analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

75c5a02d7413f9e2995469808b544ba2839ac48d7da0fccdbf3259e81ae4734a

Full analysis: https://app.any.run/tasks/e3909dc2-0454-4010-9b0a-a0c379cc9397
Verdict: Malicious activity
Analysis date: February 22, 2020, 01:32:21
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/octet-stream
File info: data
MD5:

D1523C52E56EC8719C9B77424E3AA3CC

SHA1:

1B5F2B03427FED76E1296A0494711703A1364B1B

SHA256:

75C5A02D7413F9E2995469808B544BA2839AC48D7DA0FCCDBF3259E81AE4734A

SSDEEP:

384:xUfNIKllBCtTcnhSwdgm+6+ItU8r0yJ5fwXXyAuiILK4Tzdv7QwX1NjPjKP:uvdgmsItTLgyA4j1NjGP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts CMD.EXE for commands execution

      • WINWORD.EXE (PID: 1944)

    • Unusual execution from Microsoft Office

      • WINWORD.EXE (PID: 1944)

    • Executable content was dropped or overwritten

      • WINWORD.EXE (PID: 1944)

  • SUSPICIOUS

    • Starts Microsoft Office Application

      • rundll32.exe (PID: 3000)

    • Creates executable files which already exist in Windows

      • WINWORD.EXE (PID: 1944)

    • Unusual connect from Microsoft Office

      • WINWORD.EXE (PID: 1944)

    • Reads Internet Cache Settings

      • WINWORD.EXE (PID: 1944)

  • INFO

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 1944)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 1944)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start rundll32.exe no specs winword.exe cmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3000"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Local\Temp\75c5a02d7413f9e2995469808b544ba2839ac48d7da0fccdbf3259e81ae4734aC:\Windows\system32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1944"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\75c5a02d7413f9e2995469808b544ba2839ac48d7da0fccdbf3259e81ae4734a"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
3164cmd /c %tmp%\services.exeC:\Windows\system32\cmd.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Total events
1 001
Read events
872
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
5
Text files
0
Unknown types
4

Dropped files

PID
Process
Filename
Type
1944WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR8499.tmp.cvr —
MD5:—
SHA256:—
1944WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CabB659.tmp —
MD5:—
SHA256:—
1944WINWORD.EXEC:\Users\admin\AppData\Local\Temp\TarB65A.tmp —
MD5:—
SHA256:—
1944WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:3B2028ABACB34B91D247DF17A1D03519
SHA256:A8E87D25B401FF71C1D1AFE1E4520947CFC9C36C003C3CD3CF0AD64864B41354
1944WINWORD.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\644B8874112055B5E195ECB0E8F243A4der
MD5:90CC8FC123C6481D30C2042ABC09E171
SHA256:BDB5509FAAF8DF7447552FD00F3B9248EC92A2435F45ADCEC46AC8B5D005695B
1944WINWORD.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\644B8874112055B5E195ECB0E8F243A4binary
MD5:E79D05057968E11C4F4F45051971A672
SHA256:3FCBC0D5480478F18213C225494C4DBCFFA8FE0CE5381049C498BBB3E21877B4
1944WINWORD.EXEC:\Users\admin\AppData\Local\Temp\services.exeexecutable
MD5:3CF4E680E3BAE983129E2F392EF7B581
SHA256:870D6C17C74B7B550EAEEFE2CDC179001C722B3260F6D262B45FA542EF345B68
1944WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$c5a02d7413f9e2995469808b544ba2839ac48d7da0fccdbf3259e81ae4734apgc
MD5:F3122879C6607E50221C386FC1CAA213
SHA256:FE6B8E75FB01C0D5E8833975EFBCC118E4566C28A24784EFBF6BC04DD58ABC66
1944WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{562FA5B7-4E64-458C-A4EF-A685058F4AFB}.tmpbinary
MD5:98D19DB0814DD16F7AF18DC08B1C3EE1
SHA256:9F3594F661BAA843D861058F9C94F03EEFCF855F7E44081AF2917BCAF486596A
1944WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\putty[1].exeexecutable
MD5:3CF4E680E3BAE983129E2F392EF7B581
SHA256:870D6C17C74B7B550EAEEFE2CDC179001C722B3260F6D262B45FA542EF345B68
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
3
DNS requests
3
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1944
WINWORD.EXE
GET
200
192.35.177.64:80
http://crl.identrust.com/DSTROOTCAX3CRL.crl
US
der
994 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1944
WINWORD.EXE
192.35.177.64:80
crl.identrust.com
IdenTrust
US
malicious
1944
WINWORD.EXE
2.16.186.11:80
isrg.trustid.ocsp.identrust.com
Akamai International B.V.
—
whitelisted
1944
WINWORD.EXE
97.107.141.160:443
ryara.net
Linode, LLC
US
suspicious

DNS requests

Domain
IP
Reputation
ryara.net
  • 97.107.141.160
suspicious
isrg.trustid.ocsp.identrust.com
  • 2.16.186.11
  • 2.16.186.35
whitelisted
crl.identrust.com
  • 192.35.177.64
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
75c5a02d7413f9e2995469808b544ba2839ac48d7da0fccdbf3259e81ae4734a