analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

http://malsample.php.xdomain.jp/test_files/CS_testmalware.doc

Full analysis: https://app.any.run/tasks/181d460d-1a5b-4571-9fe5-9ffaef042f9c
Verdict: Malicious activity
Analysis date: November 21, 2023, 03:44:34
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
SHA1:

6F9246522D9905994657AD1CEC2BBBE7E7CEFEBC

SHA256:

A840D2C41EB06AD2AC057E19F5A86727CD1ED46988CA1245C2510CF4B1C47E3B

SSDEEP:

3:N1KT1jabE/RR5KV/IG:C5ja+RW/IG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Connection from MS Office application

      • WINWORD.EXE (PID: 3876)

  • SUSPICIOUS

    • Application launched itself

      • WINWORD.EXE (PID: 3876)

  • INFO

    • Reads the computer name

      • wmpnscfg.exe (PID: 3276)

    • Checks supported languages

      • wmpnscfg.exe (PID: 3276)

    • Application launched itself

      • iexplore.exe (PID: 3128)

    • Reads the machine GUID from the registry

      • wmpnscfg.exe (PID: 3276)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3276)

    • The process uses the downloaded file

      • WINWORD.EXE (PID: 3876)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
47
Monitored processes
5
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe wmpnscfg.exe no specs winword.exe winword.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3128"C:\Program Files\Internet Explorer\iexplore.exe" "http://malsample.php.xdomain.jp/test_files/CS_testmalware.doc"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3220"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3128 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3276"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
3876"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" -EmbeddingC:\Program Files\Microsoft Office\Office14\WINWORD.EXE
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
3648"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /EmbeddingC:\Program Files\Microsoft Office\Office14\WINWORD.EXE—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Word
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
Total events
12 649
Read events
12 203
Write events
401
Delete events
45

Modification events

(PID) Process:(3128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(3128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(3128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(3128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
1
Suspicious files
24
Text files
8
Unknown types
0

Dropped files

PID
Process
Filename
Type
3876WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRBCAD.tmp.cvr —
MD5:—
SHA256:—
3128iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:1BFE591A4FE3D91B03CDF26EAACD8F89
SHA256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
3128iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\favicon[1].icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
3876WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-CNRY.FSDbinary
MD5:A66009E8B7AA61C3D6967ABE7BCF09F5
SHA256:D538907B250A64561258ED471CABAD0CC67FEF1D54A9DA5518C887713B9B925C
3128iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118Abinary
MD5:6008FA1FFC567B365CC7EF84C064533F
SHA256:ACB78FE99B7438AB1EC0CF18C32766F56F1DCF57B913F8AE2BA0A629CBACE94D
3876WINWORD.EXEC:\Users\admin\AppData\Local\Temp\{F811C8BE-60A4-4C4D-A0B4-6545B8DFE6E1}binary
MD5:A66009E8B7AA61C3D6967ABE7BCF09F5
SHA256:D538907B250A64561258ED471CABAD0CC67FEF1D54A9DA5518C887713B9B925C
3128iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118Abinary
MD5:7F7B103924C327BC049A219100CEB49D
SHA256:440FC727BAEBB9649492FCDC1489C901A87D41780DD173531C61A3B1C5660646
3876WINWORD.EXEC:\Users\admin\AppData\Local\Temp\OICE_3591D680-41DA-46C7-AF04-6D7B0BEC0E79.0\B457573C.docdocument
MD5:069FEB6C31C5D968745734E192F50FC7
SHA256:A11DED2B00CFD88D1BD7FEA593C451F6EC040F88F02D8178ED5E977650D489EB
3876WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSF-{0E1EEE64-E8C6-4E2A-9759-63CF07FD8988}.FSFbinary
MD5:D471A0BB5F0B8A9AC834E0172491B7F9
SHA256:418B6AE0A39787583DCD77DA0ED040F8C3DDA03410E71D04C235EE6E736F298F
3876WINWORD.EXEC:\Users\admin\AppData\Local\Temp\OICE_3591D680-41DA-46C7-AF04-6D7B0BEC0E79.0\msoE4F6.tmpcompressed
MD5:36EFC18358A21A72BDD1D7281BF15634
SHA256:0BC186AEE1BEB8B6448FA1B48CF4EB3BDB68BB5D8E381183CF28EB57931EF305
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
19
DNS requests
11
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3876
WINWORD.EXE
OPTIONS
200
157.112.147.23:80
http://malsample.php.xdomain.jp/test_files/
unknown
—
—
unknown
3876
WINWORD.EXE
HEAD
200
157.112.147.23:80
http://malsample.php.xdomain.jp/test_files/CS_testmalware.doc
unknown
—
—
unknown
3876
WINWORD.EXE
HEAD
200
157.112.147.23:80
http://malsample.php.xdomain.jp/test_files/CS_testmalware.doc
unknown
—
—
unknown
828
svchost.exe
PROPFIND
301
157.112.147.23:80
http://malsample.php.xdomain.jp/test_files
unknown
html
251 b
unknown
828
svchost.exe
OPTIONS
301
157.112.147.23:80
http://malsample.php.xdomain.jp/test_files
unknown
html
251 b
unknown
828
svchost.exe
PROPFIND
301
157.112.147.23:80
http://malsample.php.xdomain.jp/test_files
unknown
html
251 b
unknown
3220
iexplore.exe
GET
200
157.112.147.23:80
http://malsample.php.xdomain.jp/test_files/CS_testmalware.doc
unknown
document
41.5 Kb
unknown
3128
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D
unknown
binary
313 b
unknown
3128
iexplore.exe
GET
200
23.50.131.216:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?da725366b68abe37
unknown
compressed
4.66 Kb
unknown
828
svchost.exe
PROPFIND
405
157.112.147.23:80
http://malsample.php.xdomain.jp/test_files/
unknown
html
237 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3220
iexplore.exe
157.112.147.23:80
malsample.php.xdomain.jp
Xserver Inc.
JP
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
3128
iexplore.exe
23.212.110.162:443
www.bing.com
Akamai International B.V.
CZ
unknown
3128
iexplore.exe
23.50.131.216:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
3128
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3876
WINWORD.EXE
157.112.147.23:80
malsample.php.xdomain.jp
Xserver Inc.
JP
unknown
828
svchost.exe
157.112.147.23:80
malsample.php.xdomain.jp
Xserver Inc.
JP
unknown

DNS requests

Domain
IP
Reputation
malsample.php.xdomain.jp
  • 157.112.147.23
unknown
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 23.212.110.162
  • 23.212.110.144
whitelisted
ctldl.windowsupdate.com
  • 23.50.131.216
  • 23.50.131.200
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted

Threats

PID
Process
Class
Message
3220
iexplore.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Possible Office Doc with Embedded VBA Project (Wide)
3220
iexplore.exe
Potential Corporate Privacy Violation
ET POLICY Office Document Download Containing AutoOpen Macro
3220
iexplore.exe
Potentially Bad Traffic
ET HUNTING PowerShell DownloadString Command Common In Powershell Stagers
3876
WINWORD.EXE
Misc activity
ET USER_AGENTS Microsoft Office Existence Discovery User-Agent
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
http://malsample.php.xdomain.jp/test_files/CS_testmalware.doc