File name:

myCV.doc

Full analysis: https://app.any.run/tasks/20f5679f-47d3-4b5c-a90f-cb0e856d2199
Verdict: Malicious activity
Analysis date: January 17, 2020, 18:03:50
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
Indicators:
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.3, Code page: 1252, Author: JULIET MAYNARD, Template: Normal.dotm, Last Saved By: Mark1, Revision Number: 125, Name of Creating Application: Microsoft Office Word, Total Editing Time: 4d+19:37:00, Create Time/Date: Tue Oct 29 02:36:00 2019, Last Saved Time/Date: Wed Jan 15 22:51:00 2020, Number of Pages: 52, Number of Words: 12094, Number of Characters: 68939, Security: 0
MD5:

A175B3B4579368979FD5B3636DE21C87

SHA1:

E440F67CA7D34BE0F7346013D078072F64774E8C

SHA256:

331308E689132C43D8FA6D8E290254F7A51525F99AFEECEBF212CA1C7EA24F17

SSDEEP:

3072:TeYBwnR4b2Jv8LYmeT3GkNuGyN600YsTyorToWpbl0+x+4g9r:TeYBwnR4bav8LYNT3G+FbTHou06Gr

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executable content was dropped or overwritten

      • WINWORD.EXE (PID: 2168)

    • Runs app for hidden code execution

      • WINWORD.EXE (PID: 2168)
      • endocarp.exe (PID: 1704)

    • Unusual execution from Microsoft Office

      • WINWORD.EXE (PID: 2168)

    • Loads dropped or rewritten executable

      • WINWORD.EXE (PID: 2168)
      • 15d0a3bd.exe (PID: 3040)
      • endocarp.exe (PID: 1704)

    • Starts CMD.EXE for commands execution

      • WINWORD.EXE (PID: 2168)

    • Application was dropped or rewritten from another process

      • 15d0a3bd.exe (PID: 3040)
      • endocarp.exe (PID: 1704)
      • cmd.exe (PID: 2524)
      • cmd.exe (PID: 3000)
      • cmd.exe (PID: 2820)

    • Writes to a start menu file

      • DllHost.exe (PID: 3472)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • cmd.exe (PID: 3000)
      • 15d0a3bd.exe (PID: 3040)
      • cmd.exe (PID: 2524)
      • DllHost.exe (PID: 3472)

    • Creates files in the user directory

      • cmd.exe (PID: 3000)
      • cmd.exe (PID: 2524)
      • DllHost.exe (PID: 3472)

    • Starts CMD.EXE for commands execution

      • endocarp.exe (PID: 1704)
      • cmd.exe (PID: 2820)

    • Application launched itself

      • cmd.exe (PID: 2820)

    • Executed via COM

      • DllHost.exe (PID: 3472)

    • Connects to unusual port

      • WerFault.exe (PID: 2800)

  • INFO

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2168)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2168)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (54.2)
.doc | Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

Title: -
Subject: -
Author: JULIET MAYNARD
Keywords: -
Template: Normal.dotm
LastModifiedBy: Mark1
RevisionNumber: 125
Software: Microsoft Office Word
TotalEditTime: 4.8 days
CreateDate: 2019:10:29 02:36:00
ModifyDate: 2020:01:15 22:51:00
Pages: 52
Words: 12094
Characters: 68939
Security: None
CodePage: Windows Latin 1 (Western European)
Company: University of Bradford
Lines: 574
Paragraphs: 161
CharCountWithSpaces: 80872
AppVersion: 16
ScaleCrop: No
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
TitleOfParts: -
HeadingPairs:
  • Title
  • 1
CompObjUserTypeLen: 32
CompObjUserType: Microsoft Word 97-2003 Document
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
8
Malicious processes
3
Suspicious processes
3

Behavior graph

Click at the process to see the details
start drop and start drop and start winword.exe cmd.exe 15d0a3bd.exe endocarp.exe no specs cmd.exe no specs cmd.exe Copy/Move/Rename/Delete/Link Object werfault.exe

Process information

PID
CMD
Path
Indicators
Parent process
1704C:\Users\admin\AppData\Local\Temp\endocarp.exeC:\Users\admin\AppData\Local\Temp\endocarp.exe—15d0a3bd.exe
User:
admin
Company:
Intel Corporation.
Integrity Level:
MEDIUM
Description:
ippchv8-6.1.dll is an ippCH dynamic library
Exit code:
0
Version:
6,1,137,768
Modules
Images
c:\users\admin\appdata\local\temp\endocarp.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
2168"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\myCV.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
2524C:\Windows\system32\cmd.exe /c "COPY /Y /B "C:\Users\admin\AppData\Local\Temp\15d0a3bd.exe" "C:\Users\admin\AppData\Roaming\Adobe\Headlights\WUDFHost.exe""C:\Windows\system32\cmd.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2800"C:\Windows\System32\WerFault.exe"C:\Windows\System32\WerFault.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\users\admin\appdata\local\temp\liebert.bmp
c:\windows\system32\werfault.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\nsi.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
2820"C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe—endocarp.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\opengl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
3000"C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe
WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3040"C:\Users\admin\AppData\Local\Temp\15d0a3bd.exe"C:\Users\admin\AppData\Local\Temp\15d0a3bd.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
2
Modules
Images
c:\users\admin\appdata\local\temp\15d0a3bd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
3472C:\Windows\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}C:\Windows\system32\DllHost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
2 594
Read events
1 821
Write events
649
Delete events
124

Modification events

(PID) Process:(2168) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:writeName:|x=
Value:
7C783D0078080000010000000000000000000000
(PID) Process:(2168) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
Off
(PID) Process:(2168) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1041
Value:
Off
(PID) Process:(2168) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1046
Value:
Off
(PID) Process:(2168) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1036
Value:
Off
(PID) Process:(2168) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1031
Value:
Off
(PID) Process:(2168) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1040
Value:
Off
(PID) Process:(2168) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1049
Value:
Off
(PID) Process:(2168) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:3082
Value:
Off
(PID) Process:(2168) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:WORDFiles
Value:
1345388606
Executable files
9
Suspicious files
2
Text files
33
Unknown types
6

Dropped files

PID
Process
Filename
Type
2168WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRA8FC.tmp.cvr —
MD5:—
SHA256:—
2168WINWORD.EXEC:\Users\admin\AppData\Local\Temp\ssh2_poll.dll —
MD5:—
SHA256:—
2168WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:—
SHA256:—
3000cmd.exeC:\Users\admin\AppData\Local\Temp\15dfdcd5.dattext
MD5:—
SHA256:—
3000cmd.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@pastebin[1].txttext
MD5:—
SHA256:—
304015d0a3bd.exeC:\Users\admin\AppData\Local\Temp\rd\websphere\shoutbox\sites\voter\co5580getcanwrite.cstext
MD5:—
SHA256:—
304015d0a3bd.exeC:\Users\admin\AppData\Local\Temp\25\columnists\printpdf\received\doit\43.opends60.dllbinary
MD5:—
SHA256:—
304015d0a3bd.exeC:\Users\admin\AppData\Local\Temp\rd\websphere\shoutbox\sites\voter\jpverb207.gifimage
MD5:—
SHA256:—
304015d0a3bd.exeC:\Users\admin\AppData\Local\Temp\rd\websphere\shoutbox\sites\voter\libssl1.1amd64.listtext
MD5:—
SHA256:—
304015d0a3bd.exeC:\Users\admin\AppData\Local\Temp\wp-trackback\installation\_media\agency\imports\administrivia\Drum.gifimage
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
3
DNS requests
3
Threats
2

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3000
cmd.exe
104.20.68.143:443
pastebin.com
Cloudflare Inc
US
malicious
2800
WerFault.exe
194.5.99.206:4181
roboticsnetwork.duckdns.org
—
FR
malicious

DNS requests

Domain
IP
Reputation
pastebin.com
  • 104.20.68.143
  • 104.20.67.143
malicious
roboticsnetwork.duckdns.org
  • 194.5.99.206
malicious

Threats

PID
Process
Class
Message
1080
svchost.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
1080
svchost.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
myCV.doc