download:

Notificacao-Judicial.doc

Full analysis: https://app.any.run/tasks/c9ab2f54-84de-4bdd-bd98-48574afc5bc3
Verdict: Malicious activity
Analysis date: December 02, 2020, 16:55:17
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
Indicators:
MIME: application/octet-stream
File info: Microsoft OOXML
MD5:

CD929CCBA2C3615256DCBF4EA0EF8062

SHA1:

8F09A937DDC15F5522788718A9483B48557A287A

SHA256:

24A67ECE50933155FABEDCCF7DF8B32E1C4D45636EFEB720383D8C5DEACE76DB

SSDEEP:

12288:gcpZjPu8VQrLkwO8tFACyhSPHTqXjvgn4mZa0mYE8xLnIGqG+yMdosgr:gkc8VZwjazGTWjvXmM0mYh5IGFXsgr

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executable content was dropped or overwritten

      • WINWORD.EXE (PID: 2472)

    • Unusual execution from Microsoft Office

      • WINWORD.EXE (PID: 2472)

    • Application was dropped or rewritten from another process

      • ms.exe (PID: 2800)

  • SUSPICIOUS

    • Creates files in the program directory

      • WINWORD.EXE (PID: 2472)

    • Drops a file that was compiled in debug mode

      • WINWORD.EXE (PID: 2472)
      • msiexec.exe (PID: 3720)

    • Executed as Windows Service

      • vssvc.exe (PID: 3644)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 3720)
      • ms.exe (PID: 2800)

    • Creates a directory in Program Files

      • msiexec.exe (PID: 3720)

    • Starts Microsoft Installer

      • ms.exe (PID: 2800)

  • INFO

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2472)

    • Low-level read access rights to disk partition

      • vssvc.exe (PID: 3644)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2472)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 3720)

    • Searches for installed software

      • msiexec.exe (PID: 3720)

    • Application launched itself

      • msiexec.exe (PID: 3720)

    • Manual execution by user

      • taskmgr.exe (PID: 1992)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.docm | Word Microsoft Office Open XML Format document (with Macro) (53.6)
.docx | Word Microsoft Office Open XML Format document (24.2)
.zip | Open Packaging Conventions container (18)
.zip | ZIP compressed archive (4.1)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 1980:01:01 00:00:00
ZipCRC: 0xa1fe8fa1
ZipCompressedSize: 430
ZipUncompressedSize: 1768
ZipFileName: [Content_Types].xml
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
49
Monitored processes
8
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start winword.exe ms.exe msiexec.exe no specs msiexec.exe vssvc.exe no specs msiexec.exe taskmgr.exe no specs perfmon.exe

Process information

PID
CMD
Path
Indicators
Parent process
1496C:\Windows\system32\MsiExec.exe -Embedding 52A78129A81BB65F0F4D15324205B7A1C:\Windows\system32\MsiExec.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1992"C:\Windows\system32\taskmgr.exe" /4C:\Windows\system32\taskmgr.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Task Manager
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2472"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\Notificacao-Judicial.doc.docm"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
2800C:\ProgramData\Memsys\ms.exeC:\ProgramData\Memsys\ms.exe
WINWORD.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\programdata\memsys\ms.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3644C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3720C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3784"C:\Windows\System32\perfmon.exe" /resC:\Windows\System32\perfmon.exe
taskmgr.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Resource and Performance Monitor
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\perfmon.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3848"C:\Windows\System32\msiexec.exe" /i "C:\Users\Public\Documents\HDSKUDHS.msi" C:\Windows\System32\msiexec.exe—ms.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
2 281
Read events
1 437
Write events
747
Delete events
97

Modification events

(PID) Process:(2472) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:writeName:9t"
Value:
39742200A8090000010000000000000000000000
(PID) Process:(2472) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
Off
(PID) Process:(2472) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1041
Value:
Off
(PID) Process:(2472) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1046
Value:
Off
(PID) Process:(2472) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1036
Value:
Off
(PID) Process:(2472) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1031
Value:
Off
(PID) Process:(2472) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1040
Value:
Off
(PID) Process:(2472) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1049
Value:
Off
(PID) Process:(2472) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:3082
Value:
Off
(PID) Process:(2472) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1042
Value:
Off
Executable files
5
Suspicious files
5
Text files
1
Unknown types
2

Dropped files

PID
Process
Filename
Type
2472WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRD099.tmp.cvr —
MD5:—
SHA256:—
2472WINWORD.EXEC:\Users\admin\AppData\Local\Temp\msoD935.tmp —
MD5:—
SHA256:—
3720msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
3720msiexec.exeC:\Windows\Installer\MSI21C6.tmp —
MD5:—
SHA256:—
3720msiexec.exeC:\Windows\Installer\MSI22B2.tmp —
MD5:—
SHA256:—
3720msiexec.exeC:\Users\admin\AppData\Local\Temp\~DF8B07CF25C8634BD4.TMP —
MD5:—
SHA256:—
3644vssvc.exeC: —
MD5:—
SHA256:—
3720msiexec.exeC:\Windows\Installer\MSI23AE.tmp —
MD5:—
SHA256:—
3720msiexec.exeC:\Config.Msi\191a28.rbs —
MD5:—
SHA256:—
3720msiexec.exeC:\Users\admin\AppData\Local\Temp\~DFC8A673268429B0D3.TMP —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
2
DNS requests
7
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1496
MsiExec.exe
GET
200
51.81.68.207:80
http://mymodulop2pcar.servehttp.com/xx.zip
GB
compressed
29.7 Mb
suspicious
1496
MsiExec.exe
GET
200
45.15.24.61:80
http://java-update.online/Bv3wF1uHKG/counter.php
unknown
text
26 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1496
MsiExec.exe
51.81.68.207:80
mymodulop2pcar.servehttp.com
—
GB
suspicious
1496
MsiExec.exe
45.15.24.61:80
java-update.online
—
—
malicious

DNS requests

Domain
IP
Reputation
mymodulop2pcar.servehttp.com
  • 51.81.68.207
suspicious
207.68.81.51.in-addr.arpa
  • —
unknown
2.100.168.192.in-addr.arpa
  • —
whitelisted
java-update.online
  • 45.15.24.61
malicious
61.24.15.45.in-addr.arpa
  • —
unknown
252.0.0.224.in-addr.arpa
  • —
unknown
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
  • —
unknown

Threats

PID
Process
Class
Message
1044
svchost.exe
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.servehttp .com
1496
MsiExec.exe
Potentially Bad Traffic
ET INFO HTTP Connection To DDNS Domain Servehttp.com
1496
MsiExec.exe
A Network Trojan was detected
MALWARE [PTsecurity] VBS.Loader.Gen
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Notificacao-Judicial.doc