File name: | marketing-report (1).doc |
Full analysis: | https://app.any.run/tasks/fd62cac2-3d64-4c59-b951-28f22f76865f |
Verdict: | Malicious activity |
Analysis date: | June 27, 2022, 10:38:47 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | F22F3CC52489638AAB8C3F3AB8CD63FA |
SHA1: | 21D1123EB9078DCD7EF1CD9196BBC2DC67DDAF2D |
SHA256: | 3E11D7EF5C29498141FDC9664CFAEBCDAE5CC2711FF4A431C97AF9BFB040BA4E |
SSDEEP: | 192:SEhMd9264wpf4Ghey7Z/c+8poF1d3jvvtlQb8P6rGxjPRwS4UU4fNt8h+:SqA92hwt4GA0cfa7pr1lQbLyxjPR4z4B |
.docx | | | Word Microsoft Office Open XML Format document (52.2) |
---|---|---|
.zip | | | Open Packaging Conventions container (38.8) |
.zip | | | ZIP compressed archive (8.8) |
AppVersion: | 16 |
---|---|
HyperlinksChanged: | No |
SharedDoc: | No |
CharactersWithSpaces: | - |
LinksUpToDate: | No |
Company: | - |
ScaleCrop: | No |
Paragraphs: | - |
Lines: | - |
DocSecurity: | None |
Application: | Microsoft Office Word |
Characters: | - |
Words: | - |
Pages: | 1 |
TotalEditTime: | - |
Template: | Normal |
ModifyDate: | 2022:05:25 13:14:00Z |
CreateDate: | 2022:05:25 13:14:00Z |
RevisionNumber: | 3 |
LastModifiedBy: | KIS2 |
Keywords: | - |
Description: | - |
---|---|
Creator: | KIS2 |
Subject: | - |
Title: | - |
ZipFileName: | _rels/ |
---|---|
ZipUncompressedSize: | - |
ZipCompressedSize: | - |
ZipCRC: | 0x00000000 |
ZipModifyDate: | 2022:06:12 15:44:00 |
ZipCompression: | None |
ZipBitFlag: | - |
ZipRequiredVersion: | 20 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2840 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\marketing-report (1).doc.docx" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | Explorer.EXE | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 Modules
| |||||||||||||||
4072 | "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding | C:\Program Files\Internet Explorer\iexplore.exe | svchost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
3664 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:4072 CREDAT:267521 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | — | iexplore.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
3732 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:4072 CREDAT:3544328 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | — | iexplore.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
|
(PID) Process: | (2840) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
Operation: | write | Name: | <s; |
Value: 3C733B00180B0000010000000000000000000000 | |||
(PID) Process: | (2840) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1033 |
Value: Off | |||
(PID) Process: | (2840) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1041 |
Value: Off | |||
(PID) Process: | (2840) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1046 |
Value: Off | |||
(PID) Process: | (2840) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1036 |
Value: Off | |||
(PID) Process: | (2840) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1031 |
Value: Off | |||
(PID) Process: | (2840) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1040 |
Value: Off | |||
(PID) Process: | (2840) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1049 |
Value: Off | |||
(PID) Process: | (2840) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 3082 |
Value: Off | |||
(PID) Process: | (2840) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1042 |
Value: Off |
PID | Process | Filename | Type | |
---|---|---|---|---|
2840 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR4F1C.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2840 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\{BE81F129-323E-4004-B022-850BE48BE463} | binary | |
MD5:07E94D48659048E0C3509494E2A1CAF4 | SHA256:188A0EAFC85AD2332D4D3D99E26DF307CCD89A880038FAF56493292143DE3612 | |||
2840 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:6452A32A768AA156062A25D582C5C070 | SHA256:960746C41FB03976B474B983ED735108000FFD8D42A3896523582FDF2CC92908 | |||
2840 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\{66B37CB0-1DE8-4892-B64C-BB1458C8AA55} | binary | |
MD5:F7A49A7C8F50BB3118E2F1F61A19CEC4 | SHA256:531F30D3F45AA923D819049BFCD7A4F417434782E060B8CF84D238C28093835A | |||
2840 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\C41A5E4B.htm | html | |
MD5:98D8A1691165DAD0D984C76D45023370 | SHA256:C4AB951DD65D25C3DA8C9A87E24F7DF2B948673639124227656A1410221E944D | |||
2840 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~$rketing-report (1).doc.docx | pgc | |
MD5:4ED1B3CD6E9EBD52D1BE5F6B67A40607 | SHA256:371255C4518C2F868A79C5C78E0E950971A97B79926F514AF18B9511CB7180D5 | |||
4072 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{5AF8BB87-F605-11EC-8C9F-1203334A04AF}.dat | binary | |
MD5:C5AD57BFB71E19903222A3BD70699369 | SHA256:7CF21D74459BF71040F0CEE75A06E1F12BB169D542FC8643C56C0F38C775A923 | |||
2840 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-{410DFC4F-2FF4-4185-9690-633920E39178}.FSD | binary | |
MD5:0CEF6929DD0A9FB237EC77E0B6B6B3AD | SHA256:12AD120A984A366225B5560B95D1E75D0F1CA701FF39A5EDC4281F8D895DBBF5 | |||
4072 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63 | binary | |
MD5:2BA28EAB62199B7140B7462E0B81483D | SHA256:381433AEC1413CBF47332445C1B84FF606CD77581E8760798DDFDA081FDDB966 | |||
2840 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD | binary | |
MD5:07E94D48659048E0C3509494E2A1CAF4 | SHA256:188A0EAFC85AD2332D4D3D99E26DF307CCD89A880038FAF56493292143DE3612 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2840 | WINWORD.EXE | HEAD | 200 | 18.195.214.39:8000 | http://18.195.214.39:8000/index.html | DE | — | — | unknown |
2840 | WINWORD.EXE | GET | 304 | 18.195.214.39:8000 | http://18.195.214.39:8000/index.html | DE | — | — | unknown |
2840 | WINWORD.EXE | HEAD | 200 | 18.195.214.39:8000 | http://18.195.214.39:8000/index.html | DE | — | — | unknown |
2840 | WINWORD.EXE | HEAD | 200 | 18.195.214.39:8000 | http://18.195.214.39:8000/index.html | DE | — | — | unknown |
2840 | WINWORD.EXE | HEAD | 200 | 18.195.214.39:8000 | http://18.195.214.39:8000/index.html | DE | — | — | unknown |
2840 | WINWORD.EXE | HEAD | 200 | 18.195.214.39:8000 | http://18.195.214.39:8000/index.html | DE | — | — | unknown |
2840 | WINWORD.EXE | HEAD | 200 | 18.195.214.39:8000 | http://18.195.214.39:8000/index.html | DE | — | — | unknown |
2840 | WINWORD.EXE | GET | 200 | 18.195.214.39:8000 | http://18.195.214.39:8000/index.html | DE | html | 4.59 Kb | unknown |
4072 | iexplore.exe | GET | 200 | 41.63.96.128:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?39c98eec54dbf7e5 | ZA | compressed | 4.70 Kb | whitelisted |
2840 | WINWORD.EXE | OPTIONS | 501 | 18.195.214.39:8000 | http://18.195.214.39:8000/ | DE | html | 500 b | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
4072 | iexplore.exe | 131.253.33.200:443 | www.bing.com | Microsoft Corporation | US | whitelisted |
2840 | WINWORD.EXE | 18.195.214.39:8000 | — | Amazon.com, Inc. | DE | unknown |
— | — | 18.195.214.39:8000 | — | Amazon.com, Inc. | DE | unknown |
4072 | iexplore.exe | 41.63.96.128:80 | ctldl.windowsupdate.com | Limelight Networks, Inc. | ZA | suspicious |
4072 | iexplore.exe | 93.184.221.240:80 | ctldl.windowsupdate.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
4072 | iexplore.exe | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
4072 | iexplore.exe | 152.199.19.161:443 | iecvlist.microsoft.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
— | — | 152.199.19.161:443 | iecvlist.microsoft.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
api.bing.com |
| whitelisted |
www.bing.com |
| whitelisted |
ctldl.windowsupdate.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
iecvlist.microsoft.com |
| whitelisted |
r20swj13mr.microsoft.com |
| whitelisted |