File name:

Web Blocked as Usual ( May 2023 ).doc

Full analysis: https://app.any.run/tasks/a75b06ef-2a10-4a0f-a47f-65f5b2ba415e
Verdict: Malicious activity
Analysis date: May 22, 2023, 02:46:01
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 949, Author: user, Template: Normal, Last Saved By: user, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Total Editing Time: 02:00, Create Time/Date: Thu Apr 27 06:46:00 2023, Last Saved Time/Date: Thu Apr 27 06:48:00 2023, Number of Pages: 1, Number of Words: 25, Number of Characters: 146, Security: 0
MD5:

6C0D2E720A5DEC59C583683C2EC70F84

SHA1:

FDFACAAC3057AE5600B9580BFB6F32616CA52FE5

SHA256:

A0D72FFE6347F08D58A5EFF7E056628831F061966CBAF7BBB04A7E94DC2B1F1C

SSDEEP:

3072:ea3Sd+iVWFBvEgVDN2mpNSAjQ5brISvCU54zaOb5i/a0gcB:eaQ8BvEkDQQjQ9ISqU2WOcN

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Connection from MS Office application

      • WINWORD.EXE (PID: 3940)

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Reads Internet Explorer settings

      • WINWORD.EXE (PID: 3940)

    • Application launched itself

      • iexplore.exe (PID: 3292)

    • Create files in a temporary directory

      • iexplore.exe (PID: 3292)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (54.2)
.doc | Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

Lines: 1
Paragraphs: 1
Pages: 1
Characters: 146
Words: 25
TotalEditTime: 2 minutes
RevisionNumber: 1
LastPrinted: 0000:00:00 00:00:00
CompObjUserType: Microsoft Word 97-2003 ????
CompObjUserTypeLen: 28
Hyperlinks:
  • https://www.englishforums.com/English/FromDavidDYChoiCdyera/bpnzrn/post.htm
CodePage: Windows Korean (Unified Hangul Code)
HeadingPairs:
  • ????
  • 1
TitleOfParts: -
HyperlinksChanged: No
SharedDoc: No
LinksUpToDate: No
ScaleCrop: No
AppVersion: 16
CharCountWithSpaces: 170
Company: -
Security: None
ModifyDate: 2023:04:27 06:48:00
CreateDate: 2023:04:27 06:46:00
Software: Microsoft Office Word
LastModifiedBy: user
Template: Normal
Comments: -
Keywords: -
Author: user
Subject: -
Title: -
Word97: No
System: Windows
DocFlags: Has picture, 1Table, ExtChar, Far east
LanguageCode: English (US)
Identification: Word 8.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
4
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winword.exe iexplore.exe iexplore.exe no specs iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
2140"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3292 CREDAT:144385 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2632"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3292 CREDAT:333058 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
3292"C:\Program Files\Internet Explorer\iexplore.exe" -startmediumtab -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
3940"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\Web Blocked as Usual ( May 2023 ).doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\system32\gdi32.dll
Total events
26 842
Read events
26 198
Write events
507
Delete events
137

Modification events

(PID) Process:(3940) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
On
(PID) Process:(3940) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1041
Value:
On
(PID) Process:(3940) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1046
Value:
On
(PID) Process:(3940) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1036
Value:
On
(PID) Process:(3940) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1031
Value:
On
(PID) Process:(3940) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1040
Value:
On
(PID) Process:(3940) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1049
Value:
On
(PID) Process:(3940) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:3082
Value:
On
(PID) Process:(3940) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1042
Value:
On
(PID) Process:(3940) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1055
Value:
On
Executable files
0
Suspicious files
72
Text files
72
Unknown types
0

Dropped files

PID
Process
Filename
Type
3940WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRC759.tmp.cvr —
MD5:—
SHA256:—
3940WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~DF9B0B72A34CD51606.TMPbinary
MD5:BF619EAC0CDF3F68D496EA9344137E8B
SHA256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
3940WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$b Blocked as Usual ( May 2023 ).docbinary
MD5:FFBE7B0AABAF91717A1A20E2D25E9F00
SHA256:630FFDD63042B08AFFE0DA59145CA53F582D9A03065B7A4511A1961F71DFFF32
2632iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\email-decode.min[1].jshtml
MD5:9E8F56E8E1806253BA01A95CFC3D392C
SHA256:2595496FE48DF6FCF9B1BC57C29A744C121EB4DD11566466BC13D2E52E6BBCC8
3940WINWORD.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:352D5CDA6285B5CCF682EC5EBAA62DB6
SHA256:39CE710B35B85608F97838E4B36C9CDF512D4989D7F69E41518F791527AE0F24
3940WINWORD.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1B1495DD322A24490E2BF2FAABAE1C61binary
MD5:DEC6BBE308EB44937F77160A25EE32DB
SHA256:68A71DE28F488586C2B169F4652347E0A1FD632D48A6D6725393607BFA18BC7E
2632iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27binary
MD5:9CE178DF2D4BECE9D6276D6334656FD8
SHA256:FC27EF7643F44701C2FFC87D3DB20FC731E872995293790C455841D032CFEC14
2632iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27binary
MD5:DB0141A118722A02BBA324DAEA78A76E
SHA256:441F5DAFFE4E1ACB8220D08F306C3B1CC0819E24C1609BE9C4DC44B3ACBEBD59
3940WINWORD.EXEC:\Users\admin\AppData\Local\Temp\TarFBC9.tmpbinary
MD5:4FF65AD929CD9A367680E0E5B1C08166
SHA256:C8733C93CC5AAF5CA206D06AF22EE8DBDEC764FB5085019A6A9181FEB9DFDEE6
3940WINWORD.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506compressed
MD5:3AC860860707BAAF32469FA7CC7C0192
SHA256:D015145D551ECD14916270EFAD773BBC9FD57FAD2228D2C24559F696C961D904
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
27
TCP/UDP connections
109
DNS requests
52
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2632
iexplore.exe
GET
—
172.217.18.3:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFRJdTSkekFdCkkVOnklDzo%3D
US
—
—
whitelisted
2632
iexplore.exe
GET
—
52.222.250.112:80
http://ocsp.rootg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D
US
—
—
whitelisted
3940
WINWORD.EXE
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?e4683693a7031d89
US
compressed
4.70 Kb
whitelisted
—
—
GET
200
104.18.32.68:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
US
der
1.42 Kb
whitelisted
2632
iexplore.exe
GET
200
172.64.155.188:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
US
binary
2.18 Kb
whitelisted
2632
iexplore.exe
GET
200
23.56.202.135:80
http://x1.c.lencr.org/
GB
der
717 b
whitelisted
2632
iexplore.exe
GET
200
52.222.250.112:80
http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEjgLnWaIozse2b%2BczaaODg8%3D
US
binary
1.39 Kb
shared
3292
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
binary
1.47 Kb
whitelisted
3940
WINWORD.EXE
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?dc0615a02c683f1b
US
compressed
62.3 Kb
whitelisted
2632
iexplore.exe
GET
200
95.101.54.131:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgMdOGVXhAdPXtVUQW%2FGleKK0g%3D%3D
DE
binary
503 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
3372
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1076
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2632
iexplore.exe
108.138.2.10:80
o.ss2.us
AMAZON-02
US
unknown
2632
iexplore.exe
188.114.96.3:443
www.englishforums.com
CLOUDFLARENET
NL
malicious
2632
iexplore.exe
104.17.24.14:443
cdnjs.cloudflare.com
CLOUDFLARENET
—
suspicious
2632
iexplore.exe
142.250.186.138:443
fonts.googleapis.com
GOOGLE
US
whitelisted
2632
iexplore.exe
138.199.37.225:443
load.sumo.com
Datacamp Limited
DE
suspicious
2632
iexplore.exe
95.101.54.131:80
r3.o.lencr.org
Akamai International B.V.
DE
suspicious

DNS requests

Domain
IP
Reputation
www.englishforums.com
  • 188.114.96.3
  • 188.114.97.3
malicious
ctldl.windowsupdate.com
  • 209.197.3.8
whitelisted
x1.c.lencr.org
  • 23.56.202.135
whitelisted
x2.c.lencr.org
  • 23.201.254.55
whitelisted
cdn.englishforums.com
  • 188.114.96.3
  • 188.114.97.3
malicious
cdn.onesignal.com
  • 104.18.214.59
  • 104.18.215.59
whitelisted
www.googletagmanager.com
  • 172.217.23.104
whitelisted
fonts.googleapis.com
  • 142.250.186.138
whitelisted
cdnjs.cloudflare.com
  • 104.17.24.14
  • 104.17.25.14
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Web Blocked as Usual ( May 2023 ).doc