File name:

12312313.doc

Full analysis: https://app.any.run/tasks/f5fe4669-b208-4b64-8ff0-837109966316
Verdict: Malicious activity
Analysis date: October 23, 2023, 14:30:32
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
macros
macros-on-open
Indicators:
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Author: User, Template: Normal.dotm, Last Saved By: User, Revision Number: 32, Name of Creating Application: Microsoft Office Word, Total Editing Time: 01:37:00, Create Time/Date: Sat Oct 7 04:28:00 2023, Last Saved Time/Date: Wed Oct 18 09:31:00 2023, Number of Pages: 1, Number of Words: 0, Number of Characters: 2, Security: 0
MD5:

12312C74772684E970998DBD2A6E1E93

SHA1:

FA0D4E11666D4EF791E652A1F7C9449A778C27C3

SHA256:

ABED5EAD9C0BF7B23CF41A3CAC841658943DD4059AF3287C87E577471ECEFD43

SSDEEP:

3072:8EVZtoSJi/A/1sX7E9rkYwIV89vdkwXmVR6:/uSI/A/GFr9vz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Unusual execution from MS Office

      • WINWORD.EXE (PID: 1296)

    • Connection from MS Office application

      • WINWORD.EXE (PID: 1296)

    • Starts CMD.EXE for commands execution

      • WINWORD.EXE (PID: 1296)

    • Microsoft Office executes commands via PowerShell or Cmd

      • WINWORD.EXE (PID: 1296)

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (54.2)
.doc | Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

Lines: 1
Paragraphs: 1
Pages: 1
Characters: 2
Words: -
TotalEditTime: 1.6 hours
RevisionNumber: 32
LastPrinted: 0000:00:00 00:00:00
CompObjUserType: ???????? Microsoft Word 97-2003
CompObjUserTypeLen: 32
HeadingPairs:
  • Название
  • 1
TitleOfParts: -
HyperlinksChanged: No
SharedDoc: No
LinksUpToDate: No
ScaleCrop: No
AppVersion: 16
CharCountWithSpaces: 2
Company: -
CodePage: Windows Cyrillic
Security: None
ModifyDate: 2023:10:18 09:31:00
CreateDate: 2023:10:07 04:28:00
Software: Microsoft Office Word
LastModifiedBy: User
Template: Normal.dotm
Comments: -
Keywords: -
Author: User
Subject: -
Title: -
Word97: No
System: Windows
DocFlags: Has picture, 1Table, ExtChar
LanguageCode: Russian
Identification: Word 8.0
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
33
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winword.exe cmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1296"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\12312313.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.5123.5000
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\microsoft office\office14\winword.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_08e61857a83bc251\msvcr90.dll
c:\windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_a4d981ff711297b6\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2956"C:\Windows\System32\cmd.exe" /k echo Hello & exitC:\Windows\System32\cmd.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
Total events
3 080
Read events
2 629
Write events
323
Delete events
128

Modification events

(PID) Process:(1296) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
On
(PID) Process:(1296) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1041
Value:
On
(PID) Process:(1296) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1042
Value:
On
(PID) Process:(1296) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1046
Value:
On
(PID) Process:(1296) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1036
Value:
On
(PID) Process:(1296) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1031
Value:
On
(PID) Process:(1296) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1040
Value:
On
(PID) Process:(1296) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1049
Value:
On
(PID) Process:(1296) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:3082
Value:
On
(PID) Process:(1296) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1055
Value:
On
Executable files
0
Suspicious files
1
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
1296WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRB3DA.tmp.cvr —
MD5:—
SHA256:—
1296WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K78MRVB5\information[1].htmtext
MD5:5C6A085DB532BA65183F20D2728062C5
SHA256:78E0CB31F64A30409E2D71CFC7A69835014A37B6179261F08B39A73E4BC17192
1296WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$312313.docbinary
MD5:7297B449C68A56F23BC8E7064826AB45
SHA256:EBCFF6E7BD7ACC796CC81E111D76C5BFB5BD0AE8DBA997C580BD68054B04AEBC
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
7
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1296
WINWORD.EXE
GET
200
5.187.6.45:80
http://g119847.hostde20.fornex.host/information.php?nocache=52261.27
unknown
text
49 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
324
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1296
WINWORD.EXE
5.187.6.45:80
g119847.hostde20.fornex.host
diva-e Datacenters GmbH
DE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
1956
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
g119847.hostde20.fornex.host
  • 5.187.6.45
  • 5.187.6.111
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
12312313.doc