analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

risingsun.doc

Full analysis: https://app.any.run/tasks/86caa10b-59ad-4faf-a4a4-c53590adafcd
Verdict: Malicious activity
Analysis date: June 12, 2019, 00:40:21
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
Indicators:
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 949, Author: Richard, Template: Normal.dotm, Last Saved By: , Revision Number: 14, Name of Creating Application: Microsoft Office Word, Total Editing Time: 05:00, Create Time/Date: Tue Oct 16 00:10:00 2018, Last Saved Time/Date: Thu May 9 11:37:00 2019, Number of Pages: 1, Number of Words: 0, Number of Characters: 1, Security: 0
MD5:

159499C409F5C932328553BFCBE87D89

SHA1:

F1B7CBCB24A472DC1DCC68398C4216276206B416

SHA256:

5993F5BAA63DD2C9EB72709914246269384C0482BF33F95CAEDDD4FB789661A0

SSDEEP:

6144:okvQ2xGsRIvLYBAx07dFwRgnNDkT6xz34XutIgU:LdGs4LY5fUa2Gxz34X

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Unusual execution from Microsoft Office

      • WINWORD.EXE (PID: 3328)

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 3328)

    • Manual execution by user

      • cmd.exe (PID: 2188)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 3328)

    • Dropped object may contain Bitcoin addresses

      • WINWORD.EXE (PID: 3328)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (54.2)
.doc | Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

CompObjUserType: Microsoft Word 97-2003 ????
CompObjUserTypeLen: 28
HeadingPairs:
  • ????
  • 1
  • Title
  • 1
TitleOfParts:
HyperlinksChanged: No
SharedDoc: No
LinksUpToDate: No
ScaleCrop: No
AppVersion: 16
CharCountWithSpaces: 1
Paragraphs: 1
Lines: 1
Company: -
CodePage: Windows Korean (Unified Hangul Code)
Security: None
Characters: 1
Words: -
Pages: 1
ModifyDate: 2019:05:09 10:37:00
CreateDate: 2018:10:15 23:10:00
TotalEditTime: 5.0 minutes
Software: Microsoft Office Word
RevisionNumber: 14
LastModifiedBy: ?? ?α?
Template: Normal.dotm
Comments: -
Keywords: -
Author: Richard
Subject: -
Title: -
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
6
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winword.exe no specs dw20.exe no specs dwwin.exe no specs cmd.exe no specs tracert.exe no specs tracert.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3328"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\risingsun.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
1792"C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE" -x -s 1284C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Application Error Reporting
Exit code:
0
Version:
14.0.6015.1000
3068C:\Windows\system32\dwwin.exe -x -s 1284C:\Windows\system32\dwwin.exe—DW20.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Watson Client
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2188"C:\Windows\system32\cmd.exe" C:\Windows\system32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2096tracertC:\Windows\system32\TRACERT.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Traceroute Command
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3700tracert yahoo.comC:\Windows\system32\TRACERT.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Traceroute Command
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
626
Read events
596
Write events
25
Delete events
5

Modification events

(PID) Process:(3328) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:writeName:%s>
Value:
25733E00000D0000010000000000000000000000
(PID) Process:(3328) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
Off
(PID) Process:(3328) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
On
(PID) Process:(3328) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:WORDFiles
Value:
1321992222
(PID) Process:(3328) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:ProductFiles
Value:
1321992336
(PID) Process:(3328) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:ProductFiles
Value:
1321992337
(PID) Process:(3328) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word
Operation:writeName:MTTT
Value:
000D000080AD8377B720D50100000000
(PID) Process:(3328) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:writeName:{u>
Value:
7B753E00000D000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000
(PID) Process:(3328) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:delete valueName:{u>
Value:
7B753E00000D000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000
(PID) Process:(3328) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
Executable files
0
Suspicious files
2
Text files
0
Unknown types
3

Dropped files

PID
Process
Filename
Type
3328WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVREBA5.tmp.cvr —
MD5:—
SHA256:—
3328WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~DF51DDAF2068261365.TMP —
MD5:—
SHA256:—
3328WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~DF4EE670F0EF365FD9.TMP —
MD5:—
SHA256:—
3328WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{B4B425E3-DB9D-476C-BF0D-F4A8927C3E50}.tmp —
MD5:—
SHA256:—
3328WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~DFEA6160DBD276E090.TMP —
MD5:—
SHA256:—
3328WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$singsun.docpgc
MD5:7718607824D65A3DD6A73B3D60EB12AF
SHA256:E9CF3BBF69000BDD64A1198B0428B85AD9B46553ED6092DA4F722E95A554F9FB
3328WINWORD.EXEC:\Users\admin\AppData\Local\Temp\1176937.cvrsqm
MD5:754FB91D81BEF0E2E6EB5C4753F02708
SHA256:08F193BA953C4CBBDA6A281B0F06ED0F64504180F4CB2DE7FA1C42E190D7C945
3328WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:17222E7BED955763CB75EBDA153E0074
SHA256:EAEB163582F92B56C14963150DA7DBEA34565552F3D187A793BE19BEB0978882
3068dwwin.exeC:\Users\admin\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_WINWORD.EXE_ef4ac5de42158e263874ab2de641f0eb2682588_0bee2af0\Report.werbinary
MD5:3BFA307B3C6A452C10EDE5E1F496E22D
SHA256:23E3D9A1FD490B740853EEF5FE6006E261838770265F53C9EE07C530DA7E12F3
3328WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{D4DB0BBD-321E-48C3-B1C2-70B6D43E7D05}.tmpbinary
MD5:65A10F911A71B40044E1D8D79DCFB67E
SHA256:0EFA1140A3271E809518F5357DCB1681D91480EEAF37F786945E506041FD3DD3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
6
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
10.149.0.1:137
—
—
—
unknown

DNS requests

Domain
IP
Reputation
yahoo.com
  • 98.138.219.232
  • 98.137.246.7
  • 98.138.219.231
  • 98.137.246.8
  • 72.30.35.10
  • 72.30.35.9
whitelisted
2.100.168.192.in-addr.arpa
  • —
whitelisted
1.0.149.10.in-addr.arpa
  • —
unknown
1.22.169.109.in-addr.arpa
  • —
unknown
25.210.117.87.in-addr.arpa
  • —
unknown
44.202.180.130.in-addr.arpa
  • —
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
risingsun.doc