analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

IVN2987362.doc

Full analysis: https://app.any.run/tasks/b5e700bb-1bad-4211-a904-e525f4914a5f
Verdict: Malicious activity
Analysis date: February 21, 2020, 18:01:35
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
generated-doc
maldoc-8
Indicators:
MIME: application/vnd.openxmlformats-officedocument.wordprocessingml.document
File info: Microsoft Word 2007+
MD5:

D9EC62E231A4DF7B699573D6FE7A2FA9

SHA1:

63D959AC1FF0082C42AFA205F35B031C9DD4C3FB

SHA256:

4FF049FB445F608E7AB59A65E6C41E0AB2708DFA0CA7372718AB27D1BD13F456

SSDEEP:

12288:NODdvfIpPUpYj0NjR2QQ9B94S5D1V8urJOKSd:NmIpPpjv594EVyd

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Unusual execution from Microsoft Office

      • WINWORD.EXE (PID: 2952)
    • Starts CMD.EXE for commands execution

      • WINWORD.EXE (PID: 2952)
  • SUSPICIOUS

    • Executes scripts

      • cmd.exe (PID: 3740)
  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2952)
    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2952)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.docm | Word Microsoft Office Open XML Format document (with Macro) (53.6)
.docx | Word Microsoft Office Open XML Format document (24.2)
.zip | Open Packaging Conventions container (18)
.zip | ZIP compressed archive (4.1)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0006
ZipCompression: Deflated
ZipModifyDate: 1980:01:01 00:00:00
ZipCRC: 0xfefd9a9e
ZipCompressedSize: 482
ZipUncompressedSize: 2010
ZipFileName: [Content_Types].xml

XMP

Title: -
Creator: -

XML

LastModifiedBy: -
RevisionNumber: 1
CreateDate: 2020:01:13 01:40:00Z
ModifyDate: 2020:02:21 12:41:00Z
Template: Normal.dotm
TotalEditTime: -
Pages: 5
Words: 1
Characters: 9
Application: Microsoft Office Word
DocSecurity: None
Lines: 1
Paragraphs: 1
ScaleCrop: No
HeadingPairs:
  • Название
  • 1
TitlesOfParts: -
LinksUpToDate: No
CharactersWithSpaces: 9
SharedDoc: No
HyperlinksChanged: No
AppVersion: 14
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winword.exe no specs cmd.exe no specs wscript.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2952"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\IVN2987362.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXEexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
3740cmd /c C:\LibWinTasksProvider\WedpolicyDepSet\CalenderView.BATC:\Windows\system32\cmd.exeWINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3760wscript C:\LibWinTasksProvider\CalenderView.JSE /nologoC:\Windows\system32\wscript.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Version:
5.8.7600.16385
Total events
1 124
Read events
941
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
0
Text files
2
Unknown types
3

Dropped files

PID
Process
Filename
Type
2952WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR6C10.tmp.cvr
MD5:
SHA256:
2952WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$N2987362.docpgc
MD5:E8BA72E4A579C0743FE189E9DCD35FA0
SHA256:D4BE95D09099F6FAD336ADF57C45881E0F024127F41762EDCEF532AF21D05B02
2952WINWORD.EXEC:\LibWinTasksProvider\WedpolicyDepSet\CalenderView.BATtext
MD5:61E8655CA1393B13C826953A9BBF13D3
SHA256:7414E595C91D12BA7F4AABE2842B7743D5DEE264016DFB82BF5314F17F29EDDF
2952WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:ED61E8FC2CE353E9EAA269333D5EDC7C
SHA256:99FD5C7E6F3EF5AB79B525CC0462B7883864B4DDC3EBC2E99EDC3C0283C6B7EB
2952WINWORD.EXEC:\Users\admin\AppData\Local\Temp\VBE\MSForms.exdtlb
MD5:A2998D7ACFD4D5C0D19041C84FC64D10
SHA256:13F8150288486023542B3F109C09C7ACFEE0BF0A394C14ACE6E7D2185212912C
2952WINWORD.EXEC:\LibWinTasksProvider\CalenderView.JSEtext
MD5:3573A33988C2C19F18D2DE07B87818FC
SHA256:3E76E0AAAC22C57A6928FA2B5864098CEB56B836E0B20F568CC476B99F82568A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info