analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| File name: | DTS VPN Setup Guideline Orgadata.docx |
| Full analysis: | https://app.any.run/tasks/27cf8dc6-3dc0-4ae2-b2d4-18ef05bdb0aa |
| Verdict: | No threats detected |
| Analysis date: | March 03, 2020 at 09:26:04 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| MIME: | application/vnd.openxmlformats-officedocument.wordprocessingml.document |
| File info: | Microsoft Word 2007+ |
| MD5: | E9B3159DD2D02F5B50BC39011BA43659 |
| SHA1: | D1931D4FF525B07424A79B4FB19F693EAF7A0F4D |
| SHA256: | F1FB960C5687C1E6BA725A3A7B22F876CB8B15A9EB9D2347366C906DB3CC6842 |
| SSDEEP: | 6144:J2OHT8K9VFmwhLyxFGAPunxgoO+blI7GE9fqhwoVXARcCyqsvmJk:oaTHVFKFGyuZVI19OAT0vCk |
MALICIOUS
No malicious indicators.SUSPICIOUS
No suspicious indicators.INFO
Creates files in the user directory
- WINWORD.EXE (PID: 1232)
Reads Microsoft Office registry keys
- WINWORD.EXE (PID: 1232)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .docx | | | Word Microsoft Office Open XML Format document (52.2) |
|---|---|---|
| .zip | | | Open Packaging Conventions container (38.8) |
| .zip | | | ZIP compressed archive (8.8) |
EXIF
ZIP
| ZipRequiredVersion: | 20 |
|---|---|
| ZipBitFlag: | 0x0006 |
| ZipCompression: | Deflated |
| ZipModifyDate: | 1980:01:01 00:00:00 |
| ZipCRC: | 0x031c5917 |
| ZipCompressedSize: | 455 |
| ZipUncompressedSize: | 2795 |
| ZipFileName: | [Content_Types].xml |
XMP
| Title: | - |
|---|---|
| Subject: | - |
| Creator: | Thomas Schmitz |
| Description: | - |
XML
| Keywords: | - |
|---|---|
| LastModifiedBy: | Maximilian Goerke |
| RevisionNumber: | 2 |
| CreateDate: | 2020:02:18 13:37:00Z |
| ModifyDate: | 2020:02:18 13:37:00Z |
| Template: | Normal.dotm |
| TotalEditTime: | - |
| Pages: | 6 |
| Words: | 525 |
| Characters: | 3311 |
| Application: | Microsoft Office Word |
| DocSecurity: | None |
| Lines: | 27 |
| Paragraphs: | 7 |
| ScaleCrop: | No |
| Company: | DTS Systeme GmbH |
| LinksUpToDate: | No |
| CharactersWithSpaces: | 3829 |
| SharedDoc: | No |
| HyperlinksChanged: | No |
| AppVersion: | 16 |
| ContentTypeId: | 0x0101007D1D6C50E45C0B4787A310811A923A86 |
| Tag_dlc_DocIdItemGuid: | d4456d4a-7ee4-4cb7-987c-9e130ef2d0ca |
Total processes
35
Monitored processes
1
Malicious processes
0
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1232 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\DTS VPN Setup Guideline Orgadata.docx" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Exit code: 0 Version: 14.0.6024.1000 Modules
| |||||||||||||||
Total events
2 104
Read events
1 017
Write events
935
Delete events
152
Modification events
| (PID) Process: | (1232) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
| Operation: | write | Name: | o`, |
Value: 6F602C00D0040000010000000000000000000000 | |||
| (PID) Process: | (1232) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1033 |
Value: Off | |||
| (PID) Process: | (1232) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1041 |
Value: Off | |||
| (PID) Process: | (1232) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1046 |
Value: Off | |||
| (PID) Process: | (1232) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1036 |
Value: Off | |||
| (PID) Process: | (1232) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1031 |
Value: Off | |||
| (PID) Process: | (1232) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1040 |
Value: Off | |||
| (PID) Process: | (1232) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1049 |
Value: Off | |||
| (PID) Process: | (1232) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 3082 |
Value: Off | |||
| (PID) Process: | (1232) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1042 |
Value: Off | |||
Executable files
0
Suspicious files
0
Text files
2
Unknown types
2
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1232 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR6C4F.tmp.cvr | — | |
MD5:— | SHA256:— | |||
| 1232 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\11A3E0E0.png | — | |
MD5:— | SHA256:— | |||
| 1232 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\DB1959EE.png | — | |
MD5:— | SHA256:— | |||
| 1232 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\CE374C2C.png | — | |
MD5:— | SHA256:— | |||
| 1232 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\25C6517.png | — | |
MD5:— | SHA256:— | |||
| 1232 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\26CBAB61.png | — | |
MD5:— | SHA256:— | |||
| 1232 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{59C3E6C1-8BBB-44DA-8C8C-0D8BB9CF1028}.tmp | — | |
MD5:— | SHA256:— | |||
| 1232 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{FB19C1E2-CFC6-4C09-9CDB-0A3C5A5B9C3A}.tmp | — | |
MD5:— | SHA256:— | |||
| 1232 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{65051BE7-1819-4DB0-A198-8A0FFA072437}.tmp | — | |
MD5:— | SHA256:— | |||
| 1232 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:590D78103669C3F8759447C7133CDAE6 | SHA256:4CB23FAB6EBDE683F9623E0BAD5BEE137093A02D33867372542B117700C30084 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report