analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

IG_CON_WageList.doc

Full analysis: https://app.any.run/tasks/45ac32da-055b-44d3-aa4e-216e8404a3c9
Verdict: Malicious activity
Analysis date: November 08, 2018, 14:13:35
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: MacOS, Version 13.10, Code page: 10000, Author: Installer, Template: Normal.dotm, Last Saved By: Lukas Reiter, Revision Number: 5, Name of Creating Application: Microsoft Office Word, Total Editing Time: 01:00, Create Time/Date: Wed Sep 12 12:26:00 2018, Last Saved Time/Date: Thu Nov 8 14:12:00 2018, Number of Pages: 1, Number of Words: 27, Number of Characters: 70, Security: 0
MD5:

DF3E4CCF835749390FE33950DD68991D

SHA1:

79ACF311807B11DF2AB7CFF31D8562D83CAD6B18

SHA256:

3F853A83D4241510F68B88CB137115A499DEA7E72C88EE83D28F72BBF6C5E8E8

SSDEEP:

6144:uHk1/hHmjAqv8+AUD4sm+5/9+G3qm0Cr/MdbCQNVoaA:uHcYd8quG6m0dbC4iaA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executable content was dropped or overwritten

      • WINWORD.EXE (PID: 3112)

    • Starts CMD.EXE for commands execution

      • WINWORD.EXE (PID: 3112)

    • Unusual execution from Microsoft Office

      • WINWORD.EXE (PID: 3112)

    • Application was dropped or rewritten from another process

      • MacroAutoStart.exe (PID: 1864)

  • SUSPICIOUS

    • Creates files in the user directory

      • MacroAutoStart.exe (PID: 1864)

    • Connects to server without host name

      • MacroAutoStart.exe (PID: 1864)

    • Reads Internet Cache Settings

      • MacroAutoStart.exe (PID: 1864)

    • Reads internet explorer settings

      • MacroAutoStart.exe (PID: 1864)

  • INFO

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 3112)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 3112)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (54.2)
.doc | Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

CompObjUserType: Microsoft Word 97-2003 Document
CompObjUserTypeLen: 32
HyperlinkBase: -
CodePage: Mac Roman (Western European)
HeadingPairs:
  • Title
  • 1
TitleOfParts: -
HyperlinksChanged: No
SharedDoc: No
LinksUpToDate: No
ScaleCrop: No
AppVersion: 16
CharCountWithSpaces: 73
Paragraphs: 24
Lines: 70
Company: -
Manager: -
Category: -
Security: None
Characters: 70
Words: 27
Pages: 1
ModifyDate: 2018:11:08 14:12:00
CreateDate: 2018:09:12 11:26:00
TotalEditTime: 1.0 minutes
Software: Microsoft Office Word
RevisionNumber: 5
LastModifiedBy: Lukas Reiter
Template: Normal.dotm
Comments: -
Keywords: -
Author: Installer
Subject: -
Title: -
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
34
Monitored processes
3
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winword.exe cmd.exe no specs macroautostart.exe

Process information

PID
CMD
Path
Indicators
Parent process
3112"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\IG_CON_WageList.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
2956"C:\Windows\system32\cmd.exe" /k "C:\Users\admin\Desktop\MacroAutoStart.exe"C:\Windows\system32\cmd.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
1864C:\Users\admin\Desktop\MacroAutoStart.exeC:\Users\admin\Desktop\MacroAutoStart.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Total events
1 204
Read events
839
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
0
Text files
10
Unknown types
3

Dropped files

PID
Process
Filename
Type
3112WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR9C4B.tmp.cvr —
MD5:—
SHA256:—
1864MacroAutoStart.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txttext
MD5:DE40D9D837A7A598499F9E5CA049B04B
SHA256:19D5B129906700CB5B9F50CA8800D3F4B3FC7FB68B52922FFE3B7B3DCBA39923
1864MacroAutoStart.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txttext
MD5:85935261FF9769121926599F465F10F0
SHA256:3495C2AA5ED1797C232B0103A2801AFDC87DFA054F50D78F5A0C17F67789169C
1864MacroAutoStart.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012018110820181109\index.datdat
MD5:D29B57CB80E03C444379F009D828DEA3
SHA256:CCC68B20FF79B158B6370BCB2876AB6F2D4B0E8622537EFB572339DCAB803A5D
1864MacroAutoStart.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\session-commands7be00079[1].htmtext
MD5:A438C2B916AEE3C960CB50ECEF59936D
SHA256:72A9E32C08A2C014900AE6BAFDF29F473E2FB43C890DD4622F1D8955E5D74C1B
3112WINWORD.EXEC:\Users\admin\Desktop\MacroAutoStart.exeexecutable
MD5:E64CB183F9ADD86065B13F65BA5C6B4A
SHA256:859C42BF7B9A5FBA55D0BCB39343DA274D0C2BA1E5E5BA0243E77BE13FD77BC1
3112WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:6D91E9BA10BE7484E49E380771F2FD60
SHA256:8038F61FD24C01152B1CA92CB2532880D10B68B637A378C6750D77DD73334427
3112WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$_CON_WageList.docpgc
MD5:847C25DA84FAB5E50A9C7861A7D20C57
SHA256:091D23654AD449B3F05A6C356EDB7A2C233F7CE34DC1D90887D5BB1100ACCD34
1864MacroAutoStart.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0UU90R59\session-commands7be00079[1].htmtext
MD5:A438C2B916AEE3C960CB50ECEF59936D
SHA256:72A9E32C08A2C014900AE6BAFDF29F473E2FB43C890DD4622F1D8955E5D74C1B
1864MacroAutoStart.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\session-commands7be00079[1].htmtext
MD5:A438C2B916AEE3C960CB50ECEF59936D
SHA256:72A9E32C08A2C014900AE6BAFDF29F473E2FB43C890DD4622F1D8955E5D74C1B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
6
DNS requests
0
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1864
MacroAutoStart.exe
POST
200
85.195.226.45:80
http://85.195.226.45/0lsc3rrzs057vyga/session-commands
CH
text
57 b
unknown
1864
MacroAutoStart.exe
POST
200
85.195.226.45:80
http://85.195.226.45/0lsc3rrzs057vyga/session-commands
CH
text
57 b
unknown
1864
MacroAutoStart.exe
POST
200
85.195.226.45:80
http://85.195.226.45/0lsc3rrzs057vyga/session-commands
CH
text
57 b
unknown
1864
MacroAutoStart.exe
POST
200
85.195.226.45:80
http://85.195.226.45/0lsc3rrzs057vyga/session-init
CH
text
35 b
unknown
1864
MacroAutoStart.exe
POST
200
85.195.226.45:80
http://85.195.226.45/0lsc3rrzs057vyga/session-commands
CH
text
57 b
unknown
1864
MacroAutoStart.exe
POST
200
85.195.226.45:80
http://85.195.226.45/0lsc3rrzs057vyga/session-commands
CH
text
57 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1864
MacroAutoStart.exe
85.195.226.45:80
—
Init7 (Switzerland) Ltd.
CH
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
IG_CON_WageList.doc