General Info

File name

5993f5baa63dd2c9eb72709914246269384c0482bf33f95caeddd4fb789661a0.doc

Full analysis
https://app.any.run/tasks/2f43ef03-5e5a-4b0b-bade-23bc649a5f80
Verdict
Malicious activity
Analysis date
6/12/2019, 05:45:48
OS:
Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:

macros

macros-on-open

Indicators:

MIME:
application/msword
File info:
Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 949, Author: Richard, Template: Normal.dotm, Last Saved By: , Revision Number: 14, Name of Creating Application: Microsoft Office Word, Total Editing Time: 05:00, Create Time/Date: Tue Oct 16 00:10:00 2018, Last Saved Time/Date: Thu May 9 11:37:00 2019, Number of Pages: 1, Number of Words: 0, Number of Characters: 1, Security: 0
MD5

159499c409f5c932328553bfcbe87d89

SHA1

f1b7cbcb24a472dc1dcc68398c4216276206b416

SHA256

5993f5baa63dd2c9eb72709914246269384c0482bf33f95caeddd4fb789661a0

SSDEEP

6144:okvQ2xGsRIvLYBAx07dFwRgnNDkT6xz34XutIgU:LdGs4LY5fUa2Gxz34X

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distored by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Software environment set and analysis options

Launch configuration

Task duration
60 seconds
Additional time used
none
Fakenet option
off
Heavy Evaision option
off
MITM proxy
off
Route via Tor
off
Network geolocation
off
Privacy
Public submission
Autoconfirmation of UAC
on

Software preset

  • Internet Explorer 8.0.7601.17514
  • Adobe Acrobat Reader DC MUI (15.023.20070)
  • Adobe Flash Player 26 ActiveX (26.0.0.131)
  • Adobe Flash Player 26 NPAPI (26.0.0.131)
  • Adobe Flash Player 26 PPAPI (26.0.0.131)
  • Adobe Refresh Manager (1.8.0)
  • CCleaner (5.35)
  • FileZilla Client 3.36.0 (3.36.0)
  • Google Chrome (73.0.3683.75)
  • Google Update Helper (1.3.33.23)
  • Java 8 Update 92 (8.0.920.14)
  • Java Auto Updater (2.8.92.14)
  • Microsoft .NET Framework 4.6.1 (4.6.01055)
  • Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Professional 2010 (14.0.6029.1000)
  • Microsoft Office Proof (English) 2010 (14.0.6029.1000)
  • Microsoft Office Proof (French) 2010 (14.0.6029.1000)
  • Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
  • Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
  • Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Single Image 2010 (14.0.6029.1000)
  • Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
  • Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
  • Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
  • Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
  • Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
  • Microsoft Visual C++ 2017 Redistributable (x86) - 14.15.26706 (14.15.26706.0)
  • Microsoft Visual C++ 2017 x86 Additional Runtime - 14.15.26706 (14.15.26706)
  • Microsoft Visual C++ 2017 x86 Minimum Runtime - 14.15.26706 (14.15.26706)
  • Mozilla Firefox 65.0.2 (x86 en-US) (65.0.2)
  • Notepad++ (32-bit x86) (7.5.1)
  • Opera 12.15 (12.15.1748)
  • Skype version 8.29 (8.29)
  • VLC media player (2.2.6)
  • WinRAR 5.60 (32-bit) (5.60.0)

Hotfixes

  • Client LanguagePack Package
  • Client Refresh LanguagePack Package
  • CodecPack Basic Package
  • Foundation Package
  • IE Troubleshooters Package
  • InternetExplorer Optional Package
  • KB2534111
  • KB2999226
  • KB976902
  • LocalPack AU Package
  • LocalPack CA Package
  • LocalPack GB Package
  • LocalPack US Package
  • LocalPack ZA Package
  • ProfessionalEdition
  • UltimateEdition

Behavior activities

MALICIOUS SUSPICIOUS INFO
Unusual execution from Microsoft Office
  • WINWORD.EXE (PID: 3252)

No suspicious indicators.

Dropped object may contain Bitcoin addresses
  • WINWORD.EXE (PID: 3252)
  • dwwin.exe (PID: 3268)
Creates files in the user directory
  • WINWORD.EXE (PID: 3252)
Reads Microsoft Office registry keys
  • WINWORD.EXE (PID: 3252)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Static information

TRiD
.doc
|   Microsoft Word document (54.2%)
.doc
|   Microsoft Word document (old ver.) (32.2%)
EXIF
FlashPix
Title:
null
Subject:
null
Author:
Richard
Keywords:
null
Comments:
null
Template:
Normal.dotm
LastModifiedBy:
?? ?α?
RevisionNumber:
14
Software:
Microsoft Office Word
TotalEditTime:
5.0 minutes
CreateDate:
2018:10:15 23:10:00
ModifyDate:
2019:05:09 10:37:00
Pages:
1
Words:
null
Characters:
1
Security:
None
CodePage:
Windows Korean (Unified Hangul Code)
Company:
null
Lines:
1
Paragraphs:
1
CharCountWithSpaces:
1
AppVersion:
16
ScaleCrop:
No
LinksUpToDate:
No
SharedDoc:
No
HyperlinksChanged:
No
TitleOfParts
null
null
HeadingPairs
null
null
null
null
CompObjUserTypeLen:
28
CompObjUserType:
Microsoft Word 97-2003 ????

Screenshots

Processes

Total processes
34
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

+
start winword.exe no specs dw20.exe no specs dwwin.exe
Specs description
Program did not start
Integrity level elevation
Task сontains an error or was rebooted
Process has crashed
Task contains several apps running
Executable file was dropped
Debug information is available
Process was injected
Network attacks were detected
Application downloaded the executable file
Actions similar to stealing personal data
Behavior similar to exploiting the vulnerability
Inspected object has sucpicious PE structure
File is detected by antivirus software
CPU overrun
RAM overrun
Process starts the services
Process was added to the startup
Behavior similar to spam
Low-level access to the HDD
Probably Tor was used
System was rebooted
Connects to the network
Known threat

Process information

Click at the process to see the details.

PID
3252
CMD
"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\5993f5baa63dd2c9eb72709914246269384c0482bf33f95caeddd4fb789661a0.doc"
Path
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Indicators
No indicators
Parent process
––
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Microsoft Corporation
Description
Microsoft Word
Version
14.0.6024.1000
Modules
Image
c:\program files\microsoft office\office14\winword.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\system32\gdi32.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\program files\microsoft office\office14\wwlib.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\program files\microsoft office\office14\gfx.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\msimg32.dll
c:\program files\microsoft office\office14\oart.dll
c:\program files\common files\microsoft shared\office14\mso.dll
c:\windows\system32\msi.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\apphelp.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\program files\common files\microsoft shared\office14\cultures\office.odf
c:\program files\microsoft office\office14\1033\wwintl.dll
c:\program files\common files\microsoft shared\office14\1033\msointl.dll
c:\program files\common files\microsoft shared\office14\msores.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\dwmapi.dll
c:\program files\common files\microsoft shared\office14\msptls.dll
c:\windows\system32\uxtheme.dll
c:\program files\common files\microsoft shared\office14\riched20.dll
c:\windows\system32\mscoree.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
c:\windows\system32\version.dll
c:\windows\microsoft.net\framework\v2.0.50727\mscorwks.dll
c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\osppc.dll
c:\windows\system32\winspool.drv
c:\windows\system32\shell32.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\devobj.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\propsys.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\msxml6.dll
c:\windows\system32\profapi.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\wininet.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\sspicli.dll
c:\progra~1\common~1\micros~1\vba\vba7\vbe7.dll
c:\program files\microsoft office\office14\gkword.dll
c:\program files\common files\microsoft shared\office14\usp10.dll
c:\windows\system32\shdocvw.dll
c:\windows\system32\sxs.dll
c:\progra~1\common~1\micros~1\vba\vba7\1033\vbe7intl.dll
c:\progra~1\common~1\micros~1\dw\dw20.exe

PID
3916
CMD
"C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE" -x -s 1284
Path
C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE
Indicators
No indicators
Parent process
WINWORD.EXE
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Microsoft Corporation
Description
Microsoft Application Error Reporting
Version
14.0.6015.1000
Modules
Image
c:\progra~1\common~1\micros~1\dw\dw20.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleacc.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\shell32.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\wininet.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acspecfc.dll
c:\windows\system32\mscms.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\system32\winmm.dll
c:\windows\system32\ddraw.dll
c:\windows\system32\dciman32.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\mpr.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\msi.dll
c:\windows\system32\dwwin.exe

PID
3268
CMD
C:\Windows\system32\dwwin.exe -x -s 1284
Path
C:\Windows\system32\dwwin.exe
Indicators
Parent process
DW20.EXE
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Microsoft Corporation
Description
Watson Client
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\dwwin.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\wer.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\version.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\psapi.dll
c:\program files\microsoft office\office14\winword.exe
c:\windows\system32\feclient.dll
c:\windows\system32\sensapi.dll
c:\windows\system32\werui.dll
c:\windows\system32\ole32.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\dui70.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\duser.dll
c:\windows\system32\riched20.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\xmllite.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\webio.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\credssp.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshqos.dll
c:\windows\system32\wshtcpip.dll
c:\windows\system32\wship6.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\dhcpcsvc6.dll
c:\windows\system32\dhcpcsvc.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\rasadhlp.dll
c:\windows\system32\fwpuclnt.dll
c:\windows\system32\apphelp.dll
c:\program files\microsoft office\office14\accdds.dll
c:\program files\microsoft office\office14\accddsf.dll
c:\program files\microsoft office\office14\accddslm.dll
c:\program files\microsoft office\office14\accicons.exe
c:\program files\microsoft office\office14\accvdt.dll
c:\program files\microsoft office\office14\accwiz.dll
c:\program files\microsoft office\office14\acedao.dll
c:\program files\microsoft office\office14\audiosearchlts.dll
c:\program files\microsoft office\office14\audiosearchmain.dll
c:\program files\microsoft office\office14\audiosearchsapife.dll
c:\program files\microsoft office\office14\authzax.dll
c:\program files\microsoft office\office14\cdlmso.dll
c:\program files\microsoft office\office14\clview.exe
c:\program files\microsoft office\office14\cnfnot32.exe
c:\program files\microsoft office\office14\contab32.dll
c:\program files\microsoft office\office14\contactpicker.dll
c:\program files\microsoft office\office14\css7data0009.dll
c:\program files\microsoft office\office14\css7data000a.dll
c:\program files\microsoft office\office14\css7data000c.dll
c:\program files\microsoft office\office14\dbghelp.dll
c:\program files\microsoft office\office14\dlgsetp.dll
c:\program files\microsoft office\office14\emablt32.dll
c:\program files\microsoft office\office14\emsmdb32.dll
c:\program files\microsoft office\office14\entitydatahandler.dll
c:\program files\microsoft office\office14\entitypicker.dll
c:\program files\microsoft office\office14\envelope.dll
c:\program files\microsoft office\office14\excel.exe
c:\program files\microsoft office\office14\excelcnv.exe
c:\program files\microsoft office\office14\excelcnvpxy.dll
c:\program files\microsoft office\office14\exsec32.dll
c:\program files\microsoft office\office14\form.dll
c:\program files\microsoft office\office14\gfx.dll
c:\program files\microsoft office\office14\gkexcel.dll
c:\program files\microsoft office\office14\gkpowerpoint.dll
c:\program files\microsoft office\office14\gkword.dll
c:\program files\microsoft office\office14\graph.exe
c:\program files\microsoft office\office14\ieawsdc.dll
c:\program files\microsoft office\office14\iecontentservice.exe
c:\program files\microsoft office\office14\impmail.dll
c:\program files\microsoft office\office14\intldate.dll
c:\program files\microsoft office\office14\ipeditor.dll
c:\program files\microsoft office\office14\mapiph.dll
c:\program files\microsoft office\office14\mapishell.dll
c:\program files\microsoft office\office14\mcps.dll
c:\program files\microsoft office\office14\medcat.dll
c:\program files\microsoft office\office14\mimedir.dll
c:\program files\microsoft office\office14\misc.exe
c:\program files\microsoft office\office14\mlshext.dll
c:\program files\microsoft office\office14\morph9.dll
c:\program files\microsoft office\office14\msaccess.exe
c:\program files\microsoft office\office14\msaexp30.dll
c:\program files\microsoft office\office14\mscss7en.dll
c:\program files\microsoft office\office14\mscss7es.dll
c:\program files\microsoft office\office14\mscss7fr.dll
c:\program files\microsoft office\office14\mset7.dll
c:\program files\microsoft office\office14\mset7tk.dll
c:\program files\microsoft office\office14\mset7tkjp.dll
c:\program files\microsoft office\office14\msocf.dll
c:\program files\microsoft office\office14\msocfu.dll
c:\program files\microsoft office\office14\msocfuiutilitiesdll.dll
c:\program files\microsoft office\office14\msodcw.dll
c:\program files\microsoft office\office14\msohev.dll
c:\program files\microsoft office\office14\msohevi.dll
c:\program files\microsoft office\office14\msohtmed.exe
c:\program files\microsoft office\office14\msostyle.dll
c:\program files\microsoft office\office14\msosync.exe
c:\program files\microsoft office\office14\msouc.exe
c:\program files\microsoft office\office14\msproof7.dll
c:\program files\microsoft office\office14\mspst32.dll
c:\program files\microsoft office\office14\mspub.exe
c:\program files\microsoft office\office14\msqry32.exe
c:\program files\microsoft office\office14\msrtedit.dll
c:\program files\microsoft office\office14\mstordb.exe
c:\program files\microsoft office\office14\mstore.exe
c:\program files\microsoft office\office14\mstores.dll
c:\program files\microsoft office\office14\msyubin7.dll
c:\program files\microsoft office\office14\name.dll
c:\program files\microsoft office\office14\namecontrolproxy.dll
c:\program files\microsoft office\office14\namecontrolserver.exe
c:\program files\microsoft office\office14\nl7data0011.dll
c:\program files\microsoft office\office14\nl7lexicons0011.dll
c:\program files\microsoft office\office14\nl7models0009.dll
c:\program files\microsoft office\office14\nl7models000a.dll
c:\program files\microsoft office\office14\nl7models000c.dll
c:\program files\microsoft office\office14\nl7models0011.dll
c:\program files\microsoft office\office14\npauthz.dll
c:\program files\microsoft office\office14\npspwrap.dll
c:\program files\microsoft office\office14\oart.dll
c:\program files\microsoft office\office14\oartconv.dll
c:\program files\microsoft office\office14\offowc.dll
c:\program files\microsoft office\office14\offrhd.dll
c:\program files\microsoft office\office14\offxml.dll
c:\program files\microsoft office\office14\ogalegit.dll
c:\program files\microsoft office\office14\oimg.dll
c:\program files\microsoft office\office14\ois.exe
c:\program files\microsoft office\office14\oisapp.dll
c:\program files\microsoft office\office14\oisctrl.dll
c:\program files\microsoft office\office14\oisgraph.dll
c:\program files\microsoft office\office14\olkfstub.dll
c:\program files\microsoft office\office14\olmapi32.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\profapi.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
c:\program files\microsoft office\office14\wwlib.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\msimg32.dll
c:\program files\common files\microsoft shared\office14\mso.dll
c:\windows\system32\msi.dll
c:\program files\common files\microsoft shared\office14\cultures\office.odf
c:\program files\microsoft office\office14\1033\wwintl.dll
c:\program files\common files\microsoft shared\office14\1033\msointl.dll
c:\program files\common files\microsoft shared\office14\msores.dll
c:\program files\common files\microsoft shared\office14\msptls.dll
c:\program files\common files\microsoft shared\office14\riched20.dll
c:\windows\system32\mscoree.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\osppc.dll
c:\windows\system32\winspool.drv
c:\windows\system32\propsys.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\msxml6.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\wininet.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\program files\common files\microsoft shared\office14\usp10.dll
c:\windows\system32\shdocvw.dll
c:\windows\system32\sxs.dll
c:\progra~1\common~1\micros~1\vba\vba7\vbe7.dll
c:\progra~1\common~1\micros~1\vba\vba7\1033\vbe7intl.dll
c:\windows\system32\verifier.dll

Registry activity

Total events
631
Read events
605
Write events
25
Delete events
1

Modification events

PID
Process
Operation
Key
Name
Value
3252
WINWORD.EXE
delete key
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
3252
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
cz>
637A3E00B40C0000010000000000000000000000
3252
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
1033
Off
3252
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
1033
On
3252
WINWORD.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
WORDFiles
1321992222
3252
WINWORD.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
ProductFiles
1321992336
3252
WINWORD.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
ProductFiles
1321992337
3252
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word
MTTT
B40C00000CA67C62D120D50100000000
3252
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
(|>
287C3E00B40C000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000
3252
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
UNCAsIntranet
0
3252
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
AutoDetect
1
3252
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
}}>
7D7D3E00B40C00000600000001000000DE00000002000000CE0000000400000063003A005C00750073006500720073005C00610064006D0069006E005C0061007000700064006100740061005C006C006F00630061006C005C00740065006D0070005C0035003900390033006600350062006100610036003300640064003200630039006500620037003200370030003900390031003400320034003600320036003900330038003400630030003400380032006200660033003300660039003500630061006500640064006400340066006200370038003900360036003100610030002E0064006F006300000000000000
3252
WINWORD.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
VBAFiles
1321992196
3252
WINWORD.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
ProductFiles
1321992338
3252
WINWORD.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
ProductFiles
1321992339
3252
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\ReviewCycle
ReviewToken
{EACFB74B-2730-444D-898B-3C6DED02F784}
3252
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Place MRU
Max Display
25
3252
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\File MRU
Max Display
25
3252
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\DocumentRecovery\11FB75
11FB75
04000000B40C00006600000043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C004C006F00630061006C005C00540065006D0070005C0035003900390033006600350062006100610036003300640064003200630039006500620037003200370030003900390031003400320034003600320036003900330038003400630030003400380032006200660033003300660039003500630061006500640064006400340066006200370038003900360036003100610030002E0064006F0063004400000035003900390033006600350062006100610036003300640064003200630039006500620037003200370030003900390031003400320034003600320036003900330038003400630030003400380032006200660033003300660039003500630061006500640064006400340066006200370038003900360036003100610030002E0064006F0063000000000001000000000000004ABA7062D120D50175FB110075FB110000000000DB040000000000000000000000000000000000000000000000000000FFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF
3252
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word
MTTF
0
3252
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word
MTTA
85
3252
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\DocumentRecovery\11FB75
11FB75
04000000B40C00006600000043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C004C006F00630061006C005C00540065006D0070005C0035003900390033006600350062006100610036003300640064003200630039006500620037003200370030003900390031003400320034003600320036003900330038003400630030003400380032006200660033003300660039003500630061006500640064006400340066006200370038003900360036003100610030002E0064006F0063004400000035003900390033006600350062006100610036003300640064003200630039006500620037003200370030003900390031003400320034003600320036003900330038003400630030003400380032006200660033003300660039003500630061006500640064006400340066006200370038003900360036003100610030002E0064006F0063000000000001100000000000004ABA7062D120D50175FB110075FB110000000000DB040000000000000000000000000000000000000000000000000000FFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF
3252
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
n9?
6E393F00B40C00000A0000000100000000000000
3252
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word
MTTA
135

Files activity

Executable files
0
Suspicious files
3
Text files
5
Unknown types
5

Dropped files

PID
Process
Filename
Type
3252
WINWORD.EXE
C:\Users\admin\AppData\Local\Temp\~DF6518E24F8B658B3E.TMP
––
MD5:  ––
SHA256:  ––
3268
dwwin.exe
C:\Users\admin\AppData\Local\Temp\WER9A47.tmp.mdmp
––
MD5:  ––
SHA256:  ––
3252
WINWORD.EXE
C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{8EBCBAA3-E98D-40E3-8269-DCD8F221AE71}.tmp
––
MD5:  ––
SHA256:  ––
3268
dwwin.exe
C:\Users\admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\AppCrash_WINWORD.EXE_ef4ac5de42158e263874ab2de641f0eb2682588_cab_0cd69bfa\WER9A47.tmp.mdmp
dmp
MD5: e39f63caaef41623912cc531694aef7f
SHA256: 04a06fc84edc371bf73dc9504b89796bfccffb282c58782d3c6c6b84a0c42db8
3268
dwwin.exe
C:\Users\admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\AppCrash_WINWORD.EXE_ef4ac5de42158e263874ab2de641f0eb2682588_cab_0cd69bfa\Report.wer
binary
MD5: 1772de6055dba36ab06c9c3a71abbe77
SHA256: d7cc8b53ae6b9d70aa5cc824b0bd0af589a8d5c3787d588a91f18eaae7e68210
3268
dwwin.exe
C:\Users\admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\AppCrash_WINWORD.EXE_ef4ac5de42158e263874ab2de641f0eb2682588_cab_0cd69bfa\WER97D5.tmp.hdmp
––
MD5:  ––
SHA256:  ––
3268
dwwin.exe
C:\Users\admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\AppCrash_WINWORD.EXE_ef4ac5de42158e263874ab2de641f0eb2682588_cab_0cd69bfa\5993f5baa63dd2c9eb72709914246269384c0482bf33f95caeddd4fb789661a0.doc
document
MD5: 159499c409f5c932328553bfcbe87d89
SHA256: 5993f5baa63dd2c9eb72709914246269384c0482bf33f95caeddd4fb789661a0
3268
dwwin.exe
C:\Users\admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\AppCrash_WINWORD.EXE_ef4ac5de42158e263874ab2de641f0eb2682588_cab_0cd69bfa\WER8DA3.tmp.appcompat.txt
xml
MD5: a78e993c40e5a39541f1ea524e137a7c
SHA256: 0f349b56ec2cc61c4f324b18ba391521105a0e5e095138168fdbfb015aaaaabf
3268
dwwin.exe
C:\Users\admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\AppCrash_WINWORD.EXE_ef4ac5de42158e263874ab2de641f0eb2682588_cab_0cd69bfa\1179890.cvr
sqm
MD5: 384dec094297d203a42f26b56ff60442
SHA256: a7fb863dbcc47e86b5b7c3e58c9b1e77729511a9f16895bc32fed5b4558a9236
3268
dwwin.exe
C:\Users\admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\AppCrash_WINWORD.EXE_ef4ac5de42158e263874ab2de641f0eb2682588_cab_0cd69bfa\WERC9B.tmp.WERInternalMetadata.xml
xml
MD5: 53d8fc7b63071cba0df1d0d839a9b805
SHA256: 874bcc81004c20dfc745e9a25fe2ed197e679447a8306a52d0828af55126f15e
3252
WINWORD.EXE
C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{B7750C5B-C51C-4D11-ACAF-DA3C9E1AEBB2}.tmp
binary
MD5: 65a10f911a71b40044e1d8d79dcfb67e
SHA256: 0efa1140a3271e809518f5357dcb1681d91480eeaf37f786945e506041fd3dd3
3268
dwwin.exe
C:\Users\admin\AppData\Local\Temp\WER97D5.tmp.hdmp
––
MD5:  ––
SHA256:  ––
3268
dwwin.exe
C:\Users\admin\AppData\Local\Temp\WER8DA3.tmp.appcompat.txt
xml
MD5: a78e993c40e5a39541f1ea524e137a7c
SHA256: 0f349b56ec2cc61c4f324b18ba391521105a0e5e095138168fdbfb015aaaaabf
3268
dwwin.exe
C:\Users\admin\AppData\Local\Temp\WERC9B.tmp.WERInternalMetadata.xml
xml
MD5: 53d8fc7b63071cba0df1d0d839a9b805
SHA256: 874bcc81004c20dfc745e9a25fe2ed197e679447a8306a52d0828af55126f15e
3252
WINWORD.EXE
C:\Users\admin\AppData\Local\Temp\1179890.cvr
sqm
MD5: 384dec094297d203a42f26b56ff60442
SHA256: a7fb863dbcc47e86b5b7c3e58c9b1e77729511a9f16895bc32fed5b4558a9236
3252
WINWORD.EXE
C:\Users\admin\AppData\Local\Temp\~DFAE8801282D522175.TMP
––
MD5:  ––
SHA256:  ––
3252
WINWORD.EXE
C:\Users\admin\AppData\Local\Temp\~DF8470F8F8D9FA9BAE.TMP
––
MD5:  ––
SHA256:  ––
3252
WINWORD.EXE
C:\Users\admin\AppData\Local\Temp\~$93f5baa63dd2c9eb72709914246269384c0482bf33f95caeddd4fb789661a0.doc
pgc
MD5: 581cab5ef90e2c7bfa6943237feafd7c
SHA256: a355431ffad6bf14cceb1d8354925df21ab8c46c12120bf0eea274a47c25924c
3252
WINWORD.EXE
C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm
pgc
MD5: 17222e7bed955763cb75ebda153e0074
SHA256: eaeb163582f92b56c14963150da7dbea34565552f3d187a793be19beb0978882
3252
WINWORD.EXE
C:\Users\admin\AppData\Local\Temp\CVRF653.tmp.cvr
––
MD5:  ––
SHA256:  ––

Find more information of the staic content and download it at the full report

Network activity

HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
1
Threats
2

HTTP requests

PID Process Method HTTP Code IP URL CN Type Size Reputation
3268 dwwin.exe GET –– 20.44.86.127:80 http://watson.microsoft.com/StageOne/WINWORD_EXE/14_0_6024_1000/4d83e310/unknown/0_0_0_0/00000000/c0000005/057804f5.htm?LCID=1033&skulcid=1033&LCID=1033&OS=6.1.7601.2.00010100.1.0.48.17514&SM=DELL&SPN=DELL&BV=DELL&MID=3ADE2C42-4AB9-49B7-B142-BE9AEEA69063 US
––
––
whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID Process IP ASN CN Reputation
3268 dwwin.exe 20.44.86.127:80 US suspicious

DNS requests

Domain IP Reputation
watson.microsoft.com 20.44.86.127
whitelisted

Threats

PID Process Class Message
3268 dwwin.exe Potential Corporate Privacy Violation ET POLICY Application Crash Report Sent to Microsoft
3268 dwwin.exe Unknown Traffic ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)

Debug output strings

No debug info.