Malware analysis 2020-06-03-Word-doc-with-macro-for-Valak.bin Malicious activity

Add for printing

File name:	2020-06-03-Word-doc-with-macro-for-Valak.bin
Full analysis:	https://app.any.run/tasks/bd40aefd-75fc-4187-bfda-967ed16e4330
Verdict:	Malicious activity
Analysis date:	May 16, 2025, 06:12:48
OS:	Windows 10 Professional (build: 19044, 64 bit)
Tags:	generated-doc maldoc-51 macros macros-on-open
Indicators:
MIME:	application/vnd.openxmlformats-officedocument.wordprocessingml.document
File info:	Microsoft Word 2007+
MD5:	4D4994030DB743C270956B50C765CADE
SHA1:	D5BAF0693E9988E4194621F736DB00E643F4A458
SHA256:	4C0D7B112DFD99C751A85AD9539152C413EDE7E5D976F75AE13A8B46EBF53E66
SSDEEP:	3072:zXokxE5Et2foxdPDKZWF5OFaLzIzZjPgWjnxgueBVNng:1t4kPDPF4gHIzxTnK/6

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 300 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: 240 seconds
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: on
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- Drops known malicious document
  - OpenWith.exe (PID: 5552)
SUSPICIOUS
- Application launched itself
  - powershell.exe (PID: 5960)
  - powershell.exe (PID: 976)
  - powershell.exe (PID: 4380)
  - powershell.exe (PID: 6208)
  - powershell.exe (PID: 2568)
  - powershell.exe (PID: 4212)
  - powershell.exe (PID: 5436)
  - powershell.exe (PID: 6760)
  - powershell.exe (PID: 4244)
  - powershell.exe (PID: 5352)
  - powershell.exe (PID: 3016)
  - powershell.exe (PID: 6392)
  - powershell.exe (PID: 4200)
  - powershell.exe (PID: 5260)
  - powershell.exe (PID: 6760)
  - powershell.exe (PID: 1052)
  - powershell.exe (PID: 924)
  - powershell.exe (PID: 4068)
  - powershell.exe (PID: 3884)
  - powershell.exe (PID: 4436)
  - powershell.exe (PID: 6228)
  - powershell.exe (PID: 6752)
  - powershell.exe (PID: 7052)
  - powershell.exe (PID: 6392)
  - powershell.exe (PID: 5044)
  - powershell.exe (PID: 2896)
  - powershell.exe (PID: 5116)
  - powershell.exe (PID: 2960)
  - powershell.exe (PID: 960)
  - powershell.exe (PID: 2516)
  - powershell.exe (PID: 5332)
  - powershell.exe (PID: 5640)
  - powershell.exe (PID: 5020)
  - powershell.exe (PID: 2408)
  - powershell.exe (PID: 2416)
  - powershell.exe (PID: 2908)
  - powershell.exe (PID: 3800)
  - powershell.exe (PID: 4180)
  - powershell.exe (PID: 1388)
  - powershell.exe (PID: 4728)
  - powershell.exe (PID: 5256)
  - powershell.exe (PID: 4692)
  - powershell.exe (PID: 2780)
  - powershell.exe (PID: 1052)
  - powershell.exe (PID: 4784)
  - powershell.exe (PID: 2408)
  - powershell.exe (PID: 5308)
  - powershell.exe (PID: 2908)
  - powershell.exe (PID: 4996)
  - powershell.exe (PID: 6640)
  - powershell.exe (PID: 4844)
  - powershell.exe (PID: 2852)
  - powershell.exe (PID: 2140)
  - powershell.exe (PID: 132)
  - powershell.exe (PID: 968)
  - powershell.exe (PID: 5176)
  - powershell.exe (PID: 968)
  - powershell.exe (PID: 6192)
  - powershell.exe (PID: 6228)
  - powershell.exe (PID: 5452)
  - powershell.exe (PID: 6640)
  - powershell.exe (PID: 2100)
  - powershell.exe (PID: 1116)
  - powershell.exe (PID: 2140)
  - powershell.exe (PID: 4012)
  - powershell.exe (PID: 4108)
  - powershell.exe (PID: 2984)
  - powershell.exe (PID: 5064)
  - powershell.exe (PID: 5960)
  - powershell.exe (PID: 7020)
  - powershell.exe (PID: 2244)
  - powershell.exe (PID: 516)
  - powershell.exe (PID: 1628)
  - powershell.exe (PID: 6712)
  - powershell.exe (PID: 5304)
  - powershell.exe (PID: 4108)
  - powershell.exe (PID: 2984)
  - powershell.exe (PID: 6820)
  - powershell.exe (PID: 3804)
  - powershell.exe (PID: 5044)
  - powershell.exe (PID: 3796)
  - powershell.exe (PID: 4308)
  - powershell.exe (PID: 780)
  - powershell.exe (PID: 5800)
  - powershell.exe (PID: 4400)
  - powershell.exe (PID: 1072)
  - powershell.exe (PID: 6900)
  - powershell.exe (PID: 7104)
  - powershell.exe (PID: 4896)
  - powershell.exe (PID: 6564)
  - powershell.exe (PID: 5952)
  - powershell.exe (PID: 2644)
  - powershell.exe (PID: 1504)
  - powershell.exe (PID: 6700)
  - powershell.exe (PID: 6384)
  - powershell.exe (PID: 1132)
  - powershell.exe (PID: 1660)
  - powershell.exe (PID: 2040)
  - powershell.exe (PID: 976)
  - powershell.exe (PID: 1300)
  - powershell.exe (PID: 4016)
  - powershell.exe (PID: 1168)
  - powershell.exe (PID: 132)
  - powershell.exe (PID: 7012)
  - powershell.exe (PID: 4528)
  - powershell.exe (PID: 976)
  - powershell.exe (PID: 6004)
  - powershell.exe (PID: 1004)
  - powershell.exe (PID: 6276)
  - powershell.exe (PID: 1664)
  - powershell.exe (PID: 4868)
  - powershell.exe (PID: 4304)
  - powershell.exe (PID: 3796)
  - powershell.exe (PID: 6080)
- Starts POWERSHELL.EXE for commands execution
  - OpenWith.exe (PID: 5552)
  - powershell.exe (PID: 976)
  - OpenWith.exe (PID: 5384)
  - powershell.exe (PID: 5960)
  - powershell.exe (PID: 4380)
  - powershell.exe (PID: 6208)
  - powershell.exe (PID: 6760)
  - powershell.exe (PID: 5436)
  - powershell.exe (PID: 4244)
  - powershell.exe (PID: 6392)
  - powershell.exe (PID: 5352)
  - powershell.exe (PID: 2568)
  - powershell.exe (PID: 3016)
  - powershell.exe (PID: 4212)
  - powershell.exe (PID: 4200)
  - powershell.exe (PID: 3884)
  - powershell.exe (PID: 6392)
  - powershell.exe (PID: 6760)
  - powershell.exe (PID: 1052)
  - powershell.exe (PID: 924)
  - powershell.exe (PID: 4068)
  - powershell.exe (PID: 5260)
  - powershell.exe (PID: 6228)
  - powershell.exe (PID: 5116)
  - powershell.exe (PID: 6752)
  - powershell.exe (PID: 4436)
  - powershell.exe (PID: 7052)
  - powershell.exe (PID: 5044)
  - powershell.exe (PID: 2896)
  - powershell.exe (PID: 2960)
  - powershell.exe (PID: 5332)
  - powershell.exe (PID: 960)
  - powershell.exe (PID: 5640)
  - powershell.exe (PID: 2516)
  - powershell.exe (PID: 5020)
  - powershell.exe (PID: 2408)
  - powershell.exe (PID: 2416)
  - powershell.exe (PID: 2908)
  - powershell.exe (PID: 3800)
  - powershell.exe (PID: 1388)
  - powershell.exe (PID: 4180)
  - powershell.exe (PID: 4728)
  - powershell.exe (PID: 5256)
  - powershell.exe (PID: 4692)
  - powershell.exe (PID: 2780)
  - powershell.exe (PID: 1052)
  - powershell.exe (PID: 4784)
  - powershell.exe (PID: 5308)
  - powershell.exe (PID: 2408)
  - powershell.exe (PID: 2908)
  - powershell.exe (PID: 4996)
  - powershell.exe (PID: 6640)
  - powershell.exe (PID: 4844)
  - powershell.exe (PID: 2852)
  - powershell.exe (PID: 132)
  - powershell.exe (PID: 2140)
  - powershell.exe (PID: 968)
  - powershell.exe (PID: 5176)
  - powershell.exe (PID: 968)
  - powershell.exe (PID: 6192)
  - powershell.exe (PID: 6228)
  - powershell.exe (PID: 5452)
  - powershell.exe (PID: 6640)
  - powershell.exe (PID: 2100)
  - powershell.exe (PID: 1116)
  - powershell.exe (PID: 2140)
  - powershell.exe (PID: 2984)
  - powershell.exe (PID: 5960)
  - powershell.exe (PID: 4012)
  - powershell.exe (PID: 4108)
  - powershell.exe (PID: 5064)
  - powershell.exe (PID: 4108)
  - powershell.exe (PID: 7020)
  - powershell.exe (PID: 2244)
  - powershell.exe (PID: 516)
  - powershell.exe (PID: 1628)
  - powershell.exe (PID: 6712)
  - powershell.exe (PID: 5304)
  - powershell.exe (PID: 6820)
  - powershell.exe (PID: 2984)
  - powershell.exe (PID: 3796)
  - powershell.exe (PID: 3804)
  - powershell.exe (PID: 5044)
  - powershell.exe (PID: 4308)
  - powershell.exe (PID: 780)
  - powershell.exe (PID: 5800)
  - powershell.exe (PID: 4400)
  - powershell.exe (PID: 1072)
  - powershell.exe (PID: 6900)
  - powershell.exe (PID: 2644)
  - powershell.exe (PID: 4896)
  - powershell.exe (PID: 6564)
  - powershell.exe (PID: 5952)
  - powershell.exe (PID: 7104)
  - powershell.exe (PID: 6384)
  - powershell.exe (PID: 1132)
  - powershell.exe (PID: 1660)
  - powershell.exe (PID: 2040)
  - powershell.exe (PID: 1504)
  - powershell.exe (PID: 6700)
  - powershell.exe (PID: 976)
  - powershell.exe (PID: 1300)
  - powershell.exe (PID: 4016)
  - powershell.exe (PID: 1168)
  - powershell.exe (PID: 132)
  - powershell.exe (PID: 7012)
  - powershell.exe (PID: 4528)
  - powershell.exe (PID: 6276)
  - powershell.exe (PID: 6004)
  - powershell.exe (PID: 6080)
  - powershell.exe (PID: 1664)
  - powershell.exe (PID: 4868)
  - powershell.exe (PID: 4304)
  - powershell.exe (PID: 3796)
  - powershell.exe (PID: 976)
  - powershell.exe (PID: 1004)
INFO
- An automatically generated document
  - OpenWith.exe (PID: 5552)
- Reads Microsoft Office registry keys
  - OpenWith.exe (PID: 5384)
  - OpenWith.exe (PID: 5552)
- Reads security settings of Internet Explorer
  - OpenWith.exe (PID: 5552)
  - OpenWith.exe (PID: 5384)
- Checks proxy server information
  - slui.exe (PID: 2984)
- Reads the software policy settings
  - slui.exe (PID: 4244)
  - slui.exe (PID: 2984)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.docm	\|	Word Microsoft Office Open XML Format document (with Macro) (53.6)
.docx	\|	Word Microsoft Office Open XML Format document (24.2)
.zip	\|	Open Packaging Conventions container (18)
.zip	\|	ZIP compressed archive (4.1)

EXIF

ZIP

ZipRequiredVersion:	20
ZipBitFlag:	0x0006
ZipCompression:	Deflated
ZipModifyDate:	1980:01:01 00:00:00
ZipCRC:	0x7df6b578
ZipCompressedSize:	427
ZipUncompressedSize:	1637
ZipFileName:	[Content_Types].xml

XML

Template:	Normal.dotm
TotalEditTime:	-
Pages:	1
Words:	-
Characters:	-
Application:	Microsoft Office Word
DocSecurity:	None
Lines:	4
Paragraphs:	-
ScaleCrop:	No
Manager:	-
Company:	-
LinksUpToDate:	No
CharactersWithSpaces:	-
SharedDoc:	No
HyperlinksChanged:	No
AppVersion:	16
Keywords:	-
LastModifiedBy:	admin
RevisionNumber:	2
CreateDate:	2020:06:03 09:47:00Z
ModifyDate:	2020:06:03 09:47:00Z
Category:	-

XMP

Title:	-
Subject:	-
Creator:	ciifwq
Description:	-

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

366

Monitored processes

237

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

132

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "C:\Users\admin\AppData\Local\Temp\2020-06-03-Word-doc-with-macro-for-Valak.bin"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

—

powershell.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows PowerShell

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
c:\windows\system32\ucrtbase.dll

132

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "C:\Users\admin\AppData\Local\Temp\2020-06-03-Word-doc-with-macro-for-Valak.bin"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

—

powershell.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows PowerShell

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll

132

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "C:\Users\admin\AppData\Local\Temp\2020-06-03-Word-doc-with-macro-for-Valak.bin"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

—

powershell.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows PowerShell

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

232

\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

—

powershell.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Console Window Host

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

240

\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

—

powershell.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Console Window Host

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

516

\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

—

powershell.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Console Window Host

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

516

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "C:\Users\admin\AppData\Local\Temp\2020-06-03-Word-doc-with-macro-for-Valak.bin"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

—

powershell.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows PowerShell

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\atl.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll

540

\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

—

powershell.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Console Window Host

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

632

\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

—

powershell.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Console Window Host

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

660

\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

—

powershell.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Console Window Host

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

Add for printing

Total events

545 837

Read events

545 716

Write events

121

Delete events

Modification events


(PID) Process:	(5384) OpenWith.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bin\OpenWithProgids
Operation:	write	Name:	bin_auto_file
Value:
(PID) Process:	(5384) OpenWith.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bin\UserChoice
Operation:	write	Name:	ProgId
Value: Applications\powershell.exe
(PID) Process:	(5384) OpenWith.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bin\UserChoice
Operation:	write	Name:	Hash
Value: 75XkTvDUczU=
(PID) Process:	(5384) OpenWith.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bin\OpenWithList
Operation:	write	Name:	MRUList
Value: a
(PID) Process:	(5384) OpenWith.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:	write	Name:	GlobalAssocChangedCounter
Value: 114
(PID) Process:	(5960) powershell.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bin\OpenWithProgids
Operation:	write	Name:	bin_auto_file
Value:
(PID) Process:	(976) powershell.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bin\OpenWithProgids
Operation:	write	Name:	bin_auto_file
Value:
(PID) Process:	(4380) powershell.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bin\OpenWithProgids
Operation:	write	Name:	bin_auto_file
Value:
(PID) Process:	(6208) powershell.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bin\OpenWithProgids
Operation:	write	Name:	bin_auto_file
Value:
(PID) Process:	(2568) powershell.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bin\OpenWithProgids
Operation:	write	Name:	bin_auto_file
Value:

Add for printing

Executable files

Suspicious files

349

Text files

232

Unknown types

Dropped files

PID	Process	Filename		Type
976	powershell.exe	C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2R055O8HRKAHOZ7D36MD.temp		binary
		MD5:500F02184632D336FA5C392041982618	SHA256:62350CCA22839818CC6D3E55328790E27B657410684801C65B18B0EAE4614784
5960	powershell.exe	C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF12911c.TMP		binary
		MD5:BC1652A0BCBEDB4CFA74D973757469AC	SHA256:B1FC4C38A77E48610FCBB829C3E5BBC4877FA59670D433CEF12E93CFCF4E8C47
6768	powershell.exe	C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_v1hfh40z.du1.ps1		text
		MD5:D17FE0A3F47BE24A6453E9EF58C94641	SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6768	powershell.exe	C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\CP6BWPQBTFDFC03493W8.temp		binary
		MD5:BC1652A0BCBEDB4CFA74D973757469AC	SHA256:B1FC4C38A77E48610FCBB829C3E5BBC4877FA59670D433CEF12E93CFCF4E8C47
6768	powershell.exe	C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF112de3.TMP		binary
		MD5:D040F64E9E7A2BB91ABCA5613424598E	SHA256:D04E0A6940609BD6F3B561B0F6027F5CA4E8C5CF0FB0D0874B380A0374A8D670
976	powershell.exe	C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ntxonyf4.ac4.psm1		text
		MD5:D17FE0A3F47BE24A6453E9EF58C94641	SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6768	powershell.exe	C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_24fpsn55.sul.psm1		text
		MD5:D17FE0A3F47BE24A6453E9EF58C94641	SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6768	powershell.exe	C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms		binary
		MD5:BC1652A0BCBEDB4CFA74D973757469AC	SHA256:B1FC4C38A77E48610FCBB829C3E5BBC4877FA59670D433CEF12E93CFCF4E8C47
5960	powershell.exe	C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms		binary
		MD5:5FFD6A6DC6260834D1518970C3D8DC51	SHA256:E4737D672AE9B131BF9DD35CA04205B48F50CA4F37E253EBBBBBA466EDB43CC6
5960	powershell.exe	C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\25A11PQXOH9XB5BPACN7.temp		binary
		MD5:5FFD6A6DC6260834D1518970C3D8DC51	SHA256:E4737D672AE9B131BF9DD35CA04205B48F50CA4F37E253EBBBBBA466EDB43CC6

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

No HTTP requests

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:137	—	—	—	whitelisted
2104	svchost.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
—	—	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
2112	svchost.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
3216	svchost.exe	172.211.123.250:443	client.wns.windows.com	MICROSOFT-CORP-MSN-AS-BLOCK	FR	whitelisted
6544	svchost.exe	40.126.31.128:443	login.live.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
2104	svchost.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
920	SIHClient.exe	20.109.210.53:443	slscr.update.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	US	whitelisted
920	SIHClient.exe	20.3.187.198:443	fe3cr.delivery.mp.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	US	whitelisted

DNS requests

Domain	IP	Reputation
settings-win.data.microsoft.com	4.231.128.59 51.104.136.2	whitelisted
google.com	142.250.186.142	whitelisted
client.wns.windows.com	172.211.123.250 172.211.123.248 172.211.123.249	whitelisted
login.live.com	40.126.31.128 40.126.31.129 40.126.31.130 20.190.159.128 20.190.159.2 20.190.159.23 20.190.159.75 20.190.159.4	whitelisted
slscr.update.microsoft.com	20.109.210.53	whitelisted
fe3cr.delivery.mp.microsoft.com	20.3.187.198 2603:1030:7::106	whitelisted
198.187.3.20.in-addr.arpa	—	unknown
6.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.0.3.0.1.3.0.6.2.ip6.arpa	—	unknown
activation-v2.sls.microsoft.com	20.83.72.98	whitelisted
nexusrules.officeapps.live.com	52.111.227.14	whitelisted

Threats

No threats detected

Add for printing

No debug info

General Info

2020-06-03-Word-doc-with-macro-for-Valak.bin

4D4994030DB743C270956B50C765CADE

D5BAF0693E9988E4194621F736DB00E643F4A458

4C0D7B112DFD99C751A85AD9539152C413EDE7E5D976F75AE13A8B46EBF53E66

3072:zXokxE5Et2foxdPDKZWF5OFaLzIzZjPgWjnxgueBVNng:1t4kPDPF4gHIzxTnK/6

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Drops known malicious document

SUSPICIOUS

Application launched itself

Starts POWERSHELL.EXE for commands execution

INFO

An automatically generated document

Reads Microsoft Office registry keys

Reads security settings of Internet Explorer

Checks proxy server information

Reads the software policy settings

Malware configuration

Static information

TRiD

EXIF

ZIP

XML

XMP

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings