analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

malware.malware

Full analysis: https://app.any.run/tasks/a9c70a0c-486e-46a0-a898-17ac8b9fee30
Verdict: Malicious activity
Analysis date: July 18, 2019, 08:37:52
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
macros-on-close
generated-doc
maldoc-4
Indicators:
MIME: application/vnd.openxmlformats-officedocument.wordprocessingml.document
File info: Microsoft Word 2007+
MD5:

12ED9F31D44BCB2FC82BD8CD852179B7

SHA1:

553CF9818F903ECEC4FE4935360878301B36585B

SHA256:

4A94543E8D9046DC399C064A5A81F103F9648DEE0EDB8A719161549958ADAD34

SSDEEP:

3072:OkUXyfNSX//O/VyB4f33SCwFY7rKV/tOkkED1+24D91m4nT:vUifu/W/Vve6atOkBh+24vm4nT

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Unusual execution from Microsoft Office

      • WINWORD.EXE (PID: 3476)
    • Executes scripts

      • WINWORD.EXE (PID: 3476)
  • SUSPICIOUS

    No suspicious indicators.
  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 3476)
    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 3476)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.docm | Word Microsoft Office Open XML Format document (with Macro) (53.6)
.docx | Word Microsoft Office Open XML Format document (24.2)
.zip | Open Packaging Conventions container (18)
.zip | ZIP compressed archive (4.1)

EXIF

XMP

Creator: -

XML

ModifyDate: 2019:07:17 13:53:00Z
CreateDate: 2019:07:08 09:55:00Z
RevisionNumber: 1
LastModifiedBy: -
AppVersion: 14
HyperlinksChanged: No
SharedDoc: No
CharactersWithSpaces: 662960
LinksUpToDate: No
Company: -
TitlesOfParts: -
HeadingPairs:
  • Title
  • 1
ScaleCrop: No
Paragraphs: 1325
Lines: 4709
DocSecurity: None
Application: Microsoft Office Word
Characters: 565138
Words: 99147
Pages: 118
TotalEditTime: -
Template: Normal.dotm

ZIP

ZipFileName: [Content_Types].xml
ZipUncompressedSize: 2645
ZipCompressedSize: 501
ZipCRC: 0xc6337d17
ZipModifyDate: 1980:01:01 00:00:00
ZipCompression: Deflated
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winword.exe no specs wscript.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3476"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\malware.malware.docm"C:\Program Files\Microsoft Office\Office14\WINWORD.EXEexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
4032"C:\Windows\System32\wscript.exe" /e:JScript "C:\Users\admin\Desktop\malware.malware.docm.dec"C:\Windows\System32\wscript.exeWINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Version:
5.8.7600.16385
Total events
1 060
Read events
714
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
0
Text files
4
Unknown types
4

Dropped files

PID
Process
Filename
Type
3476WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRE929.tmp.cvr
MD5:
SHA256:
3476WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\C3C6BF85.png
MD5:
SHA256:
3476WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{F1CB8259-7853-4944-9AC2-991AE8023019}.tmp
MD5:
SHA256:
3476WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{10AAE773-9BC2-4C34-9A13-65A10F0AFD6E}.tmp
MD5:
SHA256:
3476WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{A9555B6C-F2CF-4448-AAAE-E4C8B966733B}.tmp
MD5:
SHA256:
3476WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{CAEC534A-599E-4DAE-8ED7-0798CB86545A}.tmp
MD5:
SHA256:
3476WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\malware.malware.docm.LNKlnk
MD5:6F71492549553505BDE77F186BBA0D3E
SHA256:B47F27116AE70379FB95903CA8947810983FF4306CE2F16DF91DDA65F4036C6F
3476WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:6D2070271381661F752D1879C5EEEC88
SHA256:9F94B002B43189A9D0BEA303D6B74AD422169C9B3A73C66A3FEBF63BC0073001
3476WINWORD.EXEC:\Users\admin\Desktop\~$lware.malware.docmpgc
MD5:D7E690C142C5AE7E1AE90B11440A7DBE
SHA256:595FB8179904BBCCC2F6FA6C8A9F50EEEE1A9EF8F1DEA96F2CB22A3A7B08D731
3476WINWORD.EXEC:\Users\admin\Desktop\malware.malware.docm.dectext
MD5:D4E2D3C4FC84020F0E09A81DD959EE07
SHA256:AD5FD9F1D523BE79ECD6655FCDA373B23004AE027D8BE1BD7C625AC52AF27159
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info