| File name: | Office_2024_EN_64Bits.exe |
| Full analysis: | https://app.any.run/tasks/a80a7b55-2d84-451f-aedb-834a4c4508f0 |
| Verdict: | Malicious activity |
| Analysis date: | November 30, 2024, 16:31:35 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections |
| MD5: | 7408133E63AA3D775BEEDBA6EA6ED3E9 |
| SHA1: | C0C98105A43F1478E659CA675BE30AC56FE0BCB7 |
| SHA256: | 0157AFE7FBB8757A5F92BBB9D2DFBC2F06D9A1A8493B6D25E64A1735AC455811 |
| SSDEEP: | 98304:SfLIQ/3oou0LTVZOyCrFW+JdcIfrp41GzL6u4Ndl2etH7M5ozFhGW9rPhVGaiimE:8jaiqbNQ |
MALICIOUS
No malicious indicators.SUSPICIOUS
Reads security settings of Internet Explorer
- Office_2024_EN_64Bits.exe (PID: 6372)
- setup.exe (PID: 7084)
- setup.exe (PID: 6168)
Reads Microsoft Outlook installation path
- Office_2024_EN_64Bits.exe (PID: 6372)
Executable content was dropped or overwritten
- Office_2024_EN_64Bits.exe (PID: 6372)
Reads Internet Explorer settings
- Office_2024_EN_64Bits.exe (PID: 6372)
Executing commands from a ".bat" file
- Office_2024_EN_64Bits.exe (PID: 6372)
Starts CMD.EXE for commands execution
- Office_2024_EN_64Bits.exe (PID: 6372)
Process drops legitimate windows executable
- Office_2024_EN_64Bits.exe (PID: 6372)
Starts a Microsoft application from unusual location
- setup.exe (PID: 7084)
- setup.exe (PID: 6168)
The executable file from the user directory is run by the CMD process
- setup.exe (PID: 7084)
Application launched itself
- setup.exe (PID: 7084)
INFO
Checks supported languages
- Office_2024_EN_64Bits.exe (PID: 6372)
- setup.exe (PID: 7084)
- setup.exe (PID: 6168)
Reads the computer name
- Office_2024_EN_64Bits.exe (PID: 6372)
- setup.exe (PID: 7084)
- setup.exe (PID: 6168)
Checks proxy server information
- Office_2024_EN_64Bits.exe (PID: 6372)
- setup.exe (PID: 7084)
Create files in a temporary directory
- Office_2024_EN_64Bits.exe (PID: 6372)
Process checks computer location settings
- Office_2024_EN_64Bits.exe (PID: 6372)
- setup.exe (PID: 6168)
- setup.exe (PID: 7084)
The process uses the downloaded file
- Office_2024_EN_64Bits.exe (PID: 6372)
- setup.exe (PID: 7084)
- setup.exe (PID: 6168)
Reads the machine GUID from the registry
- setup.exe (PID: 7084)
- setup.exe (PID: 6168)
Process checks whether UAC notifications are on
- setup.exe (PID: 7084)
Creates files or folders in the user directory
- setup.exe (PID: 7084)
Reads the software policy settings
- setup.exe (PID: 7084)
Reads Microsoft Office registry keys
- setup.exe (PID: 7084)
- setup.exe (PID: 6168)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable (generic) (52.9) |
|---|---|---|
| .exe | | | Generic Win/DOS Executable (23.5) |
| .exe | | | DOS Executable Generic (23.5) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2023:10:03 07:51:19+00:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 14.33 |
| CodeSize: | 214528 |
| InitializedDataSize: | 263680 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x21d50 |
| OSVersion: | 5.1 |
| ImageVersion: | - |
| SubsystemVersion: | 5.1 |
| Subsystem: | Windows GUI |
Total processes
131
Monitored processes
6
Malicious processes
1
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 5300 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | setup.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6168 | "C:\Users\admin\AppData\Local\Temp\package\setup.exe" ELEVATED sid=S-1-5-21-1693682860-607145093-2874071422-1001 /configure configuration.xml | C:\Users\admin\AppData\Local\Temp\package\setup.exe | setup.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft 365 and Office Exit code: 4294967295 Version: 16.0.17531.20046 Modules
| |||||||||||||||
| 6372 | "C:\Users\admin\AppData\Local\Temp\Office_2024_EN_64Bits.exe" | C:\Users\admin\AppData\Local\Temp\Office_2024_EN_64Bits.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 4294967295 Modules
| |||||||||||||||
| 7028 | C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\start.bat" " | C:\Windows\SysWOW64\cmd.exe | — | Office_2024_EN_64Bits.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 4294967295 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7036 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7084 | setup /configure configuration.xml | C:\Users\admin\AppData\Local\Temp\package\setup.exe | cmd.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft 365 and Office Exit code: 4294967295 Version: 16.0.17531.20046 Modules
| |||||||||||||||
Total events
4 879
Read events
4 794
Write events
81
Delete events
4
Modification events
| (PID) Process: | (6372) Office_2024_EN_64Bits.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (6372) Office_2024_EN_64Bits.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (6372) Office_2024_EN_64Bits.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (7084) setup.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages |
| Operation: | write | Name: | en-US |
Value: 2 | |||
| (PID) Process: | (7084) setup.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages |
| Operation: | write | Name: | de-de |
Value: 2 | |||
| (PID) Process: | (7084) setup.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages |
| Operation: | write | Name: | fr-fr |
Value: 2 | |||
| (PID) Process: | (7084) setup.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages |
| Operation: | write | Name: | es-es |
Value: 2 | |||
| (PID) Process: | (7084) setup.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages |
| Operation: | write | Name: | it-it |
Value: 2 | |||
| (PID) Process: | (7084) setup.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages |
| Operation: | write | Name: | ja-jp |
Value: 2 | |||
| (PID) Process: | (7084) setup.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages |
| Operation: | write | Name: | ko-kr |
Value: 2 | |||
Executable files
1
Suspicious files
7
Text files
6
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6372 | Office_2024_EN_64Bits.exe | C:\Users\admin\AppData\Local\Temp\package\setup.exe | executable | |
MD5:7488D696F9A3D74E093B4C31EF7282C6 | SHA256:B03C4CC3C1377EE81B1F94DA126E58A30F484D4D935889538FAE1C650DD6828B | |||
| 6372 | Office_2024_EN_64Bits.exe | C:\Users\admin\AppData\Local\Temp\package\configuration.xml | text | |
MD5:B8A2F53FD00F8AC78982A497E2472497 | SHA256:D30E4B5CBF1C373DE24CC2BA9A660BD5006DDE136ACDFE30CF194701C77C1F64 | |||
| 6168 | setup.exe | C:\Users\admin\AppData\Local\Microsoft\Office\OTele\setup.exe.db-wal | binary | |
MD5:5CB67236374A5659A6C43D51F9FC5EA6 | SHA256:409EA63E2E8A2496A8F808CF398928CEF97009F2AB7C4EAF40969F31ABE67EA7 | |||
| 6168 | setup.exe | C:\Users\admin\AppData\Local\Temp\DESKTOP-JGLLJLD-20241130-1631a.log | text | |
MD5:54ABF434F06259899F67885906DD3431 | SHA256:1FE31557780B342F34C452EA5378C2BD5EBBC621626DA0D0EE91CB9AEFB865C4 | |||
| 7084 | setup.exe | C:\Users\admin\AppData\Local\Microsoft\Office\OTele\setup.exe.db-journal | binary | |
MD5:8439E28DB0C6FC3BFD012BED625EAD53 | SHA256:AFBFCAA37D8DFA6EC5AC9B687FE71765CFF312CF4A03776E4DDF7AE0E82AD7A7 | |||
| 7084 | setup.exe | C:\Users\admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\ED01ADC4-A234-41B3-B5A4-65FD2D70EC29 | xml | |
MD5:622ED273DBAD098EDFAEEE03DAE17268 | SHA256:17EA1CC7E46B78C45B44168C919B17B9B7358614CE17F525FCCE4A2B10B72DE6 | |||
| 6168 | setup.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9 | binary | |
MD5:405294CF99AC14EABF7D98FA7D03395F | SHA256:834F584320A70A2A2DD1EA1E774E071251577B3CC1C343212B8DEC50C7026AB3 | |||
| 6168 | setup.exe | C:\Users\admin\AppData\Local\Microsoft\Office\OTele\setup.exe.db-shm | binary | |
MD5:08511F7F56B7ADFC71BC3F3B811CE073 | SHA256:6CABA31309750B50E04D9A0980CDDA4BD94F300219FD5D7276CFDEADB95686D9 | |||
| 6168 | setup.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9 | binary | |
MD5:28D86F0B27D9F07EDB05D49EC9B0CAA2 | SHA256:DF9EBBEA04823B73A2D67E7D5D89146F506C901C1A3F8B3A5B73F17D9C891F81 | |||
| 7084 | setup.exe | C:\Users\admin\AppData\Local\Temp\DESKTOP-JGLLJLD-20241130-1631.log | text | |
MD5:7D026800FEEEF620CCFC7FB7142834EF | SHA256:1F8F513A0504FD952EB81F8E755AB9A4E1C47251EFD193CF975F5118DA2D36A9 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
37
DNS requests
20
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
4712 | MoUsoCoreWorker.exe | GET | 200 | 2.16.164.9:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 2.16.164.9:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
4712 | MoUsoCoreWorker.exe | GET | 200 | 88.221.169.152:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 88.221.169.152:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
6168 | setup.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D | unknown | — | — | whitelisted |
2928 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D | unknown | — | — | whitelisted |
5460 | SIHClient.exe | GET | 200 | 88.221.169.152:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
5460 | SIHClient.exe | GET | 200 | 88.221.169.152:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 2.23.209.189:443 | www.bing.com | Akamai International B.V. | GB | whitelisted |
— | — | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4712 | MoUsoCoreWorker.exe | 2.16.164.9:80 | crl.microsoft.com | Akamai International B.V. | NL | whitelisted |
— | — | 2.16.164.9:80 | crl.microsoft.com | Akamai International B.V. | NL | whitelisted |
— | — | 88.221.169.152:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
4712 | MoUsoCoreWorker.exe | 88.221.169.152:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
1176 | svchost.exe | 20.190.159.64:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
www.bing.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
go.microsoft.com |
| whitelisted |
officeclient.microsoft.com |
| whitelisted |
ecs.office.com |
| whitelisted |