443
methodsofcreation.blogspot.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
methodsofcreation.blogspot.com
  • 172.217.18.161
whitelisted

Threats

No threats detected
No debug info