File name:

help.doc

Full analysis: https://app.any.run/tasks/c9e51f6a-4e3c-462f-9305-e8ea6ee6595b
Verdict: Malicious activity
Threats:

Hancitor was created in 2014 to drop other malware on infected machines. It is also known as Tordal and Chanitor. This malware is available as a service which makes it accessible tools to criminals and contributes to the popularity of this virus.

Malware Trends Tracker     >>>
Analysis date: August 02, 2022, 07:17:00
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
encrypted
evasion
hancitor
Indicators:
MIME: application/encrypted
File info: CDFV2 Encrypted
MD5:

B259E7D25E95EE65052D6DB146BCFE24

SHA1:

B788506181233087E4AFF0CAFF8755E2C32733EF

SHA256:

106A02E6E6452320F7F5425DBFBC8B126AC331D3C758417B08AB80B8AAA91846

SSDEEP:

1536:lePhCq5vJl18xTGz9MGMd+w3YwRxU+0gB0U/ymYomGgekV5f6Rfy6YP9+bnLMQ4E:gZvVMTGZMLLxNztymYLek+j08bLMQAd

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executable content was dropped or overwritten

      • WINWORD.EXE (PID: 3160)

    • Drops executable file immediately after starts

      • WINWORD.EXE (PID: 3160)

    • Loads dropped or rewritten executable

      • rundll32.exe (PID: 3888)

    • HANCITOR detected by memory dumps

      • rundll32.exe (PID: 3888)

  • SUSPICIOUS

    • Drops a file with a compile date too recent

      • WINWORD.EXE (PID: 3160)

    • Checks supported languages

      • cmd.exe (PID: 968)
      • cmd.exe (PID: 1716)

    • Application launched itself

      • cmd.exe (PID: 968)

    • Checks for external IP

      • rundll32.exe (PID: 3888)

  • INFO

    • Checks supported languages

      • WINWORD.EXE (PID: 3160)
      • PING.EXE (PID: 2332)
      • PING.EXE (PID: 1572)
      • rundll32.exe (PID: 3888)

    • Reads the computer name

      • WINWORD.EXE (PID: 3160)
      • PING.EXE (PID: 2332)
      • PING.EXE (PID: 1572)
      • rundll32.exe (PID: 3888)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 3160)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Hancitor

(PID) Process(3888) rundll32.exe
Hosts (3)http://hiltustra.com/9/forum.php
http://corelince.ru/9/forum.php
http://mernwel.ru/9/forum.php
Hosts (3)http://hiltustra.com/9/forum.php
http://corelince.ru/9/forum.php
http://mernwel.ru/9/forum.php
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
6
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winword.exe cmd.exe no specs ping.exe no specs cmd.exe no specs ping.exe no specs #HANCITOR rundll32.exe

Process information

PID
CMD
Path
Indicators
Parent process
968cmd.exe /c cd c:\users\admin\appdata\roaming\microsoft\templates && ping localhost -n 10 && c:\users\admin\appdata\roaming\microsoft\templates/1.batC:\Windows\system32\cmd.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
1572ping localhost -n 10 C:\Windows\system32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1716cmd.exe /c ping localhost -n 10 C:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2332ping localhost -n 10 C:\Windows\system32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3160"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\help.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
3888rundll32.exe iff.bin,WCWGVXGWTDGAWLWC:\Windows\system32\rundll32.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Hancitor
(PID) Process(3888) rundll32.exe
Hosts (3)http://hiltustra.com/9/forum.php
http://corelince.ru/9/forum.php
http://mernwel.ru/9/forum.php
(PID) Process(3888) rundll32.exe
Hosts (3)http://hiltustra.com/9/forum.php
http://corelince.ru/9/forum.php
http://mernwel.ru/9/forum.php
Total events
0
Read events
0
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
5
Text files
2
Unknown types
8

Dropped files

PID
Process
Filename
Type
3160WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR42BE.tmp.cvr —
MD5:—
SHA256:—
3160WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$help.docpgc
MD5:—
SHA256:—
3160WINWORD.EXEC:\Users\admin\AppData\Local\Temp\if.binexecutable
MD5:—
SHA256:—
3160WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~DF7EA3B2954B6AA735.TMPbinary
MD5:—
SHA256:—
3160WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~DFB8E17B4D58F24700.TMPbinary
MD5:—
SHA256:—
3160WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{B50D8837-DA0E-4230-895E-93FB3D3A25DE}.tmpbinary
MD5:—
SHA256:—
3160WINWORD.EXEC:\users\admin\appdata\roaming\microsoft\templates\1.battext
MD5:—
SHA256:—
3160WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{58CDF0E3-AFD6-46D6-9331-45A56AB78200}.tmpbinary
MD5:—
SHA256:—
3160WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:—
SHA256:—
3160WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~DFD1640731C2C8F0B0.TMPbinary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
13
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3888
rundll32.exe
GET
200
3.232.242.170:80
http://api.ipify.org/
US
text
13 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
3.232.242.170:80
api.ipify.org
—
US
malicious

DNS requests

Domain
IP
Reputation
api.ipify.org
  • 3.232.242.170
  • 3.220.57.224
  • 52.20.78.240
  • 54.91.59.199
shared
hiltustra.com
  • —
malicious
dns.msftncsi.com
  • 131.107.255.255
shared
corelince.ru
  • —
unknown
mernwel.ru
  • —
unknown

Threats

PID
Process
Class
Message
3888
rundll32.exe
Potential Corporate Privacy Violation
ET POLICY External IP Lookup api.ipify.org
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
help.doc