File name:

21eef5d8eb947ee9de2733b3c0be32d7ecef4b16d907363278daed0b804b6747.doc

Full analysis: https://app.any.run/tasks/fb57840c-a185-4078-94c9-e9ea7b29d027
Verdict: Malicious activity
Threats:

NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins which allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website.

Malware Trends Tracker     >>>
Analysis date: May 21, 2019, 02:27:41
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ole-embedded
generated-doc
rat
nanocore
Indicators:
MIME: application/vnd.openxmlformats-officedocument.wordprocessingml.document
File info: Microsoft Word 2007+
MD5:

6A62D273B1AF58160FCFCE03013FC8EA

SHA1:

3D10DB6A56C7638F62F5A98B294C5057D5A8F76F

SHA256:

21EEF5D8EB947EE9DE2733B3C0BE32D7ECEF4B16D907363278DAED0B804B6747

SSDEEP:

3072:06mePD0hyDmFm4F5nEsD6almpKvL2LKmx+Eb85WLkstre9/AxhjD+B2IbZ:rmePFD6P7D6aoa2WmEy85ke6zSIId

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executable content was dropped or overwritten

      • WINWORD.EXE (PID: 2628)

    • Unusual execution from Microsoft Office

      • WINWORD.EXE (PID: 2628)

    • Application was dropped or rewritten from another process

      • sever1 (2).exe (PID: 1252)

    • NanoCore was detected

      • sever1 (2).exe (PID: 1252)

    • Changes the autorun value in the registry

      • sever1 (2).exe (PID: 1252)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • sever1 (2).exe (PID: 1252)

    • Creates files in the user directory

      • sever1 (2).exe (PID: 1252)

  • INFO

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2628)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2628)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.docx | Word Microsoft Office Open XML Format document (52.2)
.zip | Open Packaging Conventions container (38.8)
.zip | ZIP compressed archive (8.8)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0006
ZipCompression: Deflated
ZipModifyDate: 1980:01:01 00:00:00
ZipCRC: 0x24886c04
ZipCompressedSize: 373
ZipUncompressedSize: 1460
ZipFileName: [Content_Types].xml

XMP

Title: -
Subject: -
Creator: hp
Description: -

XML

Keywords: -
LastModifiedBy: hp
RevisionNumber: 1
CreateDate: 2019:05:20 20:05:00Z
ModifyDate: 2019:05:20 20:05:00Z
Template: Normal
TotalEditTime: -
Pages: 1
Words: 3
Characters: 18
Application: Microsoft Office Word
DocSecurity: None
Lines: 1
Paragraphs: 1
ScaleCrop: No
Company: -
LinksUpToDate: No
CharactersWithSpaces: 20
SharedDoc: No
HyperlinksChanged: No
AppVersion: 16
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
34
Monitored processes
2
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start winword.exe #NANOCORE sever1 (2).exe

Process information

PID
CMD
Path
Indicators
Parent process
1252"C:\Users\admin\AppData\Local\Temp\sever1 (2).exe" C:\Users\admin\AppData\Local\Temp\sever1 (2).exe
WINWORD.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\sever1 (2).exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2628"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\21eef5d8eb947ee9de2733b3c0be32d7ecef4b16d907363278daed0b804b6747.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
Total events
1 583
Read events
891
Write events
687
Delete events
5

Modification events

(PID) Process:(2628) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:writeName:?{
Value:
3F7B2000440A0000010000000000000000000000
(PID) Process:(2628) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
Off
(PID) Process:(2628) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
On
(PID) Process:(2628) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:WORDFiles
Value:
1320484894
(PID) Process:(2628) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:ProductFiles
Value:
1320485008
(PID) Process:(2628) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:ProductFiles
Value:
1320485009
(PID) Process:(2628) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word
Operation:writeName:MTTT
Value:
440A0000A6BF9CCC7C0FD50100000000
(PID) Process:(2628) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:writeName:h|
Value:
687C2000440A000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000
(PID) Process:(2628) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:delete valueName:h|
Value:
687C2000440A000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000
(PID) Process:(2628) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
Executable files
2
Suspicious files
0
Text files
1
Unknown types
3

Dropped files

PID
Process
Filename
Type
2628WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR3F1F.tmp.cvr —
MD5:—
SHA256:—
2628WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:—
SHA256:—
2628WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$eef5d8eb947ee9de2733b3c0be32d7ecef4b16d907363278daed0b804b6747.docpgc
MD5:—
SHA256:—
1252sever1 (2).exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\TCP Monitor\tcpmon.exeexecutable
MD5:—
SHA256:—
2628WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\1F7D1DD7.emfemf
MD5:—
SHA256:—
1252sever1 (2).exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\run.dattext
MD5:—
SHA256:—
2628WINWORD.EXEC:\Users\admin\AppData\Local\Temp\sever1 (2).exeexecutable
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
6
DNS requests
5
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1252
sever1 (2).exe
8.8.8.8:53
—
Google Inc.
US
malicious
1252
sever1 (2).exe
104.129.18.230:1604
biz.myddns.me
QuadraNet, Inc
US
unknown

DNS requests

Domain
IP
Reputation
biz.myddns.me
  • 104.129.18.230
unknown
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
21eef5d8eb947ee9de2733b3c0be32d7ecef4b16d907363278daed0b804b6747.doc