File name:

Office 365 v7.7.7.zip

Full analysis: https://app.any.run/tasks/80c979a4-cd91-44dc-bf0c-154b79f02aad
Verdict: Malicious activity
Analysis date: February 08, 2024, 21:48:39
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

B0614CD78DA331378868E8F1E46E4901

SHA1:

43E2A368F7DAFCF0347B30145E741BB51B9F8B59

SHA256:

A3907B1676757FF85B728285AAFC4A5CD453273A976FB55B6E4E52DFF663F96D

SSDEEP:

98304:TwHD+Mkc9VMbcgOtD6bzdSH1v4AZdwjLWYogn7a0GaGl3Fe59Kqm8fcVz15aj3Ps:6hwd204WjnfsTP0WK3Ut9

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 1264)
      • files.dat (PID: 3000)
      • Office 365 v7.7.7.exe (PID: 3096)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • Office 365 v7.7.7.exe (PID: 3096)

    • Executable content was dropped or overwritten

      • files.dat (PID: 3000)
      • Office 365 v7.7.7.exe (PID: 3096)
      • expand.exe (PID: 3772)

    • Drops 7-zip archiver for unpacking

      • Office 365 v7.7.7.exe (PID: 3096)

    • The process drops C-runtime libraries

      • files.dat (PID: 3000)
      • expand.exe (PID: 3772)

    • Process drops legitimate windows executable

      • files.dat (PID: 3000)
      • expand.exe (PID: 3772)
      • Office 365 v7.7.7.exe (PID: 3096)

    • Starts application with an unusual extension

      • cmd.exe (PID: 3052)

    • Probably download files using WebClient

      • Office 365 v7.7.7.exe (PID: 3096)

    • Unusual connection from system programs

      • powershell.exe (PID: 2932)
      • powershell.exe (PID: 2840)

    • Starts POWERSHELL.EXE for commands execution

      • Office 365 v7.7.7.exe (PID: 3096)

    • Reads the Internet Settings

      • powershell.exe (PID: 2932)
      • powershell.exe (PID: 2840)
      • Office 365 v7.7.7.exe (PID: 3096)

    • The Powershell connects to the Internet

      • powershell.exe (PID: 2932)
      • powershell.exe (PID: 2840)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 3964)
      • cmd.exe (PID: 2292)
      • cmd.exe (PID: 2960)
      • cmd.exe (PID: 1348)
      • cmd.exe (PID: 2152)
      • cmd.exe (PID: 2904)
      • cmd.exe (PID: 4068)
      • Office 365 v7.7.7.exe (PID: 3096)
      • cmd.exe (PID: 2968)
      • cmd.exe (PID: 268)

    • The executable file from the user directory is run by the CMD process

      • test.exe (PID: 3912)

    • Connects to unusual port

      • test.exe (PID: 3912)

  • INFO

    • Checks supported languages

      • Office 365 v7.7.7.exe (PID: 3096)
      • files.dat (PID: 3000)
      • aria2_oinstall.exe (PID: 3412)
      • test.exe (PID: 3912)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1264)

    • Manual execution by a user

      • Office 365 v7.7.7.exe (PID: 3096)
      • Office 365 v7.7.7.exe (PID: 2028)

    • Reads the computer name

      • Office 365 v7.7.7.exe (PID: 3096)
      • aria2_oinstall.exe (PID: 3412)
      • test.exe (PID: 3912)

    • Create files in a temporary directory

      • Office 365 v7.7.7.exe (PID: 3096)
      • aria2_oinstall.exe (PID: 3412)

    • Reads the machine GUID from the registry

      • aria2_oinstall.exe (PID: 3412)
      • test.exe (PID: 3912)

    • Creates files in the program directory

      • Office 365 v7.7.7.exe (PID: 3096)
      • expand.exe (PID: 3772)
      • expand.exe (PID: 4008)

    • Reads Microsoft Office registry keys

      • reg.exe (PID: 1768)
      • reg.exe (PID: 2480)

    • Reads Environment values

      • Office 365 v7.7.7.exe (PID: 3096)

    • Drops the executable file immediately after the start

      • expand.exe (PID: 3772)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2023:11:20 12:48:46
ZipCRC: 0xebe1a0b2
ZipCompressedSize: 11501896
ZipUncompressedSize: 18649512
ZipFileName: Office 365 v7.7.7.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
114
Monitored processes
47
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe office 365 v7.7.7.exe no specs office 365 v7.7.7.exe reg.exe no specs cmd.exe no specs files.dat aria2_oinstall.exe reg.exe no specs reg.exe no specs cmd.exe no specs regedit.exe no specs reg.exe no specs powershell.exe expand.exe powershell.exe expand.exe no specs officeclicktorun.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs test.exe cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs reg.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
116reg.exe add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v AudienceId /t REG_SZ /d 5030841d-c919-4594-8d2d-84ae4f96e58e /fC:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
268"C:\Windows\System32\cmd.exe" /c REG QUERY HKLM\Software\WOW6432Node\Microsoft\Office /s /v PathC:\Windows\System32\cmd.exe—Office 365 v7.7.7.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
584REG QUERY HKLM\Software\WOW6432Node\Microsoft\Office /s /v PathC:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
748reg.exe add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v UpdateUrl /t REG_SZ /d http://officecdn.microsoft.com/pr/5030841d-c919-4594-8d2d-84ae4f96e58e /fC:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
784"C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v KeyManagementServicePort /t REG_SZ /d 1688 /fC:\Windows\System32\reg.exe—Office 365 v7.7.7.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
844"C:\Windows\System32\cmd.exe" /D /c cscript.exe "" //NoLogo /actC:\Windows\System32\cmd.exe—Office 365 v7.7.7.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
984"C:\Windows\System32\cmd.exe" /D /c cscript.exe "" //NoLogo /setprt:1688C:\Windows\System32\cmd.exe—Office 365 v7.7.7.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1264"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Office 365 v7.7.7.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1348"C:\Windows\System32\cmd.exe" /D /c reg.exe add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v UpdateChannel /t REG_SZ /d http://officecdn.microsoft.com/pr/5030841d-c919-4594-8d2d-84ae4f96e58e /fC:\Windows\System32\cmd.exe—Office 365 v7.7.7.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1540cscript.exe "" //NoLogo /setprt:1688C:\Windows\System32\cscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft ® Console Based Script Host
Exit code:
1
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\cscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
Total events
4 550
Read events
4 519
Write events
31
Delete events
0

Modification events

(PID) Process:(1264) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1264) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(1264) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(1264) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(1264) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(1264) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1264) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1264) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1264) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1264) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
Executable files
222
Suspicious files
13
Text files
30
Unknown types
0

Dropped files

PID
Process
Filename
Type
2932powershell.exeC:\Users\admin\AppData\Local\Temp\over227734\i320.cab —
MD5:—
SHA256:—
1264WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1264.43138\Office 365 v7.7.7.exeexecutable
MD5:B3EF471608291771890D2EF8D3E8AF41
SHA256:3980BE5DC7DD6A5E27E8116B181D4B007FF9E3AF2702FEADAC0818708142D87B
3000files.datC:\Users\admin\Desktop\files\x64\cleanospp.exeexecutable
MD5:D3467CB7B83B654C2D05407DC7BA2360
SHA256:EDF85F4E2EF1A427B34265A22F261D664EC78DE90C3B5DA4174EF28558C8522A
2932powershell.exeC:\Users\admin\AppData\Local\Temp\ikiqbty2.se4.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
3096Office 365 v7.7.7.exeC:\Users\admin\AppData\Local\Temp\aria2_oinstall.exeexecutable
MD5:B95DBDE252CC8EA490E1D9D04EC5FE0D
SHA256:0AE98794B3523634B0AF362D6F8C04A9BBD32AEDA959B72CA0E7FC24E84D2A66
3000files.datC:\Users\admin\Desktop\files\x86\msvcr100.dllexecutable
MD5:BF38660A9125935658CFA3E53FDC7D65
SHA256:60C06E0FA4449314DA3A0A87C1A9D9577DF99226F943637E06F61188E5862EFA
3412aria2_oinstall.exeC:\Users\admin\AppData\Local\Temp\ver.txttext
MD5:0B50254088F055DDFBB2DD65E441A303
SHA256:CBBFCD1FB3AB523511788C3F250931001E095F8B4E35CE368AF3AFE9F9B08206
3096Office 365 v7.7.7.exeC:\Users\admin\Desktop\files\Configure.xmltext
MD5:F693E4FB8D3907E6CC44A34E1CC87296
SHA256:CDCD3FA3CB1EBFAFC98273AE52632F80B95CB9D25933EE1C7D2FDEC640B264D0
2932powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCachebinary
MD5:6675EDE59684F4A119D2E5DA282AFBE6
SHA256:5026C5EE8FA9ACB21718BF1FAD563C0A3FD5BC79327611FDF9C4ABD2647CE829
3772expand.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dllexecutable
MD5:BFB08FB09E8D68673F2F0213C59E2B97
SHA256:6D5881719E9599BF10A4193C8E2DED2A38C10DE0BA8904F48C67F2DA6E84ED3E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
11
DNS requests
7
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
488
lsass.exe
GET
304
184.24.77.199:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?fa455765e490287c
unknown
—
—
unknown
488
lsass.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
binary
471 b
unknown
2932
powershell.exe
GET
200
2.21.20.154:80
http://officecdn.microsoft.com/pr/5030841d-c919-4594-8d2d-84ae4f96e58e/Office/Data/16.0.14332.20624/i320.cab
unknown
compressed
23.5 Mb
unknown
1080
svchost.exe
GET
200
46.228.146.128:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?a414549a770d7263
unknown
compressed
65.2 Kb
unknown
2840
powershell.exe
GET
200
2.21.20.154:80
http://officecdn.microsoft.com/pr/5030841d-c919-4594-8d2d-84ae4f96e58e/Office/Data/16.0.14332.20624/i321033.cab
unknown
compressed
9.86 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3412
aria2_oinstall.exe
52.109.89.117:443
mrodevicemgr.officeapps.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
488
lsass.exe
184.24.77.199:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
488
lsass.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
2932
powershell.exe
2.21.20.154:80
officecdn.microsoft.com
Akamai International B.V.
DE
unknown
1080
svchost.exe
46.228.146.128:80
ctldl.windowsupdate.com
LLNW
US
unknown
2840
powershell.exe
2.21.20.154:80
officecdn.microsoft.com
Akamai International B.V.
DE
unknown
3912
test.exe
106.55.134.25:1688
kms.loli.best
Shenzhen Tencent Computer Systems Company Limited
CN
unknown

DNS requests

Domain
IP
Reputation
mrodevicemgr.officeapps.live.com
  • 52.109.89.117
whitelisted
ctldl.windowsupdate.com
  • 184.24.77.199
  • 184.24.77.207
  • 184.24.77.203
  • 184.24.77.209
  • 184.24.77.179
  • 184.24.77.205
  • 184.24.77.206
  • 184.24.77.208
  • 184.24.77.174
  • 46.228.146.128
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
officecdn.microsoft.com
  • 2.21.20.154
  • 2.21.20.139
whitelisted
kms.loli.best
  • 106.55.134.25
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Office 365 v7.7.7.zip