analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

docs 06.02.2021.doc

Full analysis: https://app.any.run/tasks/34ef5f53-b04f-4191-8a33-445016d7ac1c
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Malware Trends Tracker     >>>
Analysis date: June 27, 2022, 11:11:31
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
generated-doc
trojan
Indicators:
MIME: application/vnd.openxmlformats-officedocument.wordprocessingml.document
File info: Microsoft Word 2007+
MD5:

F08771B9FDFE82CAAA089641E2348C8E

SHA1:

B02C121597C9D56D7FAB76B54834D5F3BD961E8C

SHA256:

CC721111B5924CFEB91440ECACCC60ECC30D10FFFBDAB262F7C0A17027F527D1

SSDEEP:

768:u5WkgUEeFPIlj5oQ0fUDjxXSwU/+BtgKpyAAlQg6DPLFXS:plekVoQTCFmgKpslepC

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Unusual execution from Microsoft Office

      • WINWORD.EXE (PID: 2220)

  • SUSPICIOUS

    • Reads the computer name

      • mshta.exe (PID: 664)

    • Checks supported languages

      • mshta.exe (PID: 664)

    • Uses RUNDLL32.EXE to load library

      • mshta.exe (PID: 664)

    • Executed via COM

      • explorer.exe (PID: 120)

    • Starts MSHTA.EXE for opening HTA or HTMLS files

      • explorer.exe (PID: 120)

    • Reads Microsoft Outlook installation path

      • mshta.exe (PID: 664)

  • INFO

    • Reads the computer name

      • explorer.exe (PID: 3284)
      • explorer.exe (PID: 120)
      • WINWORD.EXE (PID: 2220)
      • explorer.exe (PID: 1836)

    • Checks supported languages

      • rundll32.exe (PID: 1416)
      • explorer.exe (PID: 120)
      • explorer.exe (PID: 3284)
      • WINWORD.EXE (PID: 2220)
      • explorer.exe (PID: 1836)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2220)

    • Reads internet explorer settings

      • mshta.exe (PID: 664)

    • Searches for installed software

      • WINWORD.EXE (PID: 2220)

    • Manual execution by user

      • explorer.exe (PID: 1836)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2220)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.docm | Word Microsoft Office Open XML Format document (with Macro) (53.6)
.docx | Word Microsoft Office Open XML Format document (24.2)
.zip | Open Packaging Conventions container (18)
.zip | ZIP compressed archive (4.1)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0006
ZipCompression: Deflated
ZipModifyDate: 1980:01:01 00:00:00
ZipCRC: 0x3f450766
ZipCompressedSize: 399
ZipUncompressedSize: 1503
ZipFileName: [Content_Types].xml

XML

Template: Normal
TotalEditTime: -
Pages: 1
Words: 2
Characters: 86
Application: Microsoft Office Word
DocSecurity: None
Lines: 3
Paragraphs: 1
ScaleCrop: No
HeadingPairs:
  • Название
  • 1
TitlesOfParts: -
Manager: -
Company: -
LinksUpToDate: No
CharactersWithSpaces: 87
SharedDoc: No
HyperlinksChanged: No
AppVersion: 16
Keywords: -
LastModifiedBy: Пользователь Windows
RevisionNumber: 2
CreateDate: 2021:06:02 10:36:00Z
ModifyDate: 2021:06:02 10:36:00Z
Category: -

XMP

Title: -
Subject: -
Creator: fxnhqeo
Description: -
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
6
Malicious processes
1
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winword.exe no specs explorer.exe no specs explorer.exe no specs mshta.exe rundll32.exe no specs explorer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2220"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\docs 06.02.2021.doc.docm"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
3284explorer collectionBoxConst.htaC:\Windows\explorer.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
120C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -EmbeddingC:\Windows\explorer.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
664"C:\Windows\System32\mshta.exe" "C:\Users\admin\AppData\Local\Temp\collectionBoxConst.hta" C:\Windows\System32\mshta.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
1416"C:\Windows\System32\rundll32.exe" c:\users\public\collectionBoxConst.jpg,PluginInitC:\Windows\System32\rundll32.exe—mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1836"C:\Windows\explorer.exe" C:\Windows\explorer.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
4 069
Read events
3 732
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
2
Text files
3
Unknown types
3

Dropped files

PID
Process
Filename
Type
2220WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR95BF.tmp.cvr —
MD5:—
SHA256:—
2220WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryRU0419.lextext
MD5:F3B25701FE362EC84616A93A45CE9998
SHA256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
2220WINWORD.EXEC:\Users\admin\AppData\Local\Temp\collectionBoxConst.htahtml
MD5:99A1A4391C6BE3AC5F137C0A092D8EDD
SHA256:B25865183C5CD2C5E550ACA8476E592B62ED3E37E6B628F955BBED454FDBB100
2220WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{656FF44F-2085-4D84-837D-C587C07FCA9E}.tmpbinary
MD5:5244D451C697908B88BF744544E792F8
SHA256:7117A542EA9B30CDAC57F945F8A5E08E17DB7B4EC581075FA614F9C8C3E3F46B
2220WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:B441B146E56E2764ACFA116FEB4866A1
SHA256:1188F9CD73576F14D8F7FB06ED609FE6FF35E870BE52D5DBF85CE39D42CD1F02
2220WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$cs 06.02.2021.doc.docmpgc
MD5:021B8C6DDC3A54611736B100CF20E7DC
SHA256:DE7B768C3BD8586F93F8133EB2833E19377716A4A25B362CD74E6298CC50A353
2220WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{EE3B0A6B-F7B5-4E80-B65D-FAD1B860B86C}.tmpsmt
MD5:5D4D94EE7E06BBB0AF9584119797B23A
SHA256:4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
2220WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\5039BD9F.pngimage
MD5:3D7510F8295900F92283E2B38A72C84E
SHA256:F90FF293DF58ECB0F31B15962569ADD58D57C44303EF73B12B01BB214319D02C
2220WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{83BE467A-5C65-4BEA-A6A6-571A74814899}.tmpbinary
MD5:01AD3E47C51E6F699F6A1C197A4739A9
SHA256:7D688D2FF30DCA94DF5A192650899608B6E57816591E27783C4B3F0B535195E4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
664
mshta.exe
GET
404
54.38.220.85:80
http://coursemcclurez.com/adda/T/5xBOnOkAQixWY7/JQNizzLtuT6BVV0xRecCKVVHAAR6PkgGrIPN/sose5?user=anRsIkfbv&time=0qobcg4DyUX11ZLF5yHrIevFn&page=1K2n8iJ&i9y9SwJu=yVaCtZ9s0gUfn&q=hj9xWh4I6PDdXOPDey&id=Vr4pf&user=mHMoD292T&search=uZVgg21LyVRFdD2FABGZvQlnkM90&q=Dwc1s67MbWC24TGoOjMXC
FR
html
198 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
664
mshta.exe
54.38.220.85:80
coursemcclurez.com
OVH SAS
FR
malicious

DNS requests

Domain
IP
Reputation
coursemcclurez.com
  • 54.38.220.85
malicious

Threats

Found threats are available for the paid subscriptions
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
docs 06.02.2021.doc