File name:

Office_2024_EN_64Bits.exe

Full analysis: https://app.any.run/tasks/edb02769-16ef-4fe9-9cec-3fb02ee05c3c
Verdict: Malicious activity
Analysis date: March 22, 2025, 13:05:42
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

7408133E63AA3D775BEEDBA6EA6ED3E9

SHA1:

C0C98105A43F1478E659CA675BE30AC56FE0BCB7

SHA256:

0157AFE7FBB8757A5F92BBB9D2DFBC2F06D9A1A8493B6D25E64A1735AC455811

SSDEEP:

98304:SfLIQ/3oou0LTVZOyCrFW+JdcIfrp41GzL6u4Ndl2etH7M5ozFhGW9rPhVGaiimE:8jaiqbNQ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Scans artifacts that could help determine the target

      • setup.exe (PID: 5064)
      • setup.exe (PID: 664)

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • Office_2024_EN_64Bits.exe (PID: 4880)

    • Executable content was dropped or overwritten

      • Office_2024_EN_64Bits.exe (PID: 4880)

    • Process drops legitimate windows executable

      • Office_2024_EN_64Bits.exe (PID: 4880)

    • Reads security settings of Internet Explorer

      • Office_2024_EN_64Bits.exe (PID: 4880)
      • setup.exe (PID: 5064)
      • setup.exe (PID: 664)

    • Reads Internet Explorer settings

      • Office_2024_EN_64Bits.exe (PID: 4880)

    • Executing commands from a ".bat" file

      • Office_2024_EN_64Bits.exe (PID: 4880)

    • Starts CMD.EXE for commands execution

      • Office_2024_EN_64Bits.exe (PID: 4880)

    • Starts a Microsoft application from unusual location

      • setup.exe (PID: 5064)
      • setup.exe (PID: 664)

    • The executable file from the user directory is run by the CMD process

      • setup.exe (PID: 5064)

    • Application launched itself

      • setup.exe (PID: 5064)

    • There is functionality for taking screenshot (YARA)

      • Office_2024_EN_64Bits.exe (PID: 4880)

    • Searches for installed software

      • setup.exe (PID: 664)

  • INFO

    • Checks proxy server information

      • Office_2024_EN_64Bits.exe (PID: 4880)
      • setup.exe (PID: 5064)
      • setup.exe (PID: 664)

    • Reads the computer name

      • Office_2024_EN_64Bits.exe (PID: 4880)
      • setup.exe (PID: 5064)
      • setup.exe (PID: 664)

    • Create files in a temporary directory

      • Office_2024_EN_64Bits.exe (PID: 4880)
      • setup.exe (PID: 664)
      • setup.exe (PID: 5064)

    • Process checks computer location settings

      • Office_2024_EN_64Bits.exe (PID: 4880)
      • setup.exe (PID: 664)
      • setup.exe (PID: 5064)

    • Checks supported languages

      • Office_2024_EN_64Bits.exe (PID: 4880)
      • setup.exe (PID: 5064)
      • setup.exe (PID: 664)

    • Reads the machine GUID from the registry

      • setup.exe (PID: 5064)
      • setup.exe (PID: 664)

    • Process checks whether UAC notifications are on

      • setup.exe (PID: 5064)

    • Reads Microsoft Office registry keys

      • setup.exe (PID: 5064)
      • setup.exe (PID: 664)

    • Creates files or folders in the user directory

      • setup.exe (PID: 5064)
      • setup.exe (PID: 664)

    • Reads the software policy settings

      • setup.exe (PID: 5064)
      • setup.exe (PID: 664)

    • Reads Environment values

      • setup.exe (PID: 5064)
      • setup.exe (PID: 664)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:10:03 07:51:19+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.33
CodeSize: 214528
InitializedDataSize: 263680
UninitializedDataSize: -
EntryPoint: 0x21d50
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
141
Monitored processes
8
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start office_2024_en_64bits.exe sppextcomobj.exe no specs slui.exe no specs cmd.exe no specs conhost.exe no specs setup.exe setup.exe conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
664"C:\Users\admin\AppData\Local\Temp\package\setup.exe" ELEVATED sid=S-1-5-21-1693682860-607145093-2874071422-1001 /configure configuration.xmlC:\Users\admin\AppData\Local\Temp\package\setup.exe
setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft 365 and Office
Exit code:
4294967295
Version:
16.0.17531.20046
Modules
Images
c:\users\admin\appdata\local\temp\package\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
1228C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\start.bat" "C:\Windows\SysWOW64\cmd.exe—Office_2024_EN_64Bits.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
4294967295
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2140\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2236\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4428C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
4880"C:\Users\admin\AppData\Local\Temp\Office_2024_EN_64Bits.exe" C:\Users\admin\AppData\Local\Temp\Office_2024_EN_64Bits.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
4294967295
Modules
Images
c:\users\admin\appdata\local\temp\office_2024_en_64bits.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
5064setup /configure configuration.xmlC:\Users\admin\AppData\Local\Temp\package\setup.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft 365 and Office
Exit code:
4294967295
Version:
16.0.17531.20046
Modules
Images
c:\users\admin\appdata\local\temp\package\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
5556"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
5 007
Read events
4 923
Write events
80
Delete events
4

Modification events

(PID) Process:(4880) Office_2024_EN_64Bits.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(4880) Office_2024_EN_64Bits.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(4880) Office_2024_EN_64Bits.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(5064) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:en-US
Value:
2
(PID) Process:(5064) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:de-de
Value:
2
(PID) Process:(5064) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:fr-fr
Value:
2
(PID) Process:(5064) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:es-es
Value:
2
(PID) Process:(5064) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:it-it
Value:
2
(PID) Process:(5064) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:ja-jp
Value:
2
(PID) Process:(5064) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:ko-kr
Value:
2
Executable files
1
Suspicious files
9
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
4880Office_2024_EN_64Bits.exeC:\Users\admin\AppData\Local\Temp\package\setup.exeexecutable
MD5:7488D696F9A3D74E093B4C31EF7282C6
SHA256:B03C4CC3C1377EE81B1F94DA126E58A30F484D4D935889538FAE1C650DD6828B
4880Office_2024_EN_64Bits.exeC:\Users\admin\AppData\Local\Temp\package\configuration.xmltext
MD5:B8A2F53FD00F8AC78982A497E2472497
SHA256:D30E4B5CBF1C373DE24CC2BA9A660BD5006DDE136ACDFE30CF194701C77C1F64
5064setup.exeC:\Users\admin\AppData\Local\Microsoft\Office\OTele\setup.exe.db-journalbinary
MD5:507EBF02FED5F696533B1893A4F9F313
SHA256:1A6D21413148D3F2FFE133F86670D652538E2B524833AE77420068E4CD3EE072
664setup.exeC:\Users\admin\AppData\Local\Microsoft\Office\OTele\setup.exe.db-shmbinary
MD5:7580A70FDD7870A9BF47BA273AB52249
SHA256:EA01F20B0DFC9E0951136873B0111823C0598C2506AB8AFE8D2F95F425AF8E77
5064setup.exeC:\Users\admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\8A062419-5024-4804-A3A5-64B94CE9D601xml
MD5:6BA106CC6BD216EACFA6DAFA36EDFF80
SHA256:CB74D037D24B5E2643DAF82521F8357C2214A52C230F5134B5FB973D5F4A036F
664setup.exeC:\Users\admin\AppData\Local\Microsoft\Office\OTele\setup.exe.db-walbinary
MD5:07D4CD1A1AC7713720CC27B5BEC35F94
SHA256:E322CE349467F39B259AE579B55015D3880F0CAE45A91EAF10BE673DFED292D6
664setup.exeC:\Users\admin\AppData\Local\Temp\DESKTOP-JGLLJLD-20250322-1305a.logbinary
MD5:D570DE6092D8D9E2287D0A5EF53B5124
SHA256:E985D6434A84FC3E095CA7D7595286E29EC9D51F0DA7D16B3BC16CD80282996D
5064setup.exeC:\Users\admin\AppData\Local\Temp\DESKTOP-JGLLJLD-20250322-1305.logbinary
MD5:52FD39090E09E32F10567D1748B58B65
SHA256:C5B212C7E1E311B2E8FA72A05BFE47F6F5B9286F0FF4BD64C0398B2B40F674C1
664setup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187binary
MD5:01FA3211165CA3E0DBD816E5389630BF
SHA256:9C37414511C26DC0F5EE71CC6DE4D26A00BDF225C4F8F31A34C93ACB7F43D817
664setup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187binary
MD5:1C4F65087365CC15BEE15E25CC63B4CE
SHA256:DCB1FBF86DC4AF4F1CA5A6D33D7595D41D4CD18160875CEFDFF82C6F734257D0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
27
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.16.168.124:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6240
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
664
setup.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
7868
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7868
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.16.168.124:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6544
svchost.exe
40.126.31.128:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
2112
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5064
setup.exe
52.109.28.46:443
officeclient.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
GB
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 2.16.168.124
  • 2.16.168.114
whitelisted
google.com
  • 172.217.16.206
whitelisted
login.live.com
  • 40.126.31.128
  • 40.126.31.131
  • 20.190.159.23
  • 20.190.159.71
  • 20.190.159.129
  • 20.190.159.0
  • 40.126.31.130
  • 40.126.31.1
whitelisted
ocsp.digicert.com
  • 184.30.131.245
  • 2.23.77.188
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
officeclient.microsoft.com
  • 52.109.28.46
whitelisted
ecs.office.com
  • 52.123.129.14
  • 52.123.128.14
whitelisted
arc.msn.com
  • 20.199.58.43
whitelisted
mobile.events.data.microsoft.com
  • 52.168.112.67
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Office_2024_EN_64Bits.exe