Find similar analyses in TI Lookup

Analysis date (UTC): 10 February 2021, 00:57Analysis environment: Windows 10 Pro, build 16299, x64

0208_54741869750132.doc

MD5:7F6C623196D7E76C205B4FB898AD9BE6

SHA1:408BB5B4E8AC34CE3B70BA54E00E9858CED885C0

SHA256:3A5648F7DE99C4F87331C36983FC8ADCD667743569A19C8DAFDD5E8A33DE154D

Analysis result

Threat level:Malicious activity

Tags:

macrosole-embeddedmacros-on-opengenerated-docevasiontrojanhancitormaldoc-57

Full analysis:Analysis 0208_54741869750132.doc (MD5: 7F6C623196D7E76C205B4FB898AD9BE6) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Loads dropped or rewritten executable

rundll32.exe (PID: 4532)

Unusual execution from Microsoft Office

WINWORD.EXE (PID: 4440)

Executable content was dropped or overwritten

WINWORD.EXE (PID: 4440)

Connects to CnC server

rundll32.exe (PID: 4532)

HANCITOR was detected

rundll32.exe (PID: 4532)

SUSPICIOUS

Drops a file with too old compile date

WINWORD.EXE (PID: 4440)

Uses RUNDLL32.EXE to load library

WINWORD.EXE (PID: 4440)
rundll32.exe (PID: 2444)

Checks for external IP

rundll32.exe (PID: 4532)

INFO

Reads settings of System Certificates

WINWORD.EXE (PID: 4440)

Reads the software policy settings

WINWORD.EXE (PID: 4440)

Reads Environment values

WINWORD.EXE (PID: 4440)

Scans artifacts that could help determine the target

WINWORD.EXE (PID: 4440)

Creates files in the user directory

WINWORD.EXE (PID: 4440)

Reads Microsoft Office registry keys

WINWORD.EXE (PID: 4440)

Threats

PID	Process	Class	Message
4532	rundll32.exe	Potential Corporate Privacy Violation	ET POLICY External IP Lookup api.ipify.org
4532	rundll32.exe	A Network Trojan was detected	MALWARE [PTsecurity] Hancitor POST Data send
4532	rundll32.exe	A Network Trojan was detected	MALWARE [PTsecurity] Hancitor POST Data send