Malware analysis file.doc Malicious activity | ANY.RUN

Add for printing

File name:	file.doc
Full analysis:	https://app.any.run/tasks/7bb9311e-138e-4ede-932c-3789fdb72674
Verdict:	Malicious activity
Threats:	A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email. Malware Trends Tracker >>>
Analysis date:	December 18, 2018, 13:48:41
OS:	Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:	macros macros-on-open generated-doc trojan nemucod loader
Indicators:
MIME:	application/msword
File info:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Title: jarnqjnotguohojlueoe, Subject: pwmjktby, Author: wrval, Comments: ffmngwescsailssbmmwgtvsae, Template: Normal.dotm, Last Saved By: victim, Revision Number: 2, Name of Creating Application: Microsoft Office Word, Total Editing Time: 01:00, Create Time/Date: Tue Dec 18 13:26:00 2018, Last Saved Time/Date: Tue Dec 18 13:26:00 2018, Number of Pages: 1, Number of Words: 54, Number of Characters: 311, Security: 0
MD5:	3607DAFE4A7FA0A2B994CB940F0BA52D
SHA1:	65D28251323DE5B01F83C2F3A861A35FB834DCA4
SHA256:	CF3260BC63BD66CA3590C9AB5E95EC51F30BE8E8D35C591B8011A9A735B211E0
SSDEEP:	384:jBZ3EDN6Sz0YDfV9fP4iS2N8MYI7WfDOxz99ttB30Rod0jn2gxA:jBZ3EDN6kjVlNyfDOxz99lJW2

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 60 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: none
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 8.0.7601.17514 undefined
Adobe Acrobat Reader DC MUI (15.023.20070)
Adobe Flash Player 26 ActiveX (26.0.0.131)
Adobe Flash Player 26 NPAPI (26.0.0.131)
Adobe Flash Player 26 PPAPI (26.0.0.131)
Adobe Refresh Manager (1.8.0)
CCleaner (5.35)
FileZilla Client 3.36.0 (3.36.0)
Google Chrome (68.0.3440.106)
Google Update Helper (1.3.33.17)
Java 8 Update 92 (8.0.920.14)
Java Auto Updater (2.8.92.14)
Microsoft .NET Framework 4.6.1 (4.6.01055)
Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Professional 2010 (14.0.6029.1000)
Microsoft Office Proof (English) 2010 (14.0.6029.1000)
Microsoft Office Proof (French) 2010 (14.0.6029.1000)
Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Single Image 2010 (14.0.6029.1000)
Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2017 Redistributable (x86) - 14.15.26706 (14.15.26706.0)
Microsoft Visual C++ 2017 x86 Additional Runtime - 14.15.26706 (14.15.26706)
Microsoft Visual C++ 2017 x86 Minimum Runtime - 14.15.26706 (14.15.26706)
Mozilla Firefox 61.0.2 (x86 en-US) (61.0.2)
Notepad++ (32-bit x86) (7.5.1)
Opera 12.15 (12.15.1748)
Skype version 8.29 (8.29)
VLC media player (2.2.6)
WinRAR 5.60 (32-bit) (5.60.0)

Hotfixes

Client LanguagePack Package
Client Refresh LanguagePack Package
CodecPack Basic Package
Foundation Package
IE Troubleshooters Package
InternetExplorer Optional Package
KB2534111
KB2999226
KB976902
LocalPack AU Package
LocalPack CA Package
LocalPack GB Package
LocalPack US Package
LocalPack ZA Package
ProfessionalEdition
UltimateEdition

Add for printing

MALICIOUS
- Requests a remote executable file from MS Office
  - WINWORD.EXE (PID: 2672)
- Unusual execution from Microsoft Office
  - WINWORD.EXE (PID: 2672)
- Executable content was dropped or overwritten
  - WINWORD.EXE (PID: 2672)
- Application was dropped or rewritten from another process
  - qwerty2.exe (PID: 2716)
  - qwerty2.exe (PID: 3108)
- Loads dropped or rewritten executable
  - qwerty2.exe (PID: 2716)
- Downloads executable files from IP
  - WINWORD.EXE (PID: 2672)
- Uses SVCHOST.EXE for hidden code execution
  - qwerty2.exe (PID: 3108)
- Loads the Task Scheduler COM API
  - svchost.exe (PID: 4088)
- NEMUCOD was detected
  - WINWORD.EXE (PID: 2672)
SUSPICIOUS
- Reads Internet Cache Settings
  - WINWORD.EXE (PID: 2672)
- Unusual connect from Microsoft Office
  - WINWORD.EXE (PID: 2672)
- Application launched itself
  - qwerty2.exe (PID: 2716)
- Executable content was dropped or overwritten
  - qwerty2.exe (PID: 2716)
  - svchost.exe (PID: 4088)
- Creates files in the program directory
  - svchost.exe (PID: 4088)
INFO
- Reads Microsoft Office registry keys
  - WINWORD.EXE (PID: 2672)
- Creates files in the user directory
  - WINWORD.EXE (PID: 2672)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.doc	\|	Microsoft Word document (54.2)
.doc	\|	Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

Title:	jarnqjnotguohojlueoe
Subject:	pwmjktby
Author:	wrval
Comments:	ffmngwescsailssbmmwgtvsae
Template:	Normal.dotm
LastModifiedBy:	victim
RevisionNumber:	2
Software:	Microsoft Office Word
TotalEditTime:	1.0 minutes
CreateDate:	2018:12:18 13:26:00
ModifyDate:	2018:12:18 13:26:00
Pages:	1
Words:	54
Characters:	311
Security:	None
CodePage:	Windows Latin 1 (Western European)
Category:	jjyrgar
Company:	jwvynh
Lines:	2
Paragraphs:	1
CharCountWithSpaces:	364
AppVersion:	15
ScaleCrop:	No
LinksUpToDate:	No
SharedDoc:	No
HyperlinksChanged:	No
TitleOfParts:	jarnqjnotguohojlueoe
HeadingPairs:	Title 1
CompObjUserTypeLen:	32
CompObjUserType:	Microsoft Word 97-2003 Document

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

2672

"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\file.doc"

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

explorer.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Microsoft Word

Exit code:

Version:

14.0.6024.1000

Modules

Images
c:\program files\microsoft office\office14\winword.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll

2716

C:\Users\admin\AppData\Local\Temp\qwerty2.exe

WINWORD.EXE

User:

admin

Integrity Level:

MEDIUM

Exit code:

Modules

Images
c:\users\admin\appdata\local\temp\qwerty2.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll

3108

C:\Users\admin\AppData\Local\Temp\qwerty2.exe

qwerty2.exe

User:

admin

Integrity Level:

MEDIUM

Exit code:

Modules

Images
c:\users\admin\appdata\local\temp\qwerty2.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll

4088

C:\Windows\system32\svchost.exe

qwerty2.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Host Process for Windows Services

Exit code:

Version:

6.1.7600.16385 (win7_rtm.090713-1255)

Modules

Images
c:\windows\system32\svchost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll

Add for printing

Total events

1 474

Read events

1 076

Write events

393

Delete events

Modification events


(PID) Process:	(2672) WINWORD.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:	write	Name:	k)>
Value: 6B293E00700A0000010000000000000000000000
(PID) Process:	(2672) WINWORD.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:	write	Name:	1033
Value: Off
(PID) Process:	(2672) WINWORD.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:	write	Name:	1033
Value: On
(PID) Process:	(2672) WINWORD.EXE	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:	write	Name:	WORDFiles
Value: 1301413911
(PID) Process:	(2672) WINWORD.EXE	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:	write	Name:	ProductFiles
Value: 1301414032
(PID) Process:	(2672) WINWORD.EXE	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:	write	Name:	ProductFiles
Value: 1301414033
(PID) Process:	(2672) WINWORD.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word
Operation:	write	Name:	MTTT
Value: 700A00005CAD5669D896D40100000000
(PID) Process:	(2672) WINWORD.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:	write	Name:	d*>
Value: 642A3E00700A000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000
(PID) Process:	(2672) WINWORD.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:	delete value	Name:	d*>
Value: 642A3E00700A000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000
(PID) Process:	(2672) WINWORD.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	UNCAsIntranet
Value: 0

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
2672	WINWORD.EXE	C:\Users\admin\AppData\Local\Temp\CVR95CB.tmp.cvr		—
		MD5:—	SHA256:—
2716	qwerty2.exe	C:\Users\admin\AppData\Local\Temp\nsuA201.tmp		—
		MD5:—	SHA256:—
2672	WINWORD.EXE	C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm		pgc
		MD5:—	SHA256:—
2672	WINWORD.EXE	C:\Users\admin\AppData\Local\Temp\~$file.doc		pgc
		MD5:—	SHA256:—
2672	WINWORD.EXE	C:\Users\admin\AppData\Local\Temp\VBE\MSForms.exd		tlb
		MD5:—	SHA256:—
2716	qwerty2.exe	C:\Users\admin\AppData\Local\Temp\OneNoteNewNoteMedTile.scale-100.png		image
		MD5:A45C8ED65521C42ED303BD2362F1EFB8	SHA256:0B3B179CC05DDF12DE65E98523717AEFE14853BAB828AC67C0C7E19C3A080604
2716	qwerty2.exe	C:\Users\admin\AppData\Local\Temp\nsjA211.tmp\System.dll		executable
		MD5:75ED96254FBF894E42058062B4B4F0D1	SHA256:A632D74332B3F08F834C732A103DAFEB09A540823A2217CA7F49159755E8F1D7
2672	WINWORD.EXE	C:\Users\admin\AppData\Local\Temp\qwerty2.exe		executable
		MD5:7B1B00FEAEFEF192C02C360A883B400A	SHA256:F476342981C639D55CE2F5471C3E9962FD2D5162890E55D2B4E45DDC641F207F
2716	qwerty2.exe	C:\Users\admin\AppData\Local\Temp\Square310x310Logo.scale-125.png		image
		MD5:15317448D5657C21F8C70539AA626E7E	SHA256:753F4FBA2BBCEEB89DE99D0C18D4B981E6F208CB9EB4152987A4541FDEB8E319
2716	qwerty2.exe	C:\Users\admin\AppData\Local\Temp\RNWebViewBridgeObject.winmd		executable
		MD5:AB52AE0F3D20AB47BF177D981E431BA6	SHA256:86EA210F530253520169CB8F7A55EDDC426BB6908F380C1D3019BFECD2C8B5C3

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
2672	WINWORD.EXE	GET	200	209.141.61.249:80	http://209.141.61.249/23.exe	US	executable	154 Kb	malicious

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
2672	WINWORD.EXE	209.141.61.249:80	—	FranTech Solutions	US	malicious

DNS requests

No data

Threats

PID	Process	Class	Message
2672	WINWORD.EXE	A Network Trojan was detected	ET TROJAN JS/Nemucod requesting EXE payload 2016-02-01
2672	WINWORD.EXE	A Network Trojan was detected	ET INFO Executable Download from dotted-quad Host
2672	WINWORD.EXE	A Network Trojan was detected	ET CURRENT_EVENTS Likely Evil EXE download from dotted Quad by MSXMLHTTP M1
2672	WINWORD.EXE	Potential Corporate Privacy Violation	ET POLICY PE EXE or DLL Windows file download HTTP
2672	WINWORD.EXE	A Network Trojan was detected	ET TROJAN JS/Nemucod.M.gen downloading EXE payload
2672	WINWORD.EXE	A Network Trojan was detected	ET CURRENT_EVENTS Likely Evil EXE download from dotted Quad by MSXMLHTTP M2
2672	WINWORD.EXE	Potentially Bad Traffic	ET INFO SUSPICIOUS Dotted Quad Host MZ Response

Add for printing

Process	Message
qwerty2.exe	Start
qwerty2.exe	Stop ok

General Info

file.doc

3607DAFE4A7FA0A2B994CB940F0BA52D

65D28251323DE5B01F83C2F3A861A35FB834DCA4

CF3260BC63BD66CA3590C9AB5E95EC51F30BE8E8D35C591B8011A9A735B211E0

384:jBZ3EDN6Sz0YDfV9fP4iS2N8MYI7WfDOxz99ttB30Rod0jn2gxA:jBZ3EDN6kjVlNyfDOxz99lJW2

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Requests a remote executable file from MS Office

Unusual execution from Microsoft Office

Executable content was dropped or overwritten

Application was dropped or rewritten from another process

Loads dropped or rewritten executable

Downloads executable files from IP

Uses SVCHOST.EXE for hidden code execution

Loads the Task Scheduler COM API

NEMUCOD was detected

SUSPICIOUS

Reads Internet Cache Settings

Unusual connect from Microsoft Office

Application launched itself

Executable content was dropped or overwritten

Creates files in the program directory

INFO

Reads Microsoft Office registry keys

Creates files in the user directory

Malware configuration

Static information

TRiD

EXIF

FlashPix

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings