File name:

Black Friday.docx

Full analysis: https://app.any.run/tasks/7bdc690c-1f86-47b0-8a40-dfe85f3fcfd5
Verdict: Malicious activity
Analysis date: October 31, 2024, 18:25:18
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ole-embedded
Indicators:
MIME: application/vnd.openxmlformats-officedocument.wordprocessingml.document
File info: Microsoft Word 2007+
MD5:

D2C54126B71A2439DFC384930580786C

SHA1:

7BB6EEBA638AA0EFCC0C29EBD4D8BA1E5A0FDA7E

SHA256:

A7447DB99BA60C2F7BFD9E9BCFADFB05A4FC0EA214450B76EA85D386DB1F727B

SSDEEP:

768:yO1x/Hz3OxLC8HH13Ai+Gk2mTBgTHoNMYwF2kUqZg3:yO1xfzexN1w92Yg84W

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Unusual execution from MS Office

      • WINWORD.EXE (PID: 3024)

    • Creates internet connection object (SCRIPT)

      • wscript.exe (PID: 1876)
      • wscript.exe (PID: 1568)

    • Gets %appdata% folder path (SCRIPT)

      • wscript.exe (PID: 1876)
      • wscript.exe (PID: 1568)

    • Accesses environment variables (SCRIPT)

      • wscript.exe (PID: 1876)
      • wscript.exe (PID: 1568)

    • Uses Task Scheduler to run other applications

      • wscript.exe (PID: 1876)
      • wscript.exe (PID: 1568)

    • Opens an HTTP connection (SCRIPT)

      • wscript.exe (PID: 1876)
      • wscript.exe (PID: 1568)

    • Creates a new registry key or changes the value of an existing one (SCRIPT)

      • wscript.exe (PID: 1876)
      • wscript.exe (PID: 1568)

    • Modifies registry startup key (SCRIPT)

      • wscript.exe (PID: 1876)
      • wscript.exe (PID: 1568)

    • Sends HTTP request (SCRIPT)

      • wscript.exe (PID: 1876)
      • wscript.exe (PID: 1568)

  • SUSPICIOUS

    • The process executes VB scripts

      • WINWORD.EXE (PID: 3024)

    • Accesses ComputerSystem(Win32_ComputerSystem) via WMI (SCRIPT)

      • wscript.exe (PID: 1876)
      • wscript.exe (PID: 1568)

    • Executes WMI query (SCRIPT)

      • wscript.exe (PID: 1876)
      • wscript.exe (PID: 1568)

    • Accesses WMI object, sets custom ImpersonationLevel (SCRIPT)

      • wscript.exe (PID: 1876)
      • wscript.exe (PID: 1568)

    • Creates a Stream, which may work with files, input/output devices, pipes, or TCP/IP sockets (SCRIPT)

      • wscript.exe (PID: 1876)
      • wscript.exe (PID: 1568)

    • Reads the Internet Settings

      • wscript.exe (PID: 1876)
      • wscript.exe (PID: 1568)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 1876)
      • wscript.exe (PID: 1568)

  • INFO

    • The process uses the downloaded file

      • WINWORD.EXE (PID: 3024)
      • wscript.exe (PID: 1876)
      • wscript.exe (PID: 1568)

    • Drops encrypted VBS script (Microsoft Script Encoder)

      • WINWORD.EXE (PID: 3024)

    • Checks proxy server information

      • wscript.exe (PID: 1568)
      • wscript.exe (PID: 1876)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.docx | Word Microsoft Office Open XML Format document (52.2)
.zip | Open Packaging Conventions container (38.8)
.zip | ZIP compressed archive (8.8)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0006
ZipCompression: Deflated
ZipModifyDate: 1980:01:01 00:00:00
ZipCRC: 0xd7a58a60
ZipCompressedSize: 383
ZipUncompressedSize: 1511
ZipFileName: [Content_Types].xml

XML

Template: Normal
TotalEditTime: 17 minutes
Pages: 1
Words: 34
Characters: 199
Application: Microsoft Office Word
DocSecurity: None
Lines: 1
Paragraphs: 1
ScaleCrop: No
HeadingPairs:
  • Название
  • 1
TitlesOfParts: -
Company: -
LinksUpToDate: No
CharactersWithSpaces: 232
SharedDoc: No
HyperlinksChanged: No
AppVersion: 16
Keywords: -
LastModifiedBy: Пользователь Windows
RevisionNumber: 15
CreateDate: 2017:11:27 21:28:00Z
ModifyDate: 2017:12:14 18:47:00Z

XMP

Title: -
Subject: -
Creator: Пользователь Windows
Description: -
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
6
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winword.exe no specs wscript.exe no specs schtasks.exe no specs svchost.exe wscript.exe no specs schtasks.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1060C:\Windows\system32\svchost.exe -k NetworkServiceC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1568"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\Voucer.vbs" C:\Windows\System32\wscript.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1876"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\Voucer.vbs" C:\Windows\System32\wscript.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3024"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\Black Friday.docx"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
3512"C:\Windows\System32\schtasks.exe" /create /tn Cclenears /SC HOURLY /MO 3 /tr "C:\Users\admin\AppData\Roaming\sys.exe"C:\Windows\System32\schtasks.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
3944"C:\Windows\System32\schtasks.exe" /create /tn Cclenears /SC HOURLY /MO 3 /tr "C:\Users\admin\AppData\Roaming\sys.exe"C:\Windows\System32\schtasks.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
Total events
9 347
Read events
8 266
Write events
684
Delete events
397

Modification events

(PID) Process:(3024) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:writeName:yd/
Value:
79642F00D00B0000010000000000000000000000
(PID) Process:(3024) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
Off
(PID) Process:(3024) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1041
Value:
Off
(PID) Process:(3024) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1046
Value:
Off
(PID) Process:(3024) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1036
Value:
Off
(PID) Process:(3024) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1031
Value:
Off
(PID) Process:(3024) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1040
Value:
Off
(PID) Process:(3024) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1049
Value:
Off
(PID) Process:(3024) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:3082
Value:
Off
(PID) Process:(3024) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1042
Value:
Off
Executable files
0
Suspicious files
8
Text files
5
Unknown types
1

Dropped files

PID
Process
Filename
Type
3024WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRC0F9.tmp.cvr —
MD5:—
SHA256:—
3024WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmbinary
MD5:2DCDC70B8271EC8DD385085AC9CBBCFE
SHA256:5C009A9DC16162B4C5586313F7889D6069A3879E713D9D4C884A4AF5FF84CE6C
3024WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$ack Friday.docxbinary
MD5:5579A6BB6BC276DC5FD2C8F2D8751F3B
SHA256:8211AF69227805A7DB5024CA3E3745FA4B1310C0922CDA0802A83432DF96B555
3024WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{BCDE8C3A-792F-466B-BB7A-0FA3028E85A6}.tmpbinary
MD5:CB09936D67A813F3498E1284ACE4EFA1
SHA256:B9853169B48D820EF40E790D3AA1D3E1D37A5220BD1CFF91D62A4C834E557490
3024WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\8889556F.emfemf
MD5:FB813ED34231B6DE535CB1D3222B5656
SHA256:A98E291138500445FC9829AA24AE87F1EDF056947321F7023F7B67F924F049F4
3024WINWORD.EXEC:\Users\admin\AppData\Local\Temp\Voucer.vbs:Zone.Identifiertext
MD5:FBCCF14D504B7B2DBCB5A5BDA75BD93B
SHA256:EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
3024WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~WRD0001.tmpdocument
MD5:53C243D3D9D4138C739E8A2E60E8993C
SHA256:71E30608959538F3E584E06E30FBC9599666ABD7B45838A8D7B6A1D0008DCDE8
3024WINWORD.EXEC:\Users\admin\AppData\Local\Temp\Voucer.vbstext
MD5:BBB378AEC999760C29F973B32B252534
SHA256:F67A2DE79ED8B4DA056619DC29E16824478EE028EFB86F53AAA94536F77EF742
3024WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{0FB9C639-B0FB-4EE6-9506-086E66A90E62}.tmpbinary
MD5:5D4D94EE7E06BBB0AF9584119797B23A
SHA256:4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
3024WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~WRL0002.tmpdocument
MD5:D2C54126B71A2439DFC384930580786C
SHA256:A7447DB99BA60C2F7BFD9E9BCFADFB05A4FC0EA214450B76EA85D386DB1F727B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
7
DNS requests
2
Threats
1

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
whitelisted
2564
svchost.exe
239.255.255.250:3702
—
—
—
whitelisted
1060
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.46
whitelisted
forum.cryptopia.gdn
  • —
unknown

Threats

PID
Process
Class
Message
1060
svchost.exe
Potentially Bad Traffic
ET INFO DNS Query for Suspicious .gdn Domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Black Friday.docx