Malware analysis 5150f5f45365130967ae010b21abb7ef0f2d596bdecfd4d00e17297d30875f1a.docx Malicious activity

Add for printing

File name:	5150f5f45365130967ae010b21abb7ef0f2d596bdecfd4d00e17297d30875f1a.docx
Full analysis:	https://app.any.run/tasks/babcb36f-6a13-444f-977c-059d10b0bb5f
Verdict:	Malicious activity
Analysis date:	March 14, 2019, 18:00:42
OS:	Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:	generated-doc
Indicators:
MIME:	application/vnd.openxmlformats-officedocument.wordprocessingml.document
File info:	Microsoft Word 2007+
MD5:	B506722B6377D5804839805F847192C9
SHA1:	FFB3A1CF1F72492E4AE11EFC2BBD02960B0B92AF
SHA256:	5150F5F45365130967AE010B21ABB7EF0F2D596BDECFD4D00E17297D30875F1A
SSDEEP:	384:eGcBoI42na5RS/mmOS/8kF1c2OfBT3lWiu57CVnPyQ:MI2na5RS6SbDfOfPWiu57ynB

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 120 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: 60 seconds
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 8.0.7601.17514 undefined
Adobe Acrobat Reader DC MUI (15.023.20070)
Adobe Flash Player 26 ActiveX (26.0.0.131)
Adobe Flash Player 26 NPAPI (26.0.0.131)
Adobe Flash Player 26 PPAPI (26.0.0.131)
Adobe Refresh Manager (1.8.0)
CCleaner (5.35)
FileZilla Client 3.36.0 (3.36.0)
Google Chrome (68.0.3440.106)
Google Update Helper (1.3.33.17)
Java 8 Update 92 (8.0.920.14)
Java Auto Updater (2.8.92.14)
Microsoft .NET Framework 4.6.1 (4.6.01055)
Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Professional 2010 (14.0.6029.1000)
Microsoft Office Proof (English) 2010 (14.0.6029.1000)
Microsoft Office Proof (French) 2010 (14.0.6029.1000)
Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Single Image 2010 (14.0.6029.1000)
Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2017 Redistributable (x86) - 14.15.26706 (14.15.26706.0)
Microsoft Visual C++ 2017 x86 Additional Runtime - 14.15.26706 (14.15.26706)
Microsoft Visual C++ 2017 x86 Minimum Runtime - 14.15.26706 (14.15.26706)
Mozilla Firefox 61.0.2 (x86 en-US) (61.0.2)
Notepad++ (32-bit x86) (7.5.1)
Opera 12.15 (12.15.1748)
Skype version 8.29 (8.29)
VLC media player (2.2.6)
WinRAR 5.60 (32-bit) (5.60.0)

Hotfixes

Client LanguagePack Package
Client Refresh LanguagePack Package
CodecPack Basic Package
Foundation Package
IE Troubleshooters Package
InternetExplorer Optional Package
KB2534111
KB2999226
KB976902
LocalPack AU Package
LocalPack CA Package
LocalPack GB Package
LocalPack US Package
LocalPack ZA Package
ProfessionalEdition
UltimateEdition

Add for printing

MALICIOUS
No malicious indicators.
SUSPICIOUS
- Unusual connect from Microsoft Office
  - WINWORD.EXE (PID: 2964)
INFO
- Reads Microsoft Office registry keys
  - WINWORD.EXE (PID: 2964)
- Creates files in the user directory
  - WINWORD.EXE (PID: 2964)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.docx	\|	Word Microsoft Office Open XML Format document (52.2)
.zip	\|	Open Packaging Conventions container (38.8)
.zip	\|	ZIP compressed archive (8.8)

EXIF

XML

AppVersion:	16
HyperlinksChanged:	No
SharedDoc:	No
CharactersWithSpaces:	73
LinksUpToDate:	No
Company:	-
ScaleCrop:	No
Paragraphs:	1
Lines:	1
DocSecurity:	None
Application:	Microsoft Office Word
Characters:	63
Words:	11
Pages:	1
TotalEditTime:	-
Template:	Normal.dotm
ModifyDate:	2019:02:22 14:11:00Z
CreateDate:	2019:02:22 14:11:00Z
RevisionNumber:	1
LastModifiedBy:	Usuário do Windows
Keywords:	-

XMP

Description:	-
Creator:	Usuário do Windows
Subject:	-
Title:	-

ZIP

ZipFileName:	[Content_Types].xml
ZipUncompressedSize:	1364
ZipCompressedSize:	358
ZipCRC:	0x2c2fab17
ZipModifyDate:	1980:01:01 00:00:00
ZipCompression:	Deflated
ZipBitFlag:	0x0006
ZipRequiredVersion:	20

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
2964	"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\5150f5f45365130967ae010b21abb7ef0f2d596bdecfd4d00e17297d30875f1a.docx"	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE		explorer.exe
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000

Add for printing

Total events

1 356

Read events

739

Write events

Delete events

Modification events

No data

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
2964	WINWORD.EXE	C:\Users\admin\AppData\Local\Temp\CVRE320.tmp.cvr		—
		MD5:—	SHA256:—
2964	WINWORD.EXE	C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@vidalaviva[2].txt		—
		MD5:—	SHA256:—
2964	WINWORD.EXE	C:\Users\admin\AppData\Local\Temp\{87F8C4B1-F288-4627-95D4-1D21E653E609}		—
		MD5:—	SHA256:—
2964	WINWORD.EXE	C:\Users\admin\AppData\Local\Temp\{B03A125E-8298-4F04-B580-465B2FBA81D1}		—
		MD5:—	SHA256:—
2964	WINWORD.EXE	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\FAE2B283.emf		emf
		MD5:0FD6D33AB39D51F321979FBCA635F89E	SHA256:DE56BBC23752BE6D08E40951091B601ED7E97653A1B40050A65A617D515DF4BF
2964	WINWORD.EXE	C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@vidalaviva[1].txt		text
		MD5:B7E539B0482400DAE9D6A4C7756E75C6	SHA256:2A29CCD31353AB1A7377E78239BB22384A3AADC97927F03B32CB2351DD5809B6
2964	WINWORD.EXE	C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm		pgc
		MD5:DCAA67B0E70660D81D617FA974400603	SHA256:9FABD5C9F34C29E3100E05A15E1B4542A4BAF8849FC0CED4847B6465D692BCF4
2964	WINWORD.EXE	C:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-{7676C162-2602-456B-AC65-F973D1EE919E}.FSD		binary
		MD5:E8D62A08BE9295F1EC03938D3F92DD21	SHA256:2050E3C346309E1417E0C5833E19473B513A93754920519179F16BB5F6AD5655
2964	WINWORD.EXE	C:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSF-CTBL.FSF		binary
		MD5:B66131C5D550B2F51FCE8E5CCE880DD0	SHA256:83227CB06049CD69E8274535B4CF305B567B2AB916EB2C09E47A7CF10E13E480
2964	WINWORD.EXE	C:\Users\admin\AppData\Local\Temp\~$50f5f45365130967ae010b21abb7ef0f2d596bdecfd4d00e17297d30875f1a.docx		pgc
		MD5:DC4383E161A7496AD4343CDD188A009B	SHA256:4807963EFC75CC8A7601C168B6FBDA2C1C12C9C10A1DEEDEAE0258995CAAA72D

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
976	svchost.exe	OPTIONS	—	187.17.111.47:80	http://vidalaviva.com/	BR	—	—	malicious
2964	WINWORD.EXE	HEAD	404	187.17.111.47:80	http://vidalaviva.com/Doc1.doc	BR	—	—	malicious
2964	WINWORD.EXE	GET	404	187.17.111.47:80	http://vidalaviva.com/Doc1.doc	BR	html	2.52 Kb	malicious
976	svchost.exe	PROPFIND	200	187.17.111.47:80	http://vidalaviva.com/	BR	html	9.13 Kb	malicious
2964	WINWORD.EXE	HEAD	404	187.17.111.47:80	http://vidalaviva.com/Doc1.doc	BR	—	—	malicious
976	svchost.exe	PROPFIND	200	187.17.111.47:80	http://vidalaviva.com/	BR	html	9.12 Kb	malicious
2964	WINWORD.EXE	OPTIONS	200	187.17.111.47:80	http://vidalaviva.com/	BR	html	9.13 Kb	malicious
976	svchost.exe	PROPFIND	200	187.17.111.47:80	http://vidalaviva.com/	BR	html	9.12 Kb	malicious
976	svchost.exe	PROPFIND	200	187.17.111.47:80	http://vidalaviva.com/	BR	html	9.13 Kb	malicious
2964	WINWORD.EXE	GET	404	187.17.111.47:80	http://vidalaviva.com/Doc1.doc	BR	html	2.52 Kb	malicious

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
2964	WINWORD.EXE	187.17.111.47:80	vidalaviva.com	Universo Online S.A.	BR	malicious
976	svchost.exe	187.17.111.47:80	vidalaviva.com	Universo Online S.A.	BR	malicious

DNS requests

Domain	IP	Reputation
vidalaviva.com	187.17.111.47	malicious

Threats

No threats detected

Add for printing

No debug info

General Info

5150f5f45365130967ae010b21abb7ef0f2d596bdecfd4d00e17297d30875f1a.docx

B506722B6377D5804839805F847192C9

FFB3A1CF1F72492E4AE11EFC2BBD02960B0B92AF

5150F5F45365130967AE010B21ABB7EF0F2D596BDECFD4D00E17297D30875F1A

384:eGcBoI42na5RS/mmOS/8kF1c2OfBT3lWiu57CVnPyQ:MI2na5RS6SbDfOfPWiu57ynB

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

Unusual connect from Microsoft Office

INFO

Reads Microsoft Office registry keys

Creates files in the user directory

Malware configuration

Static information

TRiD

EXIF

XML

XMP

ZIP

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings