Malware analysis 380028.docx Malicious activity | ANY.RUN

Add for printing

File name:	380028.docx
Full analysis:	https://app.any.run/tasks/c6bea632-b0d7-42b6-a1c3-3d23dd096aa4
Verdict:	Malicious activity
Analysis date:	September 11, 2019, 11:33:43
OS:	Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:	opendir
Indicators:
MIME:	application/vnd.openxmlformats-officedocument.wordprocessingml.document
File info:	Microsoft Word 2007+
MD5:	DF4170914F564DF9C10D68645796BFA6
SHA1:	8361F2CA247008B50B41F65B0A9C03882339C60D
SHA256:	7DC92CEB5C56C18C2C645C4FD39E0D4D3C53A27355D5E6EEF38228F80342CC5D
SSDEEP:	192:R5C0EvCH76yMtWNKm0mqQTnhr5OwQT1Q3P55aTbFTB8GoA6akkWdmp:R5C5vCHmyMtiK4LOwQT1Q3DaNdQnmp

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 60 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: none
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 8.0.7601.17514 undefined
Adobe Acrobat Reader DC MUI (15.023.20070)
Adobe Flash Player 26 ActiveX (26.0.0.131)
Adobe Flash Player 26 NPAPI (26.0.0.131)
Adobe Flash Player 26 PPAPI (26.0.0.131)
Adobe Refresh Manager (1.8.0)
CCleaner (5.35)
FileZilla Client 3.36.0 (3.36.0)
Google Chrome (75.0.3770.100)
Google Update Helper (1.3.34.7)
Java 8 Update 92 (8.0.920.14)
Java Auto Updater (2.8.92.14)
Microsoft .NET Framework 4.7.2 (4.7.03062)
Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Professional 2010 (14.0.6029.1000)
Microsoft Office Proof (English) 2010 (14.0.6029.1000)
Microsoft Office Proof (French) 2010 (14.0.6029.1000)
Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Single Image 2010 (14.0.6029.1000)
Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2019 Redistributable (x86) - 14.21.27702 (14.21.27702.2)
Microsoft Visual C++ 2019 X86 Additional Runtime - 14.21.27702 (14.21.27702)
Microsoft Visual C++ 2019 X86 Minimum Runtime - 14.21.27702 (14.21.27702)
Mozilla Firefox 68.0.1 (x86 en-US) (68.0.1)
Notepad++ (32-bit x86) (7.5.1)
Opera 12.15 (12.15.1748)
Skype version 8.29 (8.29)
Update for Microsoft .NET Framework 4.7.2 (KB4087364) (1)
VLC media player (2.2.6)
WinRAR 5.60 (32-bit) (5.60.0)

Hotfixes

Client LanguagePack Package
Client Refresh LanguagePack Package
CodecPack Basic Package
Foundation Package
IE Troubleshooters Package
InternetExplorer Optional Package
KB2534111
KB2999226
KB4019990
KB976902
LocalPack AU Package
LocalPack CA Package
LocalPack GB Package
LocalPack US Package
LocalPack ZA Package
ProfessionalEdition
UltimateEdition

Add for printing

MALICIOUS
No malicious indicators.
SUSPICIOUS
No suspicious indicators.
INFO
- Creates files in the user directory
  - WINWORD.EXE (PID: 2736)
- Reads Microsoft Office registry keys
  - WINWORD.EXE (PID: 2736)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.docx	\|	Word Microsoft Office Open XML Format document (52.2)
.zip	\|	Open Packaging Conventions container (38.8)
.zip	\|	ZIP compressed archive (8.8)

EXIF

XMP

Creator:	Microsoft

XML

ModifyDate:	2017:09:24 17:27:00Z
CreateDate:	2017:09:24 17:26:00Z
RevisionNumber:	1
LastModifiedBy:	Microsoft
AppVersion:	14
HyperlinksChanged:	No
SharedDoc:	No
CharactersWithSpaces:	7
LinksUpToDate:	No
Company:	SPecialiST RePack
TitlesOfParts:	-
HeadingPairs:	Название 1
ScaleCrop:	No
Paragraphs:	1
Lines:	1
DocSecurity:	None
Application:	Microsoft Office Word
Characters:	7
Words:	1
Pages:	1
TotalEditTime:	1 minute
Template:	dotm.dotm

ZIP

ZipFileName:	[Content_Types].xml
ZipUncompressedSize:	1422
ZipCompressedSize:	358
ZipCRC:	0x82872409
ZipModifyDate:	2019:09:10 10:59:06
ZipCompression:	Deflated
ZipBitFlag:	0x0002
ZipRequiredVersion:	20

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
2736	"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\380028.docx"	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE		explorer.exe
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000

Add for printing

Total events

1 111

Read events

768

Write events

338

Delete events

Modification events


(PID) Process:	(2736) WINWORD.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:	write	Name:	jd!
Value: 6A642100B00A0000010000000000000000000000
(PID) Process:	(2736) WINWORD.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:	write	Name:	1033
Value: Off
(PID) Process:	(2736) WINWORD.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:	write	Name:	1033
Value: On
(PID) Process:	(2736) WINWORD.EXE	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:	write	Name:	WORDFiles
Value: 1328218142
(PID) Process:	(2736) WINWORD.EXE	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:	write	Name:	ProductFiles
Value: 1328218256
(PID) Process:	(2736) WINWORD.EXE	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:	write	Name:	ProductFiles
Value: 1328218257
(PID) Process:	(2736) WINWORD.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word
Operation:	write	Name:	MTTT
Value: B00A0000323503CB9468D50100000000
(PID) Process:	(2736) WINWORD.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:	write	Name:	bf!
Value: 62662100B00A000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000
(PID) Process:	(2736) WINWORD.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:	delete value	Name:	bf!
Value: 62662100B00A000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000
(PID) Process:	(2736) WINWORD.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	UNCAsIntranet
Value: 0

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
2736	WINWORD.EXE	C:\Users\admin\AppData\Local\Temp\CVR90EA.tmp.cvr		—
		MD5:—	SHA256:—
2736	WINWORD.EXE	C:\Users\admin\AppData\Local\Temp\{419E9A89-3920-4234-BE17-A2367C7D3B7E}		—
		MD5:—	SHA256:—
2736	WINWORD.EXE	C:\Users\admin\AppData\Local\Temp\{4D67DE93-402A-4920-BEC7-C000ECEA156B}		—
		MD5:—	SHA256:—
2736	WINWORD.EXE	C:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-{C7614559-CE10-4874-BCAB-E014F40FC10C}.FSD		binary
		MD5:53BB8CE13890E363499EFF40354D7EB0	SHA256:2B2A0C1766E17386B87586FDDFB04691E8AC3B6B9CBB5A2EB6E91CCD970799AF
2736	WINWORD.EXE	C:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-{60CF705F-E07D-41E4-AB31-905EC9EF42AD}.FSD		binary
		MD5:83D0C4A8108A96F018DC17E0370E7279	SHA256:89CDD140CC4ACB34CB9058A8A0C713FF2E871D6824FF0809C19FDF58D35FABB7
2736	WINWORD.EXE	C:\Users\admin\AppData\Local\Temp\~$380028.docx		pgc
		MD5:0F30BA2B3D4A8D16EEBF9FB307EED89B	SHA256:4E7E6A0B0403ABA160E0C9D4B635F94D1715565359E3F133A5D3C87320182301
2736	WINWORD.EXE	C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm		pgc
		MD5:B7DEA70F335E5DDC93FE702864A27887	SHA256:5E4B0BB068B9758D42C59BDBB3E585A771C8BE51EE88F713369718C081896434
2736	WINWORD.EXE	C:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-CNRY.FSD		binary
		MD5:01821ACF9F681B1893E2F1A83DC67C82	SHA256:046753E1A695BCBDD05FD53066827F129EF938B4508EF9023C4B511BA9E4A59D
2736	WINWORD.EXE	C:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSF-CTBL.FSF		binary
		MD5:5A806BF07DA5F4142822656A55FBC37D	SHA256:5D33BEDFBE5B34CFA7C4A556DFF2F77DB8888A735D00D418BE8BE558E5C6A606
2736	WINWORD.EXE	C:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD		binary
		MD5:52729391B7100AECF3A3503F522030BE	SHA256:A6DA361DD97AB9390A9A782E4AECD390B3EFE3EA59D125225CCD755CE49D4240

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
2736	WINWORD.EXE	HEAD	404	23.227.137.210:80	http://laveronicamagazine.com/wp-admin/network/jaku1/380032.doc	US	—	—	malicious
984	svchost.exe	PROPFIND	200	23.227.137.210:80	http://laveronicamagazine.com/wp-admin/network/jaku1/	US	html	1.02 Kb	malicious
2736	WINWORD.EXE	GET	—	23.227.137.210:80	http://laveronicamagazine.com/wp-admin/network/jaku1/380032.doc	US	—	—	malicious
2736	WINWORD.EXE	HEAD	404	23.227.137.210:80	http://laveronicamagazine.com/wp-admin/network/jaku1/380032.doc	US	—	—	malicious
984	svchost.exe	OPTIONS	200	23.227.137.210:80	http://laveronicamagazine.com/wp-admin/network/jaku1/	US	html	1.02 Kb	malicious
2736	WINWORD.EXE	OPTIONS	200	23.227.137.210:80	http://laveronicamagazine.com/wp-admin/network/jaku1/	US	html	1.02 Kb	malicious
984	svchost.exe	PROPFIND	200	23.227.137.210:80	http://laveronicamagazine.com/wp-admin/network/jaku1/	US	html	1.02 Kb	malicious
984	svchost.exe	PROPFIND	301	23.227.137.210:80	http://laveronicamagazine.com/wp-admin/network/jaku1	US	html	705 b	malicious
984	svchost.exe	PROPFIND	302	23.227.137.210:80	http://laveronicamagazine.com/wp-admin/network/	US	html	705 b	malicious
984	svchost.exe	PROPFIND	301	23.227.137.210:80	http://laveronicamagazine.com/wp-admin/network/jaku1	US	html	705 b	malicious

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
984	svchost.exe	23.227.137.210:80	laveronicamagazine.com	24 SHELLS	US	malicious
984	svchost.exe	23.227.137.210:443	laveronicamagazine.com	24 SHELLS	US	malicious
2736	WINWORD.EXE	23.227.137.210:80	laveronicamagazine.com	24 SHELLS	US	malicious
—	—	23.227.137.210:80	laveronicamagazine.com	24 SHELLS	US	malicious

DNS requests

Domain	IP	Reputation
laveronicamagazine.com	23.227.137.210	malicious

Threats

No threats detected

Add for printing

No debug info

General Info

380028.docx

DF4170914F564DF9C10D68645796BFA6

8361F2CA247008B50B41F65B0A9C03882339C60D

7DC92CEB5C56C18C2C645C4FD39E0D4D3C53A27355D5E6EEF38228F80342CC5D

192:R5C0EvCH76yMtWNKm0mqQTnhr5OwQT1Q3P55aTbFTB8GoA6akkWdmp:R5C5vCHmyMtiK4LOwQT1Q3DaNdQnmp

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

INFO

Creates files in the user directory

Reads Microsoft Office registry keys

Malware configuration

Static information

TRiD

EXIF

XMP

XML

ZIP

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings