File name:

DE 34212 MELSUNGE.docx

Full analysis: https://app.any.run/tasks/acb32e52-f37a-498e-b4fa-6768303ca18b
Verdict: Malicious activity
Analysis date: April 03, 2025, 16:39:22
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto
generic
phishing
Indicators:
MIME: application/vnd.openxmlformats-officedocument.wordprocessingml.document
File info: Microsoft Word 2007+
MD5:

99E913EC0E6CCAE5EAB81887426C3E02

SHA1:

11BAEAE96414C3AF0DEF32E7E5489CB42AFFB92F

SHA256:

B6F3F1968D9CF6962982A83EF82CB78CF2031D501BD0FCF24AE89A742352CB49

SSDEEP:

768:/hHt7ogInGlaZ6lVg+gkcH6ktOkT4RXkc1nuZzl2v8S:/BtpmGYZ6+XtOkURUcKzl2v8S

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • GENERIC has been found (auto)

      • WINWORD.EXE (PID: 1912)

    • PHISHING has been detected (SURICATA)

      • svchost.exe (PID: 2196)

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.docx | Word Microsoft Office Open XML Format document (52.2)
.zip | Open Packaging Conventions container (38.8)
.zip | ZIP compressed archive (8.8)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0006
ZipCompression: Deflated
ZipModifyDate: 1980:01:01 00:00:00
ZipCRC: 0x15fdb6b1
ZipCompressedSize: 440
ZipUncompressedSize: 2396
ZipFileName: [Content_Types].xml

XML

Template: Normal
TotalEditTime: 1 minute
Pages: 1
Words: -
Characters: -
Application: Microsoft Office Word
DocSecurity: None
Lines: 1
Paragraphs: 1
ScaleCrop: No
Company: Grizli777
LinksUpToDate: No
CharactersWithSpaces: -
SharedDoc: No
HyperlinksChanged: No
AppVersion: 12
Keywords: -
LastModifiedBy: vpshosting
RevisionNumber: 3
CreateDate: 2025:03:03 06:10:00Z
ModifyDate: 2025:03:03 06:12:00Z

XMP

Title: -
Subject: -
Creator: vpshosting
Description: -
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
130
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winword.exe sppextcomobj.exe no specs #PHISHING svchost.exe ai.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1912"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\DE 34212 MELSUNGE.docx" /o ""C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
16.0.16026.20146
Modules
Images
c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\csi.dll
c:\windows\system32\wintrust.dll
c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\riched20.dll
c:\windows\system32\peerdist.dll
c:\windows\system32\hlink.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\dataexchange.dll
c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\aitrx.dll
c:\windows\system32\msxml3.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
7348C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
8184"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe" "7B294BE4-4FEB-46A6-8330-A65FFBBD72B7" "0391774C-8B6F-4E13-B4DC-BC232D5A6A60" "1912"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Artificial Intelligence (AI) Host for the Microsoft® Windows® Operating System and Platform x64.
Version:
0.12.2.0
Modules
Images
c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\ai.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\advapi32.dll
c:\program files\common files\microsoft shared\clicktorun\c2r64.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\ole32.dll
Total events
9 486
Read events
9 339
Write events
131
Delete events
16

Modification events

(PID) Process:(1912) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Experiment\word\AudienceList
Operation:writeName:Automation
Value:
ofy5bfmdisx6r201
(PID) Process:(1912) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Experiment\word\AudienceList
Operation:writeName:Dogfood
Value:
offbp6lldxtzgk01
(PID) Process:(1912) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Experiment\word\AudienceList
Operation:writeName:Microsoft
Value:
of14iikgwda45r01
(PID) Process:(1912) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Experiment\word\AudienceList
Operation:writeName:Insiders
Value:
ofdibw53ukclan01
(PID) Process:(1912) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Experiment\word\AudienceList
Operation:writeName:Production
Value:
ofxkhgd4x4oixy01
(PID) Process:(1912) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\FileIO
Operation:writeName:CacheId
Value:
{E8F8CDEC-5115-406B-9726-D9949305204D}
(PID) Process:(1912) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\FileIO
Operation:writeName:MetadataReplicationCompleted
Value:
1
(PID) Process:(1912) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\FileIO
Operation:delete valueName:CentralTableFileName
Value:
(PID) Process:(1912) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\FileIO
Operation:writeName:CentralTableFileName
Value:
CentralTable.accdb
(PID) Process:(1912) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\FileIO
Operation:writeName:ExpungeFilesIfDiskFullLastRunTime
Value:
Executable files
33
Suspicious files
135
Text files
18
Unknown types
0

Dropped files

PID
Process
Filename
Type
1912WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$ 34212 MELSUNGE.docxbinary
MD5:FB54EEF455C6DEF2E8F660B6B99C7EF0
SHA256:9CE798D87D457A829AB40E7FB1AE11DD83C8981164E157006AE5D3CCCD2BD89A
1912WINWORD.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04binary
MD5:8DEB6C9C30A380D66036D2A2BE65C7C7
SHA256:6A9382867473E2EBD1177D5CABFF128D15587F8BDE4819B6625E218F3CAF9C90
1912WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbresbinary
MD5:CDF22C38A996A5B7116F2E390112C807
SHA256:E1AB4500B6F37A8FF427DF786B0FC9FC84286CBA6DD0DE4E6261DA057F7DF419
1912WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\A6320407.emfbinary
MD5:484741229B0F3BBBFD3B75F06DEB3400
SHA256:68770F5283E6D32D2480E38E5A3C55916C2992E0F2CF0F09465A99AD6220030A
1912WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\FontCache\4\CloudFonts\MS Mincho\37327920121.ttf —
MD5:—
SHA256:—
1912WINWORD.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04binary
MD5:B4DBDB65E5F24A38E5E0704B0B85F67D
SHA256:51A3472F174081D9D735B83BAE1EEA856854AC2AAC33EB6286364FFC9C0CED31
1912WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bintext
MD5:CC90D669144261B198DEAD45AA266572
SHA256:89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
1912WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\350311AD-9387-4874-B1FA-C1CBD22173A3xml
MD5:BFD91974B0E63528C67D7BDD8971E9F0
SHA256:5CC39A5E9E70D5E4383D0A0C6198BD7C3641369F22424752CF027EACEA86C53A
1912WINWORD.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\62FD6123E4130BBD73F28377DEC28BD0_998896EE55BF2F8954148FCC6717F5EFbinary
MD5:EA6C4C5658FF8CBC935C987EC27C0970
SHA256:0BCDF449A50502108244C3FB814A4F4DFB304E36974745862D493B10C382DC2F
1912WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_41.ttfbinary
MD5:A807151D5747F6460143DC1FD2C3195F
SHA256:C0C3B354480E34CCC0C25D371B30D0272DB86C786AF6438C217998B0A30E5EB0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
64
DNS requests
29
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.36:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1912
WINWORD.EXE
GET
200
2.16.252.233:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1912
WINWORD.EXE
GET
200
2.16.206.148:80
http://r11.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBQaUrm0WeTDM5ghfoZtS72KO9ZnzgQUCLkRO6XQhRi06g%2BgrZ%2BGHo78OCcCEgVBvF7lHwLbzR1k2oDJemeSfw%3D%3D
unknown
—
—
whitelisted
—
—
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
1912
WINWORD.EXE
GET
200
2.16.164.17:80
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl
unknown
—
—
whitelisted
1912
WINWORD.EXE
GET
200
2.16.164.17:80
http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl
unknown
—
—
whitelisted
5392
SIHClient.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5392
SIHClient.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.36:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
172.172.255.217:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
52.109.32.97:443
officeclient.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
GB
whitelisted
—
—
52.123.129.14:443
ecs.office.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
52.109.68.129:443
roaming.officeapps.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
—
—
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
—
—
2.16.10.163:443
omex.cdn.office.net
Akamai International B.V.
AT
whitelisted
6544
svchost.exe
20.190.160.132:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
whitelisted
google.com
  • 142.250.102.100
  • 142.250.102.101
  • 142.250.102.113
  • 142.250.102.138
  • 142.250.102.139
  • 142.250.102.102
whitelisted
crl.microsoft.com
  • 23.216.77.36
  • 23.216.77.20
  • 2.16.164.17
  • 2.16.164.130
  • 2.16.164.114
  • 2.16.164.104
  • 2.16.164.10
  • 2.16.164.131
  • 2.16.164.128
  • 2.16.164.65
  • 2.16.164.113
whitelisted
client.wns.windows.com
  • 172.172.255.217
whitelisted
officeclient.microsoft.com
  • 52.109.32.97
whitelisted
ecs.office.com
  • 52.123.129.14
  • 52.123.128.14
whitelisted
roaming.officeapps.live.com
  • 52.109.68.129
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
omex.cdn.office.net
  • 2.16.10.163
  • 2.16.10.172
whitelisted
login.live.com
  • 20.190.160.132
  • 40.126.32.134
  • 20.190.160.17
  • 20.190.160.65
  • 20.190.160.3
  • 20.190.160.5
  • 40.126.32.68
  • 20.190.160.131
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Possible Social Engineering Attempted
PHISHING [ANY.RUN] Suspected Phishing Domain (st3 .pro)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
DE 34212 MELSUNGE.docx