analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Pensionskasse SHP_858151174_11.12.2018.docx

Full analysis: https://app.any.run/tasks/7ad257ad-4544-41e3-b741-3ec4db8091ad
Verdict: Malicious activity
Analysis date: January 11, 2019, 08:16:19
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ole-embedded
generated-doc
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

7EAB6D83E7AE505D9AEDDECFBD51972B

SHA1:

5DC30125F61AED479FD3A8F00178EAD0F9DBB7DC

SHA256:

9C73EB4894133262BF0094E865A9855B7278062D4792E657C96ABA009D0FCA75

SSDEEP:

1536:j/ZSUZUCPuuBQoB9WEp20e5cvqbEOqefd6sAMEVycvjp3o6S4:j/ZZZnuymx0e6CbRd6pMrcve6S4

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts CMD.EXE for commands execution

      • WINWORD.EXE (PID: 2944)

    • Unusual execution from Microsoft Office

      • WINWORD.EXE (PID: 2944)

    • Executes PowerShell scripts

      • cmd.exe (PID: 3152)
      • cmd.exe (PID: 2380)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 2380)

    • Creates files in the user directory

      • powershell.exe (PID: 3372)
      • powershell.exe (PID: 2420)

    • Executes scripts

      • cmd.exe (PID: 2380)

  • INFO

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2944)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2944)

    • Dropped object may contain TOR URL's

      • powershell.exe (PID: 2420)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.docx | Word Microsoft Office Open XML Format document (52.2)
.zip | Open Packaging Conventions container (38.8)
.zip | ZIP compressed archive (8.8)

EXIF

XML

AppVersion: 12
Company: Röhrdanz
Manager: Silvio Kuhl
Paragraphs: 388
Lines: 4515
Application: Microsoft Office Word
CharactersWithSpaces: 315237
Characters: 315237
Words: 24249
Pages: 72
Template: Normal
Category: deleniti
ModifyDate: 2018:12:08 17:21:01Z
CreateDate: 2018:12:08 17:21:01Z
RevisionNumber: 322092
LastModifiedBy: Prof. Alice Kramer
Keywords: fugiat, esse, voluptatem

XMP

Description: Consequuntur accusamus quibusdam architecto rem perferendis laborum minima quae.
Creator: Prof. Alice Kramer
Subject: Pensionskasse SHP N858151174
Title: Pensionskasse SHP N858151174

ZIP

ZipFileName: word/document.xml
ZipUncompressedSize: 6507
ZipCompressedSize: 1430
ZipCRC: 0x83f7eeea
ZipModifyDate: 2018:12:11 12:44:03
ZipCompression: Deflated
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
6
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winword.exe no specs cmd.exe no specs cmd.exe no specs powershell.exe no specs powershell.exe no specs wscript.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2944"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\Pensionskasse SHP_858151174_11.12.2018.docx"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
2380cmd /c ""C:\Users\admin\AppData\Local\Temp\Windowseigener Bildviewer.cmd" "C:\Windows\system32\cmd.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3152C:\Windows\system32\cmd.exe /c powershell -w hidden -Command "(-join ((48..57)+(65..90)+(97..122) | Get-Random -Count (Get-Random -minimum 5 -maximum 15) | % {[char]$_}))"C:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3372powershell -w hidden -Command "(-join ((48..57)+(65..90)+(97..122) | Get-Random -Count (Get-Random -minimum 5 -maximum 15) | % {[char]$_}))"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2420powershell -WindowStyle hidden -c "[IO.File]::WriteAllBytes($env:IZEivcCTHc, [System.Convert]::FromBase64String([IO.File]::ReadAllText($env:IZEivcCTHc)));"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3452wscript C:\Users\admin\AppData\Local\Temp\QqF4mpBNStAZ6X.jsC:\Windows\system32\wscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Total events
1 593
Read events
1 140
Write events
448
Delete events
5

Modification events

(PID) Process:(2944) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:writeName:p6%
Value:
70362500800B0000010000000000000000000000
(PID) Process:(2944) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
Off
(PID) Process:(2944) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
On
(PID) Process:(2944) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:WORDFiles
Value:
1311440926
(PID) Process:(2944) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:ProductFiles
Value:
1311441040
(PID) Process:(2944) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:ProductFiles
Value:
1311441041
(PID) Process:(2944) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word
Operation:writeName:MTTT
Value:
800B00006E7540FE85A9D40100000000
(PID) Process:(2944) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:writeName:48%
Value:
34382500800B000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000
(PID) Process:(2944) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:delete valueName:48%
Value:
34382500800B000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000
(PID) Process:(2944) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
Executable files
0
Suspicious files
4
Text files
71
Unknown types
2

Dropped files

PID
Process
Filename
Type
2944WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR92D0.tmp.cvr —
MD5:—
SHA256:—
2944WINWORD.EXEC:\Users\admin\AppData\Local\Temp\mso961D.tmp —
MD5:—
SHA256:—
2944WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\B33D2BAC.jpeg —
MD5:—
SHA256:—
3372powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\9UCVDJXXJ7FAYJ5R2JRH.temp —
MD5:—
SHA256:—
2380cmd.exeC:\Users\admin\AppData\Local\Temp\QqF4mpBNStAZ6X.jstext
MD5:2043BBCD9E7C137AA23B1A39D3072E53
SHA256:F8EAA984C46C517A7B8EAF03F63F2A9191DAA98A70B210A45E2BB54E64DD85B0
3372powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:901ECDF767744E6BB59CB023757886E3
SHA256:48A990A7B1201BFD70F417698302A6299D036A6574E558A96000AF48469479E1
2420powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\JDDQB7JFA6SIRLTT2AMC.temp —
MD5:—
SHA256:—
3372powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF19b1d1.TMPbinary
MD5:901ECDF767744E6BB59CB023757886E3
SHA256:48A990A7B1201BFD70F417698302A6299D036A6574E558A96000AF48469479E1
2944WINWORD.EXEC:\Users\admin\AppData\Local\Temp\Windowseigener Bildviewer.cmdtext
MD5:32BCDA4CB80CDF09155667A4AB54E836
SHA256:09F75B2BDA824C7BF09E74276F867995B0D8E6FC35303D75EB07BBE00402F4B8
2944WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$nsionskasse SHP_858151174_11.12.2018.docxpgc
MD5:6669B9CFAFCC314947097B7862A0425E
SHA256:4CEEAA61B67FCFBDC826E002D047FEBED41096544782E5895B581D68004A82A8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Pensionskasse SHP_858151174_11.12.2018.docx