File name:

Drill_2024.doc

Full analysis: https://app.any.run/tasks/2ca08369-557e-492c-866f-6b9b4ff5658e
Verdict: Malicious activity
Analysis date: July 19, 2024, 17:12:20
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
macros
macros-on-open
Indicators:
MIME: application/msword
File info: CDFV2 Microsoft Word
MD5:

1F0B037CFAD1882478C0075F05BA427D

SHA1:

665F48C9413EE76D667453DB39DC5234B0D92037

SHA256:

226AD9680E604D4D538FB5E48948F2A72084DA86407A93BF7D4F2C9EFBB2742C

SSDEEP:

3072:8cIfOgeP2J+gCHEg6s93vgbhfXk/Exgr7:NgeoCHEgTcvS97

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Creates a writable file in the system directory

      • OfficeClickToRun.exe (PID: 3872)

    • Unusual execution from MS Office

      • WINWORD.EXE (PID: 7316)
      • WINWORD.EXE (PID: 5112)

    • The DLL Hijacking

      • OfficeClickToRun.exe (PID: 3872)

    • Scans artifacts that could help determine the target

      • OfficeClickToRun.exe (PID: 3872)

  • SUSPICIOUS

    • Executes as Windows Service

      • OfficeClickToRun.exe (PID: 3872)

    • Runs shell command (SCRIPT)

      • WINWORD.EXE (PID: 7316)
      • WINWORD.EXE (PID: 5112)

    • Checks Windows Trust Settings

      • OfficeClickToRun.exe (PID: 3872)

    • Reads data from a binary Stream object (SCRIPT)

      • WINWORD.EXE (PID: 7316)
      • WINWORD.EXE (PID: 5112)

  • INFO

    • Manual execution by a user

      • WINWORD.EXE (PID: 7316)
      • WINWORD.EXE (PID: 5112)

    • Reads the machine GUID from the registry

      • OfficeClickToRun.exe (PID: 3872)

    • Reads Environment values

      • OfficeClickToRun.exe (PID: 3872)

    • Checks supported languages

      • OfficeClickToRun.exe (PID: 3872)

    • Checks proxy server information

      • OfficeClickToRun.exe (PID: 3872)

    • Reads the software policy settings

      • OfficeClickToRun.exe (PID: 3872)

    • Reads the computer name

      • OfficeClickToRun.exe (PID: 3872)

    • Reads Microsoft Office registry keys

      • OfficeClickToRun.exe (PID: 3872)

    • Process checks computer location settings

      • OfficeClickToRun.exe (PID: 3872)

    • Reads CPU info

      • OfficeClickToRun.exe (PID: 3872)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (54.2)
.doc | Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

CompObjUserTypeLen: 32
CompObjUserType: Microsoft Word 97-2003 Document
Identification: Word 8.0
LanguageCode: English (US)
DocFlags: 1Table, ExtChar
System: Windows
Word97: No
ModifyDate: 2024:04:01 14:52:37
CodePage: Unicode (UTF-8)
Company: home
Bytes: 106496
CharCountWithSpaces: 141
AppVersion: 16
ScaleCrop: No
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
TitleOfParts:
  • info
HeadingPairs:
  • Title
  • 1
  • Название
  • 1
CreateDate: 2017:04:18 16:00:00Z
LastPrinted: 0000:00:00 00:00:00
RevisionNumber: 67
TotalEditTime: 4.0 days
Words: 21
Characters: 121
Pages: 1
Paragraphs: 1
Lines: 1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
154
Monitored processes
13
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winword.exe winword.exe slui.exe no specs officeclicktorun.exe ping.exe no specs conhost.exe no specs ai.exe no specs ping.exe no specs conhost.exe no specs winword.exe ping.exe no specs conhost.exe no specs ai.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2276ping -n 1 149.28.22.48C:\Windows\System32\PING.EXE—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\nsi.dll
2860"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe" "DDF2EDC8-E792-4467-8F17-5E8805FCF083" "1CC3C92D-5456-4B85-A9BB-1E5047174832" "5112"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Artificial Intelligence (AI) Host for the Microsoft® Windows® Operating System and Platform x64.
Exit code:
0
Version:
0.12.2.0
Modules
Images
c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\ai.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\advapi32.dll
c:\program files\common files\microsoft shared\clicktorun\c2r64.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3872"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /serviceC:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Office Click-to-Run (SxS)
Version:
16.0.16026.20140
Modules
Images
c:\program files\common files\microsoft shared\clicktorun\officeclicktorun.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\gdi32.dll
5112"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\admin\Desktop\Drill_2024.doc" /o ""C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
16.0.16026.20146
Modules
Images
c:\program files\microsoft office\root\office16\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\rpcrt4.dll
5716\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—PING.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5720"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe" "908C6737-97F4-4A9A-9561-D3DC8BBC4E87" "E0E60E71-2B43-4625-9F88-27624C9DA6EE" "7316"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Artificial Intelligence (AI) Host for the Microsoft® Windows® Operating System and Platform x64.
Exit code:
0
Version:
0.12.2.0
Modules
Images
c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\ai.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
6800"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n C:\Users\admin\Desktop\Drill_2024.doc /o ""C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
16.0.16026.20146
Modules
Images
c:\program files\microsoft office\root\office16\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
6840\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—PING.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6968C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6992ping -n 1 149.28.22.48C:\Windows\System32\PING.EXE—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\nsi.dll
Total events
26 955
Read events
26 181
Write events
727
Delete events
47

Modification events

(PID) Process:(3872) OfficeClickToRun.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:en-US
Value:
2
(PID) Process:(3872) OfficeClickToRun.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:en-US
Value:
1
(PID) Process:(3872) OfficeClickToRun.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\RuntimeExceptionHelperModules
Operation:writeName:C:\Program Files\Common Files\Microsoft Shared\ClickToRun\c2r64werhandler.dll
Value:
0
(PID) Process:(3872) OfficeClickToRun.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\Office\16.0\Common
Operation:writeName:SessionId
Value:
11EE2191D3B2CB4B8D35B2E37235559D
(PID) Process:(3872) OfficeClickToRun.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun
Operation:writeName:MachineMetadataSentTime
Value:
13365882767379
(PID) Process:(3872) OfficeClickToRun.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3872) OfficeClickToRun.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3872) OfficeClickToRun.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3872) OfficeClickToRun.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(7316) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\ClientTelemetry\Sampling
Operation:writeName:0
Value:
017012000000001000B24E9A3E01000000000000000500000000000000
Executable files
1
Suspicious files
46
Text files
9
Unknown types
2

Dropped files

PID
Process
Filename
Type
7316WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\2AF9FF0F-D61B-4CCE-A445-28D0D0ED329Fxml
MD5:63B9BF075D34E8CF1BA44B8DF2CD1101
SHA256:0DC902457CF667FF51CD44AE308844C43AF60C5D4C37191BBA40BAB329C421DC
7316WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dattext
MD5:B95B3963755AFFD003D99FA50B7D1A20
SHA256:EA7BA2C667196CF24B666A972137B43012D64DD6F082A2809899C746A2D51B6C
7316WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\Drill_2024.doc.LNKbinary
MD5:18EFAFFC5FDFE2D58E87E0ADFF351975
SHA256:52BBB042DF851141311D3C435E3AD66EF6E34A10049FF1CC9BBA793765A187E1
6800WINWORD.EXEC:\Users\admin\AppData\Local\Temp\Diagnostics\WINWORD\App1721409169445430200_E606C85E-307D-40FA-B80B-11389AB521D9.log —
MD5:—
SHA256:—
6800WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbresbinary
MD5:0E9C468D904C085F8DE7CA1B1D3AAD61
SHA256:2097E8601FB28BAFA91B6A398AB7D099AC4240D7821180681D295F759E3F7C9A
7316WINWORD.EXEC:\Users\admin\Desktop\~$ill_2024.docbinary
MD5:229849B9ED2880644BA2032E91C2E3D9
SHA256:DEFB0036CA451566EA1BE0BD9041506174AA64370603BEDB321B2B2B0B89EC2A
6800WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbresbinary
MD5:578BF57BBC5919E5A1401725CB662CAF
SHA256:61AC1D5DDCFF57BF2E76EE6AAD560F256E7134C64BF80EB11A633DDA4C909C1E
6800WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.Settings.jsonbinary
MD5:E4E83F8123E9740B8AA3C3DFA77C1C04
SHA256:6034F27B0823B2A6A76FE296E851939FD05324D0AF9D55F249C79AF118B0EB31
6800WINWORD.EXEC:\Users\admin\AppData\Local\Temp\9916B5E1.tmpbinary
MD5:FB0B4D1C8A9F1B5E7C46D1AF4451BEB3
SHA256:36AB816CA5B786D49A4B8B6FA895143C59C5EE349DE81D24A09582A145D98296
6800WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.CampaignStates.jsonbinary
MD5:F1B59332B953B3C99B3C95A44249C0D2
SHA256:138E49660D259061D8152137ABD8829ACDFB78B69179890BEB489FE3FFE23E0C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
49
DNS requests
23
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7316
WINWORD.EXE
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5620
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4716
svchost.exe
40.126.32.133:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
—
—
4.209.32.67:443
licensing.mp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
4032
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
2760
svchost.exe
40.115.3.253:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2892
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4716
svchost.exe
20.190.160.20:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5620
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
whitelisted
login.live.com
  • 40.126.32.133
  • 20.190.160.20
  • 40.126.32.136
  • 40.126.32.138
  • 20.190.160.17
  • 40.126.32.68
  • 40.126.32.140
  • 20.190.160.22
whitelisted
google.com
  • 172.217.23.110
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
arc.msn.com
  • 20.103.156.88
whitelisted
www.bing.com
  • 2.23.209.130
  • 2.23.209.185
  • 2.23.209.176
  • 2.23.209.179
  • 2.23.209.177
  • 2.23.209.149
  • 2.23.209.182
  • 2.23.209.133
  • 2.23.209.189
whitelisted
licensing.mp.microsoft.com
  • 4.209.32.67
whitelisted
fd.api.iris.microsoft.com
  • 20.199.58.43
whitelisted
officeclient.microsoft.com
  • 52.109.76.240
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Drill_2024.doc