File name:

amountUSD74770_740220257452202574612025748420257485202574862025DISB50725DISB50925..docx

Full analysis: https://app.any.run/tasks/831993eb-5839-4c97-8438-76af5d2a2eb7
Verdict: Malicious activity
Analysis date: May 20, 2025, 21:01:03
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.openxmlformats-officedocument.wordprocessingml.document
File info: Microsoft Word 2007+
MD5:

77A8A9BD3371EBBDC75C7643A40EF268

SHA1:

C2404B7EBE649E9466101F67C60B91A8516483AF

SHA256:

8E25F5D662B4CD9C8C842E48D47AF6065CB1504728837D756251EEEA8129C77B

SSDEEP:

3072:7TdOqRXq99Om79R6jDh+b0AKWGMyPsjexxv05GKeUQyloIm8GT9:8qR64jDh1ASuj/eUl48c9

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Connects to the server without a host name

      • WINWORD.EXE (PID: 6872)

  • INFO

    • Reads the software policy settings

      • slui.exe (PID: 7424)

    • Checks proxy server information

      • slui.exe (PID: 7424)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.docx | Word Microsoft Office Open XML Format document (52.2)
.zip | Open Packaging Conventions container (38.8)
.zip | ZIP compressed archive (8.8)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0002
ZipCompression: Deflated
ZipModifyDate: 2025:05:19 17:41:56
ZipCRC: 0x8d4b0b97
ZipCompressedSize: 424
ZipUncompressedSize: 2461
ZipFileName: [Content_Types].xml

XML

Template: Normal.dotm
TotalEditTime: 1 minute
Pages: 1
Words: -
Characters: -
Application: Microsoft Office Word
DocSecurity: None
Lines: 1
Paragraphs: 1
ScaleCrop: No
Company: Grizli777
LinksUpToDate: No
CharactersWithSpaces: -
SharedDoc: No
HyperlinksChanged: No
AppVersion: 12
Keywords: -
LastModifiedBy: 91974
RevisionNumber: 2
CreateDate: 2025:05:18 17:06:00Z
ModifyDate: 2025:05:18 17:07:00Z

XMP

Title: -
Subject: -
Creator: 91974
Description: -
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
134
Monitored processes
4
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winword.exe svchost.exe ai.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
5024"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe" "85B49951-A67B-4D0A-AE28-DC233A20B9A0" "3B9DC6B6-A877-4A0A-BB62-9ABD58884E78" "6872"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Artificial Intelligence (AI) Host for the Microsoft® Windows® Operating System and Platform x64.
Version:
0.12.2.0
Modules
Images
c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\ai.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\program files\common files\microsoft shared\clicktorun\c2r64.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\sechost.dll
6872"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n C:\Users\admin\Desktop\amountUSD74770_740220257452202574612025748420257485202574862025DISB50725DISB50925..docx /o ""C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
16.0.16026.20146
Modules
Images
c:\program files\microsoft office\root\office16\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\rpcrt4.dll
7424C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
18 978
Read events
18 563
Write events
385
Delete events
30

Modification events

(PID) Process:(6872) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\ClientTelemetry\Sampling
Operation:writeName:0
Value:
017012000000001000B24E9A3E02000000000000000600000000000000
(PID) Process:(6872) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\6872
Operation:writeName:0
Value:
0B0E10BC47CBB5D8504D43970FD9A5D0DC8872230046D089BE8EA5B9F2ED016A04102400449A7D64B29D01008500A907556E6B6E6F776EC906022222CA0DC2190000C91003783634C511D835D2120B770069006E0077006F00720064002E00650078006500C51620C517808004C91808323231322D44656300
(PID) Process:(6872) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:en-US
Value:
2
(PID) Process:(6872) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:de-de
Value:
2
(PID) Process:(6872) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:fr-fr
Value:
2
(PID) Process:(6872) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:es-es
Value:
2
(PID) Process:(6872) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:it-it
Value:
2
(PID) Process:(6872) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:ja-jp
Value:
2
(PID) Process:(6872) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:ko-kr
Value:
2
(PID) Process:(6872) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:pt-br
Value:
2
Executable files
34
Suspicious files
135
Text files
18
Unknown types
0

Dropped files

PID
Process
Filename
Type
6872WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\80E5D746-702D-4943-A9E0-3F403DB0A661xml
MD5:8D6C0F9AE8DA42C34CD39F5998C9B608
SHA256:4D7ED0BB0394FE149F07B9BC0AE114472A6701CE4BDADA6E00463C8ED47A893C
6872WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bintext
MD5:CC90D669144261B198DEAD45AA266572
SHA256:89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
6872WINWORD.EXEC:\Users\admin\Desktop\~$ountUSD74770_740220257452202574612025748420257485202574862025DISB50725DISB50925..docxbinary
MD5:6335E95DD4D6C969FEC374D1A529CA95
SHA256:CC94018FE7BD87DF5907F6703B17B03F556FC03E0A447AE0118EEF75DEA00163
6872WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\ResourceInfoCache\data.jsonbinary
MD5:0C8B44895FAC8BC2F1C59F9AE5F06787
SHA256:EDB2320C51BF297DF672DD2CD0F7B5AA87FBCB3314AD662A4CBDCD19E8CC10B1
6872WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbresbinary
MD5:66B50518640BA05CF5CB474B06F7228D
SHA256:7F6CDC31AF0E66F2FC535B6372227AF332759168C0B76881793361EB3BA678B2
6872WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\givemebestthingsforbetterwaygoodformebest_______givemebestthingsforbetterwaygoodformebest________givemebestthingsforbetterwaygoodformebest[1].doctext
MD5:F9129E0D5B35A3A13083630A2F6998D5
SHA256:E434CB0B938280676E9AC04F72DA8212B8EA1E4A3692C24C2D5E5F606A96910E
6872WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbresbinary
MD5:685A8FC75EE18AD9408C8FA288FADA93
SHA256:2F1C2ADA19C6685C09418FB712ADC7933FD010094B5AF128B391252ECE9577C6
6872WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\ResourceInfoCache\07fc2a8c43a1d1f16572d21e959a4847e306edae.tempbinary
MD5:0C8B44895FAC8BC2F1C59F9AE5F06787
SHA256:EDB2320C51BF297DF672DD2CD0F7B5AA87FBCB3314AD662A4CBDCD19E8CC10B1
6872WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{D7A16C0A-239B-4523-A113-5DB5E0F9F18B}.tmpbinary
MD5:53B90FCC4C7ED818261A738AA2457B62
SHA256:020CE6EDDFD8AE4E92DA7059F13B891D7E886395E6B5459B61A038E67C90595D
6872WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmbinary
MD5:8E809FA15172B693B6A9624B8D1B2CAD
SHA256:2E7D97596D198836F61CCE42EA76DB94EB740EAC22979D14452EA84AB9025DB1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
19
TCP/UDP connections
129
DNS requests
30
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6872
WINWORD.EXE
HEAD
200
107.175.246.32:80
http://107.175.246.32/340/uhnb/givemebestthingsforbetterwaygoodformebest_______givemebestthingsforbetterwaygoodformebest________givemebestthingsforbetterwaygoodformebest.doc
unknown
—
—
unknown
2104
svchost.exe
GET
200
2.19.11.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6872
WINWORD.EXE
GET
200
23.48.23.173:80
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl
unknown
—
—
whitelisted
6872
WINWORD.EXE
GET
200
107.175.246.32:80
http://107.175.246.32/340/uhnb/givemebestthingsforbetterwaygoodformebest_______givemebestthingsforbetterwaygoodformebest________givemebestthingsforbetterwaygoodformebest.doc
unknown
—
—
unknown
6872
WINWORD.EXE
GET
200
23.48.23.173:80
http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl
unknown
—
—
whitelisted
6872
WINWORD.EXE
HEAD
200
107.175.246.32:80
http://107.175.246.32/340/uhnb/givemebestthingsforbetterwaygoodformebest_______givemebestthingsforbetterwaygoodformebest________givemebestthingsforbetterwaygoodformebest.doc
unknown
—
—
unknown
6872
WINWORD.EXE
GET
200
23.48.23.173:80
http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl
unknown
—
—
whitelisted
6872
WINWORD.EXE
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl
unknown
—
—
whitelisted
2552
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
2.19.11.120:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
6872
WINWORD.EXE
52.109.28.46:443
officeclient.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
GB
whitelisted
2104
svchost.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6872
WINWORD.EXE
104.21.32.1:443
smollq.cc
CLOUDFLARENET
—
unknown
6872
WINWORD.EXE
2.22.242.226:443
omex.cdn.office.net
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.104.136.2
  • 40.127.240.158
  • 4.231.128.59
whitelisted
google.com
  • 142.250.181.238
whitelisted
crl.microsoft.com
  • 2.19.11.120
  • 2.19.11.105
  • 23.48.23.173
  • 23.48.23.177
  • 23.48.23.147
  • 23.48.23.164
  • 23.48.23.166
whitelisted
officeclient.microsoft.com
  • 52.109.28.46
whitelisted
www.microsoft.com
  • 2.23.246.101
  • 95.101.149.131
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
smollq.cc
  • 104.21.32.1
  • 104.21.96.1
  • 104.21.80.1
  • 104.21.48.1
  • 104.21.112.1
  • 104.21.64.1
  • 104.21.16.1
unknown
omex.cdn.office.net
  • 2.22.242.226
  • 2.22.242.90
whitelisted
roaming.officeapps.live.com
  • 52.109.76.243
whitelisted
ecs.office.com
  • 52.123.129.14
  • 52.123.128.14
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
6872
WINWORD.EXE
Potentially Bad Traffic
ET INFO Dotted Quad Host DOC Request
—
—
Potentially Bad Traffic
ET HUNTING Office UA Retrieving Content on Unusually High Port
6872
WINWORD.EXE
Potentially Bad Traffic
ET INFO Dotted Quad Host DOC Request
6872
WINWORD.EXE
Potentially Bad Traffic
ET HUNTING Microsoft Office User-Agent Requesting A Doc File
—
—
Misc activity
ET USER_AGENTS Microsoft Office Existence Discovery User-Agent
6872
WINWORD.EXE
Potentially Bad Traffic
ET INFO Dotted Quad Host DOC Request
6872
WINWORD.EXE
Misc activity
ET USER_AGENTS Microsoft Office Existence Discovery User-Agent
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
amountUSD74770_740220257452202574612025748420257485202574862025DISB50725DISB50925..docx