analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

AppNee.com.Office.2013-2021.C2R.Install.v7.3.9.Lite.Full.7z

Full analysis: https://app.any.run/tasks/1d8db937-9555-48e5-ac16-744f74e76d17
Verdict: Malicious activity
Analysis date: January 24, 2022, 16:53:28
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

A0DDEE5E11429E74CE5FADD7AFEB7108

SHA1:

FEE7C64C98FC7133C6BDE7310BCBB5CA671B0A50

SHA256:

0DBFDF325766C93565CA3AD87B31E51D0C0FEDD99022E740AFFD48E03F6A88B3

SSDEEP:

393216:aAj81cvH39gwzff/RQoXeZQPjgEiGOvZRvr79:LSwTwmgFGY5R

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • OInstall.exe (PID: 2356)
      • OInstall.exe (PID: 2700)
      • files.dat (PID: 2920)
      • OfficeClickToRun.exe (PID: 188)
      • OfficeClickToRun.exe (PID: 3848)

    • Drops executable file immediately after starts

      • OInstall.exe (PID: 2700)
      • files.dat (PID: 2920)
      • OfficeClickToRun.exe (PID: 3848)

    • Loads dropped or rewritten executable

      • OfficeClickToRun.exe (PID: 188)
      • OfficeClickToRun.exe (PID: 3848)

    • Changes settings of System certificates

      • OfficeClickToRun.exe (PID: 3848)

  • SUSPICIOUS

    • Checks supported languages

      • WinRAR.exe (PID: 4076)
      • OInstall.exe (PID: 2700)
      • files.dat (PID: 2920)
      • cmd.exe (PID: 2768)
      • powershell.exe (PID: 3068)
      • powershell.exe (PID: 904)
      • powershell.exe (PID: 3400)
      • powershell.exe (PID: 3768)
      • powershell.exe (PID: 3504)
      • powershell.exe (PID: 3732)
      • powershell.exe (PID: 528)
      • powershell.exe (PID: 480)
      • powershell.exe (PID: 1312)
      • powershell.exe (PID: 3332)
      • OfficeClickToRun.exe (PID: 188)
      • OfficeClickToRun.exe (PID: 3848)
      • cmd.exe (PID: 2524)
      • cmd.exe (PID: 3248)
      • cmd.exe (PID: 3376)
      • cmd.exe (PID: 684)
      • cmd.exe (PID: 2148)
      • cmd.exe (PID: 2844)
      • cmd.exe (PID: 2748)
      • cmd.exe (PID: 188)
      • cscript.exe (PID: 2228)

    • Reads the computer name

      • WinRAR.exe (PID: 4076)
      • OInstall.exe (PID: 2700)
      • powershell.exe (PID: 3068)
      • powershell.exe (PID: 904)
      • powershell.exe (PID: 3400)
      • powershell.exe (PID: 3768)
      • powershell.exe (PID: 3504)
      • powershell.exe (PID: 3732)
      • powershell.exe (PID: 480)
      • powershell.exe (PID: 528)
      • powershell.exe (PID: 1312)
      • powershell.exe (PID: 3332)
      • OfficeClickToRun.exe (PID: 188)
      • OfficeClickToRun.exe (PID: 3848)
      • cscript.exe (PID: 2228)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 4076)
      • OInstall.exe (PID: 2700)
      • files.dat (PID: 2920)
      • OfficeClickToRun.exe (PID: 3848)
      • expand.exe (PID: 3888)

    • Drops a file with a compile date too recent

      • WinRAR.exe (PID: 4076)
      • OInstall.exe (PID: 2700)
      • expand.exe (PID: 3888)
      • OfficeClickToRun.exe (PID: 3848)

    • Reads Environment values

      • OInstall.exe (PID: 2700)
      • powershell.exe (PID: 3068)
      • powershell.exe (PID: 904)
      • powershell.exe (PID: 3504)
      • powershell.exe (PID: 528)
      • powershell.exe (PID: 1312)
      • powershell.exe (PID: 3332)
      • OfficeClickToRun.exe (PID: 3848)
      • OfficeClickToRun.exe (PID: 188)

    • Starts application with an unusual extension

      • cmd.exe (PID: 2768)

    • Drops a file that was compiled in debug mode

      • OInstall.exe (PID: 2700)
      • files.dat (PID: 2920)
      • expand.exe (PID: 3888)
      • OfficeClickToRun.exe (PID: 3848)

    • Starts CMD.EXE for commands execution

      • OInstall.exe (PID: 2700)

    • Executes PowerShell scripts

      • OInstall.exe (PID: 2700)

    • Uses REG.EXE to modify Windows registry

      • OInstall.exe (PID: 2700)
      • cmd.exe (PID: 2524)
      • cmd.exe (PID: 3248)
      • cmd.exe (PID: 3376)
      • cmd.exe (PID: 2148)
      • cmd.exe (PID: 684)
      • cmd.exe (PID: 2844)
      • cmd.exe (PID: 2748)

    • Creates a directory in Program Files

      • OInstall.exe (PID: 2700)
      • expand.exe (PID: 3888)
      • expand.exe (PID: 2708)
      • OfficeClickToRun.exe (PID: 3848)

    • Drops a file with too old compile date

      • expand.exe (PID: 3888)

    • Creates files in the program directory

      • expand.exe (PID: 2708)
      • OfficeClickToRun.exe (PID: 3848)
      • expand.exe (PID: 3888)

    • Executed as Windows Service

      • OfficeClickToRun.exe (PID: 3848)

    • Creates files in the Windows directory

      • OfficeClickToRun.exe (PID: 3848)

    • Removes files from Windows directory

      • OfficeClickToRun.exe (PID: 3848)

    • Adds / modifies Windows certificates

      • OfficeClickToRun.exe (PID: 3848)

    • Executes scripts

      • cmd.exe (PID: 188)

  • INFO

    • Checks Windows Trust Settings

      • powershell.exe (PID: 3068)
      • powershell.exe (PID: 3400)
      • powershell.exe (PID: 904)
      • powershell.exe (PID: 3768)
      • powershell.exe (PID: 3504)
      • powershell.exe (PID: 3732)
      • powershell.exe (PID: 528)
      • powershell.exe (PID: 480)
      • powershell.exe (PID: 1312)
      • powershell.exe (PID: 3332)
      • OfficeClickToRun.exe (PID: 3848)

    • Dropped object may contain Bitcoin addresses

      • expand.exe (PID: 3416)

    • Checks supported languages

      • expand.exe (PID: 3416)
      • expand.exe (PID: 3876)
      • expand.exe (PID: 3372)
      • expand.exe (PID: 3704)
      • reg.exe (PID: 2576)
      • expand.exe (PID: 3888)
      • expand.exe (PID: 2708)
      • reg.exe (PID: 1148)
      • reg.exe (PID: 1252)
      • reg.exe (PID: 1708)
      • reg.exe (PID: 2936)
      • reg.exe (PID: 976)
      • reg.exe (PID: 2864)
      • reg.exe (PID: 2576)

    • Reads settings of System Certificates

      • OfficeClickToRun.exe (PID: 3848)
      • OfficeClickToRun.exe (PID: 188)

    • Reads Microsoft Office registry keys

      • OfficeClickToRun.exe (PID: 3848)
      • OfficeClickToRun.exe (PID: 188)
      • reg.exe (PID: 1148)
      • reg.exe (PID: 1252)
      • reg.exe (PID: 2864)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
104
Monitored processes
40
Malicious processes
5
Suspicious processes
11

Behavior graph

Click at the process to see the details
drop and start drop and start start winrar.exe oinstall.exe no specs oinstall.exe cmd.exe no specs files.dat powershell.exe expand.exe no specs powershell.exe no specs powershell.exe expand.exe no specs powershell.exe no specs powershell.exe expand.exe no specs powershell.exe no specs reg.exe no specs powershell.exe expand.exe no specs powershell.exe no specs powershell.exe expand.exe powershell.exe expand.exe no specs officeclicktorun.exe officeclicktorun.exe cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs cscript.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
4076"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\AppNee.com.Office.2013-2021.C2R.Install.v7.3.9.Lite.Full.7z"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2356"C:\Users\admin\AppData\Local\Temp\Rar$EXb4076.37965\OInstall.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb4076.37965\OInstall.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Office 2013-2021 C2R Install
Exit code:
3221226540
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\appdata\local\temp\rar$exb4076.37965\oinstall.exe
2700"C:\Users\admin\AppData\Local\Temp\Rar$EXb4076.37965\OInstall.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb4076.37965\OInstall.exe
WinRAR.exe
User:
admin
Integrity Level:
HIGH
Description:
Office 2013-2021 C2R Install
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb4076.37965\oinstall.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
2768"C:\Windows\System32\cmd.exe" /D /c files.dat -y -pkmsautoC:\Windows\System32\cmd.exe—OInstall.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2920files.dat -y -pkmsautoC:\Users\admin\AppData\Local\Temp\Rar$EXb4076.37965\files\files.dat
cmd.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
HIGH
Description:
7z Console SFX
Exit code:
0
Version:
9.20
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb4076.37965\files\files.dat
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3068"powershell" -command "& { (New-Object Net.WebClient).DownloadFile('http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32.cab', 'C:\Users\admin\AppData\Local\Temp\over699146\v32.cab') }"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
OInstall.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
3416"expand" v32.cab -F:VersionDescriptor.xml C:\Users\admin\AppData\Local\Temp\over699146C:\Windows\system32\expand.exe—OInstall.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
LZ Expansion Utility
Exit code:
0
Version:
6.1.7601.24535 (win7sp1_ldr_escrow.191105-1059)
Modules
Images
c:\windows\system32\expand.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\cabinet.dll
3400"powershell" -command "& { Get-Content C:\Users\admin\AppData\Local\Temp\over699146\VersionDescriptor.xml | Set-Content -Encoding ASCII v32.txt }C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—OInstall.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
904"powershell" -command "& { (New-Object Net.WebClient).DownloadFile('http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32.cab', 'C:\Users\admin\AppData\Local\Temp\over373465\v32.cab') }"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
OInstall.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
3876"expand" v32.cab -F:VersionDescriptor.xml C:\Users\admin\AppData\Local\Temp\over373465C:\Windows\system32\expand.exe—OInstall.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
LZ Expansion Utility
Exit code:
0
Version:
6.1.7601.24535 (win7sp1_ldr_escrow.191105-1059)
Modules
Images
c:\windows\system32\expand.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\cabinet.dll
Total events
18 232
Read events
17 935
Write events
284
Delete events
13

Modification events

(PID) Process:(4076) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(4076) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(4076) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(4076) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(4076) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(4076) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\AppNee.com.Office.2013-2021.C2R.Install.v7.3.9.Lite.Full.7z
(PID) Process:(4076) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(4076) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(4076) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(4076) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
220
Suspicious files
35
Text files
40
Unknown types
7

Dropped files

PID
Process
Filename
Type
4076WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb4076.37965\OInstallLite.exeexecutable
MD5:B70F0484C45C885DF6E0D13C5FE7151C
SHA256:4A81E8451C0A16B9A133CFF53D5AA739F032AE4D40F867130A55A4F6399CA464
4076WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb4076.37965\readme_en.txttext
MD5:A5BE0491B4C835A53480C1E92F967941
SHA256:3C10A3E490F18D27187866A862DA22C40C9B8FC47354F2CF0F7D8A79E9981AF0
4076WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb4076.37965\Latest version.urlurl
MD5:37D4F0BD264ECC1B0AAACB3655FE3A90
SHA256:7128DD31E4737A770F31E3CCB4FE0720FE24F38D9949E4DC540F332FDA621328
2920files.datC:\Users\admin\AppData\Local\Temp\Rar$EXb4076.37965\files\x86\cleanospp.exeexecutable
MD5:5FD363D52D04AC200CD24F3BCC903200
SHA256:3FDEFE2AD092A9A7FE0EDF0AC4DC2DE7E5B9CE6A0804F6511C06564194966CF9
2920files.datC:\Users\admin\AppData\Local\Temp\Rar$EXb4076.37965\files\x64\cleanospp.exeexecutable
MD5:162AB955CB2F002A73C1530AA796477F
SHA256:5CE462E5F34065FC878362BA58617FAB28C22D631B9D836DDDCF43FB1AD4DE6E
3416expand.exeC:\Users\admin\AppData\Local\Temp\over699146\$dpx$.tmp\d954e76c9b75124b8331360160294bf9.tmpxml
MD5:CD294F1AFF7E23273C11D7D920C12125
SHA256:5535D833E22CF9739352A1B993B8DE897FFA9BF581072165C7EC11E848C22203
2700OInstall.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb4076.37965\files\files.datexecutable
MD5:55D21B2C272A5D6B9F54FA9ED82BF9EB
SHA256:7A1C82E264258470D14CA345EA1A9B6FC34FA19B393A92077A01BE5F1AD08F47
3068powershell.exeC:\Users\admin\AppData\Local\Temp\over699146\v32.cabcompressed
MD5:B44CD1125DE1AFB75FC04062CCC8692A
SHA256:5DAE61383845D34146D24B14A0B981CDD595B13BFEADD2B805E2A18DCB5F6642
4076WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb4076.37965\Original source.urlurl
MD5:0C7AF10C4FC6DCB6DED3F946B7D9F5F0
SHA256:64CD7CD89F80AD52303AFCBBC028B0CE1022630C4F5E094F9D56F22BB1BEEE0E
3416expand.exeC:\Users\admin\AppData\Local\Temp\over699146\VersionDescriptor.xmlxml
MD5:CD294F1AFF7E23273C11D7D920C12125
SHA256:5535D833E22CF9739352A1B993B8DE897FFA9BF581072165C7EC11E848C22203
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
26
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3504
powershell.exe
GET
301
104.107.160.60:80
http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32.cab
US
—
—
whitelisted
904
powershell.exe
GET
301
104.107.160.60:80
http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32.cab
US
—
—
whitelisted
528
powershell.exe
GET
301
104.107.160.60:80
http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32.cab
US
—
—
whitelisted
528
powershell.exe
GET
200
23.32.238.208:80
http://officecdn.microsoft.com.edgesuite.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32.cab
US
compressed
10.8 Kb
whitelisted
1312
powershell.exe
GET
301
104.107.160.60:80
http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/16.0.14729.20260/i320.cab
US
—
—
whitelisted
3068
powershell.exe
GET
301
104.107.160.60:80
http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32.cab
US
—
—
whitelisted
904
powershell.exe
GET
200
23.32.238.209:80
http://officecdn.microsoft.com.edgesuite.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32.cab
US
compressed
10.8 Kb
whitelisted
3332
powershell.exe
GET
301
23.53.168.85:80
http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/16.0.14729.20260/i321033.cab
NL
—
—
whitelisted
3504
powershell.exe
GET
200
23.32.238.209:80
http://officecdn.microsoft.com.edgesuite.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32.cab
US
compressed
10.8 Kb
whitelisted
1312
powershell.exe
GET
200
23.32.238.208:80
http://officecdn.microsoft.com.edgesuite.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/16.0.14729.20260/i320.cab
US
compressed
24.4 Mb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3068
powershell.exe
104.107.160.60:80
officecdn.microsoft.com
GTT Communications Inc.
US
unknown
1312
powershell.exe
23.32.238.208:80
officecdn.microsoft.com.edgesuite.net
XO Communications
US
unknown
528
powershell.exe
104.107.160.60:80
officecdn.microsoft.com
GTT Communications Inc.
US
unknown
3504
powershell.exe
104.107.160.60:80
officecdn.microsoft.com
GTT Communications Inc.
US
unknown
1312
powershell.exe
104.107.160.60:80
officecdn.microsoft.com
GTT Communications Inc.
US
unknown
528
powershell.exe
23.32.238.208:80
officecdn.microsoft.com.edgesuite.net
XO Communications
US
unknown
904
powershell.exe
104.107.160.60:80
officecdn.microsoft.com
GTT Communications Inc.
US
unknown
3332
powershell.exe
23.53.168.85:80
officecdn.microsoft.com
Akamai Technologies, Inc.
NL
unknown
3504
powershell.exe
23.32.238.209:80
officecdn.microsoft.com.edgesuite.net
XO Communications
US
suspicious
904
powershell.exe
23.32.238.209:80
officecdn.microsoft.com.edgesuite.net
XO Communications
US
suspicious

DNS requests

Domain
IP
Reputation
officecdn.microsoft.com
  • 104.107.160.60
  • 23.53.168.85
whitelisted
officecdn.microsoft.com.edgesuite.net
  • 23.32.238.209
  • 23.32.238.187
  • 23.32.238.208
  • 2.16.106.171
  • 2.16.106.194
whitelisted
ecs.office.com
  • 52.113.194.132
whitelisted
vortex-win.data.microsoft.com
  • 40.77.226.250
whitelisted
ctldl.windowsupdate.com
  • 2.16.106.233
  • 2.16.106.163
  • 2.16.106.178
whitelisted
crl.microsoft.com
  • 2.22.119.33
  • 2.22.119.98
whitelisted
www.microsoft.com
  • 2.18.233.62
whitelisted
self.events.data.microsoft.com
  • 20.189.173.9
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
AppNee.com.Office.2013-2021.C2R.Install.v7.3.9.Lite.Full.7z