We're sorry but any.run reports doesn't work properly without JavaScript enabled. Please enable it to continue.
Analysis result
Behavior activities
Threats
Find similar analyses in TI Lookup
Analysis date (UTC):
9 December 2019, 03:19
Analysis environment:
Windows 7 Pro, build 7601, x86
main.file.rtf
MD5:
3EE30A5CAC2BEF034767E159865683DF
SHA1:
C29A1FD54F9F961211E9CD987F90BD8EB0932E45
SHA256:
F08CCC040C8D8DB60F30A6D1026AA6523E97C6CF52B1B30F083A830A0A65A3A9
Analysis result
Threat level:
Malicious activity
Tags:
ole-embedded
exploit
cve-2017-11882
trojan
sidewinder
Full analysis:
Analysis main.file.rtf (MD5: 3EE30A5CAC2BEF034767E159865683DF) Malicious activity - Interactive analysis ANY.RUN
Behavior activities
MALICIOUS
Changes the autorun value in the registry
EQNEDT32.EXE (PID: 3592)
Application was dropped or rewritten from another process
rekeywiz.exe (PID: 3672)
rekeywiz.exe (PID: 2212)
Equation Editor starts application (CVE-2017-11882)
EQNEDT32.EXE (PID: 3592)
Loads dropped or rewritten executable
rekeywiz.exe (PID: 2212)
Connects to CnC server
rekeywiz.exe (PID: 2212)
Actions looks like stealing of personal data
rekeywiz.exe (PID: 2212)
SUSPICIOUS
Executed via COM
EQNEDT32.EXE (PID: 3592)
Reads internet explorer settings
EQNEDT32.EXE (PID: 3592)
Creates files in the program directory
EQNEDT32.EXE (PID: 3592)
rekeywiz.exe (PID: 2212)
Executable content was dropped or overwritten
EQNEDT32.EXE (PID: 3592)
INFO
Reads Microsoft Office registry keys
WINWORD.EXE (PID: 2864)
Creates files in the user directory
WINWORD.EXE (PID: 2864)
Manual execution by user
cmd.exe (PID: 3816)
Threats
PID
Process
Class
Message
2212
rekeywiz.exe
A Network Trojan was detected
ET TROJAN Observed Malicious SSL Cert (Sidewinder APT CnC)