File name: | Voicemail_+Transcription+_ATT003246.docx |
Full analysis: | https://app.any.run/tasks/68715a5b-60f1-4c98-a80e-8f0a1cea2879 |
Verdict: | Malicious activity |
Analysis date: | January 10, 2025, 20:43:28 |
OS: | Windows 10 Professional (build: 19045, 64 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.openxmlformats-officedocument.wordprocessingml.document |
File info: | Microsoft Word 2007+ |
MD5: | 9E7E74EB81E12D28BE3F3134096B1D2E |
SHA1: | EA72D0EF491BE96A9557E50008426C9F5E9270D0 |
SHA256: | 844A319588CECD35597AE59D47C9B0CFF0C8389C237325D5D0DD5AC1D5890741 |
SSDEEP: | 1536:QIlS2iS/Tc9F1gEGChtnOm3uBOX+TNSeLFJ5t1ivB0F:3S2tbwFHHnOmeBOWnbxivB0F |
.docx | | | Word Microsoft Office Open XML Format document (52.2) |
---|---|---|
.zip | | | Open Packaging Conventions container (38.8) |
.zip | | | ZIP compressed archive (8.8) |
ZipRequiredVersion: | 20 |
---|---|
ZipBitFlag: | - |
ZipCompression: | Deflated |
ZipModifyDate: | 2025:01:09 19:31:14 |
ZipCRC: | 0xd0aea7fc |
ZipCompressedSize: | 411 |
ZipUncompressedSize: | 1788 |
ZipFileName: | [Content_Types].xml |
Title: | - |
---|---|
Subject: | - |
Creator: | python-docx |
Description: | generated by python-docx |
Keywords: | - |
---|---|
LastModifiedBy: | - |
RevisionNumber: | 1 |
CreateDate: | 2013:12:23 23:15:00Z |
ModifyDate: | 2013:12:23 23:15:00Z |
Category: | - |
Template: | Normal.dotm |
TotalEditTime: | - |
Pages: | 1 |
Words: | - |
Characters: | - |
Application: | Microsoft Macintosh Word |
DocSecurity: | None |
Lines: | - |
Paragraphs: | - |
ScaleCrop: | No |
HeadingPairs: |
|
TitlesOfParts: | - |
Manager: | - |
Company: | - |
LinksUpToDate: | No |
CharactersWithSpaces: | - |
SharedDoc: | No |
HyperlinkBase: | - |
HyperlinksChanged: | No |
AppVersion: | 14 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
1544 | "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n C:\Users\admin\AppData\Local\Temp\Voicemail_+Transcription+_ATT003246.docx /o "" | C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 16.0.16026.20146 Modules
| |||||||||||||||
6664 | "C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe" "9703CD10-12B4-44D0-8660-9DACCBD6BF1F" "F2B38600-97A0-4401-831D-A67320ACC53B" "1544" | C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe | — | WINWORD.EXE | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Artificial Intelligence (AI) Host for the Microsoft® Windows® Operating System and Platform x64. Version: 0.12.2.0 Modules
|
(PID) Process: | (1544) WINWORD.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\ClientTelemetry\Sampling |
Operation: | write | Name: | 0 |
Value: 017012000000001000B24E9A3E02000000000000000600000000000000 | |||
(PID) Process: | (1544) WINWORD.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\1544 |
Operation: | write | Name: | 0 |
Value: 0B0E10A6F0016B47079D4180A6C1FD547D12EB230046BFF2E3A285F4D8ED016A04102400449A7D64B29D01008500A907556E6B6E6F776EC906022222CA0DC2190000C91003783634C511880CD2120B770069006E0077006F00720064002E00650078006500C51620C517808004C91808323231322D44656300 | |||
(PID) Process: | (1544) WINWORD.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages |
Operation: | write | Name: | en-US |
Value: 2 | |||
(PID) Process: | (1544) WINWORD.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages |
Operation: | write | Name: | de-de |
Value: 2 | |||
(PID) Process: | (1544) WINWORD.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages |
Operation: | write | Name: | fr-fr |
Value: 2 | |||
(PID) Process: | (1544) WINWORD.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages |
Operation: | write | Name: | es-es |
Value: 2 | |||
(PID) Process: | (1544) WINWORD.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages |
Operation: | write | Name: | it-it |
Value: 2 | |||
(PID) Process: | (1544) WINWORD.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages |
Operation: | write | Name: | ja-jp |
Value: 2 | |||
(PID) Process: | (1544) WINWORD.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages |
Operation: | write | Name: | ko-kr |
Value: 2 | |||
(PID) Process: | (1544) WINWORD.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages |
Operation: | write | Name: | pt-br |
Value: 2 |
PID | Process | Filename | Type | |
---|---|---|---|---|
1544 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin | text | |
MD5:CC90D669144261B198DEAD45AA266572 | SHA256:89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899 | |||
1544 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~$icemail_+Transcription+_ATT003246.docx | binary | |
MD5:1ABED6A7CF4675A8FB8BE2C53F408881 | SHA256:67C98C14836A5C4487326DC6781AE61CFC131F2454B9F90158F930FEE367680F | |||
1544 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin | text | |
MD5:0A64A535900C290F91EB742514087EAE | SHA256:B01A67E8C271D9E0176259E71259F73BBA3D814D32B481E8A89953BC1E16FA71 | |||
1544 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\3A51EF05-6861-426E-8A85-DD4751C5C800 | xml | |
MD5:616264E7639D3EB9B7C8002A9336886D | SHA256:5DBCB7A4F5237BCA0E13908FC86BEC4E16153A90F2CDDCF973B020A5FEB279B8 | |||
1544 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Office\16.0\UsageMetricsStore\FileActivityStoreV3\Word\ASkwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDBfTnVsbAA.S | binary | |
MD5:D64C20827D53136DDF1003FA88648B3B | SHA256:8D20140C70EB9654882CD5E5BC7EB49972CE872A65974FAC51373F8AFA28E22E | |||
1544 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres | binary | |
MD5:35A750AD8045F173144E3CF2C676B61B | SHA256:234AB49714FA88880DD3C70426B78357B4D10ED9A18EB9542036B256458EAEC6 | |||
1544 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:9A9BC4620CD703A2E04B07E4337B0835 | SHA256:7BB395487A1D077573AE394D85FF4100276D6C2D0A087E0C16E7ED933A155D7D | |||
1544 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\mso789E.tmp | image | |
MD5:ED3C1C40B68BA4F40DB15529D5443DEC | SHA256:039FE79B74E6D3D561E32D4AF570E6CA70DB6BB3718395BE2BF278B9E601279A | |||
1544 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\cabC899.tmp | compressed | |
MD5:4EFA48EC307EAF2F9B346A073C67FCFB | SHA256:3EE9AE1F8DAB4C498BD561D8FCC66D83E58F11B7BB4B2776DF99F4CDA4B850C2 | |||
1544 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\cabC898.tmp | compressed | |
MD5:92A819D434A8AAEA2C65F0CC2F33BB3A | SHA256:5D13F9907AC381D19F0A7552FD6D9FC07C9BD42C0F9CE017FFF75587E1890375 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 2.16.241.12:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
4712 | MoUsoCoreWorker.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
1544 | WINWORD.EXE | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
1176 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
5064 | SearchApp.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
1544 | WINWORD.EXE | GET | 200 | 23.48.23.193:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
4712 | MoUsoCoreWorker.exe | GET | 200 | 2.16.241.12:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 23.48.23.193:80 | http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl | unknown | — | — | whitelisted |
6592 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
1544 | WINWORD.EXE | GET | 200 | 23.48.23.193:80 | http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl | unknown | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4712 | MoUsoCoreWorker.exe | 2.16.241.12:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
— | — | 2.16.241.12:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
4712 | MoUsoCoreWorker.exe | 2.23.246.101:80 | www.microsoft.com | Ooredoo Q.S.C. | QA | whitelisted |
— | — | 2.23.246.101:80 | www.microsoft.com | Ooredoo Q.S.C. | QA | whitelisted |
1544 | WINWORD.EXE | 52.109.28.46:443 | officeclient.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | GB | whitelisted |
2168 | RUXIMICS.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
1544 | WINWORD.EXE | 52.113.194.132:443 | ecs.office.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
1544 | WINWORD.EXE | 2.16.168.119:443 | omex.cdn.office.net | Akamai International B.V. | RU | whitelisted |
Domain | IP | Reputation |
---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
officeclient.microsoft.com |
| whitelisted |
ecs.office.com |
| whitelisted |
omex.cdn.office.net |
| whitelisted |
messaging.lifecycle.office.com |
| whitelisted |
nleditor.osi.office.net |
| whitelisted |
login.live.com |
| whitelisted |
Process | Message |
---|---|
WINWORD.EXE | WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
|
WINWORD.EXE | WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
|
WINWORD.EXE | WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
|