File name:

49b367ac261a722a7c2bbbc328c32545

Full analysis: https://app.any.run/tasks/b546e669-019e-43f3-86e2-62251b30397e
Verdict: Malicious activity
Analysis date: December 27, 2024, 10:38:11
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
macros
ole-embedded
macros-on-open
macros-on-close
Indicators:
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Author: user, Template: Normal.dotm, Last Saved By: John, Revision Number: 11, Name of Creating Application: Microsoft Office Word, Total Editing Time: 08:00, Create Time/Date: Fri Nov 25 19:04:00 2016, Last Saved Time/Date: Fri Nov 25 20:04:00 2016, Number of Pages: 1, Number of Words: 320, Number of Characters: 1828, Security: 0
MD5:

49B367AC261A722A7C2BBBC328C32545

SHA1:

5BD2E2B8DDC65931704C8C3EA57ADC2BB778F66A

SHA256:

FF2C8CADAA0FD8DA6138CCE6FCE37E001F53A5D9CECCD67945B15AE273F4D751

SSDEEP:

6144:1iuv7iu2oErXZ+e7m5OPoeKAUXso/UUsAJtfiZA:1N7iu2oaXYOrWjdfi6

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Checks whether a specified folder exists (SCRIPT)

      • WINWORD.EXE (PID: 640)
      • wscript.exe (PID: 4512)

    • Unusual execution from MS Office

      • WINWORD.EXE (PID: 640)

    • Copies file to a new location (SCRIPT)

      • wscript.exe (PID: 4512)

  • SUSPICIOUS

    • Runs shell command (SCRIPT)

      • WINWORD.EXE (PID: 640)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • WINWORD.EXE (PID: 640)
      • wscript.exe (PID: 4512)

    • The process executes JS scripts

      • WINWORD.EXE (PID: 640)

    • Accesses command line arguments (SCRIPT)

      • wscript.exe (PID: 4512)

    • Gets name of the script (SCRIPT)

      • wscript.exe (PID: 4512)

    • Gets full path of the running script (SCRIPT)

      • wscript.exe (PID: 4512)

    • Accesses current user name via WMI (SCRIPT)

      • wscript.exe (PID: 4512)

  • INFO

    • Drops encrypted VBS script (Microsoft Script Encoder)

      • WINWORD.EXE (PID: 640)

    • The process uses the downloaded file

      • WINWORD.EXE (PID: 640)

    • Sends debugging messages

      • WINWORD.EXE (PID: 640)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (54.2)
.doc | Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

Identification: Word 8.0
LanguageCode: English (US)
DocFlags: Has picture, 1Table, ExtChar
System: Windows
Word97: No
Title: -
Subject: -
Author: user
Keywords: -
Template: Normal.dotm
LastModifiedBy: John
Software: Microsoft Office Word
CreateDate: 2016:11:25 19:04:00
ModifyDate: 2016:11:25 20:04:00
Security: None
CodePage: Windows Latin 1 (Western European)
Company: Olymp
CharCountWithSpaces: 2144
AppVersion: 14
ScaleCrop: No
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
TitleOfParts: -
HeadingPairs:
  • Title
  • 1
CompObjUserTypeLen: 32
CompObjUserType: Microsoft Word 97-2003 Document
LastPrinted: 0000:00:00 00:00:00
RevisionNumber: 11
TotalEditTime: 8 minutes
Words: 320
Characters: 1828
Pages: 1
Paragraphs: 4
Lines: 15
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
124
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winword.exe wscript.exe no specs ai.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
640"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n C:\Users\admin\Desktop\49b367ac261a722a7c2bbbc328c32545.doc /o ""C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
16.0.16026.20146
Modules
Images
c:\program files\microsoft office\root\office16\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
4264"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe" "B8340C59-5341-4BBE-958F-B8AA91036523" "ACA9544D-43D4-47B6-B9A6-7CA7CEDEFD08" "640"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Artificial Intelligence (AI) Host for the Microsoft® Windows® Operating System and Platform x64.
Version:
0.12.2.0
Modules
Images
c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\ai.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
4512"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Roaming\Microsoft\Windows\maintools.js" EzZETcSXyKAdF_e5I2i1C:\Windows\System32\wscript.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
15 096
Read events
14 705
Write events
360
Delete events
31

Modification events

(PID) Process:(640) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\ClientTelemetry\Sampling
Operation:writeName:0
Value:
017012000000001000B24E9A3E02000000000000000600000000000000
(PID) Process:(640) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\640
Operation:writeName:0
Value:
0B0E10ABCC32E1E2F2F44E9B4BC81E30EF86A7230046DEBEAC93B789D6ED016A04102400449A7D64B29D01008500A907556E6B6E6F776EC906022222CA0DC2190000C91003783634C5118005D2120B770069006E0077006F00720064002E00650078006500C51620C517808004C91808323231322D44656300
(PID) Process:(640) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:en-US
Value:
2
(PID) Process:(640) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:de-de
Value:
2
(PID) Process:(640) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:fr-fr
Value:
2
(PID) Process:(640) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:es-es
Value:
2
(PID) Process:(640) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:it-it
Value:
2
(PID) Process:(640) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:ja-jp
Value:
2
(PID) Process:(640) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:ko-kr
Value:
2
(PID) Process:(640) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:pt-br
Value:
2
Executable files
4
Suspicious files
114
Text files
47
Unknown types
1

Dropped files

PID
Process
Filename
Type
640WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\8BD9A3FD-2977-457F-87A9-F09A464A9260xml
MD5:C0CADAE28702AB3BEF0D523CA05A266D
SHA256:7C6C062C45E56ADBB0E9A9BDE6643F2D7B02A2AE7133329E9ECF817A2D13671B
640WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmbinary
MD5:BA90DE4EBF35F9716A843F305E19BE2A
SHA256:59FE1439564359B60AAD021332C4B25969A636926136E9E6B1F63A935C0D9849
640WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\49b367ac261a722a7c2bbbc328c32545.doc.LNKbinary
MD5:C6B3F7D9F92F5FA14585D16FDE566C66
SHA256:FDA51171613745F6E9A2F4A773FBFF9A3A07A26618316468687515DBC824B538
640WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\maintools.jstext
MD5:5EA3FD094B69E9E00894842F95FD5D85
SHA256:3A065547ADB0AFC63E318C2FA1F682108664E602934490A898C3DE1B23975628
640WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\691140CF.emfemf
MD5:FDBBE99A5DD164B403945E6A98434CC1
SHA256:D416447FB0A6AA8F66CB9C943B7FFDA365CE56D2AD8AC12AC0154EF8A52D1CA0
640WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dattext
MD5:38AEF5BF87A95AEEB91CBA39C26A6A8E
SHA256:D7A725EC89B2360733C932D55E02A1A95C470A5FCD2D08057FAD7501993B435B
640WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lextext
MD5:F3B25701FE362EC84616A93A45CE9998
SHA256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
4512wscript.exeC:\Users\admin\AppData\Local\Microsoft\Windows\maintools.jstext
MD5:5EA3FD094B69E9E00894842F95FD5D85
SHA256:3A065547ADB0AFC63E318C2FA1F682108664E602934490A898C3DE1B23975628
640WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\UsageMetricsStore\FileActivityStoreV3\Word\ASkwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDBfTnVsbAQ.Sbinary
MD5:98DEACA0321DEC68CC6AFB7B9DAA8097
SHA256:65F71F2A5B85272786F70CF1AFDFD394F5059B80D80B9EDC64A4E8B1C5950301
640WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bintext
MD5:BF089A4548451B2BE8476B2A0BEDDF1F
SHA256:9517091AA89EC1FC7DD42736769E3426FE32B1013D50945CFC10D9DE40BF32EB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
71
TCP/UDP connections
83
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1684
svchost.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1684
svchost.exe
GET
200
23.37.237.227:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
52.113.194.132:443
https://ecs.office.com/config/v2/Office/word/16.0.16026.20146/Production/CC?&Clientid=%7bD61AB268-C26A-439D-BB15-2A0DEDFCA6A3%7d&Application=word&Platform=win32&Version=16.0.16026.20146&MsoVersion=16.0.16026.20002&SDX=fa000000002.2.0.1907.31003&SDX=fa000000005.1.0.1909.30011&SDX=fa000000006.1.0.1909.13002&SDX=fa000000008.1.0.1908.16006&SDX=fa000000009.1.0.1908.6002&SDX=fa000000016.1.0.1810.13001&SDX=fa000000029.1.0.1906.25001&SDX=fa000000033.1.0.1908.24001&SDX=wa104381125.1.0.1810.9001&ProcessName=winword.exe&Audience=Production&Build=ship&Architecture=x64&Language=en-US&SubscriptionLicense=false&PerpetualLicense=2019&LicenseCategory=6&LicenseSKU=Professional2019Retail&OsVersion=10.0&OsBuild=19045&Channel=CC&InstallType=C2R&SessionId=%7bE132CCAB-F2E2-4EF4-9B4B-C81E30EF86A7%7d&LabMachine=false
unknown
tss
398 Kb
whitelisted
—
—
GET
200
23.48.23.42:443
https://omex.cdn.office.net/addinclassifier/officesharedentities
unknown
text
314 Kb
whitelisted
—
—
GET
200
2.21.20.142:443
https://binaries.templates.cdn.office.net/support/templates/en-us/tp03328884.cab
unknown
compressed
21.4 Kb
whitelisted
—
—
GET
200
2.21.20.154:443
https://binaries.templates.cdn.office.net/support/templates/en-us/tp0309043402.cab
unknown
compressed
706 Kb
whitelisted
—
—
GET
200
2.16.204.86:443
https://metadata.templates.cdn.office.net/client/templates/gallery?lcid=1033&syslcid=1033&uilcid=1033&app=0&ver=16&tl=2&build=16.0.16026&gtype=0%2C1%2C2%2C5%2C
unknown
xml
10.7 Kb
whitelisted
—
—
GET
200
2.21.20.154:443
https://binaries.templates.cdn.office.net/support/templates/en-us/tp02851226.cab
unknown
compressed
34.6 Kb
whitelisted
—
—
GET
200
2.21.20.154:443
https://binaries.templates.cdn.office.net/support/templates/en-us/tp02851218.cab
unknown
compressed
31.0 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
2.21.110.146:443
www.bing.com
AKAMAI-AS
DE
whitelisted
4712
MoUsoCoreWorker.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1684
svchost.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
192.168.100.255:138
—
—
—
whitelisted
640
WINWORD.EXE
52.109.89.18:443
officeclient.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4712
MoUsoCoreWorker.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1684
svchost.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1684
svchost.exe
23.37.237.227:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
640
WINWORD.EXE
23.48.23.18:443
omex.cdn.office.net
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 2.21.110.146
  • 2.21.110.139
whitelisted
google.com
  • 142.250.185.238
whitelisted
officeclient.microsoft.com
  • 52.109.89.18
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
  • 2.16.164.120
  • 2.16.164.49
whitelisted
www.microsoft.com
  • 23.37.237.227
  • 88.221.169.152
whitelisted
omex.cdn.office.net
  • 23.48.23.18
  • 23.48.23.11
  • 23.48.23.42
whitelisted
ecs.office.com
  • 52.113.194.132
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
messaging.lifecycle.office.com
  • 52.109.16.3
whitelisted
self.events.data.microsoft.com
  • 20.50.201.200
  • 51.105.71.136
whitelisted

Threats

No threats detected
Process
Message
WINWORD.EXE
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
WINWORD.EXE
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
WINWORD.EXE
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
49b367ac261a722a7c2bbbc328c32545