analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

1f853368ba469abd3bbb5ba797e646cf0d3485eb7053b29d5e4501a703b6f17a

Full analysis: https://app.any.run/tasks/c07e741e-1ff2-4623-9d8e-45d14e98c9e2
Verdict: Malicious activity
Analysis date: December 06, 2018, 12:16:43
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

2A1C43A62C89A78D6D7A157B3AA86B3B

SHA1:

8D886586B9EE017F5C2611CF9E0C51868D284F4C

SHA256:

1F853368BA469ABD3BBB5BA797E646CF0D3485EB7053B29D5E4501A703B6F17A

SSDEEP:

3072:jSEVa/OV7diMw+bdRBbu2MKIOU9JEyRaV7kVFEjcfUhwCgZSHK0LJx2:eEVTVZb5RxuROoEXV4VFEjcfbCgMKii

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Unusual execution from Microsoft Office

      • WINWORD.EXE (PID: 3504)

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 3504)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 3504)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.docx | Word Microsoft Office Open XML Format document (52.2)
.zip | Open Packaging Conventions container (38.8)
.zip | ZIP compressed archive (8.8)

EXIF

XML

ModifyDate: 2018:10:15 16:19:00Z
CreateDate: 2018:10:15 16:19:00Z
AppVersion: 12
HyperlinksChanged: No
SharedDoc: No
CharactersWithSpaces: -
LinksUpToDate: No
Company: -
ScaleCrop: No
Paragraphs: 1
Lines: 1
DocSecurity: None
Application: Microsoft Office Word
Characters: -
Words: -
Pages: 1
TotalEditTime: -
Template: Normal.dotm

ZIP

ZipFileName: _rels/
ZipUncompressedSize: -
ZipCompressedSize: -
ZipCRC: 0x00000000
ZipModifyDate: 2018:12:04 22:20:22
ZipCompression: None
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
35
Monitored processes
4
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winword.exe no specs fltldr.exe no specs fltldr.exe no specs fltldr.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3504"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\1f853368ba469abd3bbb5ba797e646cf0d3485eb7053b29d5e4501a703b6f17a.docx"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
2256"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\FLTLDR.EXE" C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\EPSIMP32.FLTC:\Program Files\Common Files\Microsoft Shared\OFFICE14\FLTLDR.EXE—WINWORD.EXE
User:
admin
Integrity Level:
LOW
Exit code:
0
3364"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\FLTLDR.EXE" C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\EPSIMP32.FLTC:\Program Files\Common Files\Microsoft Shared\OFFICE14\FLTLDR.EXE—WINWORD.EXE
User:
admin
Integrity Level:
LOW
Exit code:
0
1032"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\FLTLDR.EXE" C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\EPSIMP32.FLTC:\Program Files\Common Files\Microsoft Shared\OFFICE14\FLTLDR.EXE—WINWORD.EXE
User:
admin
Integrity Level:
LOW
Total events
491
Read events
458
Write events
27
Delete events
6

Modification events

(PID) Process:(3504) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:writeName:ky!
Value:
6B792100B00D0000010000000000000000000000
(PID) Process:(3504) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
Off
(PID) Process:(3504) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
On
(PID) Process:(3504) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:WORDFiles
Value:
1300627479
(PID) Process:(3504) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:ProductFiles
Value:
1300627600
(PID) Process:(3504) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:ProductFiles
Value:
1300627601
(PID) Process:(3504) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word
Operation:writeName:MTTT
Value:
B00D0000A08C12965D8DD40100000000
(PID) Process:(3504) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:writeName:3z!
Value:
337A2100B00D000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000
(PID) Process:(3504) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:delete valueName:3z!
Value:
337A2100B00D000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000
(PID) Process:(3504) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
Executable files
0
Suspicious files
0
Text files
2
Unknown types
10

Dropped files

PID
Process
Filename
Type
3504WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRA56B.tmp.cvr —
MD5:—
SHA256:—
3504WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\59D9D592.epsps
MD5:C8F5679981B53D21163E227536DBF058
SHA256:4A3EA8066674F404F03229CFDDB1EAFE0255AFE909AC36950ADD80D07C23DF4D
3504WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:C9005899C42F58E9E7C96DCB3A5EE8E3
SHA256:BAAA4B86601B2CDBDAF8C9D3F3076A6A57EBB0E5FFD49CF53E039A90105750E4
3504WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dattext
MD5:210A9A61960FBFE7E02338ED4E0DC87E
SHA256:18ADB6A941B28A784F6964762F069B18EAB455200A81AFD1020BA6C0112CDB89
3504WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\6F97DB70.epsps
MD5:C8F5679981B53D21163E227536DBF058
SHA256:4A3EA8066674F404F03229CFDDB1EAFE0255AFE909AC36950ADD80D07C23DF4D
3504WINWORD.EXEC:\Users\admin\AppData\Local\Temp\OICE_940F9BB0-09B6-48D8-898B-7D52F37711BF.0\FLAB67.tmpps
MD5:C8F5679981B53D21163E227536DBF058
SHA256:4A3EA8066674F404F03229CFDDB1EAFE0255AFE909AC36950ADD80D07C23DF4D
3504WINWORD.EXEC:\Users\admin\Desktop\~$853368ba469abd3bbb5ba797e646cf0d3485eb7053b29d5e4501a703b6f17a.docxpgc
MD5:28FA354D267C7270434285CCDC9AF997
SHA256:9ECC766405A080CA47C7958A8F7CAE32488A6CA911B25CD284207098BDC513CF
3504WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\1f853368ba469abd3bbb5ba797e646cf0d3485eb7053b29d5e4501a703b6f17a.docx.LNKlnk
MD5:75DE0FA062719A752F96B95B42E557BB
SHA256:CC9F0B27C5D7F5BDFD0F5F7C083BBC33AB65FB1CB35E36D5C3E6ECD0CCE200C2
3504WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\366A046B.epsps
MD5:C8F5679981B53D21163E227536DBF058
SHA256:4A3EA8066674F404F03229CFDDB1EAFE0255AFE909AC36950ADD80D07C23DF4D
3504WINWORD.EXEC:\Users\admin\AppData\Local\Temp\OICE_5CA396BF-0F5F-4404-B526-1B659AF58E11.0\FL4910.tmpps
MD5:C8F5679981B53D21163E227536DBF058
SHA256:4A3EA8066674F404F03229CFDDB1EAFE0255AFE909AC36950ADD80D07C23DF4D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
1f853368ba469abd3bbb5ba797e646cf0d3485eb7053b29d5e4501a703b6f17a