File name:

c59b2d6a70bc5b84998aebb2d21241a8adef33724838e92db4dee36a1ce46f43.docm

Full analysis: https://app.any.run/tasks/9fa84d36-225a-4900-ab44-a46ffb89c7be
Verdict: Malicious activity
Analysis date: February 02, 2024, 19:46:48
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Indicators:
MIME: application/octet-stream
File info: Microsoft OOXML
MD5:

A21C2B37EFFE3195665EC5597AFA329F

SHA1:

D764529D82A015204D9AB3FE414C0DA5B9829D9A

SHA256:

C59B2D6A70BC5B84998AEBB2D21241A8ADEF33724838E92DB4DEE36A1CE46F43

SSDEEP:

98304:mALh1ZKr/imh4llXwwv3NeSFiusq2b6HeW71Mry8QacL4mPS0K7X4bJ/cG7gjwRg:ourRc1wI3CJpbhYXHJzL9tF/rDyW

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Copies file to a new location (SCRIPT)

      • WINWORD.EXE (PID: 580)

    • Unusual execution from MS Office

      • WINWORD.EXE (PID: 580)

    • Executable content was dropped or overwritten

      • WINWORD.EXE (PID: 580)

  • SUSPICIOUS

    • Starts application with an unusual extension

      • WINWORD.EXE (PID: 580)

    • Runs shell command (SCRIPT)

      • WINWORD.EXE (PID: 580)

    • Connects to unusual port

      • itmvroidovss.scr (PID: 2528)

    • Creates a Folder object (SCRIPT)

      • WINWORD.EXE (PID: 580)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • WINWORD.EXE (PID: 580)

  • INFO

    • Checks supported languages

      • itmvroidovss.scr (PID: 2528)

    • Reads the computer name

      • itmvroidovss.scr (PID: 2528)

    • Reads the machine GUID from the registry

      • itmvroidovss.scr (PID: 2528)

    • Drops the executable file immediately after the start

      • WINWORD.EXE (PID: 580)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.docm | Word Microsoft Office Open XML Format document (with Macro) (53.6)
.docx | Word Microsoft Office Open XML Format document (24.2)
.zip | Open Packaging Conventions container (18)
.zip | ZIP compressed archive (4.1)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 1980:01:01 00:00:00
ZipCRC: 0x840a1a99
ZipCompressedSize: 392
ZipUncompressedSize: 1503
ZipFileName: [Content_Types].xml
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
35
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winword.exe itmvroidovss.scr

Process information

PID
CMD
Path
Indicators
Parent process
580"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\c59b2d6a70bc5b84998aebb2d21241a8adef33724838e92db4dee36a1ce46f43.docm"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.5123.5000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_08e61857a83bc251\msvcr90.dll
c:\windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_a4d981ff711297b6\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2528"C:\Users\admin\Downloads\itmvroidovss.scr" "C:\Users\admin\Downloads\itmvroidovss.scr
WINWORD.EXE
User:
admin
Integrity Level:
MEDIUM
Description:
itmvroidovs
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\downloads\itmvroidovss.scr
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework64\v4.0.30319\mscoreei.dll
Total events
4 887
Read events
4 437
Write events
320
Delete events
130

Modification events

(PID) Process:(580) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
On
(PID) Process:(580) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1041
Value:
On
(PID) Process:(580) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1042
Value:
On
(PID) Process:(580) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1046
Value:
On
(PID) Process:(580) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1036
Value:
On
(PID) Process:(580) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1031
Value:
On
(PID) Process:(580) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1040
Value:
On
(PID) Process:(580) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1049
Value:
On
(PID) Process:(580) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:3082
Value:
On
(PID) Process:(580) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1055
Value:
On
Executable files
2
Suspicious files
15
Text files
15
Unknown types
0

Dropped files

PID
Process
Filename
Type
580WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRAB08.tmp.cvr —
MD5:—
SHA256:—
580WINWORD.EXEC:\Users\admin\DOWNLO~1\191747\docProps\core.xmlxml
MD5:7035900313427FBA18E2ADDB06819FE0
SHA256:6E0494C4AC7F919D572BCE10AF5697021EBB1EBD39722CA6C39359D42905B781
580WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\964676E9.pngdocument
MD5:9A50DE0872CCC2D8B02CAA12C6DD8686
SHA256:669C94E48032E28E29C764631AD8B7DD3E5CE22D194EBA42CB4C1CD60BE6D0B3
580WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\18194088.pngcompressed
MD5:73A02AF0CC8DC6A65C9902DE4D1B9CCE
SHA256:3AF6C684044A42426FF2726F2C35521773CE2C934290D4724C250F3A526DB60B
580WINWORD.EXEC:\Users\admin\Downloads\191747\msdocks.zipdocument
MD5:A21C2B37EFFE3195665EC5597AFA329F
SHA256:C59B2D6A70BC5B84998AEBB2D21241A8ADEF33724838E92DB4DEE36A1CE46F43
580WINWORD.EXEC:\Users\admin\DOWNLO~1\191747\word\document.xmlxml
MD5:C95FA73614F9673979132D65C8681C88
SHA256:29D1993495E506921529D6FF64C679A651B346625EF352F8A58B3F4C566F1A53
580WINWORD.EXEC:\Users\admin\DOWNLO~1\191747\[Content_Types].xmlxml
MD5:5E069572B5A97282537BD790AC465A8A
SHA256:B4FA7F3FAA0510E4D969219BCEEC2A90E8A48FF28E060DB3CDD37CE935C3779C
580WINWORD.EXEC:\Users\admin\DOWNLO~1\191747\word\fontTable.xmlxml
MD5:F4CB870760851B85F695DE0D4BFD6B62
SHA256:2C06B19CA63F1FBC4B62022D111C44315FF181C2E99CB7D52C63BFD752897598
580WINWORD.EXEC:\Users\admin\DOWNLO~1\191747\word\styles.xmlxml
MD5:798C37A5BE4E781F966979CC990C956F
SHA256:71DE1C848A6767A17063A9D735337C3B6FE13E83576F753682F7B1D2EBD6BED7
580WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$9b2d6a70bc5b84998aebb2d21241a8adef33724838e92db4dee36a1ce46f43.docmbinary
MD5:B18E2F4E074B409BCD48B0D1FD50C82B
SHA256:0FEFEE7CE78E86E4BDF851C89BFA5A862FEC4D87405AF4FB9274C9D25FDD712E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
6
DNS requests
1
Threats
2

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
352
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1220
svchost.exe
239.255.255.250:3702
—
—
—
unknown
2528
itmvroidovss.scr
164.68.122.64:11128
mus09.duckdns.org
Contabo GmbH
DE
unknown

DNS requests

Domain
IP
Reputation
mus09.duckdns.org
  • 164.68.122.64
unknown

Threats

PID
Process
Class
Message
352
svchost.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
352
svchost.exe
Potentially Bad Traffic
ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
c59b2d6a70bc5b84998aebb2d21241a8adef33724838e92db4dee36a1ce46f43.docm