analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| File name: | 6ecd695f26afd8e86058155d6202751a.doc |
| Full analysis: | https://app.any.run/tasks/59cb97be-16b9-4c73-ae9d-ee969df23619 |
| Verdict: | Malicious activity |
| Analysis date: | April 23, 2019, 08:01:46 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/msword |
| File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Title: 5ui6ups2xcx4c6kldnc91d, Subject: m6l5a1n8, Author: vy6j, Comments: q797ns59qdr5bywyq1sl4j42n69itsaj, Template: Normal, Last Saved By: Windows, Revision Number: 11, Name of Creating Application: Microsoft Office Word, Total Editing Time: 03:00, Create Time/Date: Thu Apr 19 19:59:00 2018, Last Saved Time/Date: Thu Apr 18 09:34:00 2019, Number of Pages: 1, Number of Words: 1, Number of Characters: 7, Security: 0 |
| MD5: | 6ECD695F26AFD8E86058155D6202751A |
| SHA1: | 7BB657E9745FF148E6AB0B30275AC34EB6D78BD9 |
| SHA256: | 11C2A37F92F9F6F9BA6C249459E49089A2F4797F742B5CFD0CC2B72A69C599B2 |
| SSDEEP: | 1536:Oyy9tGNvd1HNNgnFR+xNyJv7Dm3ZhGjdowX2Gpz:okNvd1HMaOnx/2Gp |
MALICIOUS
Starts CMD.EXE for commands execution
- WINWORD.EXE (PID: 2604)
Runs app for hidden code execution
- WINWORD.EXE (PID: 2604)
Unusual execution from Microsoft Office
- WINWORD.EXE (PID: 2604)
SUSPICIOUS
No suspicious indicators.INFO
Reads Microsoft Office registry keys
- WINWORD.EXE (PID: 2604)
Creates files in the user directory
- WINWORD.EXE (PID: 2604)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .doc | | | Microsoft Word document (54.2) |
|---|---|---|
| .doc | | | Microsoft Word document (old ver.) (32.2) |
EXIF
FlashPix
| Title: | 5ui6ups2xcx4c6kldnc91d |
|---|---|
| Subject: | m6l5a1n8 |
| Author: | vy6j |
| Keywords: | - |
| Comments: | q797ns59qdr5bywyq1sl4j42n69itsaj |
| Template: | Normal |
| LastModifiedBy: | Пользователь Windows |
| RevisionNumber: | 11 |
| Software: | Microsoft Office Word |
| TotalEditTime: | 3.0 minutes |
| CreateDate: | 2018:04:19 18:59:00 |
| ModifyDate: | 2019:04:18 08:34:00 |
| Pages: | 1 |
| Words: | 1 |
| Characters: | 7 |
| Security: | None |
| CodePage: | Windows Cyrillic |
| Manager: | 7urctxvmkiyht |
| Company: | 1nf6 |
| Bytes: | 23552 |
| Lines: | 1 |
| Paragraphs: | 1 |
| CharCountWithSpaces: | 7 |
| AppVersion: | 16 |
| ScaleCrop: | No |
| LinksUpToDate: | No |
| SharedDoc: | No |
| HyperlinksChanged: | No |
| TitleOfParts: | |
| HeadingPairs: |
|
| CompObjUserTypeLen: | 32 |
| CompObjUserType: | Microsoft Word 97-2003 Document |
Total processes
34
Monitored processes
2
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 2604 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\6ecd695f26afd8e86058155d6202751a.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
| 2120 | "C:\Windows\System32\cmd.exe" | C:\Windows\System32\cmd.exe | — | WINWORD.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
Total events
1 042
Read events
717
Write events
0
Delete events
0
Modification events
Executable files
0
Suspicious files
0
Text files
0
Unknown types
2
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2604 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR66BB.tmp.cvr | — | |
MD5:— | SHA256:— | |||
| 2604 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~$cd695f26afd8e86058155d6202751a.doc | pgc | |
MD5:95F3A8A162636999B96AF8ED1E1CB0C0 | SHA256:C4EFDCC11122FB3FD9354C0F57154D51435FCE888EAD4557CA212BFEA9F1E45A | |||
| 2604 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:03F75A861CC10AD1C3318BEB891B725B | SHA256:7EBE4AE513B230A4E93B55D5C5B1A8281E935A6A42B38FA33B58EA5B73980E58 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report