File name:

Office_2024_EN_64Bits.exe

Full analysis: https://app.any.run/tasks/82fb1f2b-bc74-4f48-9062-1982d8caf2da
Verdict: Malicious activity
Analysis date: April 27, 2025, 12:53:49
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

7408133E63AA3D775BEEDBA6EA6ED3E9

SHA1:

C0C98105A43F1478E659CA675BE30AC56FE0BCB7

SHA256:

0157AFE7FBB8757A5F92BBB9D2DFBC2F06D9A1A8493B6D25E64A1735AC455811

SSDEEP:

98304:SfLIQ/3oou0LTVZOyCrFW+JdcIfrp41GzL6u4Ndl2etH7M5ozFhGW9rPhVGaiimE:8jaiqbNQ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Scans artifacts that could help determine the target

      • setup.exe (PID: 5576)
      • setup.exe (PID: 6108)

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • Office_2024_EN_64Bits.exe (PID: 744)

    • Reads security settings of Internet Explorer

      • Office_2024_EN_64Bits.exe (PID: 744)
      • setup.exe (PID: 6108)
      • setup.exe (PID: 5576)

    • Reads Internet Explorer settings

      • Office_2024_EN_64Bits.exe (PID: 744)

    • Executable content was dropped or overwritten

      • Office_2024_EN_64Bits.exe (PID: 744)

    • There is functionality for taking screenshot (YARA)

      • Office_2024_EN_64Bits.exe (PID: 744)

    • Process drops legitimate windows executable

      • Office_2024_EN_64Bits.exe (PID: 744)

    • Starts CMD.EXE for commands execution

      • Office_2024_EN_64Bits.exe (PID: 744)

    • The executable file from the user directory is run by the CMD process

      • setup.exe (PID: 6108)

    • Starts a Microsoft application from unusual location

      • setup.exe (PID: 6108)
      • setup.exe (PID: 5576)

    • Executing commands from a ".bat" file

      • Office_2024_EN_64Bits.exe (PID: 744)

    • Application launched itself

      • setup.exe (PID: 6108)

    • Searches for installed software

      • setup.exe (PID: 5576)

  • INFO

    • Checks supported languages

      • Office_2024_EN_64Bits.exe (PID: 744)
      • setup.exe (PID: 6108)
      • setup.exe (PID: 5576)

    • Reads the computer name

      • Office_2024_EN_64Bits.exe (PID: 744)
      • setup.exe (PID: 6108)
      • setup.exe (PID: 5576)

    • Checks proxy server information

      • Office_2024_EN_64Bits.exe (PID: 744)
      • setup.exe (PID: 6108)
      • setup.exe (PID: 5576)

    • Create files in a temporary directory

      • Office_2024_EN_64Bits.exe (PID: 744)
      • setup.exe (PID: 6108)
      • setup.exe (PID: 5576)

    • Process checks computer location settings

      • Office_2024_EN_64Bits.exe (PID: 744)
      • setup.exe (PID: 6108)
      • setup.exe (PID: 5576)

    • Reads the machine GUID from the registry

      • setup.exe (PID: 6108)
      • setup.exe (PID: 5576)

    • Process checks whether UAC notifications are on

      • setup.exe (PID: 6108)

    • Creates files or folders in the user directory

      • setup.exe (PID: 6108)
      • setup.exe (PID: 5576)

    • Reads the software policy settings

      • setup.exe (PID: 6108)
      • setup.exe (PID: 5576)

    • Reads Microsoft Office registry keys

      • setup.exe (PID: 6108)
      • setup.exe (PID: 5576)

    • Reads Environment values

      • setup.exe (PID: 6108)
      • setup.exe (PID: 5576)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:10:03 07:51:19+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.33
CodeSize: 214528
InitializedDataSize: 263680
UninitializedDataSize: -
EntryPoint: 0x21d50
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
136
Monitored processes
7
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start office_2024_en_64bits.exe cmd.exe no specs conhost.exe no specs setup.exe setup.exe conhost.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
744"C:\Users\admin\AppData\Local\Temp\Office_2024_EN_64Bits.exe" C:\Users\admin\AppData\Local\Temp\Office_2024_EN_64Bits.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\office_2024_en_64bits.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
5324C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5576"C:\Users\admin\AppData\Local\Temp\package\setup.exe" ELEVATED sid=S-1-5-21-1693682860-607145093-2874071422-1001 /configure configuration.xmlC:\Users\admin\AppData\Local\Temp\package\setup.exe
setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft 365 and Office
Version:
16.0.17531.20046
Modules
Images
c:\users\admin\appdata\local\temp\package\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
5964C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\start.bat" "C:\Windows\SysWOW64\cmd.exe—Office_2024_EN_64Bits.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6080\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6108setup /configure configuration.xmlC:\Users\admin\AppData\Local\Temp\package\setup.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft 365 and Office
Version:
16.0.17531.20046
Modules
Images
c:\users\admin\appdata\local\temp\package\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
6800\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
4 848
Read events
4 721
Write events
123
Delete events
4

Modification events

(PID) Process:(744) Office_2024_EN_64Bits.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(744) Office_2024_EN_64Bits.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(744) Office_2024_EN_64Bits.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6108) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:en-US
Value:
2
(PID) Process:(6108) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:de-de
Value:
2
(PID) Process:(6108) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:fr-fr
Value:
2
(PID) Process:(6108) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:es-es
Value:
2
(PID) Process:(6108) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:it-it
Value:
2
(PID) Process:(6108) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:ja-jp
Value:
2
(PID) Process:(6108) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:ko-kr
Value:
2
Executable files
1
Suspicious files
7
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
744Office_2024_EN_64Bits.exeC:\Users\admin\AppData\Local\Temp\package\configuration.xmltext
MD5:B8A2F53FD00F8AC78982A497E2472497
SHA256:D30E4B5CBF1C373DE24CC2BA9A660BD5006DDE136ACDFE30CF194701C77C1F64
744Office_2024_EN_64Bits.exeC:\Users\admin\AppData\Local\Temp\package\Click To Run.battext
MD5:AD3ED1D41F9B51F7F203D56597C05958
SHA256:413B8E555D8F42C56D22D6843708F7BFCB0BBEDB4F833BF3C89880665925BD14
744Office_2024_EN_64Bits.exeC:\Users\admin\AppData\Local\Temp\package\setup.exeexecutable
MD5:7488D696F9A3D74E093B4C31EF7282C6
SHA256:B03C4CC3C1377EE81B1F94DA126E58A30F484D4D935889538FAE1C650DD6828B
744Office_2024_EN_64Bits.exeC:\Users\admin\AppData\Local\Temp\start.battext
MD5:83EEA8C8BF2C4E394BD3D7B5E99B2EE3
SHA256:D7D4B20EB7E17DCF3CE914AA1BC29A94427434CC67519CACFDE2C13419C70FB7
6108setup.exeC:\Users\admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\D620D747-9176-4880-BE6B-65D8C7B8E98Dxml
MD5:566D1FAAD954C924A667AB4EAF66C69A
SHA256:F3CF29FA615E28567EE324D171ED5F86B1CB93606DBF26A431DC4AB88145DA65
5576setup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9binary
MD5:8D79E68F51FD856DB776BB912586126B
SHA256:AB39E2706DEFD99768E7F2B8B46366A309594E89BAC435F042444D178DF58026
5576setup.exeC:\Users\admin\AppData\Local\Microsoft\Office\OTele\setup.exe.db-shmbinary
MD5:EBEB5671C9777980F4856BFC18BF28A0
SHA256:22EEF24D24A6128441BEA34FB5DC602D5DEF1832338954AAC9154E2A4B00F596
5576setup.exeC:\Users\admin\AppData\Local\Microsoft\Office\OTele\setup.exe.db-walbinary
MD5:03801331AE7B9B5CCB5B65003C591040
SHA256:6EE99D93D18A4C0199D18B408A24FA627D06433F380804AC880FB445EE6B9194
5576setup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9binary
MD5:0118369B5F2BA5CE029ABB26A47EF04B
SHA256:0E75AD67B983DD3B5AAB42BB06C33A3A4BAB912AC918569121F55D586903C113
6108setup.exeC:\Users\admin\AppData\Local\Microsoft\Office\OTele\setup.exe.db-journalbinary
MD5:7266802CD1D47BF4161FE8357C083CEB
SHA256:ACAC89268AC76A268EB543BC3B262D4DA573FFDFBB1FB6D4B95BE37BB205E96C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
26
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.53.40.178:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1056
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5576
setup.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
1056
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
23.53.40.178:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2656
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.73:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.53.40.178
  • 23.53.40.176
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 95.101.149.131
whitelisted
google.com
  • 216.58.206.46
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.159.73
  • 20.190.159.128
  • 20.190.159.130
  • 40.126.31.69
  • 40.126.31.73
  • 40.126.31.0
  • 20.190.159.71
  • 40.126.31.71
whitelisted
ocsp.digicert.com
  • 184.30.131.245
  • 2.23.77.188
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted
officeclient.microsoft.com
  • 52.109.76.240
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Office_2024_EN_64Bits.exe