| File name: | baddoc.zip |
| Full analysis: | https://app.any.run/tasks/7bf47407-42c5-4b6a-9dea-548adbaf6a8c |
| Verdict: | Malicious activity |
| Analysis date: | October 28, 2023, 17:57:28 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v2.0 to extract |
| MD5: | D257207061AF62C136328EDD5C1538A8 |
| SHA1: | 6AA965723E915A8365F4EC23DA8B4101F5552173 |
| SHA256: | EB95C7F8589BC6754F2B9BA5D373EB08B8070664B019C0D6944A743DAEB7351B |
| SSDEEP: | 768:1U7H4wn6Sr+ElYhbkEgOQwjET6sFnUpyI:mrC7bkEgwsypyI |
MALICIOUS
Microsoft Office executes commands via PowerShell or Cmd
- WINWORD.EXE (PID: 3532)
Starts CMD.EXE for commands execution
- WINWORD.EXE (PID: 3532)
Unusual execution from MS Office
- WINWORD.EXE (PID: 3532)
Changes powershell execution policy (Bypass)
- cscript.exe (PID: 3712)
Bypass execution policy to execute commands
- powershell.exe (PID: 3484)
SUSPICIOUS
Starts application with an unusual extension
- cmd.exe (PID: 1764)
Executing commands from a ".bat" file
- WINWORD.EXE (PID: 3532)
Reads the Internet Settings
- cscript.exe (PID: 3712)
- powershell.exe (PID: 3484)
- HelpPane.exe (PID: 3004)
The process executes Powershell scripts
- cscript.exe (PID: 3712)
Starts POWERSHELL.EXE for commands execution
- cscript.exe (PID: 3712)
The process bypasses the loading of PowerShell profile settings
- cscript.exe (PID: 3712)
Powershell version downgrade attack
- powershell.exe (PID: 3484)
The Powershell connects to the Internet
- powershell.exe (PID: 3484)
Unusual connection from system programs
- powershell.exe (PID: 3484)
Starts CMD.EXE for commands execution
- powershell.exe (PID: 3484)
Reads Microsoft Outlook installation path
- HelpPane.exe (PID: 3004)
Reads Internet Explorer settings
- HelpPane.exe (PID: 3004)
INFO
Manual execution by a user
- WINWORD.EXE (PID: 3532)
- explorer.exe (PID: 3256)
- msedge.exe (PID: 1012)
Reads security settings of Internet Explorer
- cscript.exe (PID: 3712)
Checks supported languages
- chcp.com (PID: 3648)
Reads the machine GUID from the registry
- HelpPane.exe (PID: 3004)
Checks proxy server information
- HelpPane.exe (PID: 3004)
Application launched itself
- msedge.exe (PID: 1012)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .zip | | | ZIP compressed archive (100) |
|---|
EXIF
ZIP
| ZipRequiredVersion: | 20 |
|---|---|
| ZipBitFlag: | 0x0001 |
| ZipCompression: | Deflated |
| ZipModifyDate: | 2023:03:02 12:38:02 |
| ZipCRC: | 0x5a880a24 |
| ZipCompressedSize: | 25334 |
| ZipUncompressedSize: | 64000 |
| ZipFileName: | baddoc.doc |
Total processes
73
Monitored processes
29
Malicious processes
5
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 240 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=109.0.5414.149 "--annotation=exe=C:\Program Files\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win32 "--annotation=prod=Microsoft Edge" --annotation=ver=109.0.1518.115 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd8,0x6594f598,0x6594f5a8,0x6594f5b4 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 272 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2876 --field-trial-handle=1356,i,5353484290275663681,15221166825790115805,131072 /prefetch:8 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 1012 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default | C:\Program Files\Microsoft\Edge\Application\msedge.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 1372 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3756 --field-trial-handle=1356,i,5353484290275663681,15221166825790115805,131072 /prefetch:8 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 1600 | ping 1.1.2.2 -n 2 | C:\Windows\System32\PING.EXE | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: TCP/IP Ping Command Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1736 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3824 --field-trial-handle=1356,i,5353484290275663681,15221166825790115805,131072 /prefetch:8 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 1764 | C:\Windows\system32\cmd.exe /c c:\Users\admin\AppData\Local\Temp\adobeacd-update.bat | C:\Windows\System32\cmd.exe | — | WINWORD.EXE | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 1796 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\baddoc.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe | |||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 Modules
| |||||||||||||||
| 1804 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1640 --field-trial-handle=1356,i,5353484290275663681,15221166825790115805,131072 /prefetch:8 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 1864 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1420 --field-trial-handle=1356,i,5353484290275663681,15221166825790115805,131072 /prefetch:3 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | msedge.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
Total events
8 127
Read events
7 578
Write events
424
Delete events
125
Modification events
| (PID) Process: | (1796) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\178\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (1796) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip | |||
| (PID) Process: | (1796) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\Win7-KB3191566-x86.zip | |||
| (PID) Process: | (1796) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\Desktop\phacker.zip | |||
| (PID) Process: | (1796) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (1796) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (1796) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (1796) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (3532) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1033 |
Value: On | |||
| (PID) Process: | (3532) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1041 |
Value: On | |||
Executable files
64
Suspicious files
1 330
Text files
65
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3532 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRF366.tmp.cvr | — | |
MD5:— | SHA256:— | |||
| 1796 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb1796.34807\baddoc.doc | document | |
MD5:A3B613D128AACE09241504E8ACC678C2 | SHA256:8B92C23B29422131ACC150FA1EBAC67E1B0B0F8CFC1B727805B842A88DE447DE | |||
| 3532 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dat | text | |
MD5:CD02FDACF8A312515451BEF664345571 | SHA256:C11A07BAF0D6D03EC1A4BAF6410431C329BE7E6FED4B37402D7B194A942EDE16 | |||
| 3532 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\adobeacd-update.ps1 | text | |
MD5:24FAA1509493E8C83213BC822FC1A12E | SHA256:F7AF75EE9948552E7E9A9DC8C9C5F3E5F64C01CFEA90F1EDE013CF9138F6EFC3 | |||
| 1012 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF226992.TMP | — | |
MD5:— | SHA256:— | |||
| 1012 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old | — | |
MD5:— | SHA256:— | |||
| 3532 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | binary | |
MD5:A3485EE7102F329891EDBD72827BDFBE | SHA256:77FAA5947955E7DEF4BC7C8DDEEE74496D98376BC0C3C36DB2645F4A76AA25B6 | |||
| 3532 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\baddoc.doc.LNK | binary | |
MD5:346751CDE217AD048BEC1B60943159C1 | SHA256:AF3FA4CA753A7DEF6DE7FB40EC3DDE45E0F3D80F060684D1FCA66614AE41ABDF | |||
| 3532 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\VBE\MSForms.exd | binary | |
MD5:752E4BC9DE8D4016D5F13D059EA9C735 | SHA256:B89B10B770D7E3876876D83A924959D45AD609515F4B76A095594ADE6617ACBA | |||
| 3484 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF1f2256.TMP | binary | |
MD5:CAEA3B1F09925DA2A47C2B8B890AB890 | SHA256:66F29B00CBB7B1DED878F96AAC6F52907C088DE194A1FD0CD6E1FF1916047549 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
43
DNS requests
67
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
2656 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | unknown |
1088 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
3484 | powershell.exe | 91.220.131.44:80 | — | Gloman SA | GR | unknown |
1012 | msedge.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
1864 | msedge.exe | 13.107.42.16:443 | config.edge.skype.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
1864 | msedge.exe | 204.79.197.203:443 | ntp.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
1864 | msedge.exe | 204.79.197.239:443 | edge.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | unknown |
1864 | msedge.exe | 23.36.163.156:443 | assets.msn.com | Akamai International B.V. | DE | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
dns.msftncsi.com |
| shared |
config.edge.skype.com |
| whitelisted |
ntp.msn.com |
| whitelisted |
edge.microsoft.com |
| whitelisted |
assets.msn.com |
| whitelisted |
img-s-msn-com.akamaized.net |
| whitelisted |
sb.scorecardresearch.com |
| shared |
th.bing.com |
| whitelisted |
www.bing.com |
| whitelisted |
c.msn.com |
| whitelisted |