File name:

DOC001.exe

Full analysis: https://app.any.run/tasks/f70dc0c7-bd80-4f33-af82-b7d7e95f48ee
Verdict: Malicious activity
Analysis date: December 18, 2023, 05:51:23
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

DF11B3105DF8D7C70E7B501E210E3CC3

SHA1:

01BA101C4355B18EC11652A9AB6F8994279BA769

SHA256:

59F1E69B68DE4839C65B6E6D39AC7A272E2611EC1ED1BF73A4F455E2CA20EEAA

SSDEEP:

49152:if4tcOW4mwkylp3yj7SWGpHE3EFBD+njb9ClK:usuZDeJAcBSXUlK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • DOC001.exe (PID: 1776)
      • DOC001.exe (PID: 296)

    • Create files in the Startup directory

      • DOC001.exe (PID: 296)

  • SUSPICIOUS

    • Starts itself from another location

      • DOC001.exe (PID: 1776)

    • Reads the Internet Settings

      • DOC001.exe (PID: 1776)
      • DOC001.exe (PID: 296)

  • INFO

    • Reads the computer name

      • DOC001.exe (PID: 1776)
      • wmpnscfg.exe (PID: 2184)
      • DOC001.exe (PID: 296)

    • Checks supported languages

      • wmpnscfg.exe (PID: 2184)
      • DOC001.exe (PID: 1776)
      • DOC001.exe (PID: 296)

    • Creates files or folders in the user directory

      • DOC001.exe (PID: 1776)
      • DOC001.exe (PID: 296)

    • Reads the machine GUID from the registry

      • DOC001.exe (PID: 1776)
      • DOC001.exe (PID: 296)

    • Create files in a temporary directory

      • DOC001.exe (PID: 296)

    • Checks proxy server information

      • DOC001.exe (PID: 296)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | NSIS - Nullsoft Scriptable Install System (94.8)
.exe | Win32 Executable MS Visual C++ (generic) (3.4)
.dll | Win32 Dynamic Link Library (generic) (0.7)
.exe | Win32 Executable (generic) (0.5)
.exe | Generic Win/DOS Executable (0.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2009:12:05 23:52:12+01:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 24064
InitializedDataSize: 308224
UninitializedDataSize: 8192
EntryPoint: 0x30fa
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start doc001.exe no specs doc001.exe wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
296"C:\Users\admin\AppData\Roaming\TempoR\DOC001.exe" C:\Users\admin\AppData\Roaming\TempoR\DOC001.exe
DOC001.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\tempor\doc001.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
1776"C:\Users\admin\AppData\Local\Temp\DOC001.exe" C:\Users\admin\AppData\Local\Temp\DOC001.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
2
Modules
Images
c:\users\admin\appdata\local\temp\doc001.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
2184"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
1 670
Read events
1 650
Write events
20
Delete events
0

Modification events

(PID) Process:(1776) DOC001.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1776) DOC001.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1776) DOC001.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1776) DOC001.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(296) DOC001.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(296) DOC001.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000005B010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(296) DOC001.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(296) DOC001.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(296) DOC001.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(296) DOC001.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
4
Suspicious files
1
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
1776DOC001.exeC:\Users\admin\AppData\Roaming\TempoR\DOC001.exeexecutable
MD5:DF11B3105DF8D7C70E7B501E210E3CC3
SHA256:59F1E69B68DE4839C65B6E6D39AC7A272E2611EC1ED1BF73A4F455E2CA20EEAA
296DOC001.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnkbinary
MD5:128E267BE8679E2FE3481199F030C609
SHA256:5DF1006CB2D1F92B031569FB5BF50E6873B4DB113179BFC11688BF3D267B83C1
296DOC001.exeC:\Users\admin\AppData\Roaming\TempoR\NsCpuCNMiner32.exeexecutable
MD5:E8E50CFA7F6FE0C3B54CB1E11E92960C
SHA256:C4DEB1F76A1A5127964FAB44E4D9B3EBBB36B1FEDFB640DF5A4C428C89CEDB35
296DOC001.exeC:\Users\admin\AppData\Local\Temp\nsqFE47.tmp\inetc.dllexecutable
MD5:D7A3FA6A6C738B4A3C40D5602AF20B08
SHA256:67EFF17C53A78C8EC9A28F392B9BB93DF3E74F96F6ECD87A333A482C36546B3E
296DOC001.exeC:\Users\admin\AppData\Roaming\TempoR\NsCpuCNMiner64.exeexecutable
MD5:6E6D33D666387647A22A9ABD0DD6D50D
SHA256:55766C74C458D5439688F44CEEF926D27EE57E7CE418B9AF574331ECC54B4816
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
6
DNS requests
2
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
296
DOC001.exe
GET
404
185.26.112.217:80
http://kr1s.ru/java.dat
unknown
html
1.18 Kb
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
unknown
296
DOC001.exe
185.26.112.217:80
kr1s.ru
Jsc ru-center
RU
unknown

DNS requests

Domain
IP
Reputation
kr1s.ru
  • 185.26.112.217
unknown
zcop.ru
  • —
unknown

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla))
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
DOC001.exe