File name:

christmas_giveaway.docm

Full analysis: https://app.any.run/tasks/2d00c601-cb6b-4a3a-93e8-965a013c70c2
Verdict: Malicious activity
Analysis date: December 06, 2021, 08:24:00
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
generated-doc
Indicators:
MIME: application/vnd.openxmlformats-officedocument.wordprocessingml.document
File info: Microsoft Word 2007+
MD5:

00CBA6C1746444C8B796049ED7638A88

SHA1:

4F42E754053A6D11EA2ADAEECEFC6BE8346D493B

SHA256:

CED24054149DF964B66BA695842E3055E2200232C6F1676CE820F81FD26FB9D6

SSDEEP:

12288:Oype66D9Bgz6g1nVbXcB3q/emfz1bjk+A9CLVYWQ+DJH7WUeWtvNF:O4n6Dfgv19cq/emfljkDCyj+9heWzF

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts CMD.EXE for commands execution

      • WINWORD.EXE (PID: 3636)

    • Unusual execution from Microsoft Office

      • WINWORD.EXE (PID: 3636)

  • SUSPICIOUS

    • Checks supported languages

      • cmd.exe (PID: 2920)
      • cmd.exe (PID: 3344)
      • chcp.com (PID: 3804)
      • cscript.exe (PID: 3992)
      • powershell.exe (PID: 468)

    • Starts CMD.EXE for commands execution

      • powershell.exe (PID: 468)

    • Reads the computer name

      • cscript.exe (PID: 3992)
      • powershell.exe (PID: 468)

    • Starts application with an unusual extension

      • cmd.exe (PID: 2920)

    • Executes PowerShell scripts

      • cscript.exe (PID: 3992)

    • Executes scripts

      • cmd.exe (PID: 2920)

    • Reads Environment values

      • powershell.exe (PID: 468)

  • INFO

    • Checks supported languages

      • WINWORD.EXE (PID: 3636)
      • PING.EXE (PID: 2376)

    • Reads the computer name

      • WINWORD.EXE (PID: 3636)
      • PING.EXE (PID: 2376)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 3636)

    • Checks Windows Trust Settings

      • cscript.exe (PID: 3992)
      • powershell.exe (PID: 468)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 3636)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.docm | Word Microsoft Office Open XML Format document (with Macro) (53.6)
.docx | Word Microsoft Office Open XML Format document (24.2)
.zip | Open Packaging Conventions container (18)
.zip | ZIP compressed archive (4.1)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0006
ZipCompression: Deflated
ZipModifyDate: 1980:01:01 00:00:00
ZipCRC: 0x3f450766
ZipCompressedSize: 399
ZipUncompressedSize: 1503
ZipFileName: [Content_Types].xml

XMP

Title: -
Subject: -
Creator: -
Description: -

XML

Keywords: -
LastModifiedBy: -
RevisionNumber: 1
CreateDate: 2021:11:30 23:18:00Z
ModifyDate: 2021:11:30 23:19:00Z
Template: Normal.dotm
TotalEditTime: -
Pages: 1
Words: -
Characters: 1
Application: Microsoft Office Word
DocSecurity: None
Lines: 1
Paragraphs: 1
ScaleCrop: No
Company: -
LinksUpToDate: No
CharactersWithSpaces: 1
SharedDoc: No
HyperlinksChanged: No
AppVersion: 16
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
7
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winword.exe no specs cmd.exe no specs ping.exe no specs chcp.com no specs cscript.exe no specs powershell.exe cmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
468"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy bypass -noprofile -file C:\Users\admin\AppData\Local\Temp\adobeacd-update.ps1C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2376ping 1.1.2.2 -n 2C:\Windows\system32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ping.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
2920C:\Windows\system32\cmd.exe /c c:\Users\admin\AppData\Local\Temp\adobeacd-update.batC:\Windows\system32\cmd.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3344"C:\Windows\system32\cmd.exe" /c c:\Users\admin\AppData\Local\Temp\444.exeC:\Windows\system32\cmd.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3636"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\christmas_giveaway.docm"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
3804chcp 1251C:\Windows\system32\chcp.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Change CodePage Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\chcp.com
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3992cscript.exe "c:\Users\admin\AppData\Local\Temp\adobeacd-update.vbs"C:\Windows\system32\cscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft � Console Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\cscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
Total events
4 441
Read events
3 839
Write events
528
Delete events
74

Modification events

(PID) Process:(3636) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:writeName:1d?
Value:
31643F00340E0000010000000000000000000000
(PID) Process:(3636) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
Off
(PID) Process:(3636) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1041
Value:
Off
(PID) Process:(3636) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1046
Value:
Off
(PID) Process:(3636) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1036
Value:
Off
(PID) Process:(3636) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1031
Value:
Off
(PID) Process:(3636) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1040
Value:
Off
(PID) Process:(3636) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1049
Value:
Off
(PID) Process:(3636) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:3082
Value:
Off
(PID) Process:(3636) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1042
Value:
Off
Executable files
0
Suspicious files
3
Text files
3
Unknown types
2

Dropped files

PID
Process
Filename
Type
3636WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR5011.tmp.cvr —
MD5:—
SHA256:—
3636WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:—
SHA256:—
3636WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$ristmas_giveaway.docmpgc
MD5:—
SHA256:—
468powershell.exeC:\Users\admin\AppData\Local\Temp\arnzwa1y.r5q.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
468powershell.exeC:\Users\admin\AppData\Local\Temp\czwavngg.03f.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
3636WINWORD.EXEC:\Users\admin\AppData\Local\Temp\adobeacd-update.battext
MD5:6CCDA348CEDD7C1A015B050CC5293EC7
SHA256:6577D4EC489FBB21ED1F8D6957FF3279D3BF8587C9F348734DA1BB55E761744F
468powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCachebinary
MD5:1068BF0B9B98C206F587A7DB05F6DD06
SHA256:534478EDAFC5087DAA3749624454988B1F7DF923BF1A0A9E28C5F97C3308CFDB
3636WINWORD.EXEC:\Users\admin\AppData\Local\Temp\adobeacd-update.vbstext
MD5:8CD65CBF2BA5358AF189AEE6B9181531
SHA256:320FCAA30E58756A5ADA91463E2A5D695A312FDB0692592F8C48F9AD9512CDAE
3636WINWORD.EXEC:\Users\admin\AppData\Local\Temp\adobeacd-update.ps1text
MD5:BEF90BAFC4182662A6062D5359E117F2
SHA256:859BDAA155A5812C719F7624882F797898A346F0AA0BDFEA7D97A958C8DA0A37
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
3
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
468
powershell.exe
211.125.116.200:80
hiro-wish.com
Kurashiki Cable TV
JP
malicious

DNS requests

Domain
IP
Reputation
hiro-wish.com
  • 211.125.116.200
malicious
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
christmas_giveaway.docm