analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Invoice-9567990387465.doc

Full analysis: https://app.any.run/tasks/544bab60-7a95-4188-815f-31ba81d63311
Verdict: Malicious activity
Analysis date: June 19, 2019, 12:58:55
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
encrypted
Indicators:
MIME: application/encrypted
File info: CDFV2 Encrypted
MD5:

02BAA43B74723C85122D0D4961C525B9

SHA1:

CC4443958A6595D40340FA733A52A7B9A0338198

SHA256:

666C91730B78E24D676EFB6ABE64CCDD2BFB1422A6AF701EC48A9E600A0DD0D5

SSDEEP:

3072:6q5B8rFc8f9Jblr0mons3eML7f1vIOK7I5Q:/4Z970mo6LT107I5Q

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Unusual execution from Microsoft Office

      • WINWORD.EXE (PID: 2680)
    • Application was dropped or rewritten from another process

      • awMiOFl.exe (PID: 1488)
  • SUSPICIOUS

    • Creates files in the Windows directory

      • WINWORD.EXE (PID: 2680)
      • wmic.exe (PID: 2532)
    • Executable content was dropped or overwritten

      • wmic.exe (PID: 2532)
  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2680)
    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2680)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start winword.exe no specs wmic.exe awmiofl.exe

Process information

PID
CMD
Path
Indicators
Parent process
2680"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\Invoice-9567990387465.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXEexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
2532wmic os get /format:"C:\\Windows\\Temp\\aXwZvnt48.xsl"C:\Windows\System32\Wbem\wmic.exe
WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
2147614729
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1488"C:\Windows\Temp\awMiOFl.exe" C:\Windows\Temp\awMiOFl.exe
wmic.exe
User:
admin
Integrity Level:
MEDIUM
Total events
1 659
Read events
954
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
0
Text files
1
Unknown types
3

Dropped files

PID
Process
Filename
Type
2680WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR3F4E.tmp.cvr
MD5:
SHA256:
2680WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~DFE96FDBDED622D37B.TMP
MD5:
SHA256:
2680WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~DFE2ED8839BDE7AA82.TMP
MD5:
SHA256:
2680WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~DF59303EDAD423B8B4.TMP
MD5:
SHA256:
2680WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~DF543FD3B3054FE988.TMP
MD5:
SHA256:
2680WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~DF60FD0B390E33F7FB.TMP
MD5:
SHA256:
2680WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~DF785E0A41AE46DDD8.TMP
MD5:
SHA256:
2680WINWORD.EXEC:\Users\admin\AppData\Local\Temp\VBE\MSForms.exdtlb
MD5:8CC1759E6E64A7EC24562DF9BAE912EE
SHA256:8F68A229C794A40A9B9DAFFD77E0DE3AD45DE5E2E72375FF56E65B3C984E6D3E
2680WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$voice-9567990387465.docpgc
MD5:5F4E266268B719BD0E46618F7E664633
SHA256:8002776A662AD0E99314F977ED1EA8B34D659761161F643B0106341E2ADD5919
2680WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:B19FF5CEFD1DA5D0F2805A945B570C3C
SHA256:F75A592B67565D406D9D7F15EC8C276CD6D0D5E54AD5EF87413F565E44175FC9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2532
wmic.exe
49.51.12.195:443
tor2net.com
Tencent Building, Kejizhongyi Avenue
CN
suspicious

DNS requests

Domain
IP
Reputation
tor2net.com
  • 49.51.12.195
malicious

Threats

No threats detected
Process
Message
awMiOFl.exe
Installing...
awMiOFl.exe
Installing...
awMiOFl.exe
Installing...
awMiOFl.exe
Installing...
awMiOFl.exe
Installing...
awMiOFl.exe
Installing...
awMiOFl.exe
Installing...
awMiOFl.exe
Installing...
awMiOFl.exe
Installing...
awMiOFl.exe
Installing...