File name:

80326b1e151e8348307114c8115e275c2fd63f0d2eb1dfacb6eca9840cf98525

Full analysis: https://app.any.run/tasks/a2eb0181-a692-42f7-8015-c40cab56cbac
Verdict: Malicious activity
Analysis date: September 02, 2024, 06:38:25
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
macros
macros-on-open
Indicators:
MIME: application/octet-stream
File info: Microsoft OOXML
MD5:

FCAE6B88640B58D289DF42AE2D15E3CA

SHA1:

80F4ABC3EBE62229F964122DFF078187BE960874

SHA256:

80326B1E151E8348307114C8115E275C2FD63F0D2EB1DFACB6ECA9840CF98525

SSDEEP:

98304:KZ0HXxdOcTnO+0uEEZwEN6sYqZ59o2bb5s8SRORrXkk3xbJa4/jqNdS5tT94P27K:ZK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Checks whether a specified folder exists (SCRIPT)

      • WINWORD.EXE (PID: 5556)

  • SUSPICIOUS

    • Accesses current user name via WMI (SCRIPT)

      • WINWORD.EXE (PID: 5556)

    • Checks whether a specific file exists (SCRIPT)

      • WINWORD.EXE (PID: 5556)

    • Accesses computer name via WMI (SCRIPT)

      • WINWORD.EXE (PID: 5556)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • WINWORD.EXE (PID: 5556)

  • INFO

    • The process uses the downloaded file

      • WINWORD.EXE (PID: 5556)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.docm | Word Microsoft Office Open XML Format document (with Macro) (53.6)
.docx | Word Microsoft Office Open XML Format document (24.2)
.zip | Open Packaging Conventions container (18)
.zip | ZIP compressed archive (4.1)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 1980:01:01 00:00:00
ZipCRC: 0x2d6f5646
ZipCompressedSize: 447
ZipUncompressedSize: 1952
ZipFileName: [Content_Types].xml

XML

Template: A05481F0.dotx
TotalEditTime: 41 minutes
Pages: 107
Words: 9089
Characters: 51812
Application: Microsoft Office Word
DocSecurity: None
Lines: 431
Paragraphs: 121
ScaleCrop: No
HeadingPairs:
  • Title
  • 1
TitlesOfParts: Pak Times
Company: PIET
LinksUpToDate: No
CharactersWithSpaces: 60780
SharedDoc: No
HyperlinksChanged: No
AppVersion: 16
LastModifiedBy: admin
RevisionNumber: 24
CreateDate: 2022:09:21 05:49:00Z
ModifyDate: 2023:01:20 13:53:00Z

XMP

Title: Pak Times
Creator: Spector
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
125
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winword.exe svchost.exe ai.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
488"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe" "1ECBC173-25A1-4325-8D26-51A21284A82D" "052339C5-E410-4460-A867-117B7E42FEB5" "5556"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Artificial Intelligence (AI) Host for the Microsoft® Windows® Operating System and Platform x64.
Version:
0.12.2.0
Modules
Images
c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\ai.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\advapi32.dll
c:\program files\common files\microsoft shared\clicktorun\c2r64.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\sechost.dll
2256C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
5556"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n C:\Users\admin\Desktop\80326b1e151e8348307114c8115e275c2fd63f0d2eb1dfacb6eca9840cf98525.docm /o ""C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
16.0.16026.20146
Modules
Images
c:\program files\microsoft office\root\office16\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
19 222
Read events
18 788
Write events
407
Delete events
27

Modification events

(PID) Process:(5556) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\ClientTelemetry\Sampling
Operation:writeName:0
Value:
017012000000001000B24E9A3E01000000000000000500000000000000
(PID) Process:(5556) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\5932
Operation:delete valueName:0
Value:
ซ괐殺ࠆꯞꝅ莼跳⏺䘅헉꾍樁င$梅摝麨…ީ湕湫睯쥮௅賙ᒳ೅肫
(PID) Process:(5556) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\5932
Operation:delete keyName:(default)
Value:
(PID) Process:(5556) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\5556
Operation:writeName:0
Value:
0B0E10D9C2F62A235C1949BDCA438C8A84EAAB2300469884E5E0ABA0BFED016A04102400449A7D64B29D01008500A907556E6B6E6F776EC906022222CA0DC2190000C91003783634C511B42BD2120B770069006E0077006F00720064002E00650078006500C51620C517808004C91808323231322D44656300
(PID) Process:(5556) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:en-US
Value:
2
(PID) Process:(5556) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:de-de
Value:
2
(PID) Process:(5556) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:fr-fr
Value:
2
(PID) Process:(5556) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:es-es
Value:
2
(PID) Process:(5556) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:it-it
Value:
2
(PID) Process:(5556) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:ja-jp
Value:
2
Executable files
33
Suspicious files
127
Text files
18
Unknown types
0

Dropped files

PID
Process
Filename
Type
5556WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbresbinary
MD5:C5917907B6A4E960445141A349B7AC32
SHA256:D59B71CDF56DDACAF3E76C726C52F4FFDC407A118053352D227CD87939850F1A
5556WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\81B54B4B-926F-4AEC-B0DD-FBC2CC3E23A2xml
MD5:96DD3AFA82451D25E3CEB810D7521C4A
SHA256:F9465D6A51B382E802F15B7163E05B96638CE15F485351B84F5F1BC1D53D940E
5556WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmbinary
MD5:828DE2958B1DB39C84CD215383C1CF33
SHA256:30A349F887BDDC875E6A8DD268838F20D7341EBB776C3D8751C34F2A3BCBF2CD
5556WINWORD.EXEC:\Users\admin\AppData\Local\Temp\msoB473.tmpimage
MD5:ED3C1C40B68BA4F40DB15529D5443DEC
SHA256:039FE79B74E6D3D561E32D4AF570E6CA70DB6BB3718395BE2BF278B9E601279A
5556WINWORD.EXEC:\Users\admin\Desktop\~$326b1e151e8348307114c8115e275c2fd63f0d2eb1dfacb6eca9840cf98525.docmbinary
MD5:1BBFD823E942143C4B53B9C866378921
SHA256:48B00F038B8817BA6BD312516DD10C8567A8FC0F6C9A32E53427C2ABEFCD379F
5556WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bintext
MD5:CC90D669144261B198DEAD45AA266572
SHA256:89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
5556WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbresbinary
MD5:65107B8A7BE5E52EA793223660555927
SHA256:E518DC3C87590C0E611C8DD880E9FECE64107999045330ECACF96C036BD47A18
5556WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dattext
MD5:C3D61E9844F0CF4FC8D70A110D9EBB7A
SHA256:4D542809F00CB1FAD00AB6199C80DA9871108505BE5CBA51F24DBC830449DA33
5556WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\Personalization\Governance\Anonymous\floodgatecampaigns.jsonbinary
MD5:891D58A749152A73BC23065A6C5ABE94
SHA256:4D10C44D96EE0B8952605DB4750D37FC2FFC6DC9F64B421269F3C25BD8FD13AC
5556WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bintext
MD5:059B4D7B5421D675A894464BD59E5EB9
SHA256:4A1F44D18CF9C2E2C2231BB4480FA51EEC373E77C9A9BF799201AD72A7CD30DB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
88
DNS requests
23
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5556
WINWORD.EXE
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
5556
WINWORD.EXE
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
whitelisted
3424
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5556
WINWORD.EXE
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl
unknown
—
—
whitelisted
5556
WINWORD.EXE
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
2132
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5556
WINWORD.EXE
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl
unknown
—
—
whitelisted
5556
WINWORD.EXE
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl
unknown
—
—
whitelisted
2132
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5556
WINWORD.EXE
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5796
RUXIMICS.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
—
—
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
6052
svchost.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
3260
svchost.exe
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5556
WINWORD.EXE
52.109.28.46:443
officeclient.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
GB
whitelisted
5556
WINWORD.EXE
52.113.194.132:443
ecs.office.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5556
WINWORD.EXE
52.109.76.243:443
roaming.officeapps.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5556
WINWORD.EXE
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.78
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
officeclient.microsoft.com
  • 52.109.28.46
whitelisted
ecs.office.com
  • 52.113.194.132
whitelisted
roaming.officeapps.live.com
  • 52.109.76.243
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
omex.cdn.office.net
  • 2.19.126.151
  • 2.19.126.160
whitelisted
windowsupdates.shop
  • —
unknown
login.live.com
  • 20.190.160.22
  • 40.126.32.72
  • 20.190.160.17
  • 20.190.160.14
  • 40.126.32.133
  • 40.126.32.138
  • 40.126.32.74
  • 20.190.160.20
whitelisted
messaging.engagement.office.com
  • 52.111.229.20
whitelisted

Threats

PID
Process
Class
Message
2256
svchost.exe
A Network Trojan was detected
ET MALWARE NewsPenguin Domain in DNS Lookup (windowsupdates .shop)
Process
Message
WINWORD.EXE
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
WINWORD.EXE
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
WINWORD.EXE
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
80326b1e151e8348307114c8115e275c2fd63f0d2eb1dfacb6eca9840cf98525