analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

PO18201805.doc

Full analysis: https://app.any.run/tasks/090c5e65-fb12-49c7-b011-e2ffe7113f92
Verdict: Malicious activity
Analysis date: December 18, 2018, 07:49:14
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
exploit
CVE-2017-11882
Indicators:
MIME: text/rtf
File info: Rich Text Format data, unknown version
MD5:

15FAB82A2F31BBA86ECFC44ACFE8E4FD

SHA1:

D6FD89D6136CED4A4F4EC60A47D5D63C12785794

SHA256:

E69DE0A21B5D62EA2E4BB40483E39356CE6DFBCA69D507302FE51B2E7792E0EC

SSDEEP:

12288:A3I3+3t3t3c3c3c3c3c3c3c3x3I3I3I303Q3g3o3B3Se:A3I3+3t3t3c3c3c3c3c3c3c3x3I3I3Iz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Suspicious connection from the Equation Editor

      • EQNEDT32.EXE (PID: 3360)

    • Application was dropped or rewritten from another process

      • 234345.bat (PID: 3152)

    • Equation Editor starts application (CVE-2017-11882)

      • EQNEDT32.EXE (PID: 3360)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • EQNEDT32.EXE (PID: 3360)

    • Creates files in the user directory

      • EQNEDT32.EXE (PID: 3360)

    • Suspicious files were dropped or overwritten

      • EQNEDT32.EXE (PID: 3360)

    • Starts application with an unusual extension

      • EQNEDT32.EXE (PID: 3360)

  • INFO

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2940)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2940)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rtf | Rich Text Format (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
34
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start winword.exe no specs eqnedt32.exe 234345.bat no specs

Process information

PID
CMD
Path
Indicators
Parent process
2940"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\PO18201805.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
3360"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
3152"C:\Users\admin\234345.bat"C:\Users\admin\234345.bat—EQNEDT32.EXE
User:
admin
Company:
Invoice
Integrity Level:
MEDIUM
Description:
Heartrending5
Version:
2.05.0005
Total events
1 106
Read events
749
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
0
Text files
2
Unknown types
3

Dropped files

PID
Process
Filename
Type
2940WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR93DA.tmp.cvr —
MD5:—
SHA256:—
3360EQNEDT32.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@bit[1].txttext
MD5:F04F46F150CC66EB0159D23331EECD8C
SHA256:C47F5B4BA0AFA1562BB414B5F4A4629C5AECEE9C8842D6582B85C6AA35B554C7
3360EQNEDT32.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@beautymakeup[1].txttext
MD5:8C3F3FA4AA383E8D3510A8CA9DFEA8AC
SHA256:8CD291281B9FFC2D1FCCE421292209C03A5057605163DF1D3E853C245914BB2B
3360EQNEDT32.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\24F5E30[1].pngexecutable
MD5:85F906A61D331D3834FD650D3FFECE79
SHA256:AAB24C10FE25349209D73CCA9CB2518AFA264B25BB6CB5EAABF8BFCC185BC0C2
2940WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$18201805.docpgc
MD5:6D6165A18767CF0F83FF8F1718BEF721
SHA256:1644150B721219BB0FB414386C2433DDBCBA6B480542408478C9AF2204AA4342
2940WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:0FEE22FA40EAB618E269AF59EF990721
SHA256:DB543AC7F35DE26670D8A65A74DD48BCF6E5E70FF2A75D8A42E2FD500F8A170D
3360EQNEDT32.EXEC:\Users\admin\234345.batexecutable
MD5:85F906A61D331D3834FD650D3FFECE79
SHA256:AAB24C10FE25349209D73CCA9CB2518AFA264B25BB6CB5EAABF8BFCC185BC0C2
3360EQNEDT32.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\IETldCache\index.datdat
MD5:D7A950FEFD60DBAA01DF2D85FEFB3862
SHA256:75D0B1743F61B76A35B1FEDD32378837805DE58D79FA950CB6E8164BFA72073A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
2
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3360
EQNEDT32.EXE
GET
301
67.199.248.10:80
http://bit.ly/2URySoI
US
html
126 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3360
EQNEDT32.EXE
104.28.19.55:443
www.beautymakeup.ca
Cloudflare Inc
US
shared
3360
EQNEDT32.EXE
67.199.248.10:80
bit.ly
Bitly Inc
US
shared

DNS requests

Domain
IP
Reputation
bit.ly
  • 67.199.248.10
  • 67.199.248.11
shared
www.beautymakeup.ca
  • 104.28.19.55
  • 104.28.18.55
malicious

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
PO18201805.doc