File name:

Black Friday.docx

Full analysis: https://app.any.run/tasks/3066f52a-5226-41c4-bb0c-3fb3a18966a8
Verdict: Malicious activity
Analysis date: November 03, 2024, 22:17:51
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ole-embedded
Indicators:
MIME: application/vnd.openxmlformats-officedocument.wordprocessingml.document
File info: Microsoft Word 2007+
MD5:

D2C54126B71A2439DFC384930580786C

SHA1:

7BB6EEBA638AA0EFCC0C29EBD4D8BA1E5A0FDA7E

SHA256:

A7447DB99BA60C2F7BFD9E9BCFADFB05A4FC0EA214450B76EA85D386DB1F727B

SSDEEP:

768:yO1x/Hz3OxLC8HH13Ai+Gk2mTBgTHoNMYwF2kUqZg3:yO1xfzexN1w92Yg84W

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Unusual execution from MS Office

      • WINWORD.EXE (PID: 1652)

    • Creates internet connection object (SCRIPT)

      • wscript.exe (PID: 2220)

    • Accesses environment variables (SCRIPT)

      • wscript.exe (PID: 2220)

    • Gets %appdata% folder path (SCRIPT)

      • wscript.exe (PID: 2220)

    • Uses Task Scheduler to run other applications

      • wscript.exe (PID: 2220)

    • Opens an HTTP connection (SCRIPT)

      • wscript.exe (PID: 2220)

    • Modifies registry startup key (SCRIPT)

      • wscript.exe (PID: 2220)

    • Creates a new registry key or changes the value of an existing one (SCRIPT)

      • wscript.exe (PID: 2220)

    • Sends HTTP request (SCRIPT)

      • wscript.exe (PID: 2220)

  • SUSPICIOUS

    • The process executes VB scripts

      • WINWORD.EXE (PID: 1652)

    • Executes WMI query (SCRIPT)

      • wscript.exe (PID: 2220)

    • Accesses ComputerSystem(Win32_ComputerSystem) via WMI (SCRIPT)

      • wscript.exe (PID: 2220)

    • Accesses WMI object, sets custom ImpersonationLevel (SCRIPT)

      • wscript.exe (PID: 2220)

    • Creates a Stream, which may work with files, input/output devices, pipes, or TCP/IP sockets (SCRIPT)

      • wscript.exe (PID: 2220)

    • Reads the Internet Settings

      • wscript.exe (PID: 2220)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 2220)

  • INFO

    • The process uses the downloaded file

      • WINWORD.EXE (PID: 1652)
      • wscript.exe (PID: 2220)

    • Drops encrypted VBS script (Microsoft Script Encoder)

      • WINWORD.EXE (PID: 1652)

    • Checks proxy server information

      • wscript.exe (PID: 2220)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.docx | Word Microsoft Office Open XML Format document (52.2)
.zip | Open Packaging Conventions container (38.8)
.zip | ZIP compressed archive (8.8)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0006
ZipCompression: Deflated
ZipModifyDate: 1980:01:01 00:00:00
ZipCRC: 0xd7a58a60
ZipCompressedSize: 383
ZipUncompressedSize: 1511
ZipFileName: [Content_Types].xml

XML

Template: Normal
TotalEditTime: 17 minutes
Pages: 1
Words: 34
Characters: 199
Application: Microsoft Office Word
DocSecurity: None
Lines: 1
Paragraphs: 1
ScaleCrop: No
HeadingPairs:
  • Название
  • 1
TitlesOfParts: -
Company: -
LinksUpToDate: No
CharactersWithSpaces: 232
SharedDoc: No
HyperlinksChanged: No
AppVersion: 16
Keywords: -
LastModifiedBy: Пользователь Windows
RevisionNumber: 15
CreateDate: 2017:11:27 21:28:00Z
ModifyDate: 2017:12:14 18:47:00Z

XMP

Title: -
Subject: -
Creator: Пользователь Windows
Description: -
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winword.exe no specs wscript.exe no specs schtasks.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
1008"C:\Windows\System32\schtasks.exe" /create /tn Cclenears /SC HOURLY /MO 3 /tr "C:\Users\admin\AppData\Roaming\sys.exe"C:\Windows\System32\schtasks.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1060C:\Windows\system32\svchost.exe -k NetworkServiceC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1652"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\Black Friday.docx"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
2220"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\Voucer.vbs" C:\Windows\System32\wscript.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
5 663
Read events
4 818
Write events
591
Delete events
254

Modification events

(PID) Process:(1652) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:writeName:6&1
Value:
3626310074060000010000000000000000000000
(PID) Process:(1652) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
Off
(PID) Process:(1652) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1041
Value:
Off
(PID) Process:(1652) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1046
Value:
Off
(PID) Process:(1652) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1036
Value:
Off
(PID) Process:(1652) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1031
Value:
Off
(PID) Process:(1652) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1040
Value:
Off
(PID) Process:(1652) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1049
Value:
Off
(PID) Process:(1652) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:3082
Value:
Off
(PID) Process:(1652) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1042
Value:
Off
Executable files
0
Suspicious files
3
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
1652WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRC696.tmp.cvr —
MD5:—
SHA256:—
1652WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryPB0416.lextext
MD5:F3B25701FE362EC84616A93A45CE9998
SHA256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
1652WINWORD.EXEC:\Users\admin\AppData\Local\Temp\Voucer.vbs:Zone.Identifiertext
MD5:FBCCF14D504B7B2DBCB5A5BDA75BD93B
SHA256:EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
1652WINWORD.EXEC:\Users\admin\AppData\Local\Temp\Voucer.vbstext
MD5:BBB378AEC999760C29F973B32B252534
SHA256:F67A2DE79ED8B4DA056619DC29E16824478EE028EFB86F53AAA94536F77EF742
1652WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmbinary
MD5:4E2FDB6D8B29D038A386ECEABA882E57
SHA256:40A2ACED0CF44E16365B0D1EFDB979DEE94A533F83EFEF82B6AA1C61E7C478C9
1652WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$ack Friday.docxbinary
MD5:AC3FDA10D473FE6BD39A22D57F5FF08D
SHA256:76385CA4C4ACB111365EEBB5BDD7FDBFE8A3FD2855CAB36C068ACF879CA1745E
1652WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lextext
MD5:F3B25701FE362EC84616A93A45CE9998
SHA256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
1652WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\EAF97BF7.emfemf
MD5:FB813ED34231B6DE535CB1D3222B5656
SHA256:A98E291138500445FC9829AA24AE87F1EDF056947321F7023F7B67F924F049F4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
7
DNS requests
2
Threats
1

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
whitelisted
2564
svchost.exe
239.255.255.250:3702
—
—
—
whitelisted
1060
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.46
whitelisted
forum.cryptopia.gdn
  • —
unknown

Threats

PID
Process
Class
Message
1060
svchost.exe
Potentially Bad Traffic
ET INFO DNS Query for Suspicious .gdn Domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Black Friday.docx