analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| File name: | fbd63941a25253f5bafe69c9cc86c7effc6ff14b9adddd6f69e2f26ed39a77a4 |
| Full analysis: | https://app.any.run/tasks/272ff007-cc97-47da-8ca9-10120dc1cc01 |
| Verdict: | Malicious activity |
| Analysis date: | May 23, 2019, 23:58:07 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.openxmlformats-officedocument.wordprocessingml.document |
| File info: | Microsoft Word 2007+ |
| MD5: | 44284B5EB3B6DA8C988924907478ADBD |
| SHA1: | D10A6FF627C0DF209C4B56BD3B264C322ADAC091 |
| SHA256: | FBD63941A25253F5BAFE69C9CC86C7EFFC6FF14B9ADDDD6F69E2F26ED39A77A4 |
| SSDEEP: | 98304:w3UV9UGmPbrzB43Qqg6ZpIPgE7sc1jFOSbJtBhAO2DwaB0hs0VH:w3m9WPbpxEpIPnJOQS7wGFM |
MALICIOUS
Changes the autorun value in the registry
- regedit.exe (PID: 3188)
SUSPICIOUS
Executed via Task Scheduler
- ctfmon.exe (PID: 1404)
INFO
Manual execution by user
- regedit.exe (PID: 3188)
- explorer.exe (PID: 1916)
- regedit.exe (PID: 2136)
Reads Microsoft Office registry keys
- WINWORD.EXE (PID: 2792)
Creates files in the user directory
- WINWORD.EXE (PID: 2792)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .docm | | | Word Microsoft Office Open XML Format document (with Macro) (53.6) |
|---|---|---|
| .docx | | | Word Microsoft Office Open XML Format document (24.2) |
| .zip | | | Open Packaging Conventions container (18) |
| .zip | | | ZIP compressed archive (4.1) |
EXIF
ZIP
| ZipRequiredVersion: | 20 |
|---|---|
| ZipBitFlag: | 0x0006 |
| ZipCompression: | Deflated |
| ZipModifyDate: | 1980:01:01 00:00:00 |
| ZipCRC: | 0x3f450766 |
| ZipCompressedSize: | 399 |
| ZipUncompressedSize: | 1503 |
| ZipFileName: | [Content_Types].xml |
XML
| Template: | Normal.dotm |
|---|---|
| TotalEditTime: | - |
| Pages: | 2 |
| Words: | - |
| Characters: | 4 |
| Application: | Microsoft Office Word |
| DocSecurity: | None |
| Lines: | 1 |
| Paragraphs: | 1 |
| ScaleCrop: | No |
| HeadingPairs: |
|
| TitlesOfParts: | - |
| Company: | - |
| LinksUpToDate: | No |
| CharactersWithSpaces: | 4 |
| SharedDoc: | No |
| HyperlinksChanged: | No |
| AppVersion: | 15 |
| Keywords: | - |
| LastModifiedBy: | PC |
| RevisionNumber: | 2 |
| CreateDate: | 2019:01:08 05:59:00Z |
| ModifyDate: | 2019:01:08 05:59:00Z |
XMP
| Title: | - |
|---|---|
| Subject: | - |
| Creator: | MFA |
| Description: | - |
Total processes
81
Monitored processes
5
Malicious processes
0
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 2792 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Downloads\fbd63941a25253f5bafe69c9cc86c7effc6ff14b9adddd6f69e2f26ed39a77a4.docm" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Exit code: 0 Version: 14.0.6024.1000 | ||||
| 1916 | "C:\Windows\explorer.exe" | C:\Windows\explorer.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
| 2136 | "regedit.exe" "C:\Users\admin\AppData\Local\Temp\in.reg" | C:\Windows\regedit.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Registry Editor Exit code: 3221226540 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
| 3188 | "regedit.exe" "C:\Users\admin\AppData\Local\Temp\in.reg" | C:\Windows\regedit.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Registry Editor Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
| 1404 | C:\Windows\System32\ctfmon.exe | C:\Windows\System32\ctfmon.exe | — | taskeng.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: CTF Loader Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
Total events
1 700
Read events
996
Write events
0
Delete events
0
Modification events
Executable files
0
Suspicious files
0
Text files
3
Unknown types
5
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2792 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR1361.tmp.cvr | — | |
MD5:— | SHA256:— | |||
| 2792 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\E24DCD4D.png | — | |
MD5:— | SHA256:— | |||
| 2792 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\EEF11B7C.png | — | |
MD5:— | SHA256:— | |||
| 2792 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\8A451AEA.png | — | |
MD5:— | SHA256:— | |||
| 2792 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{ED5DB01B-4472-4337-8EF2-FB463605742B}.tmp | — | |
MD5:— | SHA256:— | |||
| 2792 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{4FAF5C1A-2AE7-4866-AE3F-0A03371E90A1}.tmp | — | |
MD5:— | SHA256:— | |||
| 2792 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~DF7E14F2368731C785.TMP | — | |
MD5:— | SHA256:— | |||
| 2792 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{85EF5C3A-1781-44E2-8ED3-6F1CCF9E8900}.tmp | — | |
MD5:— | SHA256:— | |||
| 2792 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:CD630E99BA8C1E20B8FC05F7B6042A90 | SHA256:C4B2B6DAB64B2E45D091A9D4B4CC4DB6A7BC97660DEAB5D0FDD5DB28EC5502AE | |||
| 2792 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\fbd63941a25253f5bafe69c9cc86c7effc6ff14b9adddd6f69e2f26ed39a77a4.docm.LNK | lnk | |
MD5:A97A39A533AF60990418CA15579DD267 | SHA256:2CDF0E1554D7E717A771A4E3C1B253BA2EE1D730D10A1BF4FBF8181C4AA67016 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report